Data Model

Relational model optimized for auditability, immutability, and tenant isolation.

Core Entities

Tenants

• tenant_id (PK) - Unique tenant identifier
• name - Tenant name
• status - Tenant status (active, suspended, deleted)
• created_at - Creation timestamp
• metadata - JSON metadata

Products

• product_id (PK) - Unique product identifier
• name - Product name
• created_at - Creation timestamp
• metadata - JSON metadata

Releases

• release_id (PK) - Unique release identifier
• product_id (FK) - Product reference
• channel - Release channel (stable, beta, etc.)
• version - Version string
• published_at - Publication timestamp
• revoked_at - Revocation timestamp (nullable)
• status - Release status (ACTIVE, REVOKED)
• metadata - JSON metadata

Release Artifacts

• release_artifact_id (PK) - Unique artifact reference identifier
• release_id (FK) - Release reference
• artifact_id (FK) - Artifact reference
• platform - Platform (windows, linux, macos)
• arch - Architecture (x64, arm64, etc.)
• installer_type - Installer type (msi, msix, zip, etc.)
• requires_admin - Admin privileges required (boolean)

Artifact Storage

Artifacts

• artifact_id (PK) - Unique artifact identifier
• source_type - Source type (MANAGED, EXTERNAL)
• sha256 - SHA-256 checksum
• size_bytes - File size in bytes
• storage_path - Storage path (for MANAGED artifacts)
• external_url - External URL (for EXTERNAL artifacts)
• status - Verification status
• verified_at - Verification timestamp

Update Policy

Tenant Product Policies

• policy_id (PK) - Unique policy identifier
• tenant_id (FK) - Tenant reference
• product_id (FK) - Product reference
• channel - Channel name
• action - Update action (NONE, NOTIFY, DOWNLOAD, INSTALL)
• conditions - JSON conditions
• priority - Policy priority
• created_at - Creation timestamp
• updated_at - Update timestamp

Blocked Versions

• blocklist_id (PK) - Unique blocklist entry identifier
• tenant_id (FK) - Tenant reference
• product_id (FK) - Product reference
• blocked_version - Blocked version string
• reason - Block reason
• created_at - Creation timestamp

Rollouts

Channel Rollouts

• rollout_id (PK) - Unique rollout identifier
• product_id (FK) - Product reference
• channel - Channel name
• release_id (FK) - Release reference
• percentage - Rollout percentage (0-100)
• status - Rollout status (active, paused, completed, killed)
• created_at - Creation timestamp
• updated_at - Update timestamp

Licensing

Entitlements

• entitlement_id (PK) - Unique entitlement identifier
• tenant_id (FK) - Tenant reference
• product_id (FK) - Product reference
• policy_json - License policy JSON
• starts_at - Start timestamp
• ends_at - End timestamp (nullable)
• created_at - Creation timestamp
• updated_at - Update timestamp

License Leases

• lease_id (PK) - Unique lease identifier
• entitlement_id (FK) - Entitlement reference
• subject_type - Subject type (user, machine, device)
• subject_id - Subject identifier
• issued_at - Issue timestamp
• expires_at - Expiration timestamp
• token_hash - Token hash for verification

Seat Assignments

• seat_assignment_id (PK) - Unique seat assignment identifier
• entitlement_id (FK) - Entitlement reference
• subject_type - Subject type (user, machine, device)
• subject_id - Subject identifier
• assigned_at - Assignment timestamp
• assigned_by - Assigner identifier
• revoked_at - Revocation timestamp (nullable)
• revoked_by - Revoker identifier (nullable)

Note: Seat assignments are used when seat_assignment_mode: "explicit" is set in the entitlement policy. When seat_assignment_mode: "automatic" (default), seats are tracked automatically through active leases.

Snapshots & Mirrors

Snapshots

• snapshot_id (PK) - Unique snapshot identifier
• tenant_id (FK) - Tenant reference
• created_at - Creation timestamp
• signature - Cryptographic signature
• manifest - Snapshot manifest JSON

Mirror Instances

• mirror_id (PK) - Unique mirror identifier
• tenant_id (FK) - Tenant reference
• vendor_url - Vendor control plane URL
• credential_token - Mirror credential token (encrypted)
• allowed_channels - JSON array of allowed channels
• status - Mirror status (active, inactive, error)
• last_sync_at - Last sync timestamp
• last_snapshot_id - Last synced snapshot identifier
• created_at - Creation timestamp
• updated_at - Update timestamp

Audit

Audit Events

• event_id (PK) - Unique event identifier
• tenant_id (FK) - Tenant reference (nullable)
• actor_type - Actor type (user, service_account, system)
• actor_id - Actor identifier
• event_type - Event type
• payload - JSON event payload
• created_at - Event timestamp

Relationships

• Tenants → Products (one-to-many)
• Products → Releases (one-to-many)
• Releases → Release Artifacts (one-to-many)
• Artifacts → Release Artifacts (one-to-many)
• Tenants → Policies (one-to-many)
• Products → Policies (one-to-many)
• Tenants → Entitlements (one-to-many)
• Products → Entitlements (one-to-many)
• Entitlements → Leases (one-to-many)
• Entitlements → Seat Assignments (one-to-many)
• Tenants → Snapshots (one-to-many)
• Tenants → Mirrors (one-to-many)

Constraints

• Releases are append-only (cannot be modified, only revoked)
• Policies are versioned (history maintained)
• Entitlements cannot overlap for same tenant/product
• Seat assignments enforce max_seats limit when seat_assignment_mode: "explicit"
• Snapshots are immutable once created
• Audit events are append-only