Skip to main content

Data Model Overview

This is the compact map of the durable objects that matter most in the current repo.

It is not a schema dump. It is the minimum useful orientation for technical readers.

The important split​

The current repo has four important durable object families:

  1. Studio authoring and approval
  2. Zero-config runtime plan state
  3. Replay runtime control-plane state
  4. Execution history and references

That split matters because the browser workbench, the zero-config runtime, and the runtime control plane do not all read from the same rows.

1. Studio authoring and approval​

These are the durable objects behind Governance Studio.

GovernanceWorkspace​

Top-level Studio scope for one tenant, agent, and environment.

Important fields:

  • agent
  • environment
  • status
  • runtime_authority_kind
  • active_draft_id
  • active_draft_snapshot_id
  • active_approval_id

This is the stable anchor for the Studio lineage.

BusinessSource​

Immutable source material attached to a workspace.

Examples:

  • observed runs
  • prompt snapshots
  • tool schemas
  • uploaded docs
  • pasted rules
  • manual notes
  • customer corrections

Important fields:

  • kind
  • title
  • content_hash
  • security_status
  • ingestion_status
  • provenance_json

BusinessDraft​

Editable authoring lineage for a workspace.

Important fields:

  • status
  • active_snapshot_id
  • current_version
  • parent_draft_id
  • derived_from_approval_id

BusinessDraftSnapshot​

Immutable versioned snapshot of a draft.

Important fields:

  • version
  • status
  • memory_json
  • source_snapshot_hash
  • command_history_hash
  • generation_profile
  • compiler_version

If you want to know what was actually under review at one point in time, this is the core record.

BusinessCommand​

Append-only typed command log for Studio writes.

Important fields:

  • command_type
  • expected_draft_version
  • payload_json
  • origin
  • actor_id
  • idempotency_key
  • validation_state
  • applied_at

GovernanceApproval​

Immutable approval record for one specific draft snapshot.

Important fields:

  • draft_snapshot_id
  • approval_version
  • approved_by
  • approved_at
  • source_snapshot_hash
  • command_history_hash
  • compiler_version
  • approval_proof_json

CompiledGovernanceArtifact​

Immutable compiled output linked 1:1 to an approval.

Important fields:

  • approval_id
  • compiled_hash
  • review_projection_json
  • runtime_projection_json
  • compat_projection_json

ApprovalRuntimeReceipt​

Immutable receipt showing that runtime comparison executed at least once for an approval lineage.

This matters because a clean comparison can exist even when there are zero DriftItem rows.

DriftItem​

Post-approval divergence record.

Important fields:

  • approval_id
  • target_ref
  • fingerprint
  • severity
  • status
  • summary

Drift does not mutate approval truth in place. It creates review work.

EvidenceEntry​

Workspace-scoped evidence health accumulator.

Important fields:

  • source_snapshot_hash
  • scope
  • target_ref
  • family
  • support_count
  • contradiction_count
  • freshness
  • last_observed_at

2. Zero-config runtime plan state​

These are the durable rows behind the hosted zero-config runtime lookup.

GovernancePlan​

Environment-scoped runtime plan object used by:

  • GET /api/v1/governance/plan?agent=<agent>&environment=<env>

Important fields:

  • agent
  • environment
  • status
  • observations
  • confidence
  • tool_inventory
  • tools_observed
  • inferred_session
  • policy_layer
  • workflow_truth
  • compiled_plan
  • compiled_session
  • compiled_hash
  • approved_by
  • approved_at
  • version

Key statuses:

  • LEARNING
  • READY
  • APPROVED
  • ENFORCING

This is the row the zero-config runtime consults at startup. It is not the same object as the Studio approval rows.

3. Replay runtime control-plane state​

These are the durable objects behind Govern mode and the hosted replay runtime APIs.

ReplaySession​

Canonical durable runtime session record.

Important fields:

  • session_id
  • agent
  • mode
  • tier
  • status
  • contract_hash
  • compiled_session_hash
  • state_version
  • control_revision
  • current_phase
  • total_tool_calls
  • total_step_count
  • total_cost
  • total_unguarded_calls
  • labels
  • compromised_at
  • killed_at

ReplayPreparedRequest​

Durable preflight record for one governed request.

Important fields:

  • prepared_request_id
  • request_seq
  • state_version
  • control_revision
  • request_hash
  • prepared_request_json
  • narrowing_json
  • consumed_at

When workflow governance is active, this row also stores the workflow tuple binding.

ReplayPendingCall​

Durable ledger entry for a proposed governed tool call.

Important fields:

  • step_id
  • tool_call_id
  • tool_name
  • arguments_hash
  • commit_requirement
  • execution_state
  • evidence_level
  • commit_state
  • status

ReplayExecutionReceipt​

Durable receipt for a governed execution.

Important fields:

  • pending_call_id
  • tool_name
  • idempotency_key
  • status
  • evidence_level
  • output_hash
  • external_ref
  • started_at
  • completed_at

ReplaySessionSnapshot​

Materialized snapshot of session state rebuilt from the event stream.

ReplayDecisionEvent​

Append-only runtime lifecycle event log for authoritative and advisory replay activity.

ReplaySessionLease​

Fence-based single-writer lease for authoritative runtime sessions.

ReplayWorkflow​

Top-level durable workflow record for multi-session governance.

Important fields:

  • workflow_id
  • root_session_id
  • status
  • compiled_workflow_hash
  • limits_json
  • state_version
  • control_revision
  • total_session_count
  • active_session_count
  • total_step_count
  • total_cost
  • total_handoff_count
  • unresolved_handoff_count
  • kill_scope

There are additional workflow tables for events, links, handoffs, resource claims, and budget reservations. The top-level point is that workflow governance is a real durable control-plane envelope in this repo, not just an SDK convenience.

4. Execution history and references​

These are the durable objects behind runs, captures, inference, and references.

Run​

Top-level execution record.

Important fields:

  • run_id
  • status
  • provider
  • model_id
  • baseline_key
  • strict_hash
  • run_mode_lane
  • provider_mode
  • corpus_manifest_hash

Step​

Per-step execution and evaluation detail inside a run.

Important fields:

  • status
  • contract_path
  • contract_tool
  • step_index
  • tool_call_names
  • fingerprint
  • response_shape_hash

CapturedCall​

Hosted capture record for observed runtime traffic.

Important fields:

  • agent
  • provider
  • model_id
  • primary_tool_name
  • request
  • response
  • validation
  • sdk_session_id
  • replay_trace

InferredContract​

Tenant-scoped inferred contract state derived from captures and customer overrides.

Important fields:

  • agent
  • tool_name
  • provider
  • model_id
  • contract_yaml
  • invariants
  • tool_schema
  • sample_count
  • customer_invariants
  • passing_capture_id

Baseline​

Reference and trust object used for comparisons over time.

Important fields:

  • baseline_key
  • state
  • success_count
  • promoted_at
  • stale_at
  • retired_at
  • promotion_corpus_manifest_hash
  • provider
  • model_id

States:

  • CANDIDATE
  • ACTIVE
  • STALE
  • RETIRED

What is not a durable model​

The Phase 7 Studio workbench is built from read models, not new authority tables.

Examples:

  • Atlas
  • Control
  • Focus
  • approval preview
  • impact preview
  • conformance findings

These are read-only projections assembled by the Studio query layer and the workbench loader. They sit on top of the durable objects above. They are not a separate truth store.

That distinction matters:

  • durable rows hold authority, lineage, approvals, and runtime state
  • workbench views are projections over those rows

Minimal relationship map​

flowchart TD
  Workspace["GovernanceWorkspace"] --> Draft["BusinessDraft"]
  Workspace --> Source["BusinessSource"]
  Workspace --> Evidence["EvidenceEntry"]
  Draft --> Snapshot["BusinessDraftSnapshot"]
  Draft --> Command["BusinessCommand"]
  Snapshot --> Approval["GovernanceApproval"]
  Approval --> Artifact["CompiledGovernanceArtifact"]
  Approval --> Receipt["ApprovalRuntimeReceipt"]
  Approval --> Drift["DriftItem"]

  Plan["GovernancePlan"] --> PlanArtifact["compiled_session / compiled_hash"]

  ReplaySession["ReplaySession"] --> Prepared["ReplayPreparedRequest"]
  ReplaySession --> Pending["ReplayPendingCall"]
  Pending --> ExecReceipt["ReplayExecutionReceipt"]
  ReplaySession --> SessionSnapshot["ReplaySessionSnapshot"]
  ReplaySession --> ReplayWorkflow["ReplayWorkflow"]

  Run["Run"] --> Step["Step"]
  Captured["CapturedCall"] --> Inferred["InferredContract"]
  Run --> Baseline["Baseline"]

Why this matters​

Use this page to answer:

  • where does Studio approval live?
  • where does zero-config runtime attachment read from?
  • where does governed runtime state live?
  • what is a durable row versus a workbench projection?
  • what object is the reference system built on?

If you need field-level detail, go to the schema directly. This page is for orientation.