<mxfile host="app.diagrams.net" agent="architecture-diagram" version="24.0.0">
  <diagram name="Certificate Lifecycle Service — Core Data Model" id="11-data-model">
    <mxGraphModel dx="1400" dy="900" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="1660" pageHeight="940" math="0" shadow="0">
      <root>
        <mxCell id="0" />
        <mxCell id="1" parent="0" />
        <mxCell id="n.tenant" value="&lt;b&gt;tenant&lt;/b&gt;&lt;br&gt;&lt;font style=&quot;font-size:10px;color:#5b6b7d&quot;&gt;tenant_id  PK&lt;br&gt;name&lt;br&gt;status&lt;/font&gt;" style="rounded=1;arcSize=4;whiteSpace=wrap;html=1;fillColor=#d5e8d4;strokeColor=#82b366;fontColor=#1e3a1e;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;align=left;spacingLeft=12;spacingTop=7;spacingRight=10;" vertex="1" parent="1">
          <mxGeometry x="40" y="80" width="330" height="90" as="geometry" />
        </mxCell>
        <mxCell id="n.domain" value="&lt;b&gt;domain_ownership&lt;/b&gt;&lt;br&gt;&lt;font style=&quot;font-size:10px;color:#5b6b7d&quot;&gt;domain  PK&lt;br&gt;tenant_id  FK&lt;br&gt;method  dns-01 | http-01&lt;br&gt;proven_at&lt;br&gt;reprove_due&lt;/font&gt;" style="rounded=1;arcSize=4;whiteSpace=wrap;html=1;fillColor=#d5e8d4;strokeColor=#82b366;fontColor=#1e3a1e;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;align=left;spacingLeft=12;spacingTop=7;spacingRight=10;" vertex="1" parent="1">
          <mxGeometry x="460" y="80" width="330" height="120" as="geometry" />
        </mxCell>
        <mxCell id="n.profile" value="&lt;b&gt;issuance_profile&lt;/b&gt;&lt;br&gt;&lt;font style=&quot;font-size:10px;color:#5b6b7d&quot;&gt;profile_id  PK&lt;br&gt;key_alg&lt;br&gt;max_lifetime&lt;br&gt;eku&lt;br&gt;name_constraints&lt;/font&gt;" style="rounded=1;arcSize=4;whiteSpace=wrap;html=1;fillColor=#d5e8d4;strokeColor=#82b366;fontColor=#1e3a1e;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;align=left;spacingLeft=12;spacingTop=7;spacingRight=10;" vertex="1" parent="1">
          <mxGeometry x="870" y="80" width="330" height="120" as="geometry" />
        </mxCell>
        <mxCell id="n.identity" value="&lt;b&gt;managed_identity&lt;/b&gt;&lt;br&gt;&lt;font style=&quot;font-size:10px;color:#5b6b7d&quot;&gt;identity_id  PK&lt;br&gt;trust_domain&lt;br&gt;subject / SAN&lt;br&gt;owner_team&lt;br&gt;class&lt;/font&gt;" style="rounded=1;arcSize=4;whiteSpace=wrap;html=1;fillColor=#d5e8d4;strokeColor=#82b366;fontColor=#1e3a1e;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;align=left;spacingLeft=12;spacingTop=7;spacingRight=10;" vertex="1" parent="1">
          <mxGeometry x="1290" y="80" width="330" height="120" as="geometry" />
        </mxCell>
        <mxCell id="n.authority" value="&lt;b&gt;ca_authority&lt;/b&gt;&lt;br&gt;&lt;font style=&quot;font-size:10px;color:#5b6b7d&quot;&gt;authority_id  PK&lt;br&gt;tier  root | issuing&lt;br&gt;not_after&lt;br&gt;hsm_ref&lt;br&gt;status&lt;/font&gt;" style="rounded=1;arcSize=4;whiteSpace=wrap;html=1;fillColor=#d5e8d4;strokeColor=#82b366;fontColor=#1e3a1e;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;align=left;spacingLeft=12;spacingTop=7;spacingRight=10;" vertex="1" parent="1">
          <mxGeometry x="40" y="340" width="330" height="120" as="geometry" />
        </mxCell>
        <mxCell id="n.cert" value="&lt;b&gt;certificate&lt;/b&gt;&lt;br&gt;&lt;font style=&quot;font-size:10px;color:#5b6b7d&quot;&gt;issuer + serial  PK&lt;br&gt;identity_id  FK&lt;br&gt;authority_id  FK&lt;br&gt;profile_id  FK&lt;br&gt;not_before / not_after&lt;br&gt;state&lt;/font&gt;" style="rounded=1;arcSize=4;whiteSpace=wrap;html=1;fillColor=#d5e8d4;strokeColor=#82b366;fontColor=#1e3a1e;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;align=left;spacingLeft=12;spacingTop=7;spacingRight=10;" vertex="1" parent="1">
          <mxGeometry x="460" y="340" width="330" height="130" as="geometry" />
        </mxCell>
        <mxCell id="n.endpoint" value="&lt;b&gt;endpoint&lt;/b&gt;&lt;br&gt;&lt;font style=&quot;font-size:10px;color:#5b6b7d&quot;&gt;endpoint_id  PK&lt;br&gt;identity_id  FK&lt;br&gt;address&lt;br&gt;probeable  bool&lt;/font&gt;" style="rounded=1;arcSize=4;whiteSpace=wrap;html=1;fillColor=#d5e8d4;strokeColor=#82b366;fontColor=#1e3a1e;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;align=left;spacingLeft=12;spacingTop=7;spacingRight=10;" vertex="1" parent="1">
          <mxGeometry x="1290" y="340" width="330" height="100" as="geometry" />
        </mxCell>
        <mxCell id="n.bundle" value="&lt;b&gt;trust_bundle&lt;/b&gt;&lt;br&gt;&lt;font style=&quot;font-size:10px;color:#5b6b7d&quot;&gt;bundle_id  PK&lt;br&gt;version&lt;br&gt;authority_ids&lt;br&gt;signed_at&lt;/font&gt;" style="rounded=1;arcSize=4;whiteSpace=wrap;html=1;fillColor=#d5e8d4;strokeColor=#82b366;fontColor=#1e3a1e;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;align=left;spacingLeft=12;spacingTop=7;spacingRight=10;" vertex="1" parent="1">
          <mxGeometry x="870" y="340" width="330" height="100" as="geometry" />
        </mxCell>
        <mxCell id="n.revocation" value="&lt;b&gt;revocation&lt;/b&gt;&lt;br&gt;&lt;font style=&quot;font-size:10px;color:#5b6b7d&quot;&gt;issuer + serial  PK/FK&lt;br&gt;reason_code&lt;br&gt;actor&lt;br&gt;revoked_at&lt;br&gt;published_at&lt;/font&gt;" style="rounded=1;arcSize=4;whiteSpace=wrap;html=1;fillColor=#d5e8d4;strokeColor=#82b366;fontColor=#1e3a1e;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;align=left;spacingLeft=12;spacingTop=7;spacingRight=10;" vertex="1" parent="1">
          <mxGeometry x="40" y="600" width="330" height="120" as="geometry" />
        </mxCell>
        <mxCell id="n.issuance" value="&lt;b&gt;issuance_event&lt;/b&gt;&lt;br&gt;&lt;font style=&quot;font-size:10px;color:#5b6b7d&quot;&gt;event_id  PK&lt;br&gt;issuer + serial  FK&lt;br&gt;requested_by&lt;br&gt;policy_ref&lt;br&gt;occurred_at&lt;/font&gt;" style="rounded=1;arcSize=4;whiteSpace=wrap;html=1;fillColor=#d5e8d4;strokeColor=#82b366;fontColor=#1e3a1e;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;align=left;spacingLeft=12;spacingTop=7;spacingRight=10;" vertex="1" parent="1">
          <mxGeometry x="460" y="600" width="330" height="120" as="geometry" />
        </mxCell>
        <mxCell id="n.report" value="&lt;b&gt;bundle_report&lt;/b&gt;&lt;br&gt;&lt;font style=&quot;font-size:10px;color:#5b6b7d&quot;&gt;report_id  PK&lt;br&gt;bundle_id  FK&lt;br&gt;relying_party&lt;br&gt;reported_at&lt;/font&gt;" style="rounded=1;arcSize=4;whiteSpace=wrap;html=1;fillColor=#d5e8d4;strokeColor=#82b366;fontColor=#1e3a1e;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;align=left;spacingLeft=12;spacingTop=7;spacingRight=10;" vertex="1" parent="1">
          <mxGeometry x="870" y="600" width="330" height="100" as="geometry" />
        </mxCell>
        <mxCell id="n.obs" value="&lt;b&gt;observation&lt;/b&gt;&lt;br&gt;&lt;font style=&quot;font-size:10px;color:#5b6b7d&quot;&gt;observation_id  PK&lt;br&gt;endpoint_id  FK&lt;br&gt;observed_serial  FK&lt;br&gt;chain_ok&lt;br&gt;observed_at&lt;/font&gt;" style="rounded=1;arcSize=4;whiteSpace=wrap;html=1;fillColor=#d5e8d4;strokeColor=#82b366;fontColor=#1e3a1e;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;align=left;spacingLeft=12;spacingTop=7;spacingRight=10;" vertex="1" parent="1">
          <mxGeometry x="1290" y="600" width="330" height="120" as="geometry" />
        </mxCell>
        <mxCell id="_r1" value="1 : N" style="edgeStyle=orthogonalEdgeStyle;rounded=1;html=1;endArrow=ERmany;endFill=0;startArrow=ERone;startFill=0;strokeWidth=1.4;strokeColor=#5a6570;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;exitX=1;exitY=0.5;exitDx=0;exitDy=0;entryX=0;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.tenant" target="n.domain">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="_r2" value="1 : N" style="edgeStyle=orthogonalEdgeStyle;rounded=1;html=1;endArrow=ERmany;endFill=0;startArrow=ERone;startFill=0;strokeWidth=1.4;strokeColor=#5a6570;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;exitX=0.5;exitY=1;exitDx=0;exitDy=0;entryX=0.5;entryY=0;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.domain" target="n.cert">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="_r3" value="1 : N" style="edgeStyle=orthogonalEdgeStyle;rounded=1;html=1;endArrow=ERmany;endFill=0;startArrow=ERone;startFill=0;strokeWidth=1.4;strokeColor=#5a6570;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;exitX=0.25;exitY=1;exitDx=0;exitDy=0;entryX=0.75;entryY=0;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.profile" target="n.cert">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="_r4" value="1 : N" style="edgeStyle=orthogonalEdgeStyle;rounded=1;html=1;endArrow=ERmany;endFill=0;startArrow=ERone;startFill=0;strokeWidth=1.4;strokeColor=#5a6570;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;exitX=1;exitY=0.5;exitDx=0;exitDy=0;entryX=0;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.authority" target="n.cert">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="_r5" value="1 : N" style="edgeStyle=orthogonalEdgeStyle;rounded=1;html=1;endArrow=ERmany;endFill=0;startArrow=ERone;startFill=0;strokeWidth=1.4;strokeColor=#5a6570;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;exitX=0.5;exitY=1;exitDx=0;exitDy=0;entryX=0.5;entryY=0;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.identity" target="n.endpoint">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="_r6" value="1 : N" style="edgeStyle=orthogonalEdgeStyle;rounded=1;html=1;endArrow=ERmany;endFill=0;startArrow=ERone;startFill=0;strokeWidth=1.4;strokeColor=#5a6570;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;exitX=0.5;exitY=1;exitDx=0;exitDy=0;entryX=0.5;entryY=0;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.cert" target="n.issuance">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="_r7" value="1 : 0..1" style="edgeStyle=orthogonalEdgeStyle;rounded=1;html=1;endArrow=ERmany;endFill=0;startArrow=ERone;startFill=0;strokeWidth=1.4;strokeColor=#8c8c8c;dashed=1;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;exitX=0.25;exitY=1;exitDx=0;exitDy=0;entryX=0.5;entryY=0;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.cert" target="n.revocation">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="_r8" value="1 : N" style="edgeStyle=orthogonalEdgeStyle;rounded=1;html=1;endArrow=ERmany;endFill=0;startArrow=ERone;startFill=0;strokeWidth=1.4;strokeColor=#5a6570;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;exitX=0.5;exitY=1;exitDx=0;exitDy=0;entryX=0.5;entryY=0;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.endpoint" target="n.obs">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="_r9" value="1 : N" style="edgeStyle=orthogonalEdgeStyle;rounded=1;html=1;endArrow=ERmany;endFill=0;startArrow=ERone;startFill=0;strokeWidth=1.4;strokeColor=#5a6570;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;exitX=0.5;exitY=1;exitDx=0;exitDy=0;entryX=0.5;entryY=0;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.bundle" target="n.report">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="title" value="Certificate Lifecycle Service — Core Data Model" style="text;html=1;strokeColor=none;fillColor=none;align=left;verticalAlign=middle;whiteSpace=wrap;fontSize=20;fontStyle=1;fontColor=#16202c;fontFamily=Segoe UI;" vertex="1" parent="1">
          <mxGeometry x="40" y="20" width="1570" height="30" as="geometry" />
        </mxCell>
        <mxCell id="rule" value="" style="line;strokeWidth=1;html=1;strokeColor=#c9d3de;" vertex="1" parent="1">
          <mxGeometry x="40" y="50" width="1570" height="10" as="geometry" />
        </mxCell>
        <mxCell id="note" value="observation.observed_serial is the foreign key that carries the architecture: a certificate reaches SERVING only because an observation points at it, and an observation whose serial resolves to nothing is an unmanaged certificate." style="text;html=1;strokeColor=none;fillColor=none;align=left;verticalAlign=middle;whiteSpace=wrap;fontSize=10;fontColor=#8a97a5;fontFamily=Segoe UI;" vertex="1" parent="1">
          <mxGeometry x="40" y="870" width="1570" height="20" as="geometry" />
        </mxCell>
        <mxCell id="foot-rule" value="" style="line;strokeWidth=1;html=1;strokeColor=#e3e9ef;" vertex="1" parent="1">
          <mxGeometry x="40" y="890" width="1570" height="10" as="geometry" />
        </mxCell>
        <mxCell id="foot" value="v 1.0   ·   owner Data Architecture   ·   date 2026-09" style="text;html=1;strokeColor=none;fillColor=none;align=left;verticalAlign=middle;whiteSpace=wrap;fontSize=9;fontColor=#9aa7b4;fontFamily=Segoe UI;" vertex="1" parent="1">
          <mxGeometry x="40" y="910" width="1570" height="10" as="geometry" />
        </mxCell>
      </root>
    </mxGraphModel>
  </diagram>
</mxfile>
