- Status: approved (2026-07-18)
- Priority: P0 EXT — blocking (production rollout gated via YSD-0139)
- Decision owner: @GreyChimp
- Drafted: 2026-07-18 by Claude Code (claude-fable-5)
- Approval: approved as recommended by @GreyChimp on 2026-07-18; outcome recorded in decision-log.json; review by 2027-07-18
Question#
What are the private/local model execution, data-residency, offline, and provider-substitution requirements?
Recommendation#
All model inference routes through the Isis gateway with provider substitution (open-model registry + RunPod endpoints per the 2026-07-06 migration); study sources never leave the tenant's storage region for inference unless the grant explicitly allows it; offline/no-model operation is a first-class mode (YSD-0018/YSD-1039) — manual study must be complete without any model; enterprise residency requirements (local or private endpoints) are declared per tenant and enforced by the gateway configuration, failing closed to manual mode.
Options considered#
- Direct provider SDK calls from workspace code — rejected: bypasses YSD-0160 gateway ownership and audit.
- Mandatory local models — rejected: no on-box GPU; RunPod endpoints are the execution substrate.
Consequences#
- Isis adapter (Section 6) carries residency/substitution config; degraded-mode UX follows YSD-2007.
Machine-enforced outcome (once approved)#
Architecture tests (YSD-0164) reject unapproved model calls; gateway config schema validates residency settings.