Data & Event Platform — aggregate roots

Generated from the architecture model

This page is rendered from model/**/*.yaml by tools/docs_model during mkdocs build. Edit the YAML, not this page; hand-written design lives on the linked service, platform and plane pages.

Aggregate	Service	Root entity	Events	Tables
TopicDefinition	EnvelopeRegistryService	TopicDefinition	TopicRegistered, SchemaVersionPublished, TopicDeprecated	Topics, SchemaVersions, TopicConsumers
EnvelopeProfile	EnvelopeRegistryService	EnvelopeProfile	EnvelopeProfileActivated	EnvelopeProfiles
StoreProfile	StoreProfileService	StoreProfile	StoreProfileActivated	StoreProfiles
StoreBinding	StoreProfileService	StoreBinding	StoreBindingChanged	StoreBindings
RetentionRule	RetentionResidencyService	RetentionRule	RetentionRuleChanged	RetentionRules
ResidencyRule	RetentionResidencyService	ResidencyRule	ResidencyRuleChanged	ResidencyRules
GovernanceOrder	RetentionResidencyService	GovernanceOrder	DeletionOrderIssued, DeletionOrderCompleted, ExportCompleted, LegalHoldChanged	GovernanceOrders, GovernanceOrderTasks

TopicDefinition (EnvelopeRegistryService)

One integration topic: context (the producing bounded context slug), area, version, event name, producing service, registered consumers, the current payload schema version and the envelope profile; mirrors the architecture model and is the runtime truth for publish-time validation.

Field	Type	Required	Description
topic	string	yes	context.area.vN.event-name
context	string	yes
area	string	yes
version	int	yes
eventName	string	yes
producer	string	yes	Service id.
consumers	list:string	yes
currentSchemaVersion	string	yes
state	enum:TopicState	yes
registeredAt	datetime	yes

Invariants

• Exactly one producer per topic; the context segment equals the producer's bounded-context slug.
• A new schema version is Active only if it is backward compatible with the current one or every registered consumer has acknowledged the breaking version.
• Deprecated topics keep delivering for the deprecation window; Retired topics reject publication.

States (TopicState)

stateDiagram-v2
    Draft --> Active : Activate
    Active --> Deprecated : Deprecate
    Deprecated --> Retired : WindowElapsed

Hold "Alt" / "Option" to enable pan & zoom

Entities: SchemaVersion · Value objects: —

EnvelopeProfile (EnvelopeRegistryService)

How the port-level envelope (eventId, schemaVersion, occurredAt, tenantId, projectId, runId, stepId, attemptId, correlationId, causationId, producer, type; ADR-0014) is carried on each messaging profile: body fields, mirrored transport properties, outbox and inbox table contracts, deduplication window.

Field	Type	Required	Description
profile	enum:MessagingProfile	yes
envelopeSchemaVersion	string	yes
transportProperties	json	yes	Mirrored properties, e.g. cs-event-type, cs-tenant-id, cs-schema-version
outboxContract	json	yes	Outbox table columns and dispatcher semantics.
inboxContract	json	yes	Inbox table columns and deduplication window.
dedupWindowHours	int	yes
active	bool	yes

Invariants

• The envelope fields are identical across profiles; only their carriage differs.
• No profile promises exactly-once external effects or replay (ADR-0014); consumers deduplicate on eventId within the window.

StoreProfile (StoreProfileService)

One engine profile for one store class on one topology: engine, adapter library, migration convention, backup class (RPO, RTO), encryption, and whether it is authoritative or derived.

Field	Type	Required	Description
profileId	string	yes	e.g. nhibernate-sqlserver, vector-qdrant, azure-blob-immutable
storeClass	enum:StoreClass	yes
topology	string	yes
engine	string	yes
adapterLibrary	string	yes	Library id from the libraries catalog.
migrationConvention	string	yes	FluentMigrator per service schema; TenantId column by default
rpoMinutes	int	yes
rtoMinutes	int	yes
encryption	string	yes
authoritative	bool	yes	False for derived stores (vector, cache, projections).

Invariants

• A derived store (cache, vector, projection) is never the authoritative state of anything and must be rebuildable from an authoritative one.
• The pilot backup class (D30: RPO 15 min, RTO 4 h) is the minimum for authoritative stores; derived stores may be looser.

StoreBinding (StoreProfileService)

The binding of one logical store (the stores catalog id) to its owning service, profile, tenant-selected region, encryption key and state; the runtime truth of where data lives.

Field	Type	Required	Description
storeId	string	yes	Logical store id from the stores catalog.
tenantId	string	yes	Platform tenant for shared stores; a tenant id for per-tenant stores in the on-prem profile.
ownerService	string	yes
profileId	string	yes
region	string	yes	Tenant-selected region (D31): westeurope default, israelcentral available
keyReference	string	yes	Customer-managed key reference in the secret store.
state	enum:BindingState	yes
schemas	list:string	yes	Database schemas owned per service on a shared server.

Invariants

• Exactly one owning service per store; other services reach its data through that service's API or events, never the store (ownership rule).
• Two services may share a server but never a schema.
• A binding's region must satisfy the tenant's residency rule.

States (BindingState)

stateDiagram-v2
    Planned --> Provisioned : Provisioned
    Provisioned --> Active : MigrationsApplied
    Active --> Draining : DecommissionRequested
    Draining --> Decommissioned : DataMovedOrDeleted

Hold "Alt" / "Option" to enable pan & zoom

RetentionRule (RetentionResidencyService)

How long a store class keeps data of a classification for a scope (platform default, tenant override that may only shorten), and what happens at expiry (delete, redact, archive).

Field	Type	Required	Description
ruleId	guid	yes
tenantId	string	yes
storeClass	string	yes
classification	string	yes	public
retentionDays	int	yes
expiryAction	string	yes	delete
legalHoldExempt	bool	yes
active	bool	yes

Invariants

• Platform defaults (D31) are the ceiling; a tenant may shorten retention, never lengthen it beyond the platform rule for the class.
• Audit evidence is never deleted before 7 years and is redacted, not purged; legal holds suspend expiry for the held scope.

ResidencyRule (RetentionResidencyService)

The tenant's selected region and the engines and regions allowed for every store class; evaluated when a store is bound and when a model deployment or connector is selected.

Field	Type	Required	Description
tenantId	string	yes
region	string	yes
allowedRegions	list:string	yes
allowedEngines	json	yes	Per store class.
modelDataResidency	string	yes	same-region
changedAt	datetime	yes

Invariants

• Changing a tenant's region issues a migration order; data is never in two regions at once except during a tracked move.

GovernanceOrder (RetentionResidencyService)

A deletion, purge, export or legal-hold order for a scope, fanned out to every owning service as a task with an acknowledgement receipt; completes only when every owner acknowledged; overdue at 30 days (deletion) with an alert and audit evidence.

Field	Type	Required	Description
orderId	guid	yes
tenantId	string	yes
kind	enum:OrderKind	yes
scope	json	yes	tenant, project, run set or classification
issuedBy	string	yes
approvalId	guid	no	Tenant deletion is a production-class action with an approval.
state	enum:OrderState	yes
tasks	json	yes	Per owning service with state and receipt.
dueAt	datetime	yes
completedAt	datetime	no
exportRef	string	no	Artifact reference of an export bundle.

Invariants

• Deletion removes derived indexes and memory with the source (D31); the order is not complete until the vector, graph, cache and projection owners acknowledged.
• An export bundle is in open formats and includes a manifest of what was and was not exported (audit evidence stays redacted).

States (OrderState)

stateDiagram-v2
    Issued --> InProgress : TasksDispatched
    InProgress --> AwaitingAcknowledgements : AllTasksSent
    AwaitingAcknowledgements --> Completed : AllAcknowledged
    AwaitingAcknowledgements --> Overdue : DueElapsed
    Overdue --> Completed : AllAcknowledged
    Issued --> Cancelled : Cancel

Hold "Alt" / "Option" to enable pan & zoom