ADR 0019: Model configuration as data with run-start verification

Status: Accepted
Date: 2026-09-14
Deciders: Founder

Context

The attribution word list forbids naming the model in code, docs or copy, while the regulatory frame expects the model version to be logged per run and disclosed in plain language. Phase 1 kept the model id in an environment variable only.

Decision

model_configs rows (label MC-n, model_id_value, inference_profile_id, embedding_model_id_value, region, recorded_at, recorded_by) are data, never static copy; the UI shows “Model configuration MC-n (recorded <date>)”.
agent_versions (prompt, skills, check logic, model configuration, image digest) move candidate -> active only after the evaluation suite passes.
At run start the container reports its model id, inference profile and region; the worker compares them with the active version’s configuration and refuses to run with config_mismatch until a new version is activated; the outcome is stored in run_snapshots.model_check.

Consequences

Residency and model provenance are evidenced per run, not assumed.
Model ids still enter only through AGENT_MODEL_ID and EMBEDDING_MODEL_ID.

Alternatives considered

Model name in copy: violates the attribution list; rejected.
No verification: the environment could drift from the recorded configuration; rejected.

Follow-ups

Expose model configuration history on the agents page (R2).