hank-model-authority

The model authority every product repository reads: which models exist (registry entries with their execution identity and per-family request facts), which model each capability uses (selection policy), and what each model costs (rate tables). The distribution depends on PyYAML and pydantic only, so Risk, Investment and Edgar take it without the gateway.

Design and rollout: docs/design/model-authority-registry-as-data-artifact-design-2026-09-29.md and its implementation plan.

Layout

The package root imports types and the loader, never current, so python -m model_authority check <dir> can check a candidate directory while the host directory is broken.

Which directory a process loads

HANK_MODEL_AUTHORITY_DIR set: that directory, resolved once at start; missing or unreadable fails the start. Unset: the packaged authority/ directory. Every process reports what it admitted through health_fact(): {"revision", "schema", "sha256", "source", "loader", "admits"}.

Changing it

• A data change (a model, a default, a price, a compat value) edits authority/ and ships by the host deploy of that directory, not by a release. Declare the lowest schema minor that covers the fields the artifact uses.
• A schema change is a release: a new optional field or literal is a minor (SCHEMA_MINOR), a removal or redefinition a major. Deploy loaders before data that uses a new minor: a loader refuses an artifact whose minor is newer than its own, naming both.
• A capability or its executing process is a release (capabilities.py).

Check a candidate directory with the ordinary load:

python -m model_authority check <dir>   # prints the health fact, or exits 1 with the refusal

Tests: .venv/bin/python3 -m pytest packages/model-authority/tests -q (make test-area AREA=model_authority).