<mxfile host="app.diagrams.net" agent="architecture-diagram" version="24.0.0">
  <diagram name="Evidence Data Model" id="11-evidence-data-model">
    <mxGraphModel dx="1400" dy="900" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="1680" pageHeight="1160" math="0" shadow="0">
      <root>
        <mxCell id="0" />
        <mxCell id="1" parent="0" />
        <mxCell id="n.m-repo" value="&lt;b&gt;repository&lt;/b&gt;&lt;br&gt;&lt;font style=&quot;font-size:10px;color:#5b6b7d&quot;&gt;repository_id  PK&lt;br&gt;project  FK -&gt; tenant&lt;br&gt;class  release|dev&lt;br&gt;quota_bytes&lt;br&gt;immutable_tags&lt;/font&gt;" style="rounded=1;arcSize=4;whiteSpace=wrap;html=1;fillColor=#d5e8d4;strokeColor=#82b366;fontColor=#1e3a1e;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;align=left;spacingLeft=12;spacingTop=7;spacingRight=10;" vertex="1" parent="1">
          <mxGeometry x="40" y="80" width="330" height="120" as="geometry" />
        </mxCell>
        <mxCell id="n.m-art" value="&lt;b&gt;artifact&lt;/b&gt;&lt;br&gt;&lt;font style=&quot;font-size:10px;color:#5b6b7d&quot;&gt;digest  PK  sha256&lt;br&gt;repository_id  FK&lt;br&gt;media_type&lt;br&gt;size_bytes&lt;br&gt;first_pushed_at&lt;/font&gt;" style="rounded=1;arcSize=4;whiteSpace=wrap;html=1;fillColor=#d5e8d4;strokeColor=#82b366;fontColor=#1e3a1e;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;align=left;spacingLeft=12;spacingTop=7;spacingRight=10;" vertex="1" parent="1">
          <mxGeometry x="460" y="80" width="330" height="120" as="geometry" />
        </mxCell>
        <mxCell id="n.m-att" value="&lt;b&gt;attestation&lt;/b&gt;&lt;br&gt;&lt;font style=&quot;font-size:10px;color:#5b6b7d&quot;&gt;attestation_id  PK&lt;br&gt;subject_digest  FK&lt;br&gt;predicate_type&lt;br&gt;generator&lt;br&gt;superseded_by&lt;/font&gt;" style="rounded=1;arcSize=4;whiteSpace=wrap;html=1;fillColor=#d5e8d4;strokeColor=#82b366;fontColor=#1e3a1e;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;align=left;spacingLeft=12;spacingTop=7;spacingRight=10;" vertex="1" parent="1">
          <mxGeometry x="880" y="80" width="330" height="120" as="geometry" />
        </mxCell>
        <mxCell id="n.m-sig" value="&lt;b&gt;signature&lt;/b&gt;&lt;br&gt;&lt;font style=&quot;font-size:10px;color:#5b6b7d&quot;&gt;signature_id  PK&lt;br&gt;attestation_id  FK&lt;br&gt;signer_identity&lt;br&gt;issuer&lt;br&gt;cert_not_after&lt;/font&gt;" style="rounded=1;arcSize=4;whiteSpace=wrap;html=1;fillColor=#d5e8d4;strokeColor=#82b366;fontColor=#1e3a1e;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;align=left;spacingLeft=12;spacingTop=7;spacingRight=10;" vertex="1" parent="1">
          <mxGeometry x="1300" y="80" width="330" height="120" as="geometry" />
        </mxCell>
        <mxCell id="n.m-tag" value="&lt;b&gt;tag_history&lt;/b&gt;&lt;br&gt;&lt;font style=&quot;font-size:10px;color:#5b6b7d&quot;&gt;tag_event_id  PK&lt;br&gt;repository_id  FK&lt;br&gt;tag&lt;br&gt;digest  FK&lt;br&gt;actor&lt;br&gt;occurred_at&lt;/font&gt;" style="rounded=1;arcSize=4;whiteSpace=wrap;html=1;fillColor=#d5e8d4;strokeColor=#82b366;fontColor=#1e3a1e;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;align=left;spacingLeft=12;spacingTop=7;spacingRight=10;" vertex="1" parent="1">
          <mxGeometry x="40" y="330" width="330" height="130" as="geometry" />
        </mxCell>
        <mxCell id="n.m-comp" value="&lt;b&gt;sbom_component&lt;/b&gt;&lt;br&gt;&lt;font style=&quot;font-size:10px;color:#5b6b7d&quot;&gt;component_id  PK&lt;br&gt;subject_digest  FK&lt;br&gt;purl&lt;br&gt;version&lt;br&gt;licence&lt;br&gt;layer_digest&lt;/font&gt;" style="rounded=1;arcSize=4;whiteSpace=wrap;html=1;fillColor=#d5e8d4;strokeColor=#82b366;fontColor=#1e3a1e;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;align=left;spacingLeft=12;spacingTop=7;spacingRight=10;" vertex="1" parent="1">
          <mxGeometry x="460" y="330" width="330" height="130" as="geometry" />
        </mxCell>
        <mxCell id="n.m-pro" value="&lt;b&gt;promotion&lt;/b&gt;&lt;br&gt;&lt;font style=&quot;font-size:10px;color:#5b6b7d&quot;&gt;promotion_id  PK&lt;br&gt;attestation_id  FK&lt;br&gt;from_env&lt;br&gt;to_env&lt;br&gt;approver&lt;br&gt;bundle_version&lt;/font&gt;" style="rounded=1;arcSize=4;whiteSpace=wrap;html=1;fillColor=#d5e8d4;strokeColor=#82b366;fontColor=#1e3a1e;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;align=left;spacingLeft=12;spacingTop=7;spacingRight=10;" vertex="1" parent="1">
          <mxGeometry x="880" y="330" width="330" height="130" as="geometry" />
        </mxCell>
        <mxCell id="n.m-inc" value="&lt;b&gt;inclusion_proof&lt;/b&gt;&lt;br&gt;&lt;font style=&quot;font-size:10px;color:#5b6b7d&quot;&gt;proof_id  PK&lt;br&gt;signature_id  FK&lt;br&gt;log_index&lt;br&gt;tree_size&lt;br&gt;signed_entry_ts&lt;/font&gt;" style="rounded=1;arcSize=4;whiteSpace=wrap;html=1;fillColor=#d5e8d4;strokeColor=#82b366;fontColor=#1e3a1e;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;align=left;spacingLeft=12;spacingTop=7;spacingRight=10;" vertex="1" parent="1">
          <mxGeometry x="1300" y="330" width="330" height="120" as="geometry" />
        </mxCell>
        <mxCell id="n.m-find" value="&lt;b&gt;finding&lt;/b&gt;&lt;br&gt;&lt;font style=&quot;font-size:10px;color:#5b6b7d&quot;&gt;finding_id  PK&lt;br&gt;subject_digest  FK&lt;br&gt;component_id  FK&lt;br&gt;advisory_id  FK&lt;br&gt;severity&lt;br&gt;state&lt;br&gt;first_observed_at&lt;/font&gt;" style="rounded=1;arcSize=4;whiteSpace=wrap;html=1;fillColor=#d5e8d4;strokeColor=#82b366;fontColor=#1e3a1e;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;align=left;spacingLeft=12;spacingTop=7;spacingRight=10;" vertex="1" parent="1">
          <mxGeometry x="460" y="580" width="330" height="150" as="geometry" />
        </mxCell>
        <mxCell id="n.m-adv" value="&lt;b&gt;advisory&lt;/b&gt;&lt;br&gt;&lt;font style=&quot;font-size:10px;color:#5b6b7d&quot;&gt;advisory_id  PK  CVE|GHSA&lt;br&gt;feed_agreement&lt;br&gt;severity_osv&lt;br&gt;severity_distro&lt;br&gt;amended_at&lt;/font&gt;" style="rounded=1;arcSize=4;whiteSpace=wrap;html=1;fillColor=#d5e8d4;strokeColor=#82b366;fontColor=#1e3a1e;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;align=left;spacingLeft=12;spacingTop=7;spacingRight=10;" vertex="1" parent="1">
          <mxGeometry x="880" y="580" width="330" height="120" as="geometry" />
        </mxCell>
        <mxCell id="n.m-bun" value="&lt;b&gt;policy_bundle&lt;/b&gt;&lt;br&gt;&lt;font style=&quot;font-size:10px;color:#5b6b7d&quot;&gt;bundle_version  PK&lt;br&gt;environment&lt;br&gt;rego_digest&lt;br&gt;signed_by&lt;br&gt;effective_from&lt;/font&gt;" style="rounded=1;arcSize=4;whiteSpace=wrap;html=1;fillColor=#d5e8d4;strokeColor=#82b366;fontColor=#1e3a1e;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;align=left;spacingLeft=12;spacingTop=7;spacingRight=10;" vertex="1" parent="1">
          <mxGeometry x="1300" y="580" width="330" height="120" as="geometry" />
        </mxCell>
        <mxCell id="n.m-sup" value="&lt;b&gt;suppression&lt;/b&gt;&lt;br&gt;&lt;font style=&quot;font-size:10px;color:#5b6b7d&quot;&gt;suppression_id  PK&lt;br&gt;finding_id  FK&lt;br&gt;justification&lt;br&gt;approver&lt;br&gt;expires_at  NOT NULL&lt;/font&gt;" style="rounded=1;arcSize=4;whiteSpace=wrap;html=1;fillColor=#d5e8d4;strokeColor=#82b366;fontColor=#1e3a1e;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;align=left;spacingLeft=12;spacingTop=7;spacingRight=10;" vertex="1" parent="1">
          <mxGeometry x="460" y="830" width="330" height="120" as="geometry" />
        </mxCell>
        <mxCell id="n.m-exc" value="&lt;b&gt;exception&lt;/b&gt;&lt;br&gt;&lt;font style=&quot;font-size:10px;color:#5b6b7d&quot;&gt;exception_id  PK&lt;br&gt;scope&lt;br&gt;owner&lt;br&gt;justification&lt;br&gt;expires_at  NOT NULL&lt;/font&gt;" style="rounded=1;arcSize=4;whiteSpace=wrap;html=1;fillColor=#d5e8d4;strokeColor=#82b366;fontColor=#1e3a1e;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;align=left;spacingLeft=12;spacingTop=7;spacingRight=10;" vertex="1" parent="1">
          <mxGeometry x="880" y="830" width="330" height="120" as="geometry" />
        </mxCell>
        <mxCell id="n.m-dec" value="&lt;b&gt;admission_decision&lt;/b&gt;&lt;br&gt;&lt;font style=&quot;font-size:10px;color:#5b6b7d&quot;&gt;decision_id  PK&lt;br&gt;subject_digest&lt;br&gt;bundle_version  FK&lt;br&gt;verdict&lt;br&gt;reason_codes&lt;br&gt;evidence_digests&lt;/font&gt;" style="rounded=1;arcSize=4;whiteSpace=wrap;html=1;fillColor=#d5e8d4;strokeColor=#82b366;fontColor=#1e3a1e;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;align=left;spacingLeft=12;spacingTop=7;spacingRight=10;" vertex="1" parent="1">
          <mxGeometry x="1300" y="830" width="330" height="130" as="geometry" />
        </mxCell>
        <mxCell id="_r1" value="1 : N" style="edgeStyle=orthogonalEdgeStyle;rounded=1;html=1;endArrow=ERmany;endFill=0;startArrow=ERone;startFill=0;strokeWidth=1.4;strokeColor=#5a6570;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;exitX=1;exitY=0.5;exitDx=0;exitDy=0;entryX=0;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.m-repo" target="n.m-art">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="_r2" value="1 : N" style="edgeStyle=orthogonalEdgeStyle;rounded=1;html=1;endArrow=ERmany;endFill=0;startArrow=ERone;startFill=0;strokeWidth=1.4;strokeColor=#5a6570;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;exitX=0.5;exitY=1;exitDx=0;exitDy=0;entryX=0.25;entryY=0;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.m-repo" target="n.m-tag">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="_r3" value="N : 1" style="edgeStyle=orthogonalEdgeStyle;rounded=1;html=1;endArrow=ERmany;endFill=0;startArrow=ERone;startFill=0;strokeWidth=1.4;strokeColor=#5a6570;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;exitX=0.25;exitY=1;exitDx=0;exitDy=0;entryX=0.75;entryY=0;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.m-art" target="n.m-tag">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="_r4" value="1 : N" style="edgeStyle=orthogonalEdgeStyle;rounded=1;html=1;endArrow=ERmany;endFill=0;startArrow=ERone;startFill=0;strokeWidth=1.4;strokeColor=#5a6570;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;exitX=1;exitY=0.5;exitDx=0;exitDy=0;entryX=0;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.m-art" target="n.m-att">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="_r5" value="1 : 1" style="edgeStyle=orthogonalEdgeStyle;rounded=1;html=1;endArrow=ERmany;endFill=0;startArrow=ERone;startFill=0;strokeWidth=1.4;strokeColor=#5a6570;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;exitX=1;exitY=0.5;exitDx=0;exitDy=0;entryX=0;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.m-att" target="n.m-sig">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="_r6" value="1 : 1" style="edgeStyle=orthogonalEdgeStyle;rounded=1;html=1;endArrow=ERmany;endFill=0;startArrow=ERone;startFill=0;strokeWidth=1.4;strokeColor=#5a6570;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;exitX=0.5;exitY=1;exitDx=0;exitDy=0;entryX=0.5;entryY=0;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.m-sig" target="n.m-inc">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="_r7" value="subtype" style="edgeStyle=orthogonalEdgeStyle;rounded=1;html=1;endArrow=ERmany;endFill=0;startArrow=ERone;startFill=0;strokeWidth=1.4;strokeColor=#5a6570;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;exitX=0.5;exitY=1;exitDx=0;exitDy=0;entryX=0.5;entryY=0;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.m-att" target="n.m-pro">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="_r8" value="1 : N" style="edgeStyle=orthogonalEdgeStyle;rounded=1;html=1;endArrow=ERmany;endFill=0;startArrow=ERone;startFill=0;strokeWidth=1.4;strokeColor=#5a6570;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;exitX=0.75;exitY=1;exitDx=0;exitDy=0;entryX=0.5;entryY=0;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.m-art" target="n.m-comp">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="_r9" value="1 : N" style="edgeStyle=orthogonalEdgeStyle;rounded=1;html=1;endArrow=ERmany;endFill=0;startArrow=ERone;startFill=0;strokeWidth=1.4;strokeColor=#5a6570;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;exitX=0.5;exitY=1;exitDx=0;exitDy=0;entryX=0.5;entryY=0;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.m-comp" target="n.m-find">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="_r10" value="1 : N" style="edgeStyle=orthogonalEdgeStyle;rounded=1;html=1;endArrow=ERmany;endFill=0;startArrow=ERone;startFill=0;strokeWidth=1.4;strokeColor=#5a6570;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;exitX=0;exitY=0.5;exitDx=0;exitDy=0;entryX=1;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.m-adv" target="n.m-find">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="_r11" value="0 : N" style="edgeStyle=orthogonalEdgeStyle;rounded=1;html=1;endArrow=ERmany;endFill=0;startArrow=ERone;startFill=0;strokeWidth=1.4;strokeColor=#8c8c8c;dashed=1;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;exitX=0.5;exitY=1;exitDx=0;exitDy=0;entryX=0.5;entryY=0;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.m-find" target="n.m-sup">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="_r12" value="1 : N" style="edgeStyle=orthogonalEdgeStyle;rounded=1;html=1;endArrow=ERmany;endFill=0;startArrow=ERone;startFill=0;strokeWidth=1.4;strokeColor=#5a6570;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;exitX=0.75;exitY=1;exitDx=0;exitDy=0;entryX=0.5;entryY=0;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.m-bun" target="n.m-dec">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="_r13" value="1 : N" style="edgeStyle=orthogonalEdgeStyle;rounded=1;html=1;endArrow=ERmany;endFill=0;startArrow=ERone;startFill=0;strokeWidth=1.4;strokeColor=#5a6570;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;exitX=0.25;exitY=1;exitDx=0;exitDy=0;entryX=1;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.m-bun" target="n.m-exc">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="title" value="Evidence Data Model" style="text;html=1;strokeColor=none;fillColor=none;align=left;verticalAlign=middle;whiteSpace=wrap;fontSize=20;fontStyle=1;fontColor=#16202c;fontFamily=Segoe UI;" vertex="1" parent="1">
          <mxGeometry x="40" y="20" width="1590" height="30" as="geometry" />
        </mxCell>
        <mxCell id="rule" value="" style="line;strokeWidth=1;html=1;strokeColor=#c9d3de;" vertex="1" parent="1">
          <mxGeometry x="40" y="50" width="1590" height="10" as="geometry" />
        </mxCell>
        <mxCell id="note" value="expires_at is NOT NULL on both suppression and exception. A grant without an expiry cannot be written." style="text;html=1;strokeColor=none;fillColor=none;align=left;verticalAlign=middle;whiteSpace=wrap;fontSize=10;fontColor=#8a97a5;fontFamily=Segoe UI;" vertex="1" parent="1">
          <mxGeometry x="40" y="1090" width="1590" height="20" as="geometry" />
        </mxCell>
        <mxCell id="foot-rule" value="" style="line;strokeWidth=1;html=1;strokeColor=#e3e9ef;" vertex="1" parent="1">
          <mxGeometry x="40" y="1110" width="1590" height="10" as="geometry" />
        </mxCell>
        <mxCell id="foot" value="v 1.0   ·   owner Data Architecture   ·   date 2026-09" style="text;html=1;strokeColor=none;fillColor=none;align=left;verticalAlign=middle;whiteSpace=wrap;fontSize=9;fontColor=#9aa7b4;fontFamily=Segoe UI;" vertex="1" parent="1">
          <mxGeometry x="40" y="1130" width="1590" height="10" as="geometry" />
        </mxCell>
      </root>
    </mxGraphModel>
  </diagram>
</mxfile>
