Architecture
Core data model
Bounded contexts, principal entities, and invariants for the platform metadata model.
v1 design baseline. This page specifies intended behavior. Delivery and validation are tracked in the implementation plan; it is not a claim that the platform is already implemented.
These are proposed bounded contexts and principal entities, not an executable schema. Column types, foreign keys, indexes, and RLS policies are Phase 1 deliverables.
| Context | Principal entities |
|---|---|
| Tenancy | organizations, organization_settings, organization_domains, subscriptions, quotas |
| Users | users, organization_memberships, roles, permissions, role_assignments |
| Identity | identity_providers, external_identities, groups, group_mappings, group_memberships, sessions, scim_tokens |
| Machine identity | service_identities, agent_identities, oauth_clients, oauth_grants, access_tokens |
| Apps | applications, application_owners, environments, routes, risk_assessments, capability_grants |
| Source | source_connections, repositories, source_revisions, change_sets, change_set_commits |
| Build | builds, build_steps, build_logs, scan_findings, sboms, artifacts, artifact_files |
| Deploy | deployment_requests, deployments, deployment_events, approvals, health_checks |
| Runtime | runtime_clusters, runtime_nodes, runtime_workloads, runtime_commands, runtime_heartbeats, route_versions |
| Database | database_instances, migration_definitions, migration_runs, database_snapshots, restore_operations, exports |
| KV | kv_namespaces, kv_usage |
| Secrets | secrets, secret_versions, integrations, integration_bindings, secret_access_events |
| Security | ip_lists, ip_list_entries, access_profiles, policy_sets, policy_versions, policy_rules, rate_limit_profiles |
| Audit | audit_events, audit_exports, security_events |
| Usage | usage_events, usage_rollups, quota_events, billing_periods |
| Reliability | outbox_messages, inbox_messages, idempotency_keys, dead_letter_events |
Important invariants
- Every tenant-owned entity has
organization_id. - An application has one canonical source mode.
- A deployment references exactly one immutable artifact.
- An artifact references exactly one immutable source revision.
- An environment has one active deployment at a time.
- A database belongs to one app environment.
- A secret/integration has explicit app/environment bindings.
- An approval is invalidated by material deployment changes.
- No AI grant can create an approval record.
- Audit events are append-only.
- Runtime commands are idempotent.
- Slugs never replace IDs in authorization logic.