120 lines
17 KiB
Markdown
120 lines
17 KiB
Markdown
# Gate 1 Decision and Evidence Dossier
|
||
|
||
**Status**: All 30 architecture decisions approved; Gate 1 closure is recorded as **PASS** in
|
||
`gate-evidence-allocation.md`. Evidence-open conditions are allocated to Gates 2-6. Implementation is
|
||
still not authorized by this docs-only task.
|
||
|
||
**Scope**: Offline Workstation AMD64 first implementation target plus shared contracts required by
|
||
all four bootable products. Approval here does not authorize ISO building, installer implementation,
|
||
Server-offline implementation or general release.
|
||
|
||
## How to Record a Decision
|
||
|
||
For every row, the visible accountable organization is **Cezen Technologies**. Record the chosen value
|
||
or explicit risk acceptance, an internal approval-record ID, decision date, expiry/review date where
|
||
applicable, evidence URI/path and status `approved`, `rejected` or `deferred`. The authorized human
|
||
approver and role MUST be attributable inside access-controlled approval evidence but need not be
|
||
named in this repository. A deferred mandatory row keeps Gate 1 failed. Any amendment to a normative
|
||
contract requires a consistency-analysis rerun before approval.
|
||
|
||
This privacy convention does not weaken separation of duties: where executor and independent reviewer
|
||
must differ, the restricted approval/evidence record proves they are different authorized people even
|
||
though the public specification displays only Cezen Technologies and opaque record IDs.
|
||
|
||
## A. Trust, Signing and Threat Ownership
|
||
|
||
| ID | Decision required | Recommended baseline / acceptable outcome | Accountable roles | Required evidence | Status |
|
||
|---|---|---|---|---|---|
|
||
| G1-01 | Release/license/test trust-domain separation and Ed25519 release signatures | Approve `release-signing-trust.md`; retain RSA license compatibility as a separate domain | Security, Platform | Trust-domain hierarchy and purpose constraints approved under `CT-G1-2026-003` | Approved 2026-07-14 |
|
||
| G1-02 | Signing hardware, root/subordinate generation, backup and custody | Non-exportable signer where supported; offline root; dual/threshold custody; named primary and alternate custodians | Security | Offline-root/isolated-signer/dual-or-threshold direction approved under `CT-G1-2026-003`; hardware, locations, custodians and ceremony evidence open | Approved 2026-07-14; evidence open |
|
||
| G1-03 | Key lifetimes, overlap, expiry and historical verification | Annual-or-shorter subordinate rotation; explicit overlap; old supported artifacts governed by signed-time/non-revoked policy | Security, Release | Rotation direction approved under `CT-G1-2026-003`; exact lifetime/overlap table and tests open | Approved 2026-07-14; evidence open |
|
||
| G1-04 | Revocation maximum age and emergency behavior | Signed monotonic offline lists; stale state blocks new activation; recovery/data access preserved unless signed emergency rule says otherwise | Security, Product, Support | Behavior approved under `CT-G1-2026-003`; maximum age, reason/action values and tabletop evidence open | Approved 2026-07-14; evidence open |
|
||
| G1-05 | Compromised-root field recovery | Independently protected recovery authority/media; ordinary compromised-root signatures cannot restore trust | Security, Support | Separate recovery-authority/media direction approved under `CT-G1-2026-003`; custody and field runbook open | Approved 2026-07-14; evidence open |
|
||
| G1-06 | Threat model and residual-risk ownership | Accept/amend all TM-01–TM-18 controls; assign every residual risk | Security, Platform, Release, Product, Support | TM-01–TM-18 controls approved under `CT-G1-2026-003`; residual-risk assignments and executed evidence open | Approved 2026-07-14; evidence open |
|
||
| G1-07 | Firmware/Secure Boot/TPM, disk encryption and administrator boundary | Declare exact mandatory baseline and unsupported threat boundary for AMD64 Workstation | Security, Platform, Product | Requirement for an explicit baseline approved under `CT-G1-2026-003`; exact baseline and exception policy open | Approved 2026-07-14; evidence open |
|
||
|
||
## B. Manifest, Compatibility and Artifact Identity
|
||
|
||
| ID | Decision required | Recommended baseline / acceptable outcome | Accountable roles | Required evidence | Status |
|
||
|---|---|---|---|---|---|
|
||
| G1-08 | Manifest/signature schemas and canonical bytes | Approve current Draft 2020-12 schemas and canonical UTF-8 lexical-key serialization | Platform, Security | Approved under `CT-G1-2026-002`; existing validator evidence linked as E-G1-002 | Approved 2026-07-14 |
|
||
| G1-09 | Compatibility order/reason codes and security floor | Default deny; approve deterministic evaluation and break-glass ownership | Platform, Security, Product | Approved under `CT-G1-2026-002`; compatibility vectors linked as E-G1-002 | Approved 2026-07-14 |
|
||
| G1-10 | Artifact naming, SemVer, channels, SBOM/provenance formats | Approve canonical naming; SPDX 3.0.1 JSON; in-toto v1.2 Statement v1/SLSA Provenance v1 | Release, Security, Platform | Formats approved under `CT-G1-2026-002`; production toolchain/sample release evidence remains required | Approved 2026-07-14 |
|
||
| G1-11 | Publication/archive locations, retention and withdrawal | Immutable stable bytes; signed channel/withdrawal history; named archive and privacy periods | Release, Security, Support | Immutable publication/withdrawal direction approved under `CT-G1-2026-002`; concrete archive locations, access and retention periods remain evidence-open | Approved 2026-07-14; evidence open |
|
||
|
||
## C. Workstation Hardware, Runtime and Payload
|
||
|
||
| ID | Decision required | Recommended baseline / acceptable outcome | Accountable roles | Required evidence | Status |
|
||
|---|---|---|---|---|---|
|
||
| G1-12 | First-release architecture and AMD GPU scope | AMD64 universal adaptive ISO; CPU-only fallback plus approved NVIDIA profiles; AMD GPU/ROCm/Strix Halo acceleration excluded | Product, Platform, Delivery | Product direction approved under `CT-G1-2026-001`; physical validation remains G1-13/Gates 4-5 | Approved 2026-07-14 |
|
||
| G1-13 | Representative physical machines | Name exact CPU-only/sub-threshold, 8 GB, 24 GB and 48 GB-or-higher NVIDIA targets, firmware and peripherals | Product, Delivery, Security | CPU-only/sub-threshold, NVIDIA 8 GB, 24 GB and 48 GB-or-higher profile matrix approved under `CT-G1-2026-006`; exact CPU/GPU/RAM/storage, asset IDs, firmware and availability remain evidence-open | Approved 2026-07-14; evidence open |
|
||
| G1-14 | Driver, CUDA, kernel and runtime pins | Resolve immutable mutually compatible versions and safe fallback behavior | Platform, AI | Ubuntu 22.04.5 AMD64, R570 open driver at least 570.124.06, CUDA 12.8.1, vLLM 0.10.2 by OCI digest and NVIDIA-independent CPU behavior approved under `CT-G1-2026-007`; exact locks and physical/rollback evidence open | Approved 2026-07-14; evidence open |
|
||
| G1-15 | Starter models and redistribution | Approve exact revisions/layers/files/digests/licenses/notices; no mutable model names | AI, Platform, Legal/Product | Pinned Phi-3 Mini Ollama manifest/layer (MIT), Nomic Embed Text v1.5 manifest (Apache-2.0) and Microsoft Phi-3 Mini commit (MIT, validated 24 GB-or-higher profiles only) approved under `CT-G1-2026-008`; exact packaged files/digests, notices and redistribution evidence open | Approved 2026-07-14; evidence open |
|
||
| G1-16 | Complete Offline Workstation payload | Resolve every package/image/wheel/runtime/source object by version, architecture, digest, bytes and license | Platform, Release, Legal/Product | Ubuntu 22.04.5 base, immutable platform/help, locked packages/environments, approved NVIDIA/container/Ollama/vLLM/starter-model payload, offline license/trust, manifests/SBOM/provenance/recovery/evidence tools and explicit exclusion boundary approved under `CT-G1-2026-009`; signed resolved inventory and measurements open | Approved 2026-07-14; evidence open |
|
||
| G1-17 | ARM64/DGX Spark later scope | Explicitly defer to separate build identity, approve future workstream, or remove claim; no AMD64 support claim | Product, Platform | Deferred to a later separately evidenced ARM64 build identity under `CT-G1-2026-001`; AMD64 media makes no DGX Spark claim | Approved 2026-07-14 |
|
||
|
||
## D. Online Acquisition, Update, Rollback and Licensing
|
||
|
||
| ID | Decision required | Recommended baseline / acceptable outcome | Accountable roles | Required evidence | Status |
|
||
|---|---|---|---|---|---|
|
||
| G1-18 | Online production endpoint classes and owners | Dedicated HTTPS index/artifact/auth endpoints with signed payload index and immutable content | Platform, Security | Endpoint classes and signed immutable index approved under `CT-G1-2026-004`; production names/owners open | Approved 2026-07-14; evidence open |
|
||
| G1-19 | Online credentials, mirrors, proxy/customer CA, retry/cache/SLA | Short-lived scoped credentials; explicit CA/proxy flow; bounded retry and content-addressed resume/cache | Platform, Security, Support | Security/resume direction approved under `CT-G1-2026-004`; issuer, mirrors, proxy/CA and numeric values/tests open | Approved 2026-07-14; evidence open |
|
||
| G1-20 | Update activation/checkpoint implementation contract | Approve atomic switch/snapshot choices per surface and full affected-state inventory | Platform, Support | Side-by-side/atomic-where-supported and complete-checkpoint direction approved under `CT-G1-2026-004`; surface mechanisms/matrix open | Approved 2026-07-14; evidence open |
|
||
| G1-21 | Backup/rollback SLA, retention, quota and health window | Retain current plus last-known-good; verified full backup; no automatic recovery deletion; approve health duration | Product, Platform, Support | Retention/no-auto-deletion direction approved under `CT-G1-2026-004`; quotas, SLA and health duration/tests open | Approved 2026-07-14; evidence open |
|
||
| G1-22 | Driver/kernel/OS and rollback-failure recovery | Declare automatic, restore-based or recovery-required path before authorization | Platform, Support, Security | Preauthorization classification requirement approved under `CT-G1-2026-004`; per-surface runbook/tests open | Approved 2026-07-14; evidence open |
|
||
| G1-23 | Offline license staging/expiry/time matrix | Explicit restricted staging allowlist; no default tier entitlement; approve continuity, tolerance and uncertain-time behavior | Product, Security, Support | Restricted staging/no-default-entitlement/fail-closed uncertain-time direction approved under `CT-G1-2026-004`; values/matrix open | Approved 2026-07-14; evidence open |
|
||
| G1-24 | Device identity, binding, rehost and revocation ownership | Binding mandatory where policy requires; named rehost authority; signed monotonic trust/revocation flow | Security, Product, Support | Binding/rehost/monotonic-revocation direction approved under `CT-G1-2026-004`; identity mechanism, authority, procedure/tests open | Approved 2026-07-14; evidence open |
|
||
|
||
## E. Model Lifecycle, Lab and Evidence
|
||
|
||
| ID | Decision required | Recommended baseline / acceptable outcome | Accountable roles | Required evidence | Status |
|
||
|---|---|---|---|---|---|
|
||
| G1-25 | Model quarantine/store/reference mechanisms and quotas | Non-executable bounded quarantine; exact-digest store; transactional references; zero-reference GC only | Platform, AI, Security | Lifecycle architecture approved under `CT-G1-2026-005`; store mechanism, quotas and reconciliation evidence open | Approved 2026-07-14; evidence open |
|
||
| G1-26 | Model-created customer data and license-change behavior | Uninstall/expiry never silently deletes customer data; approve retention/export/grace/rehost/withdrawal rules | Product, Legal, Support, Security | No-silent-deletion direction approved under `CT-G1-2026-005`; classification, retention/export/grace/rehost values open | Approved 2026-07-14; evidence open |
|
||
| G1-27 | Offline lab people, hardware, topology, tools and schedule | Named executor/reviewer separation; two physical targets plus no-route capture and air-gap confirmation | Delivery, Support, Security | Lab method approved under `CT-G1-2026-005`; restricted person attribution, assets, tools, topology and dates open | Approved 2026-07-14; evidence open |
|
||
| G1-28 | Evidence storage, signing/indexing, privacy and retention | Hash/signed index, failed-run retention, redaction, access control and immutable review record | Security, Release, Support | Tamper-evident/redacted/controlled evidence direction approved under `CT-G1-2026-005`; repository, signing method and periods open | Approved 2026-07-14; evidence open |
|
||
| G1-29 | Zero-network and interruption acceptance inventory | Approve every required clean, malicious, incompatible, power-loss and recovery case; manual repair invalidates a run | Delivery, Platform, Security | Complete no-manual-repair acceptance inventory approved under `CT-G1-2026-005`; traceability and executed evidence open | Approved 2026-07-14; evidence open |
|
||
| G1-30 | Server L/Max split disposition | For later planning only: prove support/runtime/validation distinction after large models are excluded, or reconsider duplicate ISO | Product, Platform, Support | Deferred under `CT-G1-2026-005` until Workstation evidence proves a support/runtime/validation distinction; tier naming alone cannot justify duplication | Approved 2026-07-14 |
|
||
|
||
## Gate 1 Evidence Index
|
||
|
||
Populate this index only with immutable or version-controlled evidence. “Discussed”, meeting notes
|
||
without a decision, screenshots without artifact identity, and unreviewed test output do not pass.
|
||
|
||
| Evidence ID | Covers decisions | Artifact/path/URI and digest | Executor | Independent reviewer | Date | Result |
|
||
|---|---|---|---|---|---|---|
|
||
| E-G1-001 | G1-01–G1-07 | `contracts/release-signing-trust.md`, `contracts/installer-threat-model.md`; approval `CT-G1-2026-003` | Cezen Technologies | Restricted attribution | 2026-07-14 | Architecture approved; operational values and executed evidence open |
|
||
| E-G1-002 | G1-08–G1-11 | `contracts/test-vectors/verification-evidence.md`; approval `CT-G1-2026-002` | Cezen Technologies | Restricted attribution | 2026-07-14 | Decisions approved; G1-10 production tooling and G1-11 operational values/evidence open |
|
||
| E-G1-003 | G1-12–G1-17 | `contracts/workstation-hardware-model-baseline.md`, `contracts/workstation-runtime-compatibility-baseline.md`, `contracts/payload-inventory-sizing.md`; approvals `CT-G1-2026-001`, `CT-G1-2026-006`, `CT-G1-2026-007`, `CT-G1-2026-008`, `CT-G1-2026-009` | Cezen Technologies | Restricted attribution | 2026-07-14 | All decisions approved; physical/runtime/model/payload inventory and measurement evidence open |
|
||
| E-G1-004 | G1-18–G1-24 | `contracts/online-universal-acquisition.md`, `contracts/update-rollback-policy.md`, `contracts/offline-license-policy.md`; approval `CT-G1-2026-004` | Cezen Technologies | Restricted attribution | 2026-07-14 | Architecture approved; production values/mechanisms and executed evidence open |
|
||
| E-G1-005 | G1-25–G1-30 | `contracts/model-pack-lifecycle.md`, `contracts/offline-validation-lab.md`; approval `CT-G1-2026-005` | Cezen Technologies | Restricted attribution | 2026-07-14 | Architecture approved; operational values, lab assignment and executed evidence open |
|
||
|
||
## Decision Outcome
|
||
|
||
Current result: **30 of 30 mandatory architecture decisions approved; Gate 1 PASS.** Downstream
|
||
evidence is incomplete and remains gate-blocking where allocated. G1-12 and G1-17 are approved
|
||
under Cezen Technologies record `CT-G1-2026-001`; G1-08 through G1-11 are approved under
|
||
`CT-G1-2026-002`. G1-10 still requires production toolchain/sample-release evidence and G1-11 still
|
||
requires concrete archive locations, access controls and retention periods. G1-13's matrix is approved
|
||
but lacks exact physical evidence. G1-14 is approved under `CT-G1-2026-007` but lacks exact package/
|
||
image locks and physical/rollback evidence. G1-15 is approved under `CT-G1-2026-008`; exact packaged
|
||
model files/digests, notices and redistribution evidence remain open. G1-16's payload inclusion/
|
||
exclusion boundary is approved under `CT-G1-2026-009`; the resolved signed object inventory, exact
|
||
sizes/digests/licenses, extracted-media reconciliation and measured capacity evidence remain open.
|
||
G1-01 through G1-07
|
||
are approved under `CT-G1-2026-003`; signing hardware/custody details, exact lifetimes and revocation
|
||
age, root-recovery procedure, residual-risk assignments, platform security baseline and executed
|
||
control evidence remain open.
|
||
G1-18 through G1-24 are approved under `CT-G1-2026-004`; production endpoint/credential/proxy values,
|
||
surface activation and recovery mechanisms, quotas/SLA/health windows, license clock/state values,
|
||
device identity/rehost procedure and executed failure evidence remain open.
|
||
G1-25 through G1-30 are approved under `CT-G1-2026-005`; model store/quota/data-retention values,
|
||
lab people/assets/tools/schedule, evidence repository/retention and executed traceability remain open.
|
||
Server L/Max split work is explicitly deferred until Workstation evidence proves a real distinction.
|
||
G1-13's representative profile matrix is approved under `CT-G1-2026-006`; exact physical machine
|
||
specifications and availability remain evidence-open and MUST NOT be inferred from this approval.
|
||
|
||
All decision rows are approved, but approval and evidence completion are separate. Follow
|
||
`gate-evidence-allocation.md` for Gates 2-6. Gate 1 pass authorizes only detailed Offline Workstation
|
||
implementation planning; it does not authorize implementation by itself.
|