ADR-0091: ML cortex Phase G — 7 additional functions

• Status: Accepted (2026-05-24) — Phase G scaffold (7 deterministic baselines + tests + this ADR) shipped in this PR
• Date: 2026-05-24
• Driver: closes discuss_module_validator_tbi_2026_05_10 §"ML cortex embedded (8 functions)" — Phase E shipped function #5 (role assignment); Phase G ships baselines for the other 7
• Related: ADR-0088 (Phase E, function #5 role assignment) · ADR-0090 (Phase F operator validation loop) · discuss_module_validator_tbi_2026_05_10 (strategic memo)

Context

The strategic memo named 8 ML cortex functions; Phase E shipped only function #5 (intelligent role assignment) because it was the most concrete + the easiest to bootstrap from the heuristic. The other 7 stayed conceptual until now.

Phase G ships deterministic baselines for all 7 — each function is operator-usable from day one with rule-based logic, paired with a clear seam for Phase G-real to swap in trained models as operator-validated datasets accumulate.

Decision

Ship 7 stub modules under pkg/validator-ml-cortex/src/validator_ml_cortex/functions/, each with:

1. Pydantic schema for the function's input
2. Pure-Python deterministic baseline that operator can audit
3. Pytest covering happy path + 1-2 edge cases
4. Phase G-real seam: predict_<fn> interface contract locked, ONNX inference body TODO

#	Module	Function (memo)	Phase G baseline	Phase G-real
1	discovery_ranking	Discovery method ranking	Canonical default order tuned by EnvironmentHints (no-switch → demote LLDP/CDP; airgap → drop NMAP)	Train on (env, method, succeeded)
2	cascade_optimization	Cascade topology optimization	Lowest-degree peer with RTT tiebreaker	Train on (graph, peer, post_join_latency)
3	failure_prediction	Failure prediction	Threshold-mix of (missed_heartbeats, cpu_p95, memory_p95, oom_kills, disk_pressure) → probability + rationale	GradientBoosting on (window, was_unhealthy_15min)
4	auto_recovery	Auto-recovery suggestion	Canonical playbook map (oom_kill_loop → kubectl rollout restart, disk_full → vacuum journals, etc.); critical severity forces approval	Train on (symptom, applied_action, was_resolved)
5	(role assignment)	Intelligent role assignment	Already shipped in Phase E (ADR-0088)	Phase E DecisionTree
6	anomaly_detection	Anomaly detection on telemetry streams	StreamingDetector with rolling window + z-score threshold (cold-start ≥ 5 samples)	Seasonally-aware GradientBoosting per stream
7	drift_prediction	Drift prediction	Pydantic diff between DesiredState + ObservedState; severity scoring (mode-mismatch → high, delta ≥ 2 → high, delta 1 → medium)	Train on (drift_signature, was_real_issue)
8	scan_adaptation	Scan pattern adaptation	ScanAdapter per-method EMA success rate; ranked() returns highest-success-first	Train on (target_class, method, succeeded, time_to_first_response)

Locked decisions

#	Decision	Rationale
1	Deterministic baseline ships day one	Operator gets SOMETHING from each function from the moment the sidecar boots; Phase G-real upgrades incrementally per function. Same pattern as Phase E role-assignment heuristic-replay
2	Phase G stays Python-side only	Go-side validator-art doesn't consume the 7 new functions directly (Phase E's /predict-role is the only Go integration). Phase G-real adds /predict-discovery, /predict-failure, etc. routes to server.py
3	No new ConfigMap per function	The single ml-cortex-model ConfigMap is reserved for the role-assignment ONNX. Phase G-real adds per-function models as separate keys (ml-cortex-model.binaryData.discovery-ranking-predictor.onnx etc.)
4	Pydantic schemas per function	Same library Phase E uses; consistent typing across the cortex; FastAPI request validation comes free
5	Tests are smoke-only for Phase G scaffold	16 tests (1-3 per function) cover happy path + 1-2 edge cases. Phase G-real adds per-function trained-vs-baseline drift tests when models land
6	No new patent claim	Patent Family E claim #18 (ADR-0088 + provisional draft) already covers the methodology — the 7 functions are applications of the same heuristic-replay-bootstrap + operator-validated retraining loop, not novel methods

Consequences

Positive

• Closes the strategic memo's full "8 ML cortex functions" list with deterministic-baseline scaffold + clear Phase G-real upgrade path per function
• 16 new pytest covering all 7 stubs — 61 pytest total in pkg/validator-ml-cortex/
• Operator gets discovery-ranking + failure-prediction + auto-recovery suggestions from day one without ML

Negative / deferred

• No FastAPI routes for the 7 functions — Phase G-real adds /predict-<fn> routes; for Phase G scaffold the functions are importable from validator_ml_cortex.functions but not served over HTTP
• No operator-validation table per function — Phase G-real adds validator_<fn>_overrides migrations as each function's feedback loop matures
• No per-function K8s CronJob — Phase G-late expands the MF-3 CronJob to retrain all 7 functions on the same Sunday window
• No trained models — all 7 functions return baseline outputs; trained models land per-function in Phase G-real when operator-validated datasets accumulate

Alternatives considered

• Skip Phase G entirely until trained models ready — rejected; deterministic baselines deliver real operator value (discovery ranking + failure prediction in particular)
• One unified predict_anything interface — rejected; each function has distinct input shape + semantics; one interface would force runtime type-switch
• Ship trained models with synthetic-only data — rejected; synthetic-only models without operator validation would create false confidence

References

• discuss_module_validator_tbi_2026_05_10 §"ML cortex embedded (8 functions)" (the source list)
• ADR-0088 (Phase E role-assignment function #5)
• ADR-0090 (Phase F operator validation loop)
• pkg/validator-ml-cortex/src/validator_ml_cortex/functions/ (the 7 module implementations)
• pkg/validator-ml-cortex/tests/test_functions.py (16 smoke tests)