[{"data":1,"prerenderedAt":721},["ShallowReactive",2],{"navigation":3,"\u002Farchitecture\u002Fdata-model":250,"\u002Farchitecture\u002Fdata-model-surround":716},[4,28,56,91,117,135,169,224],{"title":5,"path":6,"stem":7,"children":8,"icon":27},"Start here","\u002Fgetting-started","1.getting-started\u002F1.index",[9,11,15,19,23],{"title":10,"path":6,"stem":7},"Introduction",{"title":12,"path":13,"stem":14},"Decisions and open gates","\u002Fgetting-started\u002Fdecisions","1.getting-started\u002F2.decisions",{"title":16,"path":17,"stem":18},"Scope and non-goals","\u002Fgetting-started\u002Fscope","1.getting-started\u002F3.scope",{"title":20,"path":21,"stem":22},"Organization pilot","\u002Fgetting-started\u002Fpilot","1.getting-started\u002F4.pilot",{"title":24,"path":25,"stem":26},"Economics and quotas","\u002Fgetting-started\u002Feconomics","1.getting-started\u002F5.economics","i-lucide-compass",{"title":29,"path":30,"stem":31,"children":32,"icon":55},"Architecture","\u002Farchitecture","2.architecture\u002F1.index",[33,35,39,43,47,51],{"title":34,"path":30,"stem":31},"System architecture",{"title":36,"path":37,"stem":38},"Trust zones","\u002Farchitecture\u002Ftrust-zones","2.architecture\u002F2.trust-zones",{"title":40,"path":41,"stem":42},"Control plane","\u002Farchitecture\u002Fcontrol-plane","2.architecture\u002F3.control-plane",{"title":44,"path":45,"stem":46},"Organization tenancy","\u002Farchitecture\u002Ftenancy","2.architecture\u002F4.tenancy",{"title":48,"path":49,"stem":50},"Core data model","\u002Farchitecture\u002Fdata-model","2.architecture\u002F5.data-model",{"title":52,"path":53,"stem":54},"Codebase organization","\u002Farchitecture\u002Fcodebase","2.architecture\u002F6.codebase","i-lucide-layers",{"title":57,"icon":58,"path":59,"stem":60,"children":61,"page":90},"Identity and security","i-lucide-shield-check","\u002Fsecurity","3.security",[62,66,70,74,78,82,86],{"title":63,"path":64,"stem":65},"Identity and sessions","\u002Fsecurity\u002Fidentity","3.security\u002F1.identity",{"title":67,"path":68,"stem":69},"Domains and TLS","\u002Fsecurity\u002Fdomains","3.security\u002F2.domains",{"title":71,"path":72,"stem":73},"Ingress and egress","\u002Fsecurity\u002Fnetworking","3.security\u002F3.networking",{"title":75,"path":76,"stem":77},"Access policies and WAF-lite","\u002Fsecurity\u002Faccess-policies","3.security\u002F4.access-policies",{"title":79,"path":80,"stem":81},"Secrets and integrations","\u002Fsecurity\u002Fsecrets-integrations","3.security\u002F5.secrets-integrations",{"title":83,"path":84,"stem":85},"Governance and ownership","\u002Fsecurity\u002Fgovernance","3.security\u002F6.governance",{"title":87,"path":88,"stem":89},"Threat model","\u002Fsecurity\u002Fthreat-model","3.security\u002F7.threat-model",false,{"title":92,"icon":93,"path":94,"stem":95,"children":96,"page":90},"Building applications","i-lucide-code","\u002Fdevelopment","4.development",[97,101,105,109,113],{"title":98,"path":99,"stem":100},"AI and MCP","\u002Fdevelopment\u002Fai-mcp","4.development\u002F1.ai-mcp",{"title":102,"path":103,"stem":104},"Source control","\u002Fdevelopment\u002Fsource-control","4.development\u002F2.source-control",{"title":106,"path":107,"stem":108},"Sandboxed builds","\u002Fdevelopment\u002Fbuilds","4.development\u002F3.builds",{"title":110,"path":111,"stem":112},"Runtime contract and SDK","\u002Fdevelopment\u002Fruntime-contract","4.development\u002F4.runtime-contract",{"title":114,"path":115,"stem":116},"APIs and protocols","\u002Fdevelopment\u002Fapi","4.development\u002F5.api",{"title":118,"icon":119,"path":120,"stem":121,"children":122,"page":90},"Runtime and delivery","i-lucide-rocket","\u002Fdelivery","5.delivery",[123,127,131],{"title":124,"path":125,"stem":126},"Runtime clusters and previews","\u002Fdelivery\u002Fruntime-clusters","5.delivery\u002F1.runtime-clusters",{"title":128,"path":129,"stem":130},"Deployments and approvals","\u002Fdelivery\u002Fdeployments","5.delivery\u002F2.deployments",{"title":132,"path":133,"stem":134},"Databases and recovery","\u002Fdelivery\u002Fdata-recovery","5.delivery\u002F3.data-recovery",{"title":136,"icon":137,"path":138,"stem":139,"children":140,"page":90},"Operations","i-lucide-activity","\u002Foperations","6.operations",[141,145,149,153,157,161,165],{"title":142,"path":143,"stem":144},"Observability and audit","\u002Foperations\u002Fobservability","6.operations\u002F1.observability",{"title":146,"path":147,"stem":148},"Operating model","\u002Foperations\u002Foperating-model","6.operations\u002F2.operating-model",{"title":150,"path":151,"stem":152},"Deploy and roll back","\u002Foperations\u002Fdeploy-rollback","6.operations\u002F3.deploy-rollback",{"title":154,"path":155,"stem":156},"Back up and restore","\u002Foperations\u002Fbackup-restore","6.operations\u002F4.backup-restore",{"title":158,"path":159,"stem":160},"Upgrade and patch","\u002Foperations\u002Fupgrades","6.operations\u002F5.upgrades",{"title":162,"path":163,"stem":164},"Rotate keys and credentials","\u002Foperations\u002Fkey-rotation","6.operations\u002F6.key-rotation",{"title":166,"path":167,"stem":168},"Incidents and access revocation","\u002Foperations\u002Fincidents","6.operations\u002F7.incidents",{"title":170,"path":171,"stem":172,"children":173,"icon":223},"Implementation plan","\u002Froadmap","7.roadmap\u002F01.index",[174,175,179,183,187,191,195,199,203,207,211,215,219],{"title":170,"path":171,"stem":172},{"title":176,"path":177,"stem":178},"Phase 0: architecture spikes and ADRs","\u002Froadmap\u002Fphase-0","7.roadmap\u002F02.phase-0",{"title":180,"path":181,"stem":182},"Phase 1: control-plane foundation","\u002Froadmap\u002Fphase-1","7.roadmap\u002F03.phase-1",{"title":184,"path":185,"stem":186},"Phase 2: managed source and change sets","\u002Froadmap\u002Fphase-2","7.roadmap\u002F04.phase-2",{"title":188,"path":189,"stem":190},"Phase 3: sandboxed build system","\u002Froadmap\u002Fphase-3","7.roadmap\u002F05.phase-3",{"title":192,"path":193,"stem":194},"Phase 4: runtime and data plane","\u002Froadmap\u002Fphase-4","7.roadmap\u002F06.phase-4",{"title":196,"path":197,"stem":198},"Phase 5: deployment, preview, migration, and recovery","\u002Froadmap\u002Fphase-5","7.roadmap\u002F07.phase-5",{"title":200,"path":201,"stem":202},"Phase 6: Entra identity and security policy","\u002Froadmap\u002Fphase-6","7.roadmap\u002F08.phase-6",{"title":204,"path":205,"stem":206},"Phase 7: MCP and AI-native workflow","\u002Froadmap\u002Fphase-7","7.roadmap\u002F09.phase-7",{"title":208,"path":209,"stem":210},"Phase 8: Pilot hardening","\u002Froadmap\u002Fphase-8","7.roadmap\u002F10.phase-8",{"title":212,"path":213,"stem":214},"Phase 9: developer hybrid and v1 GA","\u002Froadmap\u002Fphase-9","7.roadmap\u002F11.phase-9",{"title":216,"path":217,"stem":218},"Test strategy","\u002Froadmap\u002Ftesting","7.roadmap\u002F12.testing",{"title":220,"path":221,"stem":222},"Definition of done","\u002Froadmap\u002Fdefinition-of-done","7.roadmap\u002F13.definition-of-done","i-lucide-list-checks",{"title":225,"icon":226,"path":227,"stem":228,"children":229,"page":90},"Reference","i-lucide-book-open","\u002Freference","8.reference",[230,234,238,242,246],{"title":231,"path":232,"stem":233},"Plan coverage","\u002Freference\u002Fplan-coverage","8.reference\u002F1.plan-coverage",{"title":235,"path":236,"stem":237},"Decision register","\u002Freference\u002Fdecisions","8.reference\u002F2.decisions",{"title":239,"path":240,"stem":241},"Glossary","\u002Freference\u002Fglossary","8.reference\u002F3.glossary",{"title":243,"path":244,"stem":245},"Sources","\u002Freference\u002Fsources","8.reference\u002F4.sources",{"title":247,"path":248,"stem":249},"Contributing and docs access","\u002Freference\u002Fcontributing","8.reference\u002F5.contributing",{"id":251,"title":48,"body":252,"description":709,"extension":710,"links":711,"meta":712,"navigation":713,"path":49,"seo":714,"stem":50,"__hash__":715},"docs\u002F2.architecture\u002F5.data-model.md",{"type":253,"value":254,"toc":703},"minimark",[255,271,274,654,659],[256,257,258],"note",{},[259,260,261,265,266,270],"p",{},[262,263,264],"strong",{},"v1 design baseline."," This page specifies intended behavior. Delivery and validation are tracked in the ",[267,268,269],"a",{"href":171},"implementation plan","; it is not a claim that the platform is already implemented.",[259,272,273],{},"These are proposed bounded contexts and principal entities, not an executable schema. Column types, foreign keys, indexes, and RLS policies are Phase 1 deliverables.",[275,276,277,290],"table",{},[278,279,280],"thead",{},[281,282,283,287],"tr",{},[284,285,286],"th",{},"Context",[284,288,289],{},"Principal entities",[291,292,293,318,340,368,390,415,437,465,487,512,537,550,572,600,616,635],"tbody",{},[281,294,295,299],{},[296,297,298],"td",{},"Tenancy",[296,300,301,305,306,305,309,305,312,305,315],{},[302,303,304],"code",{},"organizations",", ",[302,307,308],{},"organization_settings",[302,310,311],{},"organization_domains",[302,313,314],{},"subscriptions",[302,316,317],{},"quotas",[281,319,320,323],{},[296,321,322],{},"Users",[296,324,325,305,328,305,331,305,334,305,337],{},[302,326,327],{},"users",[302,329,330],{},"organization_memberships",[302,332,333],{},"roles",[302,335,336],{},"permissions",[302,338,339],{},"role_assignments",[281,341,342,345],{},[296,343,344],{},"Identity",[296,346,347,305,350,305,353,305,356,305,359,305,362,305,365],{},[302,348,349],{},"identity_providers",[302,351,352],{},"external_identities",[302,354,355],{},"groups",[302,357,358],{},"group_mappings",[302,360,361],{},"group_memberships",[302,363,364],{},"sessions",[302,366,367],{},"scim_tokens",[281,369,370,373],{},[296,371,372],{},"Machine identity",[296,374,375,305,378,305,381,305,384,305,387],{},[302,376,377],{},"service_identities",[302,379,380],{},"agent_identities",[302,382,383],{},"oauth_clients",[302,385,386],{},"oauth_grants",[302,388,389],{},"access_tokens",[281,391,392,395],{},[296,393,394],{},"Apps",[296,396,397,305,400,305,403,305,406,305,409,305,412],{},[302,398,399],{},"applications",[302,401,402],{},"application_owners",[302,404,405],{},"environments",[302,407,408],{},"routes",[302,410,411],{},"risk_assessments",[302,413,414],{},"capability_grants",[281,416,417,420],{},[296,418,419],{},"Source",[296,421,422,305,425,305,428,305,431,305,434],{},[302,423,424],{},"source_connections",[302,426,427],{},"repositories",[302,429,430],{},"source_revisions",[302,432,433],{},"change_sets",[302,435,436],{},"change_set_commits",[281,438,439,442],{},[296,440,441],{},"Build",[296,443,444,305,447,305,450,305,453,305,456,305,459,305,462],{},[302,445,446],{},"builds",[302,448,449],{},"build_steps",[302,451,452],{},"build_logs",[302,454,455],{},"scan_findings",[302,457,458],{},"sboms",[302,460,461],{},"artifacts",[302,463,464],{},"artifact_files",[281,466,467,470],{},[296,468,469],{},"Deploy",[296,471,472,305,475,305,478,305,481,305,484],{},[302,473,474],{},"deployment_requests",[302,476,477],{},"deployments",[302,479,480],{},"deployment_events",[302,482,483],{},"approvals",[302,485,486],{},"health_checks",[281,488,489,492],{},[296,490,491],{},"Runtime",[296,493,494,305,497,305,500,305,503,305,506,305,509],{},[302,495,496],{},"runtime_clusters",[302,498,499],{},"runtime_nodes",[302,501,502],{},"runtime_workloads",[302,504,505],{},"runtime_commands",[302,507,508],{},"runtime_heartbeats",[302,510,511],{},"route_versions",[281,513,514,517],{},[296,515,516],{},"Database",[296,518,519,305,522,305,525,305,528,305,531,305,534],{},[302,520,521],{},"database_instances",[302,523,524],{},"migration_definitions",[302,526,527],{},"migration_runs",[302,529,530],{},"database_snapshots",[302,532,533],{},"restore_operations",[302,535,536],{},"exports",[281,538,539,542],{},[296,540,541],{},"KV",[296,543,544,305,547],{},[302,545,546],{},"kv_namespaces",[302,548,549],{},"kv_usage",[281,551,552,555],{},[296,553,554],{},"Secrets",[296,556,557,305,560,305,563,305,566,305,569],{},[302,558,559],{},"secrets",[302,561,562],{},"secret_versions",[302,564,565],{},"integrations",[302,567,568],{},"integration_bindings",[302,570,571],{},"secret_access_events",[281,573,574,577],{},[296,575,576],{},"Security",[296,578,579,305,582,305,585,305,588,305,591,305,594,305,597],{},[302,580,581],{},"ip_lists",[302,583,584],{},"ip_list_entries",[302,586,587],{},"access_profiles",[302,589,590],{},"policy_sets",[302,592,593],{},"policy_versions",[302,595,596],{},"policy_rules",[302,598,599],{},"rate_limit_profiles",[281,601,602,605],{},[296,603,604],{},"Audit",[296,606,607,305,610,305,613],{},[302,608,609],{},"audit_events",[302,611,612],{},"audit_exports",[302,614,615],{},"security_events",[281,617,618,621],{},[296,619,620],{},"Usage",[296,622,623,305,626,305,629,305,632],{},[302,624,625],{},"usage_events",[302,627,628],{},"usage_rollups",[302,630,631],{},"quota_events",[302,633,634],{},"billing_periods",[281,636,637,640],{},[296,638,639],{},"Reliability",[296,641,642,305,645,305,648,305,651],{},[302,643,644],{},"outbox_messages",[302,646,647],{},"inbox_messages",[302,649,650],{},"idempotency_keys",[302,652,653],{},"dead_letter_events",[655,656,658],"h2",{"id":657},"important-invariants","Important invariants",[660,661,662,670,673,676,679,682,685,688,691,694,697,700],"ul",{},[663,664,665,666,669],"li",{},"Every tenant-owned entity has ",[302,667,668],{},"organization_id",".",[663,671,672],{},"An application has one canonical source mode.",[663,674,675],{},"A deployment references exactly one immutable artifact.",[663,677,678],{},"An artifact references exactly one immutable source revision.",[663,680,681],{},"An environment has one active deployment at a time.",[663,683,684],{},"A database belongs to one app environment.",[663,686,687],{},"A secret\u002Fintegration has explicit app\u002Fenvironment bindings.",[663,689,690],{},"An approval is invalidated by material deployment changes.",[663,692,693],{},"No AI grant can create an approval record.",[663,695,696],{},"Audit events are append-only.",[663,698,699],{},"Runtime commands are idempotent.",[663,701,702],{},"Slugs never replace IDs in authorization logic.",{"title":704,"searchDepth":705,"depth":706,"links":707},"",1,2,[708],{"id":657,"depth":706,"text":658},"Bounded contexts, principal entities, and invariants for the platform metadata model.","md",null,{},true,{"title":48,"description":709},"MFj0_IfMccrHO2ladsoPYg2_gvHRyBPW3ITsNxSTdaw",[717,719],{"title":44,"path":45,"stem":46,"description":718,"children":-1},"Tenant context, authorization, row-level security, immutable identifiers, and tenant isolation.",{"title":52,"path":53,"stem":54,"description":720,"children":-1},"The proposed platform monorepo, service boundaries, packages, and language allocation.",1790019415367]