feat(adaptive): govern dormant support profiles

.github/workflows/build_and_test.yml

@@ -182,6 +182,7 @@ jobs:
             tests.test_adaptive_bundle_registry \
             tests.test_adaptive_algorithm_scout \
             tests.test_adaptive_candidate_screening \
+            tests.test_adaptive_support_profile_governance \
             tests.test_adaptive_managed_output \
             tests.test_adaptive_qualification \
             tests.test_adaptive_recommendation \
@@ -253,6 +254,7 @@ jobs:
             tests.test_adaptive_bundle_registry \
             tests.test_adaptive_algorithm_scout \
             tests.test_adaptive_candidate_screening \
+            tests.test_adaptive_support_profile_governance \
             tests.test_adaptive_managed_output \
             tests.test_adaptive_qualification \
             tests.test_adaptive_recommendation \
@@ -338,6 +340,7 @@ jobs:
             tests/test_adaptive_vision_roadmap_generator.py \
             tests/test_adaptive_algorithm_scout.py \
             tests/test_adaptive_candidate_screening.py \
+            tests/test_adaptive_support_profile_governance.py \
             tests/test_adaptive_evidence_activation.py \
             tests/test_adaptive_qualification.py \
             tests/test_adaptive_recommendation.py \
@@ -414,6 +417,7 @@ jobs:
         run: |
           yolozu doctor --output -
           yolozu activate-qualification-evidence --help
+          yolozu review-image-pipeline-support-profiles --help
           yolozu qualify-image-pipeline --help
           yolozu demo instance-seg --num-images 2 --image-size 48 --max-instances 2 --run-dir "${RUNNER_TEMP}/yolozu_demo"
 
@@ -439,6 +443,7 @@ jobs:
           python3 tools/ci/install_with_hashes.py --requirements requirements-locks/requirements-runtime.lock --install-local-wheel
           yolozu doctor --output -
           yolozu activate-qualification-evidence --help
+          yolozu review-image-pipeline-support-profiles --help
           yolozu export --help
           yolozu qualify-image-pipeline --help
           python -c "from yolozu import resources; paths = resources.list_resource_paths(); assert 'schemas/predictions.schema.json' in paths; assert 'schemas/adaptive_vision_roadmap.schema.json' in paths; assert 'manifest/adaptive_vision_roadmap.json' in paths; assert 'protocols/yolo26_eval.json' in paths; print('resources OK:', len(paths))"

.github/workflows/publish.yml

@@ -45,6 +45,7 @@ jobs:
             tests.test_adaptive_bundle_registry \
             tests.test_adaptive_algorithm_scout \
             tests.test_adaptive_candidate_screening \
+            tests.test_adaptive_support_profile_governance \
             tests.test_adaptive_managed_output \
             tests.test_adaptive_recommendation \
             tests.test_adaptive_processing \
@@ -78,11 +79,15 @@ jobs:
             "yolozu/data/schemas/evidence_activation_record.schema.json",
             "yolozu/data/schemas/candidate_screening_record.schema.json",
             "yolozu/data/schemas/screening_eligibility_observation.schema.json",
+            "yolozu/data/schemas/support_profile_spec.schema.json",
+            "yolozu/data/schemas/support_profile_record.schema.json",
             "yolozu/data/schemas/support_profile_eligibility_observation.schema.json",
+            "yolozu/data/schemas/support_profile_set_proposal.schema.json",
             "yolozu/data/schemas/selection_decision.schema.json",
             "yolozu/data/adaptive_routing/bundle_specs.json",
             "yolozu/data/adaptive_routing/bundle_lifecycle.jsonl",
             "yolozu/data/adaptive_routing/candidate_screening.jsonl",
+            "yolozu/data/adaptive_routing/support_profiles.jsonl",
             "yolozu/data/adaptive_routing/evidence_activation.jsonl",
           }
           with zipfile.ZipFile(wheels[-1], "r") as archive:
@@ -206,6 +211,7 @@ jobs:
             tests.test_adaptive_bundle_registry \
             tests.test_adaptive_algorithm_scout \
             tests.test_adaptive_candidate_screening \
+            tests.test_adaptive_support_profile_governance \
             tests.test_adaptive_managed_output \
             tests.test_adaptive_recommendation \
             tests.test_adaptive_processing \
@@ -237,11 +243,15 @@ jobs:
             "yolozu/data/schemas/evidence_activation_record.schema.json",
             "yolozu/data/schemas/candidate_screening_record.schema.json",
             "yolozu/data/schemas/screening_eligibility_observation.schema.json",
+            "yolozu/data/schemas/support_profile_spec.schema.json",
+            "yolozu/data/schemas/support_profile_record.schema.json",
             "yolozu/data/schemas/support_profile_eligibility_observation.schema.json",
+            "yolozu/data/schemas/support_profile_set_proposal.schema.json",
             "yolozu/data/schemas/selection_decision.schema.json",
             "yolozu/data/adaptive_routing/bundle_specs.json",
             "yolozu/data/adaptive_routing/bundle_lifecycle.jsonl",
             "yolozu/data/adaptive_routing/candidate_screening.jsonl",
+            "yolozu/data/adaptive_routing/support_profiles.jsonl",
             "yolozu/data/adaptive_routing/evidence_activation.jsonl",
           }
           wheels = sorted(glob.glob("dist/*.whl"))

CHANGELOG.md

@@ -14,6 +14,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Register the existing model zoo as non-promoted adaptive Candidate baselines.
 - Add an Experimental bounded official-source algorithm scout and nonselectable candidate inbox.
 - Add fail-closed non-executing candidate screening and recommendation preflight.
+- Add reviewed dormant support-profile set governance and execution-time reprojection.
 
 ### Fixed
 - Keep repository-wrapper prediction and TTA/TTT log paths anchored to the checkout when invoked from another working directory.

README.md

@@ -148,6 +148,14 @@ cancellation, and atomic unactivated `qualification_report.json` publication.
 Experimental `yolozu activate-qualification-evidence` now dry-runs every review,
 trust, freshness, registry, lifecycle, and stale-head gate before it can append an
 activation, supersession, or terminal revocation. Mutation requires `--approve`.
+Experimental `yolozu review-image-pipeline-support-profiles` separately reviews one
+complete ordered exact-measured target set. It reads and, only with `--approve`,
+atomically appends to the sole packaged `support_profiles.jsonl` SSOT. A reviewed
+set remains dormant: it does not change a lifecycle pointer, activate evidence,
+bind a runner, download a model, or claim current support. The stream is currently
+empty. Recommendation and execution use the same loader-derived support-profile
+provider, and execution reprojects the lifecycle-pinned historical set before any
+runner session is opened.
 Locally emitted reports can reach only `site_managed` / `site_qualified`; arbitrary
 workspace JSON remains nonselectable. Repository-managed trust additionally requires
 the retained, tracked review workflow and a public review reference.

Readme_jp.md

@@ -145,7 +145,14 @@ preflight、固定したrepeat/soak protocol、child processのbounded cancellat
 unactivatedな`qualification_report.json`のatomic publicationを実装しています。
 Experimental `yolozu activate-qualification-evidence` は、review、trust、freshness、
 registry/lifecycle、stale-head の全gateをdry-runで確認し、`--approve`を明示した場合
-だけactivation、supersession、terminal revocationをatomicに追記します。localで生成
+だけactivation、supersession、terminal revocationをatomicに追記します。
+Experimental `yolozu review-image-pipeline-support-profiles` は、exact-measuredな
+target profileの完全なordered setを別工程でreviewします。sole packaged SSOTである
+`support_profiles.jsonl`だけを読み、`--approve`時だけatomicに追記します。review済み
+setはdormantのままで、lifecycle pointer、evidence activation、runner binding、model
+download、現在利用可能というsupport claimを変更しません。streamは現在空です。
+recommendationとexecutionは同じloader-derived providerを使い、executionはrunner
+sessionを開く直前にlifecycleが固定したhistorical setを再projectします。localで生成
 したreportは`site_managed` / `site_qualified`までで、任意のworkspace JSONは選択対象に
 なりません。repository-managed trustには、追跡されたreview workflowとpublic review
 referenceが別途必要です。

docs/README.md

@@ -48,7 +48,10 @@ The environment-qualified local image-processing program targets an Experimental
 - Current Experimental implementation boundary: `yolozu qualify-image-pipeline`
   emits only an unactivated report; `yolozu activate-qualification-evidence`
   defaults to a no-write gate report and mutates only with explicit review and
-  `--approve`. A bounded non-executing candidate-screening provider derives pass,
+  `--approve`. `yolozu review-image-pipeline-support-profiles` likewise defaults
+  to no-write and can append only a complete reviewed dormant set to the canonical
+  support-profile SSOT. That review does not advertise support or make a model
+  executable. A bounded non-executing candidate-screening provider derives pass,
   hold, or reject before selection. Its packaged stream is empty; custom input
   stays operator-asserted and cannot satisfy the managed-pass gate. A file-free
   pure selector evaluates already validated records, and the MCP-only

docs/adaptive_image_routing.md

@@ -495,6 +495,33 @@ bundle was Candidate. The decision
 pins the current lifecycle projection digest only to detect change between
 recommendation and execution.
 
+### Dormant support-profile review
+
+`yolozu review-image-pipeline-support-profiles` is the implemented Experimental
+maintainer operation for one complete ordered set of 1..32 `SupportProfileSpec`
+records. Its proposal must use exact `canonical_json_v1` bytes, repeat the exact
+family/channel and complete ordered profile IDs, and contain no private/site values.
+The default is a bounded no-write dry-run. An approved append requires the observed
+global support-profile head, the exact current set-record/set digests or explicit
+initial none, a non-personal repository review role, a public review reference, and
+a reason.
+
+Approval appends only new immutable definitions followed by one set assignment to
+`yolozu/data/adaptive_routing/support_profiles.jsonl`, then reads back the complete
+projection. Existing bytes are unchanged and no derived projection file is written.
+This produces a reviewed dormant target scope only. It does not change the current
+lifecycle assignment, activate evidence, bind or import a runner, download assets,
+promote maturity, or advertise support. The canonical stream remains empty until a
+real reviewed proposal is approved; test fixtures are not support evidence.
+
+The loader-derived support-profile provider follows the exact historical set record
+and index prefix pinned by each current lifecycle assignment. A newer dormant review
+does not rewrite that advertised snapshot. Recommendation passes only these typed
+observations to the pure selector. `process_images` reopens the support/lifecycle
+SSOTs and requires the exact pinned observation again immediately before it resolves
+a runner session. Missing, untrusted, conflicting, superseded, or tampered state
+fails closed.
+
 The environment fingerprint identifies a measured configuration, not one unique
 physical host. It excludes identifying host data. Evidence from representative
 images describes only that measured workload. It does not prove the same latency or

docs/generated/cli_reference.md

@@ -6,10 +6,10 @@ Keep narrative docs short and link here for the full command surface.
 ## Top-level `yolozu --help`
 
 ```text
-usage: yolozu [-h] [--version] {guide,doctor,dr,list,fetch,export,export-dataset,predict-images,eval-coco,calibrate,eval-long-tail,long-tail-recipe,benchmark,parity,predictions,validate,eval-instance-seg,onnxrt,resources,migrate,import,train,train-orchestrate,test,demo,qualify-image-pipeline,activate-qualification-evidence,scout-algorithms,registry,completion,comp} ...
+usage: yolozu [-h] [--version] {guide,doctor,dr,list,fetch,export,export-dataset,predict-images,eval-coco,calibrate,eval-long-tail,long-tail-recipe,benchmark,parity,predictions,validate,eval-instance-seg,onnxrt,resources,migrate,import,train,train-orchestrate,test,demo,qualify-image-pipeline,activate-qualification-evidence,review-image-pipeline-support-profiles,scout-algorithms,registry,completion,comp} ...
 
 positional arguments:
-  {guide,doctor,dr,list,fetch,export,export-dataset,predict-images,eval-coco,calibrate,eval-long-tail,long-tail-recipe,benchmark,parity,predictions,validate,eval-instance-seg,onnxrt,resources,migrate,import,train,train-orchestrate,test,demo,qualify-image-pipeline,activate-qualification-evidence,scout-algorithms,registry,completion,comp}
+  {guide,doctor,dr,list,fetch,export,export-dataset,predict-images,eval-coco,calibrate,eval-long-tail,long-tail-recipe,benchmark,parity,predictions,validate,eval-instance-seg,onnxrt,resources,migrate,import,train,train-orchestrate,test,demo,qualify-image-pipeline,activate-qualification-evidence,review-image-pipeline-support-profiles,scout-algorithms,registry,completion,comp}
     guide               Show beginner-friendly routes and copy-paste commands.
     doctor (dr)         Check the environment. Use --explain for beginner-friendly next actions.
     list                List registries and built-in catalogs.
@@ -38,6 +38,8 @@ positional arguments:
                         Measure one exact local image bundle (Experimental).
     activate-qualification-evidence
                         Review one exact qualification report; dry-run unless --approve is set.
+    review-image-pipeline-support-profiles
+                        Review one complete dormant support-profile set; dry-run by default.
     scout-algorithms    Plan or collect a bounded monitored-source candidate inbox (Experimental).
     registry            AI-first tool registry: list/show/validate/run tools from the canonical manifest.
     completion (comp)   Print shell completion script (bash/zsh).
@@ -272,6 +274,7 @@ Contact: develop@toppymicros.com
 | render_synthgen_overlay | experimental | tools/render_synthgen_overlay.py | Render semantic + instance + keypoint overlays from SynthGen shard samples. |
 | render_ttt_manual_figures | research | tools/render_ttt_manual_figures.py | Render the six-file docs/manual TTT figure bundle atomically from validated synthetic-fixture or hash-bound measured sources. |
 | report_dependency_licenses | stable | tools/report_dependency_licenses.py | Generate a best-effort dependency license report from installed Python packages (not legal advice). |
+| review_image_pipeline_support_profiles | experimental | tools/review_image_pipeline_support_profiles.py | Dry-run or atomically append one complete reviewed dormant exact-measured support-profile set; review alone never changes lifecycle support or availability. |
 | rtdetr_pose_backend_suite | experimental | tools/rtdetr_pose_backend_suite.py | Fail-closed RT-DETR backend parity + benchmark suite with shared checkpoint compatibility evidence. |
 | rtdetr_pose_train_continual | research | rtdetr_pose/tools/train_continual.py | Continual fine-tuning runner for rtdetr_pose with an explicit initial-checkpoint/FWT baseline, optional no-object-aware foreground response selection, replay/LoRA/EWC/SI, and per-task checkpoint, teacher, data-order, time, memory, and command provenance. |
 | run_actions_api | stable | tools/run_actions_api.py | Run the GPT Actions API, including fail-closed typed TTT/CTTA export jobs with full checkpoint preflight. |