[jcdavis131]

Stacked on #100 (cursor/served-model-lineage-b86c @ e11c2a5). Does not merge #100 or change its branch. Served model stays July v5 (july-v5-a4918f09); nothing is promoted.

Gaps

An adversarial review of #100 found two fail-open paths in pipeline/served_model.py:

1. Forced-adoption pin. forced_adoption_pin_problem only ran when checkpoint_sha256 was empty (or adoption.kind == served-incumbent). A hand-written lineage with forced: true and any fake non-empty checkpoint skipped the July v5 sha pin.
2. Stale sidecar self-exemption. Any sidecar that set stale / not_from_served_net skipped the run-id drift check. A live sidecar could mark itself stale and drift freely.

Fixes

• Every forced: true lineage whose embedding_f32_sha256 is not the pinned July v5 sha fails, regardless of checkpoint_sha256 or kind.
• The only alternative is a matching promote.py manifest on disk (CURRENT.json + promoted/<run_id>/manifest.json hashes, including checkpoint). Default is fail-closed. This keeps the real promote.py --force path (tests/test_e2e_smoke.py) working.
• Run-id drift exemption is limited to mtnn_jacobian.json and mtnn_attr_pop.json via STALE_SIDECAR_ALLOWLIST. Any other sidecar marked stale still fails the drift check.

Tests

• test_a_forced_lineage_with_a_fake_checkpoint_sha_fails — forced + fake non-empty checkpoint_sha256 + wrong f32 sha fails.
• test_a_non_allowlisted_stale_sidecar_with_drifted_run_id_fails — e.g. mtnn_map.json marked stale with a drifted run id fails.
• test_allowlisted_stale_sidecars_with_drifted_run_id_pass — jacobian and attr_pop still pass.

Existing forced-empty-checkpoint, committed-bundle, and real --force tests still pass.

Checks

Attached to this PR (base is not master, so GHA workflows that only trigger on master/main did not run):

Check	Result
Vercel	pass
Vercel Preview Comments	pass

Local equivalents of the #100 required jobs, all green on this head (8bfc068d):

Job	Local result
served-model (scripts/check_served_model.py)	pass — July v5 incumbent
site (tests/test_site.py + stamp/sync/facts)	pass
ruff check + format	pass
budgets (scripts/budget_check.py)	pass
tests/test_check_served_model.py + tests/test_export_lineage.py	pass

  

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
vector-hoops	Ready	Preview	Oct 19, 2026 3:02am UTC

[cursor]

Approved. Cursor Bugbot was not present after the first check poll, so that automated-review signal was skipped. No applicable approval policy required human review.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}