Appendix E — Architecture, API contracts and event schemas
This appendix delivers an engineering specification, not a production service or a Board interoperability standard. The complete ARCH-001 topology includes a canonical text diagram, trust boundaries, interfaces, flow decisions and release conditions. Text diagrams remain editable and readable without a rendering engine. Reader-format layout must preserve their alignment.
E.1 Inspect the boundaries before copying the arrows
| Boundary | Meaning in the supplied specification | Failure to preserve |
|---|---|---|
| B0 → B1 | Untrusted clients to Company-controlled service and policy enforcement | A caller supplies its own trusted purpose |
| B2 | Processor/outbox boundary, including ENT-004 | A local queue success becomes invented supplier completion |
| B3 | Foreign backup and analytics destinations | A region label bypasses the actual flow/sector/order decision |
| B4 | SYS-014 restore quarantine | A pre-withdrawal snapshot reaches production before current replay |
| B5 | Privileged operators and case-bound access | Direct-store credentials bypass the ordinary service gate |
An X on an arrow blocks new dispatch; it does not claim old bytes disappeared. Transfer decisions preserve conditional, blocked and unknown paths. Security decisions state what a deployment would still need to prove.
E.2 Proposed interface contracts
These are logical contracts, not published endpoint names. An implementer must choose transport, persistence, authentication and concurrency semantics and then test them. The supplied JSON examples are instances of a teaching design, not a claim that every field is prescribed by law.
| Interface | Required proposed input | Output / rejection semantics |
|---|---|---|
| Authority decision | operation, flow, subject, actor/workload, tenant, dataset/action, purpose, authority reference/sequence, policy version | allow only for the authenticated current scope; otherwise deny or review; record reason and version |
| Consent / withdrawal event | scene and purpose-specific operation identity, notice version/hash, actor, subject, action, occurrence and receipt times | duplicate is not a fresh grant; stale or conflicting history cannot reopen authority |
| Processor command / callback | stable operation identity, target, requested action, scope, authenticated provenance, attempt and observed result | timeout remains unknown; callback must match scope; local completion cannot stand for remote execution |
| Rights work item | parent case, subject, actor, verified authority, component, system, decision and execution state | preserve mixed outcomes and separate response delivery |
| Restore admission | snapshot, target, current captured history frontier and replay decisions | quarantine missing/conflicting history; eligible erasure remains irreversible in the model |
E.3 Actual payloads and runnable subset
Open consent-events.json for the two grants and stale replay; rights-case.json for subject/actor separation; and retention-decisions.json for target states. The Consent Manager adapter specimen supplies an authenticated-integration design with synthetic registration status. It does not establish a universal onboarding protocol or actual registered intermediary.
The local model, restore model and test manifest exercise selected trusted-input decisions. They do not implement cryptographic identity, durable outbox atomicity, production middleware or physical supplier deletion. API/event-schema delivery is therefore explicitly scoped to these populated contracts and examples, not an OpenAPI server or deployable SDK. This preserves the original useful interface promise without pretending that an unbuilt distributed service exists.
E.4 Architecture review exercise
Give a reviewer the topology and ask them to locate every path that can read DS-001 without the public application. Add an offline batch, a support console and a restored backup. For each, identify a real enforcement owner, the authority source, failure behavior and evidence. A gateway-only test cannot clear all three. Then make the policy ledger unavailable: preserve authorised reconciliation where properly scoped, but do not create a fresh grant or promote a stale snapshot to hide an outage.