Model Registry and Promotion States

The registry is the single source of truth for every model: its version, lineage, validation status, and a promotion state that governs whether it may act on a machine.

One registry, explicit states

Every model artifact lives in one registry keyed by name and version. The registry is authoritative: the online layers resolve which artifact to load by querying the registry's promotion state, never by pulling a file from a directory. This makes the question who is in control right now answerable at any instant for both the breeder and the burner.

Promotion states

• REGISTERED — artifact exists with full lineage; no authority
• STAGING — passing offline validation; eligible for shadow
• SHADOW — running alongside production, zero actuation authority
• CANARY — limited, bounded authority under tight envelopes
• PROD — full authority within its validated envelope
• DEPRECATED — superseded; retained for audit and rollback
• QUARANTINED — failed a gate or a monitor; blocked from promotion

Transitions are one-directional through the gates and reversible only via explicit rollback. A model cannot jump from STAGING to PROD; it must pass shadow, then canary, then a promotion review. Any monitor breach in production can force a model to QUARANTINED and trigger fallback to the previous PROD version in a bounded time.

ALLOWED = {
 'REGISTERED': {'STAGING','QUARANTINED'},
 'STAGING':    {'SHADOW','QUARANTINED'},
 'SHADOW':     {'CANARY','STAGING','QUARANTINED'},
 'CANARY':     {'PROD','SHADOW','QUARANTINED'},
 'PROD':       {'DEPRECATED','QUARANTINED'},
}
def transition(m, to, approvals):
    assert to in ALLOWED[m.state]
    assert gates_passed(m, to) and quorum(approvals, to)
    registry.log(m, m.state, to, approvals); m.state = to

Promotion into or out of CANARY and PROD requires an approval quorum, tying the registry to the governance workflow. The registry also underpins the fleet registry: as breeder units move FOAK to NOAK to BOAK, each unit records which model version it is running so no two units silently diverge.