Prompt & Configuration Registry · View 09 of 21 · Data
The seam
- Everything before Sealed is mutable and reviewable. Everything after it is immutable and verifiable. There is no third mode, and no path that edits a sealed artefact.
- Model alias pinning happens at Build, not at Serve. A provider changing what a name points at then shows up as a diff on the next build rather than as a silent behaviour change that invalidates every past digest (ADR-13).
- The failure edge from Verify goes back to keeping the previous bundle, never forward to serving an unverified one — availability failures fail static, integrity failures fail closed (ADR-03).
What the digest covers
- The canonical serialisation of the flattened configuration, including resolved fragments, the variable schema and the pinned model identifier. Two versions with identical content are the same version.
- It does not cover the resolved variable values at request time, which are user content and are not retained by default (ADR-14).
- SHA-256 over the canonical form; the canonicaliser is itself versioned, because a change to it changes every digest (a known future migration, recorded in ADR-06).
Risks
- Canonicaliser drift. If the flattening or serialisation rules change, old digests no longer reproduce and the reproducibility claim quietly breaks. It must be versioned inside the digest input, not outside it.
- A fragment change fans out to every version that includes it, so a shared safety preamble is a blast-radius object. The build makes this visible; nothing prevents it.
