Cloud Development Environment Platform  ·  View 12 of 21  ·  Data

Control-Plane Data Model

Eleven entities, and the one relationship the model refuses to have.

Editable source SVG draw.io All views
tenant tenant_id PK region (residency pin) egress_posture idle_timeout_s spend_ceiling repository_binding binding_id PK tenant_id FK forge_repo scopes_granted environment_definition definition_rev PK binding_id FK image_digest lockfile_hash machine_class prebuild prebuild_id PK definition_rev FK commit artefact_digest valid bool principal principal_id PK tenant_id FK class human | agent seat_state concurrency_limit workspace workspace_id PK binding_id FK definition_rev FK state last_resume_at incarnation incarnation_id PK workspace_id FK host_id FK started_at ended_reason snapshot snapshot_id PK workspace_id FK content_digest has_memory bool bytes audit_event event_id PK actor_principal FK workspace_id action reason (immutable) session session_id PK incarnation_id FK principal_id FK attached_by diff_ref host host_id PK rack · region kernel_version state live | draining oversub_ratio 1 : N 1 : N 1 : N 1 : N 1 : N 1 : N 1 : N 1 : N 1 : N 1 : N 1 : N Control-Plane Data Model A workspace has many incarnations and many snapshots, and no host: the host appears only on an incarnation. v 1.0 · owner Platform Architecture · date 2026-10

Decisions

  • A workspace has no host. The host appears only on an incarnation, which is the data-model expression of ADR-01: placement is an event in a workspace's life, not a property of it.
  • A snapshot belongs to the workspace and is written by an incarnation, keyed by content digest, so a workspace's history is a list of immutable versions rather than a mutable disk.
  • A prebuild's validity is a stored predicate over definition revision, image digest and lockfile hash — never an age (ADR-07).

Assumptions

  • Residency is an attribute of the tenant and is enforced on every placement, snapshot write and route.
  • Principal class (human or agent) is a first-class column because admission, egress posture and idle timeout all branch on it.

Risks

  • Session records hold an attached-by principal and a diff reference, which makes them the most privacy-sensitive table in the control plane.
  • An audit event references a workspace that may be deleted; the event is immutable and must stay readable after its subject is gone.
◀  Storage Zones by Ownership and Rebuildability All views Critical Flow — Resuming a Hibernated Workspace  ▶
Solution Architecture v1.0 · open source on raw/bare-metal compute · Platform Architecture · 2026-1012-control-plane-data-model