{
  "schema_version": 1,
  "snapshot": {
    "fetchedAt": "2026-09-18",
    "workingTrees": "preserved; fetched refs only",
    "repositories": [
      {
        "repo": "frontend/web",
        "ref": "origin/dev-sunbeam",
        "sha": "a547227976ee10149ad3149dfe338b3ffde16ae1",
        "snapshot": "/tmp/aicom-atlas-sources-20260918/web",
        "role": "baseline"
      },
      {
        "repo": "frontend/mobile",
        "ref": "origin/main",
        "sha": "d9a7b9fb96187b5ad15ca9998c6a742199e07ddc",
        "snapshot": "/tmp/aicom-atlas-sources-20260918/mobile",
        "role": "baseline"
      },
      {
        "repo": "frontend/mobile",
        "ref": "origin/feat/design-revamp",
        "sha": "08ea4d076967b62dedca10d04c980f971069ae11",
        "snapshot": "/tmp/aicom-atlas-sources-20260918/mobile-next",
        "role": "secondary feature branch"
      },
      {
        "repo": "frontend/electron",
        "ref": "origin/main",
        "sha": "a923d5dbcb2d782af80a7a1853318ae987a84360",
        "snapshot": "/tmp/aicom-atlas-sources-20260918/electron",
        "role": "baseline"
      },
      {
        "repo": "backend/gateway",
        "ref": "origin/dev",
        "sha": "c42b03f8a978d2457f7d668c49e1c86d8cc16d19",
        "snapshot": "/tmp/aicom-atlas-sources-20260918/gateway",
        "role": "baseline"
      },
      {
        "repo": "backend/knowledge-base",
        "ref": "origin/main",
        "sha": "6b5384c63036ea636325a4fd1d1dc59a70fe376c",
        "snapshot": "/tmp/aicom-atlas-sources-20260918/knowledge-base",
        "role": "baseline"
      },
      {
        "repo": "backend/command-center",
        "ref": "origin/main",
        "sha": "42475d49d71f30a660d4f2c24fefe4614e00a891",
        "snapshot": "/tmp/aicom-atlas-sources-20260918/command-center",
        "role": "baseline"
      }
    ]
  },
  "scope": "This blueprint describes source-backed application boundaries and documented infrastructure, not live production. All six repositories were fetched without pulling, merging, checking out or resetting working trees. Baseline files were read from SHA-pinned archives; mobile design-revamp is a secondary feature branch, not released parity. Source groups link to exact commits. External implementations, enabled feature flags, physical placement, replica counts, provider mappings and organizational RACI remain unverified. Arrows model selected requests, information flow or dependencies; tracing is not a guaranteed blast-radius calculation. Dashed links include conditional/future paths. Technical owners are code/service responsibilities, not confirmed team assignments.",
  "views": {
    "business": {
      "name": "Product landscape",
      "title": "One platform. Many kinds of work.",
      "subtitle": "Explore a capability, then follow its owner, contract and evidence. Availability differs by client and environment.",
      "height": 790,
      "nodes": [
        {
          "id": "chat",
          "x": 40,
          "y": 78,
          "w": 280,
          "h": 86,
          "title": "Assistant chat",
          "sub": "Agent sessions · tools",
          "kind": "ui",
          "icon": "chat",
          "owner": "See the linked capability map for service ownership",
          "desc": "Agent sessions · tools. This tile groups product capabilities, not a deployed service.",
          "note": "Source presence is not proof of rollout or client parity.",
          "refs": [
            17,
            27
          ],
          "status": "Product grouping",
          "chips": [],
          "related": [
            "collaboration"
          ],
          "contract": "Open the focused map for API and transport boundaries.",
          "state": "Agent sessions · tools"
        },
        {
          "id": "rooms",
          "x": 333,
          "y": 78,
          "w": 280,
          "h": 86,
          "title": "Rooms",
          "sub": "Messages · threads · membership",
          "kind": "ui",
          "icon": "people",
          "owner": "See the linked capability map for service ownership",
          "desc": "Messages · threads · membership. This tile groups product capabilities, not a deployed service.",
          "note": "Source presence is not proof of rollout or client parity.",
          "refs": [
            17
          ],
          "status": "Product grouping",
          "chips": [],
          "related": [
            "collaboration"
          ],
          "contract": "Open the focused map for API and transport boundaries.",
          "state": "Messages · threads · membership"
        },
        {
          "id": "scribe",
          "x": 626,
          "y": 78,
          "w": 280,
          "h": 86,
          "title": "Meetings & Scribe",
          "sub": "Live media · notes · assets",
          "kind": "ui",
          "icon": "file",
          "owner": "See the linked capability map for service ownership",
          "desc": "Live media · notes · assets. This tile groups product capabilities, not a deployed service.",
          "note": "Source presence is not proof of rollout or client parity.",
          "refs": [
            18
          ],
          "status": "Product grouping",
          "chips": [],
          "related": [
            "collaboration"
          ],
          "contract": "Open the focused map for API and transport boundaries.",
          "state": "Live media · notes · assets"
        },
        {
          "id": "calendar",
          "x": 919,
          "y": 78,
          "w": 280,
          "h": 86,
          "title": "Calendar",
          "sub": "Meetings · agenda · sources",
          "kind": "ui",
          "icon": "grid",
          "owner": "See the linked capability map for service ownership",
          "desc": "Meetings · agenda · sources. This tile groups product capabilities, not a deployed service.",
          "note": "Source presence is not proof of rollout or client parity.",
          "refs": [
            19
          ],
          "status": "Product grouping",
          "chips": [],
          "related": [
            "collaboration"
          ],
          "contract": "Open the focused map for API and transport boundaries.",
          "state": "Meetings · agenda · sources"
        },
        {
          "id": "apps",
          "x": 40,
          "y": 260,
          "w": 280,
          "h": 86,
          "title": "Apps",
          "sub": "Author · build · host",
          "kind": "service",
          "icon": "app",
          "owner": "See the linked capability map for service ownership",
          "desc": "Author · build · host. This tile groups product capabilities, not a deployed service.",
          "note": "Source presence is not proof of rollout or client parity.",
          "refs": [
            15
          ],
          "status": "Product grouping",
          "chips": [],
          "related": [
            "apps"
          ],
          "contract": "Open the focused map for API and transport boundaries.",
          "state": "Author · build · host"
        },
        {
          "id": "workflows",
          "x": 333,
          "y": 260,
          "w": 280,
          "h": 86,
          "title": "Workflows",
          "sub": "Definitions · versions · runs",
          "kind": "service",
          "icon": "flow",
          "owner": "See the linked capability map for service ownership",
          "desc": "Definitions · versions · runs. This tile groups product capabilities, not a deployed service.",
          "note": "Source presence is not proof of rollout or client parity.",
          "refs": [
            16
          ],
          "status": "Product grouping",
          "chips": [],
          "related": [
            "workflows"
          ],
          "contract": "Open the focused map for API and transport boundaries.",
          "state": "Definitions · versions · runs"
        },
        {
          "id": "skills",
          "x": 626,
          "y": 260,
          "w": 280,
          "h": 86,
          "title": "Skills & Marketplace",
          "sub": "Discover · approve · pin",
          "kind": "service",
          "icon": "plug",
          "owner": "See the linked capability map for service ownership",
          "desc": "Discover · approve · pin. This tile groups product capabilities, not a deployed service.",
          "note": "Source presence is not proof of rollout or client parity.",
          "refs": [
            21
          ],
          "status": "Product grouping",
          "chips": [],
          "related": [
            "skills"
          ],
          "contract": "Open the focused map for API and transport boundaries.",
          "state": "Discover · approve · pin"
        },
        {
          "id": "automation",
          "x": 919,
          "y": 260,
          "w": 280,
          "h": 86,
          "title": "Agent automation",
          "sub": "JS · cron · goals · heartbeat",
          "kind": "service",
          "icon": "loop",
          "owner": "See the linked capability map for service ownership",
          "desc": "JS · cron · goals · heartbeat. This tile groups product capabilities, not a deployed service.",
          "note": "Source presence is not proof of rollout or client parity.",
          "refs": [
            16,
            27
          ],
          "status": "Product grouping",
          "chips": [],
          "related": [
            "workflows"
          ],
          "contract": "Open the focused map for API and transport boundaries.",
          "state": "JS · cron · goals · heartbeat"
        },
        {
          "id": "knowledge",
          "x": 40,
          "y": 442,
          "w": 280,
          "h": 86,
          "title": "Knowledge & Ask",
          "sub": "Evidence · views · private memory",
          "kind": "data",
          "icon": "book",
          "owner": "See the linked capability map for service ownership",
          "desc": "Evidence · views · private memory. This tile groups product capabilities, not a deployed service.",
          "note": "Source presence is not proof of rollout or client parity.",
          "refs": [
            2,
            24,
            25
          ],
          "status": "Product grouping",
          "chips": [],
          "related": [
            "knowledge"
          ],
          "contract": "Open the focused map for API and transport boundaries.",
          "state": "Evidence · views · private memory"
        },
        {
          "id": "command",
          "x": 333,
          "y": 442,
          "w": 280,
          "h": 86,
          "title": "Command Center",
          "sub": "Priorities · briefings · feedback",
          "kind": "data",
          "icon": "flag",
          "owner": "See the linked capability map for service ownership",
          "desc": "Priorities · briefings · feedback. This tile groups product capabilities, not a deployed service.",
          "note": "Source presence is not proof of rollout or client parity.",
          "refs": [
            4,
            7,
            10
          ],
          "status": "Product grouping",
          "chips": [],
          "related": [
            "data"
          ],
          "contract": "Open the focused map for API and transport boundaries.",
          "state": "Priorities · briefings · feedback"
        },
        {
          "id": "dashboards",
          "x": 626,
          "y": 442,
          "w": 280,
          "h": 86,
          "title": "Dashboards",
          "sub": "Data · panels · layouts · sharing",
          "kind": "data",
          "icon": "graph",
          "owner": "See the linked capability map for service ownership",
          "desc": "Data · panels · layouts · sharing. This tile groups product capabilities, not a deployed service.",
          "note": "Source presence is not proof of rollout or client parity.",
          "refs": [
            20
          ],
          "status": "Product grouping",
          "chips": [],
          "related": [
            "dashboards"
          ],
          "contract": "Open the focused map for API and transport boundaries.",
          "state": "Data · panels · layouts · sharing"
        },
        {
          "id": "people",
          "x": 919,
          "y": 442,
          "w": 280,
          "h": 86,
          "title": "People",
          "sub": "Directory · hierarchy · work lens",
          "kind": "data",
          "icon": "people",
          "owner": "See the linked capability map for service ownership",
          "desc": "Directory · hierarchy · work lens. This tile groups product capabilities, not a deployed service.",
          "note": "Source presence is not proof of rollout or client parity.",
          "refs": [
            22
          ],
          "status": "Product grouping",
          "chips": [],
          "related": [
            "access"
          ],
          "contract": "Open the focused map for API and transport boundaries.",
          "state": "Directory · hierarchy · work lens"
        },
        {
          "id": "admin",
          "x": 40,
          "y": 624,
          "w": 280,
          "h": 86,
          "title": "Admin surfaces",
          "sub": "Platform · Knowledge · runtime",
          "kind": "security",
          "icon": "shield",
          "owner": "See the linked capability map for service ownership",
          "desc": "Platform · Knowledge · runtime. This tile groups product capabilities, not a deployed service.",
          "note": "Source presence is not proof of rollout or client parity.",
          "refs": [
            23
          ],
          "status": "Product grouping",
          "chips": [],
          "related": [
            "access"
          ],
          "contract": "Open the focused map for API and transport boundaries.",
          "state": "Platform · Knowledge · runtime"
        },
        {
          "id": "account",
          "x": 333,
          "y": 624,
          "w": 280,
          "h": 86,
          "title": "Account & billing",
          "sub": "Identity · subscriptions · usage",
          "kind": "security",
          "icon": "people",
          "owner": "See the linked capability map for service ownership",
          "desc": "Identity · subscriptions · usage. This tile groups product capabilities, not a deployed service.",
          "note": "Source presence is not proof of rollout or client parity.",
          "refs": [
            26
          ],
          "status": "Product grouping",
          "chips": [],
          "related": [
            "operations"
          ],
          "contract": "Open the focused map for API and transport boundaries.",
          "state": "Identity · subscriptions · usage"
        },
        {
          "id": "connections",
          "x": 626,
          "y": 624,
          "w": 280,
          "h": 86,
          "title": "Connections & files",
          "sub": "OAuth · secrets · artifacts",
          "kind": "security",
          "icon": "plug",
          "owner": "See the linked capability map for service ownership",
          "desc": "OAuth · secrets · artifacts. This tile groups product capabilities, not a deployed service.",
          "note": "Source presence is not proof of rollout or client parity.",
          "refs": [
            26,
            27
          ],
          "status": "Product grouping",
          "chips": [],
          "related": [
            "operations"
          ],
          "contract": "Open the focused map for API and transport boundaries.",
          "state": "OAuth · secrets · artifacts"
        },
        {
          "id": "runtime_ops",
          "x": 919,
          "y": 624,
          "w": 280,
          "h": 86,
          "title": "Runtime & delivery",
          "sub": "Devices · approvals · notifications",
          "kind": "security",
          "icon": "server",
          "owner": "See the linked capability map for service ownership",
          "desc": "Devices · approvals · notifications. This tile groups product capabilities, not a deployed service.",
          "note": "Source presence is not proof of rollout or client parity.",
          "refs": [
            27,
            29,
            30
          ],
          "status": "Product grouping",
          "chips": [],
          "related": [
            "operations"
          ],
          "contract": "Open the focused map for API and transport boundaries.",
          "state": "Devices · approvals · notifications"
        }
      ],
      "edges": [],
      "facts": [
        [
          "Six repositories",
          "Three clients; gateway, Knowledge and CC."
        ],
        [
          "External owners",
          "Matrix, BSG, UMS, meeting and workflow services."
        ],
        [
          "Evidence, not rollout",
          "656 inventory files; no production certification."
        ]
      ]
    },
    "application": {
      "name": "Application",
      "title": "How the services connect.",
      "subtitle": "Logical requests and source supply. External owners are explicit; not all routing hops or supporting calls are drawn.",
      "height": 850,
      "nodes": [
        {
          "id": "web",
          "x": 35,
          "y": 55,
          "w": 245,
          "h": 86,
          "title": "Web app",
          "sub": "Next.js",
          "kind": "ui",
          "icon": "app",
          "owner": "frontend/web",
          "desc": "Web experiences and client state; reaches the assistant and human chat through Matrix, plus product REST APIs.",
          "note": "Verify tenant authorization, request/output compatibility and the owning service before changing this boundary.",
          "refs": [
            3,
            8
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "Browser → Matrix client APIs (chat/rooms) → AIBot runtime; plus product/feature REST",
          "state": "Web experiences and client state; reaches the assistant and human chat through Matrix, plus product REST APIs.",
          "related": []
        },
        {
          "id": "mobile",
          "x": 335,
          "y": 55,
          "w": 245,
          "h": 86,
          "title": "Mobile app",
          "sub": "Expo / React Native",
          "kind": "ui",
          "icon": "phone",
          "owner": "frontend/mobile",
          "desc": "Native client that reuses the same routing method and backend contracts as web, including the shared Matrix path.",
          "note": "Mobile reuses the web routing method and backend contracts, including the shared Matrix path; feature-branch routes are not additional released parity.",
          "refs": [
            3,
            8,
            29
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "Same routing method and backend as web: Matrix → runtime, plus shared product REST",
          "state": "Native client that reuses the same routing method and backend contracts as web, including the shared Matrix path.",
          "related": []
        },
        {
          "id": "desktop",
          "x": 635,
          "y": 55,
          "w": 245,
          "h": 86,
          "title": "Desktop app",
          "sub": "Electron → hosted web",
          "kind": "ui",
          "icon": "desktop",
          "owner": "frontend/electron",
          "desc": "Loads the hosted web app and inherits its Matrix routing; supplies native desktop permissions.",
          "note": "Verify tenant authorization, request/output compatibility and the owning service before changing this boundary.",
          "refs": [
            3
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "Electron shell → hosted web; inherits the web Matrix routing + native permissions",
          "state": "Loads the hosted web app and inherits its Matrix routing; supplies native desktop permissions.",
          "related": []
        },
        {
          "id": "messaging",
          "x": 350,
          "y": 194,
          "w": 505,
          "h": 86,
          "title": "Messaging / calls",
          "sub": "Matrix + meeting services",
          "kind": "external",
          "icon": "chat",
          "owner": "External services + client integrations",
          "desc": "Matrix carries human chat and client↔assistant messages; rooms/events route into the AIBot runtime, with meeting/call paths beyond AIBot.",
          "note": "Verify tenant authorization, request/output compatibility and the owning service before changing this boundary.",
          "refs": [
            17,
            18,
            19
          ],
          "status": "External / documented",
          "chips": [],
          "related": [
            "collaboration"
          ],
          "contract": "Matrix client APIs carry client↔assistant messages into the runtime; meeting record/Scribe REST; backend token → LiveKit",
          "state": "Matrix carries human chat and client↔assistant messages; rooms/events route into the AIBot runtime, with meeting/call paths beyond AIBot."
        },
        {
          "id": "runtime",
          "x": 190,
          "y": 354,
          "w": 350,
          "h": 106,
          "title": "AIBot runtime",
          "sub": "Sessions · tools · workflows",
          "kind": "service",
          "icon": "brain",
          "owner": "backend/gateway",
          "desc": "Coordinates assistant work and gateway requests; executes tools and relays events.",
          "note": "AIBot is not the Bot Service Gateway or the model gateway.",
          "refs": [
            3,
            13
          ],
          "status": "Source verified",
          "chips": [
            "Agent loop",
            "Gateway"
          ],
          "contract": "Consumes Matrix room/session events; gateway chat/session RPC, tool calls and event relay",
          "state": "Coordinates assistant work and gateway requests; executes tools and relays events.",
          "related": []
        },
        {
          "id": "bsg",
          "x": 625,
          "y": 354,
          "w": 255,
          "h": 106,
          "title": "Service bridge",
          "sub": "Bot Service Gateway",
          "kind": "external",
          "icon": "flow",
          "owner": "BSG repository — not in workspace",
          "desc": "Verifies the runtime bot JWT, derives the acting user identity, brokers authorized product-service calls (Command Center, rooms/membership, directory), and fronts durable stores — the memory index and user-content/file history — for query.",
          "note": "Local clients establish the contract; the runtime authenticates to BSG with a bot JWT. The BSG server was not inspected.",
          "refs": [
            4,
            9
          ],
          "status": "External / consumer-verified",
          "chips": [],
          "contract": "Bot JWT → derived identity → product-service calls + fronts durable stores (memory index, user-content/file history) for query",
          "state": "Verifies the runtime bot JWT, derives the acting user identity, brokers authorized product-service calls (Command Center, rooms/membership, directory), and fronts durable stores — the memory index and user-content/file history — for query.",
          "related": []
        },
        {
          "id": "litellm",
          "x": 950,
          "y": 354,
          "w": 255,
          "h": 106,
          "title": "Model gateway",
          "sub": "LiteLLM routing",
          "kind": "cloud",
          "icon": "chip",
          "owner": "External gateway + each AI consumer",
          "desc": "Routes authorized model requests. Also used independently by Knowledge and CC.",
          "note": "Alias/provider targets and environment configuration are not live-verified.",
          "refs": [
            12,
            13
          ],
          "status": "External / consumer-verified",
          "chips": [],
          "contract": "Consumer-selected alias + endpoint + credentials → model routing",
          "state": "Routes authorized model requests. Also used independently by Knowledge and CC.",
          "related": []
        },
        {
          "id": "knowledge",
          "x": 35,
          "y": 567,
          "w": 265,
          "h": 96,
          "title": "Knowledge",
          "sub": "Views · evidence · retrieval",
          "kind": "data",
          "icon": "book",
          "owner": "backend/knowledge-base",
          "desc": "Evidence and view service backed by per-user workspaces and immutable search revisions; retrieval uses hybrid semantic + full-text search.",
          "note": "The arrow from AIBot is a logical retrieval dependency, not a claim about all routing hops. Ask/persona memory is self-only.",
          "refs": [
            2,
            24,
            25
          ],
          "status": "Source verified",
          "chips": [],
          "related": [
            "knowledge"
          ],
          "contract": "Authorized evidence / Ask / view interfaces; hybrid semantic + FTS retrieval dependency",
          "state": "Evidence and view service backed by per-user workspaces and immutable search revisions; retrieval uses hybrid semantic + full-text search."
        },
        {
          "id": "memory",
          "x": 335,
          "y": 567,
          "w": 265,
          "h": 96,
          "title": "Memory index",
          "sub": "Agent memory · embeddings",
          "kind": "data",
          "icon": "graph",
          "owner": "Postgres memory index (fronted by BSG) + runtime SQLite shadow",
          "desc": "Durable agent memory: a dual-write index — Postgres read path fronted by BSG plus a best-effort SQLite shadow — over embeddings and full-text for hybrid recall.",
          "note": "High-level concept. BSG also fronts bot/user-content history for query; conversation history itself is read through the runtime message tools.",
          "refs": [
            13
          ],
          "status": "Consumer-verified",
          "chips": [],
          "contract": "Durable agent memory: Postgres index fronted by BSG + runtime SQLite shadow; embeddings + FTS hybrid recall",
          "state": "Durable agent memory: a dual-write index — Postgres read path fronted by BSG plus a best-effort SQLite shadow — over embeddings and full-text for hybrid recall.",
          "related": []
        },
        {
          "id": "command",
          "x": 635,
          "y": 567,
          "w": 265,
          "h": 96,
          "title": "Command Center",
          "sub": "Priorities · people · agenda",
          "kind": "service",
          "icon": "flag",
          "owner": "backend/command-center",
          "desc": "Own collection and insight pipeline; API results and user actions pass through BSG.",
          "note": "Verify tenant authorization, request/output compatibility and the owning service before changing this boundary.",
          "refs": [
            4,
            7,
            10
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "CC reads and actions via AIBot → BSG → Command Center",
          "state": "Own collection and insight pipeline; API results and user actions pass through BSG.",
          "related": []
        },
        {
          "id": "execution",
          "x": 935,
          "y": 567,
          "w": 270,
          "h": 96,
          "title": "Execution services",
          "sub": "Authoring · runners · sandboxes",
          "kind": "external",
          "icon": "bolt",
          "owner": "AIBot + external execution infrastructure",
          "desc": "AgentCore authoring, shared app runners and generic MicroVM execution are separate axes.",
          "note": "High-level grouping of documented execution paths; not one audited deployment.",
          "refs": [
            13,
            15
          ],
          "status": "External / documented",
          "chips": [
            "Docker",
            "AgentCore",
            "MicroVM"
          ],
          "related": [
            "apps",
            "infra"
          ],
          "contract": "Sandbox backend (Docker / AgentCore / MicroVM) + browser and app-builder execution, selected by task",
          "state": "AgentCore authoring, shared app runners and generic MicroVM execution are separate axes."
        },
        {
          "id": "brain",
          "x": 35,
          "y": 758,
          "w": 300,
          "h": 72,
          "title": "Brain Data",
          "sub": "Immutable L0 snapshots",
          "kind": "external",
          "icon": "db",
          "owner": "External Brain Data service",
          "desc": "Supplies validated raw-source snapshots to Knowledge. CC can optionally fetch Slack L0.",
          "note": "Verify tenant authorization, request/output compatibility and the owning service before changing this boundary.",
          "refs": [
            2,
            4,
            6
          ],
          "status": "External / consumer-verified",
          "chips": [],
          "contract": "Immutable L0 source snapshots and ingestion handoff",
          "state": "Supplies validated raw-source snapshots to Knowledge. CC can optionally fetch Slack L0.",
          "related": []
        },
        {
          "id": "systems",
          "x": 475,
          "y": 758,
          "w": 300,
          "h": 72,
          "title": "Connected work",
          "sub": "Slack · mail · calendar · docs",
          "kind": "external",
          "icon": "plug",
          "owner": "External work systems + connector owners",
          "desc": "Knowledge and CC have different source coverage and acquisition paths.",
          "note": "Verify tenant authorization, request/output compatibility and the owning service before changing this boundary.",
          "refs": [
            2,
            4
          ],
          "status": "External / documented",
          "chips": [],
          "contract": "Source-specific collectors and connector APIs; coverage differs by service",
          "state": "Knowledge and CC have different source coverage and acquisition paths.",
          "related": []
        },
        {
          "id": "identity",
          "x": 920,
          "y": 758,
          "w": 285,
          "h": 72,
          "title": "Platform services",
          "sub": "UMS · Vault · Orchestrator",
          "kind": "security",
          "icon": "shield",
          "owner": "External identity / access / placement services",
          "desc": "Identity/hierarchy, per-user credentials and runtime placement support multiple services.",
          "note": "Shared support dependencies are grouped; not all calls are drawn.",
          "refs": [
            2,
            4,
            13
          ],
          "status": "External / consumer-verified",
          "chips": [],
          "related": [
            "access",
            "operations"
          ],
          "contract": "UMS identity/hierarchy; Vault credentials; Orchestrator assignment/placement",
          "state": "Identity/hierarchy, per-user credentials and runtime placement support multiple services."
        }
      ],
      "edges": [
        {
          "a": "web",
          "b": "messaging",
          "path": "M157 141V167H430V194",
          "label": "requests / events",
          "lx": 175,
          "ly": 160,
          "conditional": false
        },
        {
          "a": "mobile",
          "b": "messaging",
          "path": "M457 141V180H540V194",
          "label": "",
          "lx": 0,
          "ly": 0,
          "conditional": false
        },
        {
          "a": "desktop",
          "b": "messaging",
          "path": "M758 141V180H680V194",
          "label": "",
          "lx": 0,
          "ly": 0,
          "conditional": false
        },
        {
          "a": "messaging",
          "b": "runtime",
          "path": "M602 280V317H365V354",
          "label": "messaging APIs",
          "lx": 430,
          "ly": 308,
          "conditional": false
        },
        {
          "a": "runtime",
          "b": "bsg",
          "path": "M540 407H625",
          "label": "bot JWT",
          "lx": 556,
          "ly": 396,
          "conditional": false
        },
        {
          "a": "runtime",
          "b": "litellm",
          "path": "M520 354V319H1077V354",
          "label": "model calls",
          "lx": 825,
          "ly": 310,
          "conditional": false
        },
        {
          "a": "runtime",
          "b": "knowledge",
          "path": "M250 460V520H167V567",
          "label": "retrieval",
          "lx": 95,
          "ly": 515,
          "conditional": false
        },
        {
          "a": "bsg",
          "b": "memory",
          "path": "M700 460V520H467V567",
          "label": "memory query",
          "lx": 505,
          "ly": 515,
          "conditional": false
        },
        {
          "a": "bsg",
          "b": "command",
          "path": "M780 460V536H767V567",
          "label": "reads / actions",
          "lx": 700,
          "ly": 530,
          "conditional": false
        },
        {
          "a": "runtime",
          "b": "execution",
          "path": "M485 460V492H1070V567",
          "label": "tool execution",
          "lx": 930,
          "ly": 483,
          "conditional": false
        },
        {
          "a": "brain",
          "b": "knowledge",
          "path": "M167 758V663",
          "label": "handoff",
          "lx": 178,
          "ly": 712,
          "conditional": false
        },
        {
          "a": "systems",
          "b": "brain",
          "path": "M475 794H335",
          "label": "",
          "lx": 0,
          "ly": 0,
          "conditional": false
        },
        {
          "a": "systems",
          "b": "command",
          "path": "M700 758V690H767V663",
          "label": "own collection",
          "lx": 712,
          "ly": 700,
          "conditional": false
        },
        {
          "a": "brain",
          "b": "command",
          "path": "M335 777H430V690H680V663",
          "label": "optional Slack L0",
          "lx": 430,
          "ly": 682,
          "conditional": true
        }
      ],
      "facts": [
        [
          "Shared client path",
          "Web and mobile route through Matrix into the runtime with one method."
        ],
        [
          "BSG fronts stores",
          "Bot JWT brokering plus memory index and user-content history for query."
        ],
        [
          "Sandbox backends",
          "Execution runs in Docker, AgentCore or MicroVM by task."
        ]
      ]
    },
    "collaboration": {
      "name": "Collaboration",
      "title": "Conversations are not one session.",
      "subtitle": "Three state boundaries: Matrix rooms, agent execution sessions and Knowledge Ask. Calendar joins multiple sources.",
      "height": 740,
      "nodes": [
        {
          "id": "rooms",
          "x": 45,
          "y": 88,
          "w": 346,
          "h": 100,
          "title": "Rooms",
          "sub": "Human conversation",
          "kind": "ui",
          "icon": "chat",
          "owner": "External Matrix + web/mobile",
          "desc": "Matrix owns messages, threads/events and membership. A room is not an agent execution session.",
          "note": "Preserve room IDs, event schemas and access checks across clients.",
          "refs": [
            17
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "/_matrix/client/v3/createRoom; room events and membership",
          "state": "Matrix owns messages, threads/events and membership. A room is not an agent execution session.",
          "related": [
            "application"
          ]
        },
        {
          "id": "media",
          "x": 447,
          "y": 88,
          "w": 346,
          "h": 100,
          "title": "Live meetings",
          "sub": "SFU / media transport",
          "kind": "external",
          "icon": "phone",
          "owner": "External meeting service + LiveKit",
          "desc": "Live media and meeting records are distinct authorities.",
          "note": "Token scopes and media lifecycle are independent of assistant inference.",
          "refs": [
            18
          ],
          "status": "External / consumer-verified",
          "chips": [],
          "contract": "Backend SFU token path → LiveKit media",
          "state": "Live media and meeting records are distinct authorities.",
          "related": []
        },
        {
          "id": "calendar",
          "x": 849,
          "y": 88,
          "w": 346,
          "h": 100,
          "title": "Calendar",
          "sub": "Source + record + inference",
          "kind": "ui",
          "icon": "grid",
          "owner": "Web CalendarPageClient + CC + meeting service",
          "desc": "Calendar combines meeting records, CC agenda and caches. Calls redirects to Calendar.",
          "note": "Google Calendar source ≠ inferred agenda ≠ live meeting record; invalidate relevant caches.",
          "refs": [
            19
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "useAgendaEventsQuery; listCalls / listMeetings",
          "state": "Calendar combines meeting records, CC agenda and caches. Calls redirects to Calendar.",
          "related": [
            "data"
          ]
        },
        {
          "id": "sessions",
          "x": 45,
          "y": 312,
          "w": 346,
          "h": 100,
          "title": "Agent sessions",
          "sub": "Execution keys · JSONL",
          "kind": "service",
          "icon": "brain",
          "owner": "backend/gateway + web session client",
          "desc": "Append-only JSONL keeps execution history; compaction does not delete that history.",
          "note": "Do not treat Matrix room IDs or Knowledge Ask session IDs as execution keys.",
          "refs": [
            17
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "chat / sessions RPC; useChatSessionGateway",
          "state": "Append-only JSONL keeps execution history; compaction does not delete that history.",
          "related": [
            "knowledge",
            "application"
          ]
        },
        {
          "id": "meeting_service",
          "x": 447,
          "y": 312,
          "w": 346,
          "h": 100,
          "title": "Meeting service",
          "sub": "Processing & records",
          "kind": "external",
          "icon": "server",
          "owner": "External meeting service",
          "desc": "Meeting processing is not owned by AIBot. Scribe serves legacy sections or block/markdown modes.",
          "note": "Keep response-mode compatibility, edit semantics and asset access.",
          "refs": [
            18
          ],
          "status": "External / consumer-verified",
          "chips": [],
          "contract": "/meeting/v1/meetings/:id/scribe",
          "state": "Meeting processing is not owned by AIBot. Scribe serves legacy sections or block/markdown modes.",
          "related": []
        },
        {
          "id": "agenda",
          "x": 849,
          "y": 312,
          "w": 346,
          "h": 100,
          "title": "CC agenda",
          "sub": "Synthesized preparation",
          "kind": "service",
          "icon": "flag",
          "owner": "backend/command-center",
          "desc": "Meeting preparation and inferred planning are produced by CC stages.",
          "note": "A source calendar change need not immediately regenerate CC preparation.",
          "refs": [
            7,
            19
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "CC agenda via BSG / client queries",
          "state": "Meeting preparation and inferred planning are produced by CC stages.",
          "related": [
            "data"
          ]
        },
        {
          "id": "scribe_signal",
          "x": 45,
          "y": 536,
          "w": 346,
          "h": 100,
          "title": "Scribe change event",
          "sub": "Version signal, not content",
          "kind": "data",
          "icon": "bolt",
          "owner": "Matrix event + web useMeetingScribe",
          "desc": "Initial GET loads Scribe; Matrix version/change events trigger another GET. No polling.",
          "note": "Do not put the Scribe body contract on the event bus.",
          "refs": [
            18
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "aic.meeting.scribe → refetch",
          "state": "Initial GET loads Scribe; Matrix version/change events trigger another GET. No polling.",
          "related": []
        },
        {
          "id": "scribe",
          "x": 447,
          "y": 536,
          "w": 346,
          "h": 100,
          "title": "Scribe",
          "sub": "Notes · edits · assets",
          "kind": "ui",
          "icon": "file",
          "owner": "Web Scribe UI + external meeting service",
          "desc": "Meeting notes display after processing and update through event-triggered refetch.",
          "note": "aic-enable-scribe / meeting-series whitelist gate access.",
          "refs": [
            18
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "GET/edit Scribe + assets",
          "state": "Meeting notes display after processing and update through event-triggered refetch.",
          "related": []
        },
        {
          "id": "ask_session",
          "x": 849,
          "y": 536,
          "w": 346,
          "h": 100,
          "title": "Knowledge Ask",
          "sub": "Separate answer history",
          "kind": "data",
          "icon": "book",
          "owner": "backend/knowledge-base",
          "desc": "Ask has its own session bodies, metadata and leases; it is not a Matrix room or AIBot JSONL session.",
          "note": "Respect owner access and migration fallback.",
          "refs": [
            24
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "Ask streaming + _index/ask-sessions/...",
          "state": "Ask has its own session bodies, metadata and leases; it is not a Matrix room or AIBot JSONL session.",
          "related": [
            "knowledge"
          ]
        }
      ],
      "edges": [
        {
          "a": "rooms",
          "b": "scribe_signal",
          "path": "M45 138H31V586H45",
          "label": "",
          "lx": 228,
          "ly": 362.0,
          "conditional": false
        },
        {
          "a": "media",
          "b": "meeting_service",
          "path": "M620 188V312",
          "label": "meeting context",
          "lx": 630,
          "ly": 250.0,
          "conditional": false
        },
        {
          "a": "meeting_service",
          "b": "scribe",
          "path": "M620 412V536",
          "label": "GET / edit",
          "lx": 630,
          "ly": 474.0,
          "conditional": false
        },
        {
          "a": "scribe_signal",
          "b": "scribe",
          "path": "M391 586H447",
          "label": "",
          "lx": 419.0,
          "ly": 574,
          "conditional": false,
          "anchor": "middle"
        },
        {
          "a": "agenda",
          "b": "calendar",
          "path": "M1022 312V188",
          "label": "agenda results",
          "lx": 1032,
          "ly": 250.0,
          "conditional": false
        },
        {
          "a": "meeting_service",
          "b": "calendar",
          "path": "M620 312V250.0H1022V188",
          "label": "",
          "lx": 632,
          "ly": 240.0,
          "conditional": false
        }
      ],
      "facts": [
        [
          "Room ≠ session",
          "Human state and execution state stay separate."
        ],
        [
          "Scribe refresh",
          "Event signals change; GET retrieves the body."
        ],
        [
          "Calendar is a join",
          "Source calendar, meeting record and CC agenda."
        ]
      ]
    },
    "apps": {
      "name": "Apps",
      "title": "Authoring is not hosting.",
      "subtitle": "Four separate execution axes: main agent, AgentCore authoring, shared app runners and generic MicroVM tools.",
      "height": 740,
      "nodes": [
        {
          "id": "intent",
          "x": 45,
          "y": 88,
          "w": 346,
          "h": 100,
          "title": "App intent",
          "sub": "Chat request",
          "kind": "ui",
          "icon": "chat",
          "owner": "Web / mobile → main AIBot agent",
          "desc": "The main agent delegates app planning, coding and troubleshooting.",
          "note": "Preserve user and tenant context across the authoring handoff.",
          "refs": [
            15
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "User intent → agent app-builder tool / CLI",
          "state": "The main agent delegates app planning, coding and troubleshooting.",
          "related": []
        },
        {
          "id": "author",
          "x": 447,
          "y": 88,
          "w": 346,
          "h": 100,
          "title": "AgentCore",
          "sub": "Authoring sessions",
          "kind": "cloud",
          "icon": "brain",
          "owner": "External AgentCore + gateway app-builder",
          "desc": "AgentCore authors app code; it is not the fleet that serves running apps.",
          "note": "Plan/coder/troubleshoot contracts can change separately from runtime hosting.",
          "refs": [
            15
          ],
          "status": "External / documented",
          "chips": [],
          "contract": "aic-app-builder CLI → BSG",
          "state": "AgentCore authors app code; it is not the fleet that serves running apps.",
          "related": []
        },
        {
          "id": "owned",
          "x": 849,
          "y": 88,
          "w": 346,
          "h": 100,
          "title": "Owned apps",
          "sub": "Discover · start · deploy",
          "kind": "ui",
          "icon": "app",
          "owner": "Web marketplace / Apps clients",
          "desc": "Clients list owned apps and call start/deploy operations.",
          "note": "Keep ownership, deployment status and start semantics distinct.",
          "refs": [
            15
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "/marketplace/apps/owned; /aibot/api-proxy/apps/...",
          "state": "Clients list owned apps and call start/deploy operations.",
          "related": [
            "skills"
          ]
        },
        {
          "id": "cli",
          "x": 45,
          "y": 312,
          "w": 346,
          "h": 100,
          "title": "Builder CLI",
          "sub": "Prepare authoring requests",
          "kind": "service",
          "icon": "flow",
          "owner": "backend/gateway app-builder CLI",
          "desc": "CLI bridges builder workflows to service contracts.",
          "note": "Validate request, tenant identity and errors at the CLI/service boundary.",
          "refs": [
            15
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "User → main agent → aic-app-builder → BSG",
          "state": "CLI bridges builder workflows to service contracts.",
          "related": []
        },
        {
          "id": "bsg_apps",
          "x": 447,
          "y": 312,
          "w": 346,
          "h": 100,
          "title": "App control plane",
          "sub": "Prepare · build · place · start",
          "kind": "external",
          "icon": "server",
          "owner": "External BSG / app services",
          "desc": "Coordinates builds and placement on shared runners.",
          "note": "A build success is not proof of a running or publicly reachable deployment.",
          "refs": [
            15
          ],
          "status": "External / consumer-verified",
          "chips": [],
          "contract": "App lifecycle APIs via BSG",
          "state": "Coordinates builds and placement on shared runners.",
          "related": []
        },
        {
          "id": "microvm",
          "x": 849,
          "y": 312,
          "w": 346,
          "h": 100,
          "title": "Generic MicroVM",
          "sub": "Tool sandbox — not app host",
          "kind": "cloud",
          "icon": "chip",
          "owner": "Gateway tools + external sandbox service",
          "desc": "Generic sandbox execution is a fourth, separate axis.",
          "note": "Do not migrate app-hosting assumptions into sandbox policies.",
          "refs": [
            13,
            15
          ],
          "status": "External / documented",
          "chips": [],
          "contract": "Runtime sandbox/tool execution",
          "state": "Generic sandbox execution is a fourth, separate axis.",
          "related": [
            "infra",
            "operations"
          ]
        },
        {
          "id": "efs",
          "x": 45,
          "y": 536,
          "w": 346,
          "h": 100,
          "title": "Tenant EFS",
          "sub": "App source + deployment trees",
          "kind": "data",
          "icon": "file",
          "owner": "External app platform / tenant storage",
          "desc": "Tenant EFS retains app and deployment files.",
          "note": "Storage isolation, build artifacts and cleanup need independent checks.",
          "refs": [
            15
          ],
          "status": "External / documented",
          "chips": [],
          "contract": "apps/<appId>/; deployments/<appId>/",
          "state": "Tenant EFS retains app and deployment files.",
          "related": []
        },
        {
          "id": "runner",
          "x": 447,
          "y": 536,
          "w": 346,
          "h": 100,
          "title": "Shared-runner fleet",
          "sub": "Hosts running apps",
          "kind": "cloud",
          "icon": "server",
          "owner": "External app runtime fleet",
          "desc": "Shared runners host apps; AgentCore remains the authoring system.",
          "note": "Verify actual fleet placement, capacity and isolation in the owning service.",
          "refs": [
            15
          ],
          "status": "External / documented",
          "chips": [],
          "contract": "Build/place/start → runner",
          "state": "Shared runners host apps; AgentCore remains the authoring system.",
          "related": [
            "infra"
          ]
        },
        {
          "id": "public",
          "x": 849,
          "y": 536,
          "w": 346,
          "h": 100,
          "title": "Public app route",
          "sub": "Served app experience",
          "kind": "ui",
          "icon": "app",
          "owner": "External routing → BSG / runner",
          "desc": "Public app routes front BSG/runner execution.",
          "note": "Route and access policy changes affect published app consumers.",
          "refs": [
            15
          ],
          "status": "External / consumer-verified",
          "chips": [],
          "contract": "/aibot/<env>/<app>",
          "state": "Public app routes front BSG/runner execution.",
          "related": []
        }
      ],
      "edges": [
        {
          "a": "intent",
          "b": "author",
          "path": "M391 138H447",
          "label": "delegate",
          "lx": 419.0,
          "ly": 126,
          "conditional": false,
          "anchor": "middle"
        },
        {
          "a": "intent",
          "b": "cli",
          "path": "M218 188V312",
          "label": "tool call",
          "lx": 228,
          "ly": 250.0,
          "conditional": false
        },
        {
          "a": "author",
          "b": "bsg_apps",
          "path": "M620 188V312",
          "label": "authoring API",
          "lx": 630,
          "ly": 250.0,
          "conditional": false
        },
        {
          "a": "cli",
          "b": "bsg_apps",
          "path": "M391 362H447",
          "label": "BSG",
          "lx": 419.0,
          "ly": 350,
          "conditional": false,
          "anchor": "middle"
        },
        {
          "a": "owned",
          "b": "bsg_apps",
          "path": "M1022 188V250.0H620V312",
          "label": "",
          "lx": 632,
          "ly": 240.0,
          "conditional": false
        },
        {
          "a": "bsg_apps",
          "b": "runner",
          "path": "M620 412V536",
          "label": "placement",
          "lx": 630,
          "ly": 474.0,
          "conditional": false
        },
        {
          "a": "efs",
          "b": "runner",
          "path": "M391 586H447",
          "label": "app files",
          "lx": 419.0,
          "ly": 574,
          "conditional": false,
          "anchor": "middle"
        },
        {
          "a": "runner",
          "b": "public",
          "path": "M793 586H849",
          "label": "serve",
          "lx": 821.0,
          "ly": 574,
          "conditional": false,
          "anchor": "middle"
        }
      ],
      "facts": [
        [
          "AgentCore",
          "Authors; does not host the public app."
        ],
        [
          "Shared runners",
          "Build, place and run tenant apps."
        ],
        [
          "Tenant EFS",
          "Source and deployment trees are distinct."
        ]
      ]
    },
    "workflows": {
      "name": "Workflows",
      "title": "Three automation paths, not one engine.",
      "subtitle": "Page-managed workflows, agent-authored JavaScript and runtime scheduling have different contracts and authorities.",
      "height": 740,
      "nodes": [
        {
          "id": "page",
          "x": 45,
          "y": 88,
          "w": 346,
          "h": 100,
          "title": "Workflows page",
          "sub": "Definitions & drafts",
          "kind": "ui",
          "icon": "flow",
          "owner": "Web routines client",
          "desc": "Feature flags select the workflow experience and engine.",
          "note": "Test both selected engine paths; source presence does not prove tenant enablement.",
          "refs": [
            16
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "aic-enable-workflows; user-scoped aic-workflow-engine-v2",
          "state": "Feature flags select the workflow experience and engine.",
          "related": []
        },
        {
          "id": "v2",
          "x": 447,
          "y": 88,
          "w": 346,
          "h": 100,
          "title": "Workflow V2",
          "sub": "Versions · catalog · publish",
          "kind": "external",
          "icon": "server",
          "owner": "External workflow service",
          "desc": "Workflow service is the sole draft/list store for page-managed workflows.",
          "note": "Legacy and V2 contracts differ. V2 room install/actions are not equivalent to SVC support.",
          "refs": [
            16
          ],
          "status": "External / consumer-verified",
          "chips": [],
          "contract": "/workflow/v2 via v2Rest / svcRest clients",
          "state": "Workflow service is the sole draft/list store for page-managed workflows.",
          "related": []
        },
        {
          "id": "runs",
          "x": 849,
          "y": 88,
          "w": 346,
          "h": 100,
          "title": "Runs & traces",
          "sub": "Execution records",
          "kind": "data",
          "icon": "graph",
          "owner": "External workflow service",
          "desc": "Published versions and runtime traces are distinct from local authoring state.",
          "note": "Verify execution semantics at the external service; do not infer them from CLI push.",
          "refs": [
            16
          ],
          "status": "External / consumer-verified",
          "chips": [],
          "contract": "Publish / run / traces APIs",
          "state": "Published versions and runtime traces are distinct from local authoring state.",
          "related": []
        },
        {
          "id": "catalog",
          "x": 45,
          "y": 312,
          "w": 346,
          "h": 100,
          "title": "Builder catalog",
          "sub": "Discover available actions",
          "kind": "service",
          "icon": "book",
          "owner": "Gateway workflow-builder",
          "desc": "The builder uses catalog schemas to author compatible definitions.",
          "note": "Catalog/schema changes need authoring and validation regression checks.",
          "refs": [
            16
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "catalog → init / pull / edit",
          "state": "The builder uses catalog schemas to author compatible definitions.",
          "related": []
        },
        {
          "id": "validate",
          "x": 447,
          "y": 312,
          "w": 346,
          "h": 100,
          "title": "Validate & push",
          "sub": "Save a definition",
          "kind": "service",
          "icon": "shield",
          "owner": "Gateway workflow-builder + workflow service",
          "desc": "Push transfers a workflow definition; it is not publish or run.",
          "note": "Versioning, errors and remote draft ownership must remain compatible.",
          "refs": [
            16
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "validate → push",
          "state": "Push transfers a workflow definition; it is not publish or run.",
          "related": []
        },
        {
          "id": "room_actions",
          "x": 849,
          "y": 312,
          "w": 346,
          "h": 100,
          "title": "Room actions",
          "sub": "Engine-dependent support",
          "kind": "ui",
          "icon": "chat",
          "owner": "Web / external workflow services",
          "desc": "Room integration varies by selected service implementation.",
          "note": "Do not assert SVC parity from V2 client support.",
          "refs": [
            16
          ],
          "status": "External / consumer-verified",
          "chips": [],
          "contract": "V2 room install and action paths",
          "state": "Room integration varies by selected service implementation.",
          "related": [
            "collaboration"
          ]
        },
        {
          "id": "js",
          "x": 45,
          "y": 536,
          "w": 346,
          "h": 100,
          "title": "JS automation",
          "sub": "Agent-authored programs",
          "kind": "service",
          "icon": "file",
          "owner": "backend/gateway automation tools",
          "desc": "Agent-authored automation is separate from the page workflow service.",
          "note": "Apply sandbox, approval and credential policies for this execution path.",
          "refs": [
            16,
            27
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "JavaScript authoring / execution tool path",
          "state": "Agent-authored automation is separate from the page workflow service.",
          "related": []
        },
        {
          "id": "schedule",
          "x": 447,
          "y": 536,
          "w": 346,
          "h": 100,
          "title": "Cron & heartbeat",
          "sub": "Scheduled agent work",
          "kind": "service",
          "icon": "loop",
          "owner": "backend/gateway scheduler/runtime",
          "desc": "Scheduled agent turns are not workflow-service versions or runs.",
          "note": "Change timing, retry and delivery rules independently.",
          "refs": [
            27
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "Cron / heartbeat / goals runtime contracts",
          "state": "Scheduled agent turns are not workflow-service versions or runs.",
          "related": [
            "operations"
          ]
        },
        {
          "id": "goals",
          "x": 849,
          "y": 536,
          "w": 346,
          "h": 100,
          "title": "Goals",
          "sub": "Longer-running agent intent",
          "kind": "service",
          "icon": "flag",
          "owner": "backend/gateway goal tools",
          "desc": "Goals coordinate continuing assistant work.",
          "note": "Do not imply one shared durable job engine across all automation.",
          "refs": [
            27
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "Goal lifecycle / agent turns",
          "state": "Goals coordinate continuing assistant work.",
          "related": []
        }
      ],
      "edges": [
        {
          "a": "page",
          "b": "v2",
          "path": "M391 138H447",
          "label": "API",
          "lx": 419.0,
          "ly": 126,
          "conditional": false,
          "anchor": "middle"
        },
        {
          "a": "v2",
          "b": "runs",
          "path": "M793 138H849",
          "label": "execute",
          "lx": 821.0,
          "ly": 126,
          "conditional": false,
          "anchor": "middle"
        },
        {
          "a": "catalog",
          "b": "validate",
          "path": "M391 362H447",
          "label": "author",
          "lx": 419.0,
          "ly": 350,
          "conditional": false,
          "anchor": "middle"
        },
        {
          "a": "validate",
          "b": "v2",
          "path": "M620 312V188",
          "label": "save only",
          "lx": 630,
          "ly": 250.0,
          "conditional": false
        },
        {
          "a": "v2",
          "b": "room_actions",
          "path": "M620 188V250.0H1022V312",
          "label": "",
          "lx": 632,
          "ly": 240.0,
          "conditional": false
        }
      ],
      "facts": [
        [
          "Store of record",
          "Page drafts and lists live in workflow service."
        ],
        [
          "Push ≠ publish ≠ run",
          "Do not collapse authoring and execution."
        ],
        [
          "Engine gates",
          "Legacy, V2 and SVC support differ."
        ]
      ]
    },
    "skills": {
      "name": "Skills & Marketplace",
      "title": "Discover broadly. Install deliberately.",
      "subtitle": "Skills, tools and connector grants are different layers. A model decision is not an authorization event.",
      "height": 740,
      "nodes": [
        {
          "id": "discovery",
          "x": 45,
          "y": 88,
          "w": 346,
          "h": 100,
          "title": "Skill discovery",
          "sub": "Marketplace search",
          "kind": "ui",
          "icon": "search",
          "owner": "Gateway marketplace discovery",
          "desc": "Discovery finds candidates; it does not install or authorize them.",
          "note": "Flag availability and catalog trust must be checked independently.",
          "refs": [
            21
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "marketplace-skill-discovery feature flag",
          "state": "Discovery finds candidates; it does not install or authorize them.",
          "related": []
        },
        {
          "id": "approval",
          "x": 447,
          "y": 88,
          "w": 346,
          "h": 100,
          "title": "Trusted approval",
          "sub": "Explicit user authorization",
          "kind": "security",
          "icon": "shield",
          "owner": "Gateway trusted approval path",
          "desc": "Only a trusted approval allows the installation path to proceed.",
          "note": "A model-supplied boolean must not be treated as authorization.",
          "refs": [
            21
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "Explicit approval before installation",
          "state": "Only a trusted approval allows the installation path to proceed.",
          "related": []
        },
        {
          "id": "marketplace",
          "x": 849,
          "y": 88,
          "w": 346,
          "h": 100,
          "title": "Marketplace",
          "sub": "Apps · panels · sharing",
          "kind": "ui",
          "icon": "grid",
          "owner": "Web marketplace + external services",
          "desc": "Marketplace covers more than skills: Apps, panels and sharing also exist.",
          "note": "Sharing and revocation need owner and consumer checks.",
          "refs": [
            15,
            20,
            21
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "Owned items / share / revoke APIs",
          "state": "Marketplace covers more than skills: Apps, panels and sharing also exist.",
          "related": [
            "apps",
            "dashboards"
          ]
        },
        {
          "id": "validate",
          "x": 45,
          "y": 312,
          "w": 346,
          "h": 100,
          "title": "Integrity checks",
          "sub": "Version · hash · manifest",
          "kind": "security",
          "icon": "shield",
          "owner": "Gateway marketplace installer",
          "desc": "Pinned, validated content is required before tenant installation.",
          "note": "Test malformed manifests, hash mismatches and version changes.",
          "refs": [
            21
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "Validate selected version and manifest/hash",
          "state": "Pinned, validated content is required before tenant installation.",
          "related": []
        },
        {
          "id": "pinned",
          "x": 447,
          "y": 312,
          "w": 346,
          "h": 100,
          "title": "Tenant-pinned skill",
          "sub": "Install in tenant workspace",
          "kind": "data",
          "icon": "file",
          "owner": "Gateway skill installation",
          "desc": "Validated skill instructions become tenant-pinned workspace content.",
          "note": "Track update, removal and tenant-isolation behavior.",
          "refs": [
            21
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "skills/marketplace/<name>/SKILL.md",
          "state": "Validated skill instructions become tenant-pinned workspace content.",
          "related": []
        },
        {
          "id": "grant",
          "x": 849,
          "y": 312,
          "w": 346,
          "h": 100,
          "title": "Connector grants",
          "sub": "OAuth / Vault permissions",
          "kind": "security",
          "icon": "plug",
          "owner": "External Vault + connector owners",
          "desc": "Installing a skill does not grant access to an external connector.",
          "note": "Enforce connector scope and credential ownership separately.",
          "refs": [
            21,
            26
          ],
          "status": "External / consumer-verified",
          "chips": [],
          "contract": "OAuth consent and credential retrieval",
          "state": "Installing a skill does not grant access to an external connector.",
          "related": [
            "operations",
            "access"
          ]
        },
        {
          "id": "core",
          "x": 45,
          "y": 536,
          "w": 346,
          "h": 100,
          "title": "Core skills",
          "sub": "Bundled instructions",
          "kind": "service",
          "icon": "book",
          "owner": "backend/gateway core skills",
          "desc": "Core skills are not marketplace-installed content.",
          "note": "Bundled updates and tenant-pinned versions have different lifecycles.",
          "refs": [
            21,
            27
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "Runtime skill discovery",
          "state": "Core skills are not marketplace-installed content.",
          "related": []
        },
        {
          "id": "runtime",
          "x": 447,
          "y": 536,
          "w": 346,
          "h": 100,
          "title": "Agent runtime",
          "sub": "Discovers skill instructions",
          "kind": "service",
          "icon": "brain",
          "owner": "backend/gateway agent runtime",
          "desc": "Skill instructions guide the agent; executable tool schemas remain separate.",
          "note": "Instruction changes still need tool-policy and output checks.",
          "refs": [
            21,
            27
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "Runtime discovery of installed SKILL.md",
          "state": "Skill instructions guide the agent; executable tool schemas remain separate.",
          "related": [
            "ai"
          ]
        },
        {
          "id": "tools",
          "x": 849,
          "y": 536,
          "w": 346,
          "h": 100,
          "title": "Tool schemas",
          "sub": "Executable capabilities",
          "kind": "service",
          "icon": "bolt",
          "owner": "backend/gateway tools/extensions",
          "desc": "Tool calls are controlled by runtime policy and any required grants.",
          "note": "Extension inventory does not certify production enablement.",
          "refs": [
            21,
            27,
            30
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "Tool schema + policy + connector credentials",
          "state": "Tool calls are controlled by runtime policy and any required grants.",
          "related": [
            "operations"
          ]
        }
      ],
      "edges": [
        {
          "a": "discovery",
          "b": "approval",
          "path": "M391 138H447",
          "label": "request",
          "lx": 419.0,
          "ly": 126,
          "conditional": false,
          "anchor": "middle"
        },
        {
          "a": "approval",
          "b": "validate",
          "path": "M620 188V250.0H218V312",
          "label": "",
          "lx": 230,
          "ly": 240.0,
          "conditional": false
        },
        {
          "a": "validate",
          "b": "pinned",
          "path": "M391 362H447",
          "label": "verified",
          "lx": 419.0,
          "ly": 350,
          "conditional": false,
          "anchor": "middle"
        },
        {
          "a": "pinned",
          "b": "runtime",
          "path": "M620 412V536",
          "label": "discover",
          "lx": 630,
          "ly": 474.0,
          "conditional": false
        },
        {
          "a": "core",
          "b": "runtime",
          "path": "M391 586H447",
          "label": "discover",
          "lx": 419.0,
          "ly": 574,
          "conditional": false,
          "anchor": "middle"
        },
        {
          "a": "runtime",
          "b": "tools",
          "path": "M793 586H849",
          "label": "invoke",
          "lx": 821.0,
          "ly": 574,
          "conditional": false,
          "anchor": "middle"
        },
        {
          "a": "grant",
          "b": "tools",
          "path": "M1022 412V536",
          "label": "scoped access",
          "lx": 1032,
          "ly": 474.0,
          "conditional": false
        }
      ],
      "facts": [
        [
          "Trust boundary",
          "Explicit approval, not a model boolean."
        ],
        [
          "Pinned artifacts",
          "Version, hash and manifest are validated."
        ],
        [
          "Three layers",
          "Skill instructions ≠ tools ≠ connector grants."
        ]
      ]
    },
    "dashboards": {
      "name": "Dashboards",
      "title": "A real surface, with multiple data paths.",
      "subtitle": "Specs, live panels, variable options, layout persistence and sharing are implemented. Engines remain distinct.",
      "height": 740,
      "nodes": [
        {
          "id": "builder",
          "x": 45,
          "y": 88,
          "w": 346,
          "h": 100,
          "title": "Dashboard Builder",
          "sub": "Panels · data · manifest · grid",
          "kind": "service",
          "icon": "flow",
          "owner": "Gateway dashboard-builder",
          "desc": "Builder creates dashboard specifications and supporting data/layout assets.",
          "note": "Treat generated spec, data references and layout as separate contracts.",
          "refs": [
            20
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "/aic_apps_api/dashboards/.../specs",
          "state": "Builder creates dashboard specifications and supporting data/layout assets.",
          "related": []
        },
        {
          "id": "specs",
          "x": 447,
          "y": 88,
          "w": 346,
          "h": 100,
          "title": "Dashboard specs",
          "sub": "Structured panel definitions",
          "kind": "data",
          "icon": "file",
          "owner": "Web marketplace clients + external APIs",
          "desc": "The dashboard surface has concrete API clients, not just a product vision.",
          "note": "Version specs and validate panel variables before changing the renderer.",
          "refs": [
            20
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "/marketplace/dashboard; specs / live panels / variable options",
          "state": "The dashboard surface has concrete API clients, not just a product vision.",
          "related": []
        },
        {
          "id": "web",
          "x": 849,
          "y": 88,
          "w": 346,
          "h": 100,
          "title": "Dashboard surface",
          "sub": "Render · edit · cross-filter",
          "kind": "ui",
          "icon": "graph",
          "owner": "Web customDashboard",
          "desc": "Web renders custom dashboards, edits layouts and applies cross-filters. Insights redirects here.",
          "note": "Check chart state, markdown rendering and variable interactions.",
          "refs": [
            20
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "ECharts / markdown / grid editor",
          "state": "Web renders custom dashboards, edits layouts and applies cross-filters. Insights redirects here.",
          "related": []
        },
        {
          "id": "sources",
          "x": 45,
          "y": 312,
          "w": 346,
          "h": 100,
          "title": "Source engines",
          "sub": "SQL / Databricks paths",
          "kind": "external",
          "icon": "db",
          "owner": "Gateway universal_dashboard_viewer",
          "desc": "Dashboard viewers have data-source-specific execution paths.",
          "note": "Keep source credentials, SQL safety and refresh permissions isolated.",
          "refs": [
            20
          ],
          "status": "Source-verified integration",
          "chips": [],
          "contract": "SQL runner / Databricks configuration",
          "state": "Dashboard viewers have data-source-specific execution paths.",
          "related": []
        },
        {
          "id": "viewer",
          "x": 447,
          "y": 312,
          "w": 346,
          "h": 100,
          "title": "Universal viewer",
          "sub": "Saved config & refresh",
          "kind": "service",
          "icon": "graph",
          "owner": "Gateway universal_dashboard_viewer",
          "desc": "A separate viewer path owns saved config, queries, charts and migrations.",
          "note": "Not all dashboards share the same rendering engine or data API.",
          "refs": [
            20
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "Charts / refresh / migration tools",
          "state": "A separate viewer path owns saved config, queries, charts and migrations.",
          "related": []
        },
        {
          "id": "tableau",
          "x": 849,
          "y": 312,
          "w": 346,
          "h": 100,
          "title": "Tableau",
          "sub": "Separate integration",
          "kind": "external",
          "icon": "plug",
          "owner": "Gateway Tableau integration",
          "desc": "Tableau is an additional integration, not the universal dashboard backend.",
          "note": "Validate its own authentication and capabilities.",
          "refs": [
            20
          ],
          "status": "Source-verified integration",
          "chips": [],
          "contract": "Tableau tool / connector path",
          "state": "Tableau is an additional integration, not the universal dashboard backend.",
          "related": []
        },
        {
          "id": "layout",
          "x": 45,
          "y": 536,
          "w": 346,
          "h": 100,
          "title": "Layout state",
          "sub": "Grid persistence",
          "kind": "data",
          "icon": "grid",
          "owner": "Web dashboard clients + external API",
          "desc": "Layout writes are distinct from spec and data-query writes.",
          "note": "Test reload, edits and compatibility with existing grids.",
          "refs": [
            20
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "Layouts / grid GET + PUT",
          "state": "Layout writes are distinct from spec and data-query writes.",
          "related": []
        },
        {
          "id": "sharing",
          "x": 447,
          "y": 536,
          "w": 346,
          "h": 100,
          "title": "Sharing",
          "sub": "Grant · revoke · consume",
          "kind": "security",
          "icon": "people",
          "owner": "Web marketplace sharing clients",
          "desc": "Shared dashboard access is independent of panel refresh and layout state.",
          "note": "Do not infer query permission solely from a shared UI link.",
          "refs": [
            20,
            21
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "Dashboard sharing / revocation APIs",
          "state": "Shared dashboard access is independent of panel refresh and layout state.",
          "related": [
            "skills",
            "access"
          ]
        },
        {
          "id": "consumers",
          "x": 849,
          "y": 536,
          "w": 346,
          "h": 100,
          "title": "Dashboard consumers",
          "sub": "Saved and shared views",
          "kind": "ui",
          "icon": "app",
          "owner": "Web marketplace / dashboard",
          "desc": "Consumers depend on specs, permissions, source availability and rendering behavior.",
          "note": "Change-impact reviews must cover all four dependencies.",
          "refs": [
            20
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "Dashboard view / variable selection",
          "state": "Consumers depend on specs, permissions, source availability and rendering behavior.",
          "related": []
        }
      ],
      "edges": [
        {
          "a": "builder",
          "b": "specs",
          "path": "M391 138H447",
          "label": "spec",
          "lx": 419.0,
          "ly": 126,
          "conditional": false,
          "anchor": "middle"
        },
        {
          "a": "specs",
          "b": "web",
          "path": "M793 138H849",
          "label": "render",
          "lx": 821.0,
          "ly": 126,
          "conditional": false,
          "anchor": "middle"
        },
        {
          "a": "sources",
          "b": "viewer",
          "path": "M391 362H447",
          "label": "query",
          "lx": 419.0,
          "ly": 350,
          "conditional": false,
          "anchor": "middle"
        },
        {
          "a": "sharing",
          "b": "consumers",
          "path": "M793 586H849",
          "label": "access",
          "lx": 821.0,
          "ly": 574,
          "conditional": false,
          "anchor": "middle"
        },
        {
          "a": "web",
          "b": "consumers",
          "path": "M849 138H835V586H849",
          "label": "",
          "lx": 1032,
          "ly": 362.0,
          "conditional": false
        },
        {
          "a": "layout",
          "b": "web",
          "path": "M218 536V516H1230V208H1022V188",
          "label": "",
          "lx": 230,
          "ly": 352.0,
          "conditional": false
        }
      ],
      "facts": [
        [
          "Implemented",
          "Specs, live panels, variable options and editor."
        ],
        [
          "Separate state",
          "Data, panels, layout and sharing."
        ],
        [
          "Multiple engines",
          "Custom renderer, SQL viewer and Tableau."
        ]
      ]
    },
    "access": {
      "name": "People & access",
      "title": "Identity is not hierarchy. Admin is not one app.",
      "subtitle": "Responsibility labels identify technical owners, not an unverified organizational RACI.",
      "height": 740,
      "nodes": [
        {
          "id": "directory",
          "x": 45,
          "y": 88,
          "w": 346,
          "h": 100,
          "title": "People directory",
          "sub": "Find a person",
          "kind": "security",
          "icon": "people",
          "owner": "Web / Matrix user directory",
          "desc": "Directory identity answers who a person is; it is not a reporting graph.",
          "note": "Preserve Matrix identity mapping and directory visibility rules.",
          "refs": [
            22
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "Matrix user_directory search",
          "state": "Directory identity answers who a person is; it is not a reporting graph.",
          "related": []
        },
        {
          "id": "ums",
          "x": 447,
          "y": 88,
          "w": 346,
          "h": 100,
          "title": "UMS hierarchy",
          "sub": "Reporting relationships",
          "kind": "external",
          "icon": "people",
          "owner": "External UMS",
          "desc": "UMS supplies hierarchy and identity enrichment to multiple consumers.",
          "note": "Live hierarchy changes can change retrieval authorization.",
          "refs": [
            22
          ],
          "status": "External / consumer-verified",
          "chips": [],
          "contract": "/user/direct-reports; CC UMS enrichment/search",
          "state": "UMS supplies hierarchy and identity enrichment to multiple consumers.",
          "related": []
        },
        {
          "id": "eligibility",
          "x": 849,
          "y": 88,
          "w": 346,
          "h": 100,
          "title": "CC eligibility",
          "sub": "Assignment + credentials",
          "kind": "security",
          "icon": "shield",
          "owner": "Orchestrator + Vault → CC scheduler",
          "desc": "Current scheduler eligibility is not a UMS user-enumeration loop.",
          "note": "Do not implement changes from stale UMS enumeration comments.",
          "refs": [
            22
          ],
          "status": "External / consumer-verified",
          "chips": [],
          "contract": "Orchestrator assignment list + Vault eligibility",
          "state": "Current scheduler eligibility is not a UMS user-enumeration loop.",
          "related": []
        },
        {
          "id": "people",
          "x": 45,
          "y": 312,
          "w": 346,
          "h": 100,
          "title": "CC People lens",
          "sub": "Synthesized work context",
          "kind": "service",
          "icon": "people",
          "owner": "backend/command-center",
          "desc": "The People lens is synthesized work context, not the directory or hierarchy itself.",
          "note": "Trace source context, identity joins and story synthesis separately.",
          "refs": [
            7,
            22
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "CC people outputs + UMS enrichment",
          "state": "The People lens is synthesized work context, not the directory or hierarchy itself.",
          "related": [
            "data"
          ]
        },
        {
          "id": "retrieval",
          "x": 447,
          "y": 312,
          "w": 346,
          "h": 100,
          "title": "Knowledge access",
          "sub": "Live hierarchy + owner scope",
          "kind": "security",
          "icon": "book",
          "owner": "backend/knowledge-base",
          "desc": "Owner and allowed reporting scopes govern evidence access.",
          "note": "Manager access to work evidence never grants access to a report’s private Ask persona.",
          "refs": [
            22,
            24
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "Authorized evidence retrieval; live UMS hierarchy",
          "state": "Owner and allowed reporting scopes govern evidence access.",
          "related": [
            "knowledge"
          ]
        },
        {
          "id": "profile",
          "x": 849,
          "y": 312,
          "w": 346,
          "h": 100,
          "title": "Admin entitlement",
          "sub": "Profile-based guard",
          "kind": "security",
          "icon": "shield",
          "owner": "Web AdminConsoleGuard",
          "desc": "The web guard controls entry to an external admin iframe.",
          "note": "UI hiding is not a substitute for external server authorization.",
          "refs": [
            23
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "profile.admin_console_access",
          "state": "The web guard controls entry to an external admin iframe.",
          "related": []
        },
        {
          "id": "admin",
          "x": 45,
          "y": 536,
          "w": 346,
          "h": 100,
          "title": "Platform Admin",
          "sub": "External iframe",
          "kind": "external",
          "icon": "app",
          "owner": "External admin implementation + web host",
          "desc": "The external Admin Panel implementation is not in this workspace.",
          "note": "Verify token audience, iframe boundary and server permissions with its owner.",
          "refs": [
            23
          ],
          "status": "External / consumer-verified",
          "chips": [],
          "contract": "Runtime URL /aic/overview + user token",
          "state": "The external Admin Panel implementation is not in this workspace.",
          "related": []
        },
        {
          "id": "kbadmin",
          "x": 447,
          "y": 536,
          "w": 346,
          "h": 100,
          "title": "Knowledge Admin",
          "sub": "Workspaces · jobs · evals",
          "kind": "ui",
          "icon": "book",
          "owner": "backend/knowledge-base admin",
          "desc": "Knowledge Admin manages Knowledge jobs and lifecycle separately.",
          "note": "Retention and cleanup changes require data-lifecycle tests.",
          "refs": [
            23,
            25
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "Views / extraction / cleanup / retention controls",
          "state": "Knowledge Admin manages Knowledge jobs and lifecycle separately.",
          "related": [
            "knowledge"
          ]
        },
        {
          "id": "ops",
          "x": 849,
          "y": 536,
          "w": 346,
          "h": 100,
          "title": "Runtime controls",
          "sub": "Reset · restart · health",
          "kind": "ui",
          "icon": "server",
          "owner": "Gateway / AIBot operations clients",
          "desc": "Runtime operational controls are not the Platform Admin console.",
          "note": "Validate destructive scope and tenant isolation.",
          "refs": [
            23,
            27
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "Operational reset/restart contracts",
          "state": "Runtime operational controls are not the Platform Admin console.",
          "related": [
            "operations"
          ]
        }
      ],
      "edges": [
        {
          "a": "directory",
          "b": "people",
          "path": "M218 188V312",
          "label": "identity",
          "lx": 228,
          "ly": 250.0,
          "conditional": false
        },
        {
          "a": "ums",
          "b": "retrieval",
          "path": "M620 188V312",
          "label": "live scope",
          "lx": 630,
          "ly": 250.0,
          "conditional": false
        },
        {
          "a": "ums",
          "b": "people",
          "path": "M620 188V250.0H218V312",
          "label": "",
          "lx": 230,
          "ly": 240.0,
          "conditional": false
        },
        {
          "a": "profile",
          "b": "admin",
          "path": "M1022 412V474.0H218V536",
          "label": "",
          "lx": 230,
          "ly": 464.0,
          "conditional": false
        }
      ],
      "facts": [
        [
          "Three meanings",
          "Directory identity, reporting graph, People lens."
        ],
        [
          "Private means self",
          "Report persona is not manager evidence."
        ],
        [
          "Three admin surfaces",
          "External console, Knowledge Admin, runtime ops."
        ]
      ]
    },
    "permission": {
      "name": "Permission control",
      "title": "Ask, refuse, or just instructed.",
      "subtitle": "What the bot must clear before acting. Some gates ask a human and block in code (fail closed); some refuse server-side with no ask; the rest are only a prompt instruction. Note where a gate degrades off Matrix or on autonomous turns.",
      "height": 740,
      "nodes": [
        {
          "id": "exec",
          "x": 45,
          "y": 88,
          "w": 346,
          "h": 100,
          "title": "Shell command approval",
          "sub": "Allow once · always · deny",
          "kind": "security",
          "icon": "bolt",
          "owner": "backend/gateway exec approvals",
          "desc": "A shell command missing the allowlist (or any command when ask=always) is blocked and forwarded to a human before it runs; elevated (“sudo”) mode is itself a gate — it needs tools.elevated.enabled + allowed + allowFrom.<provider>, else it is forced off.",
          "note": "Defaults security=deny, ask=on-miss, askFallback=deny — fails closed. ~2-min approval timeout; allow-always persists an allowlist entry. Skipped for allowlisted/safe builtins; only elevated-full bypasses. Forwarder is channel-agnostic (works off Matrix). A tool-result safety filter can still block secret-exfil / prompt-override in the output.",
          "refs": [
            27
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "requiresExecApproval → allow-once / allow-always / deny",
          "state": "A shell command missing the allowlist (or any command when ask=always) is blocked and forwarded to a human before it runs; elevated (“sudo”) mode is itself a gate — it needs tools.elevated.enabled + allowed + allowFrom.<provider>, else it is forced off.",
          "related": []
        },
        {
          "id": "destructive",
          "x": 447,
          "y": 88,
          "w": 346,
          "h": 100,
          "title": "Destructive confirmation",
          "sub": "ask_question · delete / stop",
          "kind": "security",
          "icon": "search",
          "owner": "backend/gateway ask_question tool",
          "desc": "Delete / permanent-stop and any confirm-first action present a clickable card and wait; on the 3-minute timeout it returns no-answer and stops — it never auto-selects. Separately, in a group room a NON-owner using a Tier-2 tool triggers a real owner-approval card (5-min, per-room mutex) before it runs.",
          "note": "The ask_question tool is UNREGISTERED off Matrix (channel≠matrix or no room target ⇒ null), so on Slack/Telegram/Discord this and every confirm-first item degrade to prompt-only. Empty selection = no answer. The group owner-approval gate is inert in DMs, for the owner, and for Tier-1 read tools.",
          "refs": [
            27
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "ask_question card, destructive hint; blocks, never auto-selects",
          "state": "Delete / permanent-stop and any confirm-first action present a clickable card and wait; on the 3-minute timeout it returns no-answer and stops — it never auto-selects. Separately, in a group room a NON-owner using a Tier-2 tool triggers a real owner-approval card (5-min, per-room mutex) before it runs.",
          "related": []
        },
        {
          "id": "install",
          "x": 849,
          "y": 88,
          "w": 346,
          "h": 100,
          "title": "Install · config · workflow HITL",
          "sub": "Skill click · tenant Apply · approval/choice/prompt",
          "kind": "security",
          "icon": "shield",
          "owner": "backend/gateway + app-builder + workflow",
          "desc": "Marketplace install needs the user’s actual click (one-time ~5-min token); tenant-config needs an owner Apply on a diff (Matrix+owner+sender-bound, 5-min, optimistic-concurrency guard); workflows can park on approval()/choice()/prompt()/send(buttons). Publishing/sharing an app has its own server gates: a plugin needs an APPROVED version first, and only the app owner may share/update it.",
          "note": "All fail closed except choice(), which AUTO-SELECTS its first option on timeout. approval() = 10-min deny, supports a delegated assignee, and auto-denies off-pod (no HITL transport). Install rides ask_question, so it too is Matrix-only. BSG also 403s app-owner mismatches and the reserved system-skill-* namespace.",
          "refs": [
            21,
            16
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "One-time click token · owner Apply on diff · durable approval/choice/prompt",
          "state": "Marketplace install needs the user’s actual click (one-time ~5-min token); tenant-config needs an owner Apply on a diff (Matrix+owner+sender-bound, 5-min, optimistic-concurrency guard); workflows can park on approval()/choice()/prompt()/send(buttons). Publishing/sharing an app has its own server gates: a plugin needs an APPROVED version first, and only the app owner may share/update it.",
          "related": [
            "skills",
            "workflows"
          ]
        },
        {
          "id": "a2a",
          "x": 45,
          "y": 312,
          "w": 346,
          "h": 100,
          "title": "Agent-to-agent send",
          "sub": "sessions_send · allowlist",
          "kind": "service",
          "icon": "flow",
          "owner": "backend/gateway sessions-send tool",
          "desc": "Sending to another agent (or spawning A2A work) is refused unless agent-to-agent is enabled and the target is on the allowlist — a config gate, not a human ask. A cross-tenant target is always forbidden, and a sandboxed sub-agent can only reach sessions it spawned.",
          "note": "Fail-closed: disabled by default ⇒ forbidden. No human-approval step before spawning a sub-agent. Sub-agents also run a fixed tool-deny list (no gateway, sessions_send, install, memory, cron) and cannot spawn deeper.",
          "refs": [
            9,
            27
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "tools.agentToAgent.enabled + allow allowlist → else forbidden",
          "state": "Sending to another agent (or spawning A2A work) is refused unless agent-to-agent is enabled and the target is on the allowlist — a config gate, not a human ask. A cross-tenant target is always forbidden, and a sandboxed sub-agent can only reach sessions it spawned.",
          "related": []
        },
        {
          "id": "roomacl",
          "x": 447,
          "y": 312,
          "w": 346,
          "h": 100,
          "title": "Invite / kick a person",
          "sub": "BSG precheck · Synapse power level",
          "kind": "service",
          "icon": "people",
          "owner": "BSG → UMS → Synapse",
          "desc": "Adding or removing someone runs as the acting human: BSG’s invite-precheck refuses (owner not in room, invitee not a person, not a group, owner cannot invite) and Synapse enforces the caller’s own power level on kick. Deleting a room needs the caller to be a live room admin (403 not_room_admin) — a distinct gate from kick.",
          "note": "Server-side refusal, not an ask. The bot can never exceed what its owner may do in the room; where PL is unreadable it defers to Synapse. Enterprise invite fan-out is also throttled by a per-server token bucket.",
          "refs": [
            4,
            17
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "invite-precheck 403s · kick uses caller power level",
          "state": "Adding or removing someone runs as the acting human: BSG’s invite-precheck refuses (owner not in room, invitee not a person, not a group, owner cannot invite) and Synapse enforces the caller’s own power level on kick. Deleting a room needs the caller to be a live room admin (403 not_room_admin) — a distinct gate from kick.",
          "related": [
            "collaboration"
          ]
        },
        {
          "id": "configwrite",
          "x": 849,
          "y": 312,
          "w": 346,
          "h": 100,
          "title": "Blocked-outright actions",
          "sub": "Config-write · mandatory deny · banned account",
          "kind": "service",
          "icon": "shield",
          "owner": "backend/gateway tool policy + exec + UMS auth",
          "desc": "Some actions are refused with no ask at all: a shell command that writes aibot.json is hard-blocked (use the config method), a mandatory deny (gateway, nodes) can never be re-enabled by a tenant, and every call made as a banned or marked-for-deletion user is 403/401’d server-side.",
          "note": "Tenants can only narrow tool policy, never widen; the mandatory deny is unioned in last. Protected/infrastructure config fields cannot be changed. Email send and other high-rate paths are also 429-throttled per bot. Using a stored secret is policy-governed, not a per-use ask.",
          "refs": [
            27
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "Exec writing aibot.json throws · SAAS_MANDATORY_DENY (gateway, nodes) · banned/deleted user 403",
          "state": "Some actions are refused with no ask at all: a shell command that writes aibot.json is hard-blocked (use the config method), a mandatory deny (gateway, nodes) can never be re-enabled by a tenant, and every call made as a banned or marked-for-deletion user is 403/401’d server-side.",
          "related": []
        },
        {
          "id": "send",
          "x": 45,
          "y": 536,
          "w": 346,
          "h": 100,
          "title": "Send to anyone but you",
          "sub": "Message · email · channel · invite",
          "kind": "data",
          "icon": "chat",
          "owner": "backend/gateway messaging tools",
          "desc": "The prompt tells the model to confirm (show recipient + content, wait for a matching yes) before messaging, emailing, broadcasting or a calendar invite to anyone but the current user; WHO you message is not code-gated. But WHERE is: a code policy blocks sends outside the bound room/provider unless cross-context is explicitly allowed, and in a channel chat only the owner may act in other rooms.",
          "note": "The recipient confirm is model + ask_question no-auto-select only, so it is unenforced off Matrix; the cross-context / cross-room block is real code and always applies. Replying to the current user is never gated; file sharing is a separate multi-option confirm flow with a permanence warning.",
          "refs": [
            9,
            27
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "System-prompt confirm-first; recipient identity not code-gated",
          "state": "The prompt tells the model to confirm (show recipient + content, wait for a matching yes) before messaging, emailing, broadcasting or a calendar invite to anyone but the current user; WHO you message is not code-gated. But WHERE is: a code policy blocks sends outside the bound room/provider unless cross-context is explicitly allowed, and in a channel chat only the owner may act in other rooms.",
          "related": []
        },
        {
          "id": "spendext",
          "x": 447,
          "y": 536,
          "w": 346,
          "h": 100,
          "title": "Spend · external writes",
          "sub": "Payment · publish · tickets · PRs",
          "kind": "data",
          "icon": "flag",
          "owner": "backend/gateway tools",
          "desc": "Spending money, purchasing, publishing to a registry, or external writes (tickets, PRs, third-party APIs), and destructive ops like delete/force-push/DB changes are confirm-first instructions. One kind of spend IS code-enforced: provisioning a MicroVM runs a fail-closed credit check and refuses (402 credit-exhausted / 503) when the tenant is out of credit.",
          "note": "Purchase/payment writes have no dedicated code gate — prompt-only, hard-gated only if routed through the shell (exec), plus the uncertain/low-confidence rule tells the model to ask first. The MicroVM credit gate is real (flag-gated, re-checked at resolution to catch races).",
          "refs": [
            26
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "Confirm-first; most spend prompt-only, but compute has a hard credit gate",
          "state": "Spending money, purchasing, publishing to a registry, or external writes (tickets, PRs, third-party APIs), and destructive ops like delete/force-push/DB changes are confirm-first instructions. One kind of spend IS code-enforced: provisioning a MicroVM runs a fail-closed credit check and refuses (402 credit-exhausted / 503) when the tenant is out of credit.",
          "related": []
        },
        {
          "id": "caveat",
          "x": 849,
          "y": 536,
          "w": 346,
          "h": 100,
          "title": "Where gates do not fire",
          "sub": "Off-Matrix · autonomous · not-a-gate",
          "kind": "data",
          "icon": "loop",
          "owner": "backend/gateway runtime",
          "desc": "Off Matrix the ask tools are absent so confirm-first is prompt-only; autonomous turns (cron, goals, heartbeat) do not call ask_question and are gated only by session send-policy. Some things people expect to ask do not: replying to you, request_connection (your ask is the consent), device pairing (a human approves an inbound node). Secrets are their own model: in a group chat only pre-approved vault keys are usable, and any other key auto-requests approval.",
          "note": "Send-policy defaults to allow unless a deny rule is set. request_connection blocks ~5 min for the OAuth round-trip; pairing is owner-initiated, not a bot self-prompt. Node/device pairing requests expire after 5 min.",
          "refs": [
            26,
            27
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "Non-Matrix degrade · cron/goals bypass · non-asks",
          "state": "Off Matrix the ask tools are absent so confirm-first is prompt-only; autonomous turns (cron, goals, heartbeat) do not call ask_question and are gated only by session send-policy. Some things people expect to ask do not: replying to you, request_connection (your ask is the consent), device pairing (a human approves an inbound node). Secrets are their own model: in a group chat only pre-approved vault keys are usable, and any other key auto-requests approval.",
          "related": [
            "operations"
          ]
        }
      ],
      "edges": [
        {
          "a": "exec",
          "b": "a2a",
          "path": "M218 188V312",
          "label": "then",
          "lx": 228,
          "ly": 250.0,
          "conditional": false
        },
        {
          "a": "destructive",
          "b": "roomacl",
          "path": "M620 188V312",
          "label": "then",
          "lx": 630,
          "ly": 250.0,
          "conditional": false
        },
        {
          "a": "install",
          "b": "configwrite",
          "path": "M1022 188V312",
          "label": "then",
          "lx": 1032,
          "ly": 250.0,
          "conditional": false
        },
        {
          "a": "a2a",
          "b": "send",
          "path": "M218 412V536",
          "label": "vs prompt",
          "lx": 228,
          "ly": 474.0,
          "conditional": false
        },
        {
          "a": "roomacl",
          "b": "spendext",
          "path": "M620 412V536",
          "label": "vs prompt",
          "lx": 630,
          "ly": 474.0,
          "conditional": false
        },
        {
          "a": "configwrite",
          "b": "caveat",
          "path": "M1022 412V536",
          "label": "vs prompt",
          "lx": 1032,
          "ly": 474.0,
          "conditional": false
        }
      ],
      "facts": [
        [
          "Three kinds",
          "Some gates ask and block (fail closed), some refuse server-side, most confirm-first are prompt-only — but a few things people call prompt-only have a real code block underneath (compute credit, cross-room sends, banned accounts)."
        ],
        [
          "Off Matrix",
          "ask_question is unregistered, so every confirm-first action degrades to prompt-only; exec approval, cross-context and server-side refusals still apply."
        ],
        [
          "Autonomous bypass",
          "Cron / goals / heartbeat turns skip the ask gates; only session send-policy and the code refusals apply."
        ]
      ]
    },
    "data": {
      "name": "Knowledge & CC",
      "title": "How information becomes useful.",
      "subtitle": "Two independent pipelines. Arrows show information flow; the lower loop spans future runs.",
      "height": 800,
      "nodes": [
        {
          "id": "l0",
          "x": 45,
          "y": 117,
          "w": 200,
          "h": 86,
          "title": "Source records",
          "sub": "L0 · immutable inputs",
          "kind": "external",
          "icon": "file",
          "owner": "Brain Data",
          "desc": "Raw connector material retained as source objects, not user-facing answers.",
          "note": "Verify tenant authorization, request/output compatibility and the owning service before changing this boundary.",
          "refs": [
            2,
            6
          ],
          "status": "External / consumer-verified",
          "chips": [],
          "contract": "Immutable L0 source records → changed-content selection",
          "state": "Raw connector material retained as source objects, not user-facing answers.",
          "related": []
        },
        {
          "id": "extract",
          "x": 290,
          "y": 117,
          "w": 210,
          "h": 86,
          "title": "L1 extraction",
          "sub": "Durable Pi batches",
          "kind": "service",
          "icon": "brain",
          "owner": "Knowledge / workspace/l1-processing.ts",
          "desc": "Conversation-aware L1 batches use capability-only Pi in the owner workspace, cumulative retries and exact citations. No generic shell/filesystem tools.",
          "note": "Prompt edits alone do not trigger historical re-extraction. Saved config can override the default prompt.",
          "refs": [
            5,
            25
          ],
          "status": "Source verified",
          "chips": [],
          "related": [
            "knowledge",
            "change"
          ],
          "contract": "Effective prompt/config + source hashes → durable L1 batches and validated citations",
          "state": "Conversation-aware L1 batches use capability-only Pi in the owner workspace, cumulative retries and exact citations. No generic shell/filesystem tools."
        },
        {
          "id": "l1",
          "x": 545,
          "y": 117,
          "w": 205,
          "h": 86,
          "title": "Published L1",
          "sub": "Evidence + index",
          "kind": "data",
          "icon": "db",
          "owner": "Knowledge / workspace revisions",
          "desc": "Validated content and indexes become visible through CURRENT publication.",
          "note": "L1 owner scope and source attribution are enforced during retrieval.",
          "refs": [
            2,
            6
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "Validated evidence and search artifacts → CURRENT revision publication",
          "state": "Validated content and indexes become visible through CURRENT publication.",
          "related": []
        },
        {
          "id": "views",
          "x": 795,
          "y": 117,
          "w": 195,
          "h": 86,
          "title": "Views",
          "sub": "Generated documents",
          "kind": "data",
          "icon": "book",
          "owner": "Knowledge / view-generation workflow",
          "desc": "Separate scheduled/on-demand generation over the owner and allowed report memory.",
          "note": "Publishing L1 does not mean every view is immediately regenerated.",
          "refs": [
            2,
            6
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "Scheduled/on-demand generation over authorized evidence",
          "state": "Separate scheduled/on-demand generation over the owner and allowed report memory.",
          "related": []
        },
        {
          "id": "ask",
          "x": 1035,
          "y": 117,
          "w": 160,
          "h": 86,
          "title": "Ask",
          "sub": "Cited answers",
          "kind": "ui",
          "icon": "search",
          "owner": "Knowledge Ask + authorized memory consumers",
          "desc": "Retrieves allowed evidence and synthesizes answers. L1 can be retrieved without a generated view.",
          "note": "Private Ask memory/persona is self-only; manager retrieval must not expose report persona.",
          "refs": [
            11,
            24
          ],
          "status": "Source verified",
          "chips": [],
          "related": [
            "knowledge"
          ],
          "contract": "Authorized evidence and generated views → cited answers; self-only private memory",
          "state": "Retrieves allowed evidence and synthesizes answers. L1 can be retrieved without a generated view."
        },
        {
          "id": "collect",
          "x": 45,
          "y": 429,
          "w": 200,
          "h": 86,
          "title": "Collect",
          "sub": "Own source inputs",
          "kind": "external",
          "icon": "plug",
          "owner": "CC collectors",
          "desc": "Collects Slack, Gmail, calendar, Matrix and meeting data; selected Slack traffic can use Brain Data L0.",
          "note": "Verify tenant authorization, request/output compatibility and the owning service before changing this boundary.",
          "refs": [
            4
          ],
          "status": "Local / external inputs",
          "chips": [],
          "contract": "Source-specific CC collectors; optional Brain Data Slack L0",
          "state": "Collects Slack, Gmail, calendar, Matrix and meeting data; selected Slack traffic can use Brain Data L0.",
          "related": []
        },
        {
          "id": "signals",
          "x": 290,
          "y": 429,
          "w": 210,
          "h": 86,
          "title": "Signals",
          "sub": "Extract + resolve",
          "kind": "service",
          "icon": "bolt",
          "owner": "CC stage 1",
          "desc": "Source-specific model calls extract signals and check whether open work was resolved.",
          "note": "Verify tenant authorization, request/output compatibility and the owning service before changing this boundary.",
          "refs": [
            7
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "Stage-1 source extraction and open-work resolution checks",
          "state": "Source-specific model calls extract signals and check whether open work was resolved.",
          "related": []
        },
        {
          "id": "stories",
          "x": 545,
          "y": 429,
          "w": 205,
          "h": 86,
          "title": "Stories",
          "sub": "Work + people context",
          "kind": "service",
          "icon": "file",
          "owner": "CC stage 2",
          "desc": "Synthesizes work stories and people context, incorporating existing active work and CC preferences.",
          "note": "Verify tenant authorization, request/output compatibility and the owning service before changing this boundary.",
          "refs": [
            7,
            10
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "Stage-2 synthesis using signals, active work and stored CC preferences",
          "state": "Synthesizes work stories and people context, incorporating existing active work and CC preferences.",
          "related": []
        },
        {
          "id": "priorities",
          "x": 795,
          "y": 387,
          "w": 195,
          "h": 74,
          "title": "Priorities",
          "sub": "Group + order",
          "kind": "service",
          "icon": "flag",
          "owner": "CC priority pipeline",
          "desc": "Uses stories plus previous groups and feedback to build and assign priority groups.",
          "note": "The stage2-priorities prompt is executed inside run_stage3.",
          "refs": [
            7,
            10
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "stage2-priorities.md executed inside run_stage3",
          "state": "Uses stories plus previous groups and feedback to build and assign priority groups.",
          "related": []
        },
        {
          "id": "briefs",
          "x": 795,
          "y": 518,
          "w": 195,
          "h": 74,
          "title": "Briefings",
          "sub": "Daily + meeting prep",
          "kind": "service",
          "icon": "file",
          "owner": "CC stage 3 / calendar stage 4",
          "desc": "Separate narrative/agent outputs and calendar preparation use story and calendar context.",
          "note": "The map groups two output stages. Same-run narrative does not consume the new priority output; draft generation is disabled in the inspected caller.",
          "refs": [
            7
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "Parallel stage-3 narrative/agent outputs and calendar preparation",
          "state": "Separate narrative/agent outputs and calendar preparation use story and calendar context.",
          "related": []
        },
        {
          "id": "dashboard",
          "x": 1035,
          "y": 444,
          "w": 160,
          "h": 86,
          "title": "Deliver",
          "sub": "Product UI",
          "kind": "ui",
          "icon": "app",
          "owner": "CC → BSG → AIBot → clients",
          "desc": "Persisted output is returned to product surfaces. Partial runs can retain usable results.",
          "note": "Verify tenant authorization, request/output compatibility and the owning service before changing this boundary.",
          "refs": [
            4,
            7
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "Persisted CC results → BSG → AIBot → client product surfaces",
          "state": "Persisted output is returned to product surfaces. Partial runs can retain usable results.",
          "related": []
        },
        {
          "id": "feedback",
          "x": 765,
          "y": 635,
          "w": 270,
          "h": 66,
          "title": "Feedback & preferences",
          "sub": "Rate → consolidate → reuse",
          "kind": "data",
          "icon": "loop",
          "owner": "CC actions + dream pipeline",
          "desc": "Recent feedback influences future priority groups; consolidation writes CC preferences that influence future stories.",
          "note": "Not model-weight training. Rating, resolving and unrating are distinct operations.",
          "refs": [
            8,
            9,
            10
          ],
          "status": "Source verified",
          "chips": [],
          "related": [
            "change"
          ],
          "contract": "Rating reason → recent context / consolidation → future CC preferences",
          "state": "Recent feedback influences future priority groups; consolidation writes CC preferences that influence future stories."
        }
      ],
      "edges": [
        {
          "a": "l0",
          "b": "extract",
          "path": "M245 160H290",
          "label": "",
          "lx": 0,
          "ly": 0,
          "conditional": false
        },
        {
          "a": "extract",
          "b": "l1",
          "path": "M500 160H545",
          "label": "",
          "lx": 0,
          "ly": 0,
          "conditional": false
        },
        {
          "a": "l1",
          "b": "views",
          "path": "M750 160H795",
          "label": "",
          "lx": 0,
          "ly": 0,
          "conditional": false
        },
        {
          "a": "views",
          "b": "ask",
          "path": "M990 160H1035",
          "label": "",
          "lx": 0,
          "ly": 0,
          "conditional": false
        },
        {
          "a": "l1",
          "b": "ask",
          "path": "M647 203V245H1115V203",
          "label": "direct evidence retrieval",
          "lx": 780,
          "ly": 237,
          "conditional": false
        },
        {
          "a": "collect",
          "b": "signals",
          "path": "M245 472H290",
          "label": "",
          "lx": 0,
          "ly": 0,
          "conditional": false
        },
        {
          "a": "signals",
          "b": "stories",
          "path": "M500 472H545",
          "label": "",
          "lx": 0,
          "ly": 0,
          "conditional": false
        },
        {
          "a": "stories",
          "b": "priorities",
          "path": "M750 450H770V424H795",
          "label": "",
          "lx": 0,
          "ly": 0,
          "conditional": false
        },
        {
          "a": "stories",
          "b": "briefs",
          "path": "M750 493H770V555H795",
          "label": "",
          "lx": 0,
          "ly": 0,
          "conditional": false
        },
        {
          "a": "priorities",
          "b": "dashboard",
          "path": "M990 424H1013V466H1035",
          "label": "",
          "lx": 0,
          "ly": 0,
          "conditional": false
        },
        {
          "a": "briefs",
          "b": "dashboard",
          "path": "M990 555H1013V507H1035",
          "label": "",
          "lx": 0,
          "ly": 0,
          "conditional": false
        },
        {
          "a": "dashboard",
          "b": "feedback",
          "path": "M1115 530V668H1035",
          "label": "",
          "lx": 0,
          "ly": 0,
          "conditional": false
        },
        {
          "a": "feedback",
          "b": "stories",
          "path": "M765 668H647V515",
          "label": "future runs",
          "lx": 649,
          "ly": 614,
          "conditional": true
        },
        {
          "a": "feedback",
          "b": "priorities",
          "path": "M945 635V615H1210V369H892V387",
          "label": "future grouping",
          "lx": 1045,
          "ly": 608,
          "conditional": true
        }
      ],
      "facts": [
        [
          "L0 → L1",
          "Source material becomes attributed memory."
        ],
        [
          "Parallel outputs",
          "Priorities and narratives are siblings."
        ],
        [
          "Freshness",
          "Reprocess ≠ regenerate ≠ retrieve."
        ]
      ]
    },
    "knowledge": {
      "name": "Knowledge lifecycle",
      "title": "Evidence and private memory have different rules.",
      "subtitle": "Durable ingestion, immutable publication, authorized retrieval and self-only assistant memory.",
      "height": 740,
      "nodes": [
        {
          "id": "l0",
          "x": 45,
          "y": 88,
          "w": 346,
          "h": 100,
          "title": "L0 source inputs",
          "sub": "Content-hash change detection",
          "kind": "external",
          "icon": "file",
          "owner": "Brain Data → Knowledge",
          "desc": "Unchanged source-content hashes are no-ops even after a prompt edit.",
          "note": "Historical prompt changes require explicit reprocessing; do not promise automatic backfill.",
          "refs": [
            2,
            5,
            25
          ],
          "status": "External / consumer-verified",
          "chips": [],
          "contract": "Immutable source snapshots / ingestion handoff",
          "state": "Unchanged source-content hashes are no-ops even after a prompt edit.",
          "related": []
        },
        {
          "id": "batches",
          "x": 447,
          "y": 88,
          "w": 346,
          "h": 100,
          "title": "Durable L1 batches",
          "sub": "Conversation-aware extraction",
          "kind": "service",
          "icon": "brain",
          "owner": "Knowledge bounded ingestion workers",
          "desc": "Extraction uses owner workspace capabilities, not generic shell/filesystem tools. GitHub commits batch by repo/UTC day with exact citations.",
          "note": "Review effective prompts, batch identity, retries and source attribution together.",
          "refs": [
            25
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "Capability-only Pi; durable cumulative retries",
          "state": "Extraction uses owner workspace capabilities, not generic shell/filesystem tools. GitHub commits batch by repo/UTC day with exact citations.",
          "related": []
        },
        {
          "id": "published",
          "x": 849,
          "y": 88,
          "w": 346,
          "h": 100,
          "title": "Published evidence",
          "sub": "L1 + search artifacts",
          "kind": "data",
          "icon": "db",
          "owner": "Knowledge shared workspace runtime",
          "desc": "Published revisions expose attributed evidence and reusable search artifacts.",
          "note": "Embedding changes can require compatible index rebuilds; publication ≠ view regeneration.",
          "refs": [
            2,
            6,
            25
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "CURRENT revisions; reusable search/embedding artifacts",
          "state": "Published revisions expose attributed evidence and reusable search artifacts.",
          "related": []
        },
        {
          "id": "views",
          "x": 45,
          "y": 312,
          "w": 346,
          "h": 100,
          "title": "Generated views",
          "sub": "Scheduled / on demand",
          "kind": "data",
          "icon": "book",
          "owner": "Knowledge view workflows",
          "desc": "Views are derived documents with a separate generation lifecycle.",
          "note": "Reprocess L0, regenerate a view and retrieve an answer are different actions.",
          "refs": [
            2,
            6
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "Authorized owner/report evidence → generated document",
          "state": "Views are derived documents with a separate generation lifecycle.",
          "related": []
        },
        {
          "id": "ask",
          "x": 447,
          "y": 312,
          "w": 346,
          "h": 100,
          "title": "Ask & retrieval",
          "sub": "Answers with evidence",
          "kind": "service",
          "icon": "search",
          "owner": "Knowledge Ask + live UMS authorization",
          "desc": "Ask retrieves authorized work evidence. Persona is guidance, never performance evidence.",
          "note": "Check citations, owner access and manager/report privacy independently.",
          "refs": [
            11,
            22,
            24
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "Ask streaming; evidence retrieval + citations",
          "state": "Ask retrieves authorized work evidence. Persona is guidance, never performance evidence.",
          "related": []
        },
        {
          "id": "persona",
          "x": 849,
          "y": 312,
          "w": 346,
          "h": 100,
          "title": "Private Ask memory",
          "sub": "Remember · forget · style",
          "kind": "security",
          "icon": "shield",
          "owner": "Knowledge assistant memory",
          "desc": "Memory and persona are self-only. A manager cannot retrieve a report’s persona.",
          "note": "Explicit mutation waits; automatic turn capture is asynchronous.",
          "refs": [
            24
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "assistant-memory/CURRENT; journals / persona",
          "state": "Memory and persona are self-only. A manager cannot retrieve a report’s persona.",
          "related": []
        },
        {
          "id": "sessions",
          "x": 45,
          "y": 536,
          "w": 346,
          "h": 100,
          "title": "Ask session bodies",
          "sub": "Workspace-owned history",
          "kind": "data",
          "icon": "file",
          "owner": "Knowledge Ask session store",
          "desc": "Bodies live in workspace storage; Postgres stores metadata/leases.",
          "note": "Keep session migration fallback and metadata/body consistency.",
          "refs": [
            24
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "_index/ask-sessions/...; historical migration fallback",
          "state": "Bodies live in workspace storage; Postgres stores metadata/leases.",
          "related": [
            "collaboration"
          ]
        },
        {
          "id": "dbos",
          "x": 447,
          "y": 536,
          "w": 346,
          "h": 100,
          "title": "DBOS + control DB",
          "sub": "Durable commits / queues",
          "kind": "cloud",
          "icon": "flow",
          "owner": "Knowledge Postgres + DBOS workers",
          "desc": "Durable execution and publication commits use Knowledge control-plane state.",
          "note": "Do not transfer DBOS retry assumptions to CC single-attempt pipeline jobs.",
          "refs": [
            14,
            24,
            25
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "Bounded worker ingestion + separate scheduler queue",
          "state": "Durable execution and publication commits use Knowledge control-plane state.",
          "related": [
            "infra",
            "data"
          ]
        },
        {
          "id": "cleanup",
          "x": 849,
          "y": 536,
          "w": 346,
          "h": 100,
          "title": "Cleanup & retention",
          "sub": "Derived data + DB lifecycle",
          "kind": "data",
          "icon": "loop",
          "owner": "Knowledge lifecycle workers/admin",
          "desc": "Workspace-derived cleanup and database retention are distinct lifecycle work.",
          "note": "Test retries, references, leases and retained records before deleting data.",
          "refs": [
            23,
            25
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "Durable derived cleanup; database retention",
          "state": "Workspace-derived cleanup and database retention are distinct lifecycle work.",
          "related": [
            "access"
          ]
        }
      ],
      "edges": [
        {
          "a": "l0",
          "b": "batches",
          "path": "M391 138H447",
          "label": "",
          "lx": 419.0,
          "ly": 126,
          "conditional": false,
          "anchor": "middle"
        },
        {
          "a": "batches",
          "b": "published",
          "path": "M793 138H849",
          "label": "publish",
          "lx": 821.0,
          "ly": 126,
          "conditional": false,
          "anchor": "middle"
        },
        {
          "a": "published",
          "b": "ask",
          "path": "M1022 188V250.0H620V312",
          "label": "",
          "lx": 632,
          "ly": 240.0,
          "conditional": false
        },
        {
          "a": "views",
          "b": "ask",
          "path": "M391 362H447",
          "label": "documents",
          "lx": 419.0,
          "ly": 350,
          "conditional": false,
          "anchor": "middle"
        },
        {
          "a": "persona",
          "b": "ask",
          "path": "M849 362H793",
          "label": "self only",
          "lx": 821.0,
          "ly": 350,
          "conditional": false,
          "anchor": "middle"
        },
        {
          "a": "ask",
          "b": "dbos",
          "path": "M620 412V536",
          "label": "durable turns",
          "lx": 630,
          "ly": 474.0,
          "conditional": false
        },
        {
          "a": "dbos",
          "b": "sessions",
          "path": "M447 586H391",
          "label": "commit",
          "lx": 419.0,
          "ly": 574,
          "conditional": false,
          "anchor": "middle"
        }
      ],
      "facts": [
        [
          "No automatic backfill",
          "Prompt edits do not change L0 hashes."
        ],
        [
          "Two memory roles",
          "Work evidence versus private assistant guidance."
        ],
        [
          "Separate pipelines",
          "No proven Knowledge L1 → Command Center feed."
        ]
      ]
    },
    "change": {
      "name": "Change impact",
      "title": "Follow contracts, not just arrows.",
      "subtitle": "A review method with two source-backed examples. Traces model relationships; they do not calculate guaranteed blast radius.",
      "height": 740,
      "nodes": [
        {
          "id": "entry",
          "x": 45,
          "y": 88,
          "w": 346,
          "h": 100,
          "title": "1 · Define the change",
          "sub": "Surface + intended behavior",
          "kind": "external",
          "icon": "search",
          "owner": "Feature owner / reviewer",
          "desc": "Start with the affected surface, selected engine/flag and technical authority.",
          "note": "Check upstream requests and downstream consumers; arrow direction is not a complete impact analysis.",
          "refs": [
            3,
            16,
            30
          ],
          "status": "Review method",
          "chips": [],
          "contract": "Entry point → transport → service owner",
          "state": "Start with the affected surface, selected engine/flag and technical authority.",
          "related": []
        },
        {
          "id": "contracts",
          "x": 447,
          "y": 88,
          "w": 346,
          "h": 100,
          "title": "2 · Follow the contract",
          "sub": "Schema + permissions + state",
          "kind": "external",
          "icon": "flow",
          "owner": "Cross-service owners",
          "desc": "Inspect each boundary for validation, authorization, defaults and saved state.",
          "note": "An external service with consumer evidence still needs owner-side verification.",
          "refs": [
            4,
            9,
            15,
            23
          ],
          "status": "Review method",
          "chips": [],
          "contract": "Request / event / persisted representation",
          "state": "Inspect each boundary for validation, authorization, defaults and saved state.",
          "related": []
        },
        {
          "id": "verify",
          "x": 849,
          "y": 88,
          "w": 346,
          "h": 100,
          "title": "3 · Verify the rollout",
          "sub": "Regression + migration + gates",
          "kind": "external",
          "icon": "shield",
          "owner": "Implementers + release owners",
          "desc": "Plan compatibility tests and any data replay or cache invalidation explicitly.",
          "note": "No diagram certifies deployed versions or organizational ownership.",
          "refs": [
            5,
            11,
            16,
            25
          ],
          "status": "Review method",
          "chips": [],
          "contract": "Tests / flags / backfill / observability",
          "state": "Plan compatibility tests and any data replay or cache invalidation explicitly.",
          "related": []
        },
        {
          "id": "prompt",
          "x": 45,
          "y": 312,
          "w": 346,
          "h": 100,
          "title": "Effective L1 prompt",
          "sub": "Default versus saved config",
          "kind": "data",
          "icon": "file",
          "owner": "Knowledge prompt/config owner",
          "desc": "Saved configuration may override the default; changing the file alone may not change the effective prompt.",
          "note": "Verify selected prompt/model and extraction schema.",
          "refs": [
            5,
            12
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "Default extraction prompt + saved override",
          "state": "Saved configuration may override the default; changing the file alone may not change the effective prompt.",
          "related": []
        },
        {
          "id": "backfill",
          "x": 447,
          "y": 312,
          "w": 346,
          "h": 100,
          "title": "Explicit reprocessing",
          "sub": "Content hashes still apply",
          "kind": "data",
          "icon": "loop",
          "owner": "Knowledge ingestion owner",
          "desc": "Unchanged content is skipped; historical re-extraction needs an explicit plan.",
          "note": "Test retries, exact citations, publication and evaluation before broad replay.",
          "refs": [
            5,
            6,
            25
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "L0 hashes → durable L1 ingestion",
          "state": "Unchanged content is skipped; historical re-extraction needs an explicit plan.",
          "related": []
        },
        {
          "id": "consumers",
          "x": 849,
          "y": 312,
          "w": 346,
          "h": 100,
          "title": "Regenerate & evaluate",
          "sub": "Views / retrieval / Ask",
          "kind": "data",
          "icon": "book",
          "owner": "Knowledge serving owner",
          "desc": "Downstream views may need regeneration; Ask can retrieve evidence directly.",
          "note": "Do not include CC as a proven L1 downstream consumer.",
          "refs": [
            6,
            11,
            25
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "Published L1 → views and evidence retrieval",
          "state": "Downstream views may need regeneration; Ask can retrieve evidence directly.",
          "related": [
            "knowledge",
            "data"
          ]
        },
        {
          "id": "tag_ui",
          "x": 45,
          "y": 536,
          "w": 346,
          "h": 100,
          "title": "Client reason picker",
          "sub": "Web + mobile serialization",
          "kind": "ui",
          "icon": "flag",
          "owner": "Web / mobile CC clients",
          "desc": "Only the first negative tag is sent today, even if the UI selects more.",
          "note": "A multi-reason feature is a larger contract change than one new reason.",
          "refs": [
            8
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "First selected tag → underscore-separated reason",
          "state": "Only the first negative tag is sent today, even if the UI selects more.",
          "related": []
        },
        {
          "id": "tag_api",
          "x": 447,
          "y": 536,
          "w": 346,
          "h": 100,
          "title": "Closed allowlists",
          "sub": "Gateway + CC validation",
          "kind": "security",
          "icon": "shield",
          "owner": "Gateway CC actions + CC API",
          "desc": "Both server layers validate reason values. UI-only additions are rejected.",
          "note": "One new reason does not inherently require a DB migration; update both validators.",
          "refs": [
            9
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "Accepted reason enum / allowlists; TEXT column",
          "state": "Both server layers validate reason values. UI-only additions are rejected.",
          "related": []
        },
        {
          "id": "tag_loop",
          "x": 849,
          "y": 536,
          "w": 346,
          "h": 100,
          "title": "Future preferences",
          "sub": "Rate → consolidate → reuse",
          "kind": "service",
          "icon": "loop",
          "owner": "CC feedback + dream pipeline",
          "desc": "Recent feedback affects priority grouping; consolidated CC preferences influence future stories.",
          "note": "This is neither model-weight training nor Knowledge private memory.",
          "refs": [
            10
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "Feedback → recent priority context / consolidation",
          "state": "Recent feedback affects priority grouping; consolidated CC preferences influence future stories.",
          "related": [
            "data"
          ]
        }
      ],
      "edges": [
        {
          "a": "entry",
          "b": "contracts",
          "path": "M391 138H447",
          "label": "inspect",
          "lx": 419.0,
          "ly": 126,
          "conditional": false,
          "anchor": "middle"
        },
        {
          "a": "contracts",
          "b": "verify",
          "path": "M793 138H849",
          "label": "test",
          "lx": 821.0,
          "ly": 126,
          "conditional": false,
          "anchor": "middle"
        },
        {
          "a": "prompt",
          "b": "backfill",
          "path": "M391 362H447",
          "label": "replay?",
          "lx": 419.0,
          "ly": 350,
          "conditional": false,
          "anchor": "middle"
        },
        {
          "a": "backfill",
          "b": "consumers",
          "path": "M793 362H849",
          "label": "publish",
          "lx": 821.0,
          "ly": 350,
          "conditional": false,
          "anchor": "middle"
        },
        {
          "a": "tag_ui",
          "b": "tag_api",
          "path": "M391 586H447",
          "label": "reason",
          "lx": 419.0,
          "ly": 574,
          "conditional": false,
          "anchor": "middle"
        },
        {
          "a": "tag_api",
          "b": "tag_loop",
          "path": "M793 586H849",
          "label": "persist",
          "lx": 821.0,
          "ly": 574,
          "conditional": false,
          "anchor": "middle"
        }
      ],
      "facts": [
        [
          "Prompt edit",
          "Effective config, replay, publish, regenerate, evaluate."
        ],
        [
          "Reason edit",
          "Clients, two validators, persistence and future context."
        ],
        [
          "Trace limits",
          "Selected links include conditional and future paths."
        ]
      ]
    },
    "ai": {
      "name": "AI & models",
      "title": "Where the intelligence lives.",
      "subtitle": "Each feature owns its instructions. Model access is shared; behavior is not.",
      "height": 740,
      "nodes": [
        {
          "id": "agent",
          "x": 45,
          "y": 92,
          "w": 345,
          "h": 110,
          "title": "Assistant",
          "sub": "Dynamic agent loop",
          "kind": "service",
          "icon": "brain",
          "owner": "AIBot runtime",
          "desc": "Combines conversation context, routing, tool policies and skills; can choose model paths dynamically.",
          "note": "Verify tenant authorization, request/output compatibility and the owning service before changing this boundary.",
          "refs": [
            13
          ],
          "status": "Source verified",
          "chips": [
            "Chat",
            "Tools",
            "Builders"
          ],
          "contract": "Conversation + routing + tool policy + skills → dynamic inference loop",
          "state": "Combines conversation context, routing, tool policies and skills; can choose model paths dynamically.",
          "related": []
        },
        {
          "id": "kbai",
          "x": 447,
          "y": 92,
          "w": 345,
          "h": 110,
          "title": "Knowledge",
          "sub": "Extract · compose · answer",
          "kind": "data",
          "icon": "book",
          "owner": "Knowledge AI feature configuration",
          "desc": "Separate model/effort settings for L1 extraction, compose, Ask, retrieval and embeddings.",
          "note": "Verify tenant authorization, request/output compatibility and the owning service before changing this boundary.",
          "refs": [
            12
          ],
          "status": "Source verified",
          "chips": [
            "L1 prompt",
            "View prompt",
            "Ask"
          ],
          "contract": "Per-feature model/effort config for extraction, compose, Ask, retrieval, embeddings",
          "state": "Separate model/effort settings for L1 extraction, compose, Ask, retrieval and embeddings.",
          "related": []
        },
        {
          "id": "ccai",
          "x": 850,
          "y": 92,
          "w": 345,
          "h": 110,
          "title": "Command Center",
          "sub": "Stage-by-stage inference",
          "kind": "service",
          "icon": "flag",
          "owner": "CC config + stage assembly",
          "desc": "Separate prompts and per-substage model/effort settings; per-user LiteLLM credentials.",
          "note": "aibot/cc-usage is a configured alias, not a verified concrete model.",
          "refs": [
            7,
            12
          ],
          "status": "Source verified",
          "chips": [
            "Signals",
            "Groups",
            "Briefs"
          ],
          "contract": "Per-substage model/effort and per-user LiteLLM credentials",
          "state": "Separate prompts and per-substage model/effort settings; per-user LiteLLM credentials.",
          "related": []
        },
        {
          "id": "promptpolicy",
          "x": 45,
          "y": 339,
          "w": 275,
          "h": 92,
          "title": "Feature instructions",
          "sub": "Prompts + schemas",
          "kind": "external",
          "icon": "file",
          "owner": "Each service / feature",
          "desc": "There is no single universal platform prompt. Prompt contracts and output validation live with their consumers.",
          "note": "This is a conceptual control, not an additional deployed service.",
          "refs": [
            5,
            7,
            12
          ],
          "status": "Conceptual grouping",
          "chips": [],
          "contract": "Feature instructions + output schemas; conceptual control, not a service",
          "state": "There is no single universal platform prompt. Prompt contracts and output validation live with their consumers.",
          "related": []
        },
        {
          "id": "proxy",
          "x": 420,
          "y": 322,
          "w": 400,
          "h": 126,
          "title": "LiteLLM gateway",
          "sub": "Authorized model routing",
          "kind": "cloud",
          "icon": "chip",
          "owner": "External model gateway",
          "desc": "Routes requests using the effective alias, endpoint and credentials supplied by the consumer.",
          "note": "A shared gateway does not mean a shared default model, shared prompt, or shared tenant context.",
          "refs": [
            12,
            13
          ],
          "status": "External / consumer-verified",
          "chips": [
            "Aliases",
            "Credentials",
            "Limits"
          ],
          "contract": "Authorized model request with effective alias / endpoint / credentials",
          "state": "Routes requests using the effective alias, endpoint and credentials supplied by the consumer.",
          "related": []
        },
        {
          "id": "access",
          "x": 920,
          "y": 339,
          "w": 275,
          "h": 92,
          "title": "Access & isolation",
          "sub": "Tenant credentials + policy",
          "kind": "security",
          "icon": "shield",
          "owner": "Runtime + service identity boundaries",
          "desc": "Model access must retain the correct tenant/user credentials and task permissions.",
          "note": "This is a cross-cutting control, not one universal access-control service.",
          "refs": [
            12,
            13
          ],
          "status": "Conceptual grouping",
          "chips": [],
          "contract": "Tenant/user identity + task policy; cross-cutting control, not a universal service",
          "state": "Model access must retain the correct tenant/user credentials and task permissions.",
          "related": []
        },
        {
          "id": "textmodels",
          "x": 45,
          "y": 585,
          "w": 345,
          "h": 72,
          "title": "Text & reasoning",
          "sub": "Generate · classify · synthesize",
          "kind": "cloud",
          "icon": "chat",
          "owner": "Configured model/provider routes",
          "desc": "Model families used for inference. Exact effective models require environment verification.",
          "note": "Verify tenant authorization, request/output compatibility and the owning service before changing this boundary.",
          "refs": [
            12,
            13
          ],
          "status": "External / routing unverified",
          "chips": [],
          "contract": "Environment-selected text/reasoning provider routes",
          "state": "Model families used for inference. Exact effective models require environment verification.",
          "related": []
        },
        {
          "id": "embeddings",
          "x": 447,
          "y": 585,
          "w": 345,
          "h": 72,
          "title": "Embedding models",
          "sub": "Semantic search vectors",
          "kind": "data",
          "icon": "graph",
          "owner": "Knowledge / runtime search consumers",
          "desc": "Represent saved content and queries for search. They are distinct from chat models.",
          "note": "Changing embedding model/dimensions may require rebuilding compatible indexes.",
          "refs": [
            12,
            13
          ],
          "status": "External / routing unverified",
          "chips": [],
          "contract": "Content/query embeddings with model-compatible index dimensions",
          "state": "Represent saved content and queries for search. They are distinct from chat models.",
          "related": []
        },
        {
          "id": "media",
          "x": 850,
          "y": 585,
          "w": 345,
          "h": 72,
          "title": "Media models",
          "sub": "Images · audio · other tools",
          "kind": "cloud",
          "icon": "bolt",
          "owner": "Tool-specific runtime configuration",
          "desc": "Documented runtime tools use their own provider/model paths. This is not a claim that every media call uses one route.",
          "note": "Verify tenant authorization, request/output compatibility and the owning service before changing this boundary.",
          "refs": [
            13
          ],
          "status": "External / documented",
          "chips": [],
          "contract": "Tool-specific image/audio/provider paths; not one universal model gateway path",
          "state": "Documented runtime tools use their own provider/model paths. This is not a claim that every media call uses one route.",
          "related": []
        }
      ],
      "edges": [
        {
          "a": "agent",
          "b": "proxy",
          "path": "M218 202V266H510V322",
          "label": "",
          "lx": 0,
          "ly": 0,
          "conditional": false
        },
        {
          "a": "kbai",
          "b": "proxy",
          "path": "M620 202V322",
          "label": "model requests",
          "lx": 635,
          "ly": 269,
          "conditional": false
        },
        {
          "a": "ccai",
          "b": "proxy",
          "path": "M1022 202V266H730V322",
          "label": "",
          "lx": 0,
          "ly": 0,
          "conditional": false
        },
        {
          "a": "proxy",
          "b": "textmodels",
          "path": "M510 448V493H218V585",
          "label": "",
          "lx": 0,
          "ly": 0,
          "conditional": false
        },
        {
          "a": "proxy",
          "b": "embeddings",
          "path": "M620 448V585",
          "label": "",
          "lx": 0,
          "ly": 0,
          "conditional": false
        },
        {
          "a": "proxy",
          "b": "media",
          "path": "M730 448V493H1022V585",
          "label": "tool-specific",
          "lx": 1040,
          "ly": 507,
          "conditional": true
        }
      ],
      "facts": [
        [
          "Prompt",
          "Instructions for a specific job."
        ],
        [
          "Runtime",
          "Coordinates context and tools."
        ],
        [
          "Model",
          "Supplies inference, not data ownership."
        ]
      ]
    },
    "infra": {
      "name": "Infrastructure",
      "title": "Where the work runs.",
      "subtitle": "Deployment inventory, not a verified network topology. Physical placement and replica counts are omitted.",
      "height": 810,
      "nodes": [
        {
          "id": "devices",
          "x": 30,
          "y": 40,
          "w": 275,
          "h": 80,
          "title": "User devices",
          "sub": "Browser · mobile · desktop",
          "kind": "ui",
          "icon": "desktop",
          "owner": "Frontend delivery surfaces",
          "desc": "Clients access hosted web/product services and assistant channels.",
          "note": "Verify deployed configuration, credentials, lifecycle and actual placement with the infrastructure owner; source manifests are not live inventory.",
          "refs": [
            3
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "Browser/native clients → service entry points",
          "state": "Clients access hosted web/product services and assistant channels.",
          "related": []
        },
        {
          "id": "edge",
          "x": 455,
          "y": 40,
          "w": 400,
          "h": 80,
          "title": "Access / routing",
          "sub": "Public and internal service entry points",
          "kind": "external",
          "icon": "flow",
          "owner": "Ingress / service gateways — deployment dependent",
          "desc": "Logical access boundary. Exact production ingress, load balancers, DNS and route placement were not audited.",
          "note": "Verify deployed configuration, credentials, lifecycle and actual placement with the infrastructure owner; source manifests are not live inventory.",
          "refs": [
            3,
            4
          ],
          "status": "External / topology unverified",
          "chips": [],
          "contract": "Logical ingress boundary; DNS, load balancers and live routes not audited",
          "state": "Logical access boundary. Exact production ingress, load balancers, DNS and route placement were not audited.",
          "related": []
        },
        {
          "id": "webhost",
          "x": 278,
          "y": 237,
          "w": 288,
          "h": 88,
          "title": "Web workload",
          "sub": "Next.js application",
          "kind": "ui",
          "icon": "app",
          "owner": "frontend/web / helm",
          "desc": "Helm service/workload templates exist for hosting the web application.",
          "note": "This is not proof of a specific live replica count or ingress topology.",
          "refs": [
            14
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "Repository Helm service/workload templates for Next.js",
          "state": "Helm service/workload templates exist for hosting the web application.",
          "related": []
        },
        {
          "id": "bothost",
          "x": 625,
          "y": 237,
          "w": 320,
          "h": 88,
          "title": "AIBot runtime",
          "sub": "Agent / gateway execution",
          "kind": "service",
          "icon": "brain",
          "owner": "AIBot + external Orchestrator",
          "desc": "Runtime placement and tenant contexts are coordinated with external orchestration.",
          "note": "Runtime workload shown from documented architecture; no live pod placement was checked.",
          "refs": [
            3,
            13
          ],
          "status": "Documented runtime",
          "chips": [],
          "contract": "Documented gateway runtime + external Orchestrator placement",
          "state": "Runtime placement and tenant contexts are coordinated with external orchestration.",
          "related": []
        },
        {
          "id": "kbapi",
          "x": 278,
          "y": 445,
          "w": 204,
          "h": 92,
          "title": "Knowledge API",
          "sub": "Content access",
          "kind": "service",
          "icon": "server",
          "owner": "Knowledge API workload",
          "desc": "Serves workspace content and authorized APIs. Separate DBOS-worker deployment templates are present.",
          "note": "Verify deployed configuration, credentials, lifecycle and actual placement with the infrastructure owner; source manifests are not live inventory.",
          "refs": [
            14,
            2
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "Authorized workspace content APIs and Knowledge control-plane access",
          "state": "Serves workspace content and authorized APIs. Separate DBOS-worker deployment templates are present.",
          "related": []
        },
        {
          "id": "kbworker",
          "x": 512,
          "y": 445,
          "w": 204,
          "h": 92,
          "title": "DBOS workers",
          "sub": "Durable KB jobs",
          "kind": "service",
          "icon": "flow",
          "owner": "Knowledge DBOS worker deployment",
          "desc": "Runs checkpointed ingestion/view workflows and reads/writes shared workspace revisions.",
          "note": "Worker deployment is independently configurable; current live replica layout is unverified.",
          "refs": [
            6,
            14
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "Configurable DBOS worker deployment; durable workspace jobs",
          "state": "Runs checkpointed ingestion/view workflows and reads/writes shared workspace revisions.",
          "related": []
        },
        {
          "id": "cchost",
          "x": 746,
          "y": 445,
          "w": 204,
          "h": 92,
          "title": "CC workload",
          "sub": "API + job workers",
          "kind": "service",
          "icon": "flag",
          "owner": "Command Center process",
          "desc": "HTTP API, scheduler and bounded worker loops run in the same process; jobs are persisted in Postgres.",
          "note": "A failed production pipeline job is not automatically requeued; later triggers create a new run.",
          "refs": [
            4,
            14
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "FastAPI + scheduler + bounded workers in one process; Postgres job queue",
          "state": "HTTP API, scheduler and bounded worker loops run in the same process; jobs are persisted in Postgres.",
          "related": []
        },
        {
          "id": "services",
          "x": 1005,
          "y": 237,
          "w": 205,
          "h": 110,
          "title": "Core services",
          "sub": "BSG · UMS · Vault",
          "kind": "external",
          "icon": "shield",
          "owner": "External service repositories",
          "desc": "Service identity, organization hierarchy, credentials and Orchestrator dependencies support the workloads.",
          "note": "Not placed inside a specific network/cluster boundary because their deployment was not audited.",
          "refs": [
            4,
            13
          ],
          "status": "External / placement unverified",
          "chips": [],
          "contract": "BSG service identity/routing; UMS hierarchy; Vault credentials",
          "state": "Service identity, organization hierarchy, credentials and Orchestrator dependencies support the workloads.",
          "related": []
        },
        {
          "id": "aiexternal",
          "x": 1005,
          "y": 445,
          "w": 205,
          "h": 92,
          "title": "External execution",
          "sub": "Models · app execution",
          "kind": "cloud",
          "icon": "cloud",
          "owner": "External model and execution services",
          "desc": "Separate LiteLLM model access, AgentCore authoring, shared-runner app hosting and MicroVM tool execution. App source/deployments use tenant EFS.",
          "note": "Verify deployed configuration, credentials, lifecycle and actual placement with the infrastructure owner; source manifests are not live inventory.",
          "refs": [
            13,
            15
          ],
          "status": "External / placement unverified",
          "chips": [],
          "related": [
            "apps",
            "ai"
          ],
          "contract": "LiteLLM / AgentCore / shared runners / MicroVM; app tenant EFS",
          "state": "Separate LiteLLM model access, AgentCore authoring, shared-runner app hosting and MicroVM tool execution. App source/deployments use tenant EFS."
        },
        {
          "id": "brainhost",
          "x": 30,
          "y": 445,
          "w": 190,
          "h": 92,
          "title": "Brain Data",
          "sub": "Source producer",
          "kind": "external",
          "icon": "plug",
          "owner": "External Brain Data deployment",
          "desc": "Produces source snapshots in the shared workspace and hands off ingestion to Knowledge.",
          "note": "Verify deployed configuration, credentials, lifecycle and actual placement with the infrastructure owner; source manifests are not live inventory.",
          "refs": [
            2,
            6
          ],
          "status": "External / placement unverified",
          "chips": [],
          "contract": "Source snapshots → shared workspace; ingestion handoff → Knowledge",
          "state": "Produces source snapshots in the shared workspace and hands off ingestion to Knowledge.",
          "related": []
        },
        {
          "id": "workspace",
          "x": 30,
          "y": 671,
          "w": 305,
          "h": 86,
          "title": "Shared workspace",
          "sub": "L0 · L1 · views · Ask bodies",
          "kind": "data",
          "icon": "file",
          "owner": "Brain Data sources + Knowledge memory/views",
          "desc": "Canonical workspace content includes evidence, views, private assistant memory and Ask session bodies; search artifacts support serving.",
          "note": "Volume technology, backups and physical storage topology are not asserted by this diagram.",
          "refs": [
            2,
            24,
            25
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "Owner folders, published CURRENT revisions, evidence/views/Ask bodies",
          "state": "Canonical workspace content includes evidence, views, private assistant memory and Ask session bodies; search artifacts support serving.",
          "related": []
        },
        {
          "id": "kbdb",
          "x": 403,
          "y": 671,
          "w": 300,
          "h": 86,
          "title": "Knowledge control DB",
          "sub": "Postgres · metadata / leases",
          "kind": "data",
          "icon": "db",
          "owner": "Knowledge control plane",
          "desc": "Knowledge control/run metadata, Ask metadata/leases and DBOS state; canonical Ask bodies stay in the workspace.",
          "note": "Shown as a logical database boundary. No physical server separation is implied.",
          "refs": [
            14,
            24,
            25
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "Postgres metadata/leases and DBOS workflow state; not canonical content bodies",
          "state": "Knowledge control/run metadata, Ask metadata/leases and DBOS state; canonical Ask bodies stay in the workspace.",
          "related": []
        },
        {
          "id": "ccdb",
          "x": 771,
          "y": 671,
          "w": 300,
          "h": 86,
          "title": "Command Center DB",
          "sub": "Postgres · queue / results / feedback",
          "kind": "data",
          "icon": "db",
          "owner": "Command Center",
          "desc": "CC source projections, run outputs, durable job queue and feedback state.",
          "note": "Shown separately to communicate ownership, not verified hosting separation.",
          "refs": [
            4,
            14
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "Postgres source projections, durable queue, results and feedback",
          "state": "CC source projections, run outputs, durable job queue and feedback state.",
          "related": []
        }
      ],
      "edges": [
        {
          "a": "devices",
          "b": "edge",
          "path": "M305 80H455",
          "label": "network access",
          "lx": 333,
          "ly": 69,
          "conditional": false
        },
        {
          "a": "edge",
          "b": "webhost",
          "path": "M515 120V153H422V237",
          "label": "",
          "lx": 0,
          "ly": 0,
          "conditional": false
        },
        {
          "a": "edge",
          "b": "bothost",
          "path": "M720 120V153H785V237",
          "label": "",
          "lx": 0,
          "ly": 0,
          "conditional": false
        },
        {
          "a": "bothost",
          "b": "services",
          "path": "M945 281H1005",
          "label": "",
          "lx": 0,
          "ly": 0,
          "conditional": false
        },
        {
          "a": "bothost",
          "b": "aiexternal",
          "path": "M895 325V388H1107V445",
          "label": "model / tool calls",
          "lx": 928,
          "ly": 380,
          "conditional": false
        },
        {
          "a": "services",
          "b": "cchost",
          "path": "M1107 347V411H848V445",
          "label": "CC via BSG",
          "lx": 974,
          "ly": 403,
          "conditional": false
        },
        {
          "a": "bothost",
          "b": "kbapi",
          "path": "M650 325V368H380V445",
          "label": "retrieval dependency",
          "lx": 382,
          "ly": 359,
          "conditional": false
        },
        {
          "a": "brainhost",
          "b": "kbworker",
          "path": "M125 537V567H614V537",
          "label": "ingest handoff",
          "lx": 236,
          "ly": 558,
          "conditional": false
        },
        {
          "a": "kbapi",
          "b": "workspace",
          "path": "M315 537V609H183V671",
          "label": "",
          "lx": 0,
          "ly": 0,
          "conditional": false
        },
        {
          "a": "kbworker",
          "b": "workspace",
          "path": "M565 537V624H275V671",
          "label": "",
          "lx": 0,
          "ly": 0,
          "conditional": false
        },
        {
          "a": "kbapi",
          "b": "kbdb",
          "path": "M430 537V594H478V671",
          "label": "",
          "lx": 0,
          "ly": 0,
          "conditional": false
        },
        {
          "a": "kbworker",
          "b": "kbdb",
          "path": "M665 537V610H623V671",
          "label": "",
          "lx": 0,
          "ly": 0,
          "conditional": false
        },
        {
          "a": "cchost",
          "b": "ccdb",
          "path": "M848 537V671",
          "label": "",
          "lx": 0,
          "ly": 0,
          "conditional": false
        },
        {
          "a": "brainhost",
          "b": "workspace",
          "path": "M100 537V671",
          "label": "",
          "lx": 0,
          "ly": 0,
          "conditional": false
        }
      ],
      "facts": [
        [
          "Knowledge",
          "API + configurable DBOS workers."
        ],
        [
          "Command Center",
          "API, scheduler and worker share a process."
        ],
        [
          "Not asserted",
          "Regions · replica counts · physical DB layout."
        ]
      ]
    },
    "operations": {
      "name": "Platform operations",
      "title": "The supporting capabilities matter too.",
      "subtitle": "Account, billing, access, files and execution controls are part of the platform—not one undifferentiated gateway.",
      "height": 740,
      "nodes": [
        {
          "id": "account",
          "x": 45,
          "y": 88,
          "w": 346,
          "h": 100,
          "title": "Account lifecycle",
          "sub": "Auth · onboarding · deletion",
          "kind": "security",
          "icon": "people",
          "owner": "Web/mobile clients + external account APIs",
          "desc": "Account flows establish user context and lifecycle boundaries.",
          "note": "Deletion requires owner-by-owner retention review; no global deletion guarantee is inferred.",
          "refs": [
            26
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "Account / session / onboarding / deletion clients",
          "state": "Account flows establish user context and lifecycle boundaries.",
          "related": []
        },
        {
          "id": "billing",
          "x": 447,
          "y": 88,
          "w": 346,
          "h": 100,
          "title": "Billing & usage",
          "sub": "Subscriptions · payment · topups",
          "kind": "external",
          "icon": "graph",
          "owner": "Clients + external billing services",
          "desc": "Commercial state and usage visibility have distinct service contracts.",
          "note": "Verify entitlements and payment-side idempotency with the external owner.",
          "refs": [
            26
          ],
          "status": "External / consumer-verified",
          "chips": [],
          "contract": "Subscription / payment / topup API clients",
          "state": "Commercial state and usage visibility have distinct service contracts.",
          "related": []
        },
        {
          "id": "vault",
          "x": 849,
          "y": 88,
          "w": 346,
          "h": 100,
          "title": "Vault & connections",
          "sub": "Secrets · OAuth grants",
          "kind": "security",
          "icon": "plug",
          "owner": "External Vault + connector integrations",
          "desc": "Per-user secrets and grants support authorized integrations.",
          "note": "A UI connection or installed skill does not imply every tool can use the credential.",
          "refs": [
            26,
            27
          ],
          "status": "External / consumer-verified",
          "chips": [],
          "contract": "OAuth consent / connector credentials",
          "state": "Per-user secrets and grants support authorized integrations.",
          "related": [
            "skills",
            "access"
          ]
        },
        {
          "id": "files",
          "x": 45,
          "y": 312,
          "w": 346,
          "h": 100,
          "title": "Files & artifacts",
          "sub": "Inputs and generated outputs",
          "kind": "data",
          "icon": "file",
          "owner": "Client file surfaces + gateway tools",
          "desc": "File attachments and generated artifacts participate in assistant work.",
          "note": "Check tenant scope, content access, URLs and retention for each storage path.",
          "refs": [
            27,
            30
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "File / artifact tool and client paths",
          "state": "File attachments and generated artifacts participate in assistant work.",
          "related": []
        },
        {
          "id": "delivery",
          "x": 447,
          "y": 312,
          "w": 346,
          "h": 100,
          "title": "Notifications",
          "sub": "Unread · desktop · channels",
          "kind": "ui",
          "icon": "desktop",
          "owner": "Web/mobile clients + Electron shell",
          "desc": "Clients differ in delivery and permission behavior; Electron loads hosted web.",
          "note": "Test native permissions and unread synchronization separately from web behavior.",
          "refs": [
            26,
            29,
            30
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "Notification/unread clients and native integration",
          "state": "Clients differ in delivery and permission behavior; Electron loads hosted web.",
          "related": []
        },
        {
          "id": "native",
          "x": 849,
          "y": 312,
          "w": 346,
          "h": 100,
          "title": "Native clients",
          "sub": "Main baseline ≠ feature branch",
          "kind": "ui",
          "icon": "phone",
          "owner": "frontend/mobile + frontend/electron",
          "desc": "Mobile main is the baseline; design-revamp routes are secondary branch evidence only.",
          "note": "Do not label additional feature routes as shipped mobile parity.",
          "refs": [
            29,
            30
          ],
          "status": "Baseline + secondary branch",
          "chips": [],
          "contract": "Expo / React Native; Electron hosted web",
          "state": "Mobile main is the baseline; design-revamp routes are secondary branch evidence only.",
          "related": [
            "application"
          ]
        },
        {
          "id": "tools",
          "x": 45,
          "y": 536,
          "w": 346,
          "h": 100,
          "title": "Research & media",
          "sub": "Research · browser · voice",
          "kind": "service",
          "icon": "search",
          "owner": "Gateway tools / extensions + providers",
          "desc": "Tools have provider-specific execution paths and capabilities.",
          "note": "Extension presence is not production enablement; verify permissions and model routes.",
          "refs": [
            27,
            30
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "Deep research / browser / voice / TTS paths",
          "state": "Tools have provider-specific execution paths and capabilities.",
          "related": [
            "ai"
          ]
        },
        {
          "id": "control",
          "x": 447,
          "y": 536,
          "w": 346,
          "h": 100,
          "title": "Execution controls",
          "sub": "Approvals · agents · devices",
          "kind": "security",
          "icon": "shield",
          "owner": "Gateway runtime / nodes",
          "desc": "Approval, tenant agent routing and device execution define additional trust boundaries.",
          "note": "Verify authorization before executing tools or acting through devices.",
          "refs": [
            27
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "Approval / tenant-agent / device-node contracts",
          "state": "Approval, tenant agent routing and device execution define additional trust boundaries.",
          "related": []
        },
        {
          "id": "health",
          "x": 849,
          "y": 536,
          "w": 346,
          "h": 100,
          "title": "Health & telemetry",
          "sub": "Usage · logs · diagnostics",
          "kind": "service",
          "icon": "server",
          "owner": "Gateway operations / service owners",
          "desc": "Operational diagnostics help inspect runtime behavior and failures.",
          "note": "Live deployment topology, provider mappings and enabled extensions remain unaudited.",
          "refs": [
            27,
            30
          ],
          "status": "Source verified",
          "chips": [],
          "contract": "Usage / health / log APIs",
          "state": "Operational diagnostics help inspect runtime behavior and failures.",
          "related": [
            "infra"
          ]
        }
      ],
      "edges": [
        {
          "a": "account",
          "b": "billing",
          "path": "M391 138H447",
          "label": "",
          "lx": 419.0,
          "ly": 126,
          "conditional": true,
          "anchor": "middle"
        },
        {
          "a": "vault",
          "b": "tools",
          "path": "M1022 188V208H1230V516H218V536",
          "label": "",
          "lx": 230,
          "ly": 352.0,
          "conditional": true
        },
        {
          "a": "control",
          "b": "tools",
          "path": "M447 586H391",
          "label": "authorize",
          "lx": 419.0,
          "ly": 574,
          "conditional": true,
          "anchor": "middle"
        },
        {
          "a": "native",
          "b": "delivery",
          "path": "M849 362H793",
          "label": "",
          "lx": 821.0,
          "ly": 350,
          "conditional": true,
          "anchor": "middle"
        }
      ],
      "facts": [
        [
          "Lifecycle boundaries",
          "Accounts, billing, files and credentials differ."
        ],
        [
          "Runtime breadth",
          "Research, browser, voice, devices and approvals."
        ],
        [
          "Branch honesty",
          "Mobile feature routes are not mainline parity."
        ]
      ]
    }
  }
}