Establish Reproducible Dataset-to-Model Lineage and Risk-Based Promotion Gates

[Inkman007]

Problem

LedgerLens has training, registry, signing, cards, drift, robustness, and shadow-scoring components, but production safety depends on one enforceable chain from immutable data inputs through feature code and evaluation to the exact deployed model. Separate utilities do not by themselves prevent unreproducible training or promotion of a model that regresses a critical cohort.

Scope

• Define immutable dataset manifests with source ranges, hashes, labels, exclusions, schema, and license/provenance metadata.
• Record code revision, dependency lock, feature schema, seeds, hyperparameters, calibration, and parent model for every run.
• Create promotion gates covering global and cohort metrics, calibration, temporal holdouts, adversarial robustness, latency/memory, and explainability stability.
• Require signed approval artifacts for staging/production promotion.
• Connect registry entries, model cards, shadow results, deployment metadata, and rollback.
• Make gate policy versioned and machine-readable.

Acceptance criteria

• A model can be reproduced from its registry record in a clean environment within documented numeric tolerances.
• Missing lineage or a failed mandatory gate makes promotion impossible through supported tooling.
• Regression thresholds are justified and include low-volume/cold-start/cross-chain cohorts.
• Rollback restores model, feature schema, calibration, and threshold versions coherently.
• CI tests detect tampered manifests, incompatible features, and nondeterministic evaluation.
• Operators can answer which data/code/policy produced any served score.