Source-agnostic governed contribution infrastructure for coordinating,
verifying, and recording work performed by humans, AI agents, or both.
Workstream binds project-defined tasks, locked rules, immutable submission
artifacts, policy-governed checks, and authorized acceptance into trusted
ContributionRecord facts. Source applications and downstream economic or
reporting systems may consume those facts but do not control Workstream's
identity, authorization, submission, review, or contribution truth. Flow
Identity is the current v0.1 external authentication provider.
A software-development lifecycle in which intent, implementation, tests, review, and durable decisions are visible in the repository. Repository records support human judgment; they do not replace GitHub permissions or create a second contribution-authorization system.
A configured work program with its own human-facing guide, submission artifact policy, checker policies, review policy, revision policy, independently published contribution policy, and queue.
The external or internal organization that provides open-ended project material
and business terms, including rubrics, task instructions and compensation
expectations. Current guide inputs are uploaded PDF/DOCX/PPTX or UTF-8 Markdown
(.md) originals, plus at least one ordinary-text task example stored with guide
metadata in PostgreSQL.
The project owner
does not author or approve Workstream's machine-readable internal policy schema.
The stable project policy that determines what canonical contributions can
earn. Its immutable published ContributionPolicyVersion contains one explicit
ContributionRule for each contribution type. Unpaid rules create no award;
payable rules reference immutable ContributionAwardDefinition rows for money,
project points, or both. A Finance Authority publishes the policy. Project
owners provide business terms but do not author the machine policy directly.
CON-03C supplies immutable storage; live award creation and fulfillment remain separate, unavailable operations.
The immutable result of evaluating one ContributionRecord against its frozen
ContributionPolicyVersion. Its instrument is money or project_points.
Money awards route downstream to payment-request/settlement adapters; points
awards route to the project-points adapter. Downstream adapters cannot create
award eligibility.
Canonical request actor and identity-link facts used by AUTH after external token
verification. Product authority comes from current Workstream grants. The removed
token-role ActorContext has no runtime replacement or compatibility projection.
Legacy registry record for a verified Flow actor. WS-AUTH-001 classifies each
row before migrating safe UUID actor identifiers into canonical
ActorProfile.id plus a new ActorIdentityLink. It is not a grant or
Workstream-owned authentication.
The single canonical Workstream actor root. It records actor kind and status;
it does not itself grant project or administrative authority. Verified
issuer/subject identities attach through ActorIdentityLink. Authority comes
from AdminRoleGrant or exact-project ProjectRoleGrant records plus resource
and lifecycle guards.
Legacy typed profile row IDs are workflow metadata IDs and never canonical actor IDs or grants.
The active-or-revoked link between one canonical issuer/opaque subject and one ActorProfile. Raw tokens, provider credentials, and full claims are not stored.
The bounded process-local operation that receives one contributor outer ZIP, inspects and checks its internal tree in private scratch, and hands passing bytes once to immutable artifact admission. It is not durable candidate storage, a Submission, or review authority; process loss before durable intent requires reupload.
Workstream's provider-neutral immutable content identity: server-computed SHA-256, byte count, and bounded media metadata. Opaque provider identifiers and protocol observations are replica details, not this record's identity.
The capacity-charged verified result of one passing submission-bundle
preparation. Its closed lifecycle is ready -> consumed|stale. A ready admission
may remain unbound through client abandonment; consumption is atomic with one
immutable Submission and binding, while proven task/predecessor/locked-context
drift may make it stale. No state expires, releases storage capacity, or
authorizes deletion in v0.1.
The immutable logical association between ArtifactContent and one exact
Workstream project/resource/logical role. Staging is not a binding. Replacement
creates a new row with supersedes_binding_id; prior rows remain history. It
records Workstream meaning and provenance, not storage-provider state.
One provider copy of ArtifactContent, identified by an opaque
provider_object_ref and optional bounded protocol observations. Verification,
availability, and integrity states belong here and do not create task or review
states. Logical Workstream references are represented only by
ArtifactBinding.
Append-only Workstream evidence for one immutable put acknowledgement. It links
the exact producer admission/attempt and replica and records operation, idempotency key,
request_digest, opaque provider_object_ref, replay observation, bounded
outcome/details, attempt number, correlation ID, and creation time. It contains
no response digest or provider receipt.
The server-generated canonical semantic description of the file/directory tree inside one contributor outer ZIP. It commits to normalized paths, entry types, each file's SHA-256/byte count, and normalized regular-file executable intent while excluding other ZIP packaging and permission metadata. It is distinct from the exact outer-ZIP SHA-256/byte count. Together they bind pre-submit evidence, verified admission, the immutable Submission, and its exact artifact binding.
The immutable WS-REV metadata projection for one exact queue entry, ReviewLease, Submission, admitting CheckerRun, stamped context, and ART binding IDs. Storage is delivered; authorized packet resolution and byte access remain separate work. The packet contains no contributor-response evidence. Separate reviewer-finding and contributor-response artifact uploads are outside v0.1.
An immutable administrative authority record for Access Administrator, Operator, Project Manager, Finance Authority, or Audit Authority at compatible system/project scope.
An immutable exact-project contributor authority record with role submitter
or reviewer. A contributor may hold both capabilities
through separate active grants.
The umbrella human product term for a person participating in Workstream. A
contributor may have exact-project submitter and reviewer
grants as independent records. Adjudicator grants and adjudication are outside v0.1.
A future separately approved initiative must define that
lifecycle before AUTH registers and activates any exact action. Celery, checker,
setup, and background workers are
internal services, not human product roles.
Where a task came from. In v0.1, sources are manual creation, controlled markdown import, or controlled CSV import.
A future external task source that can submit tasks into Workstream through an adapter. External origin onboarding is not part of v0.1.
The human-facing operating guide for a project. Uploaded PDF, DOCX, PPTX or
UTF-8 Markdown (.md) files contain project instructions, quality requirements
and review rules.
ArtifactStore/S3 holds those originals; PostgreSQL holds their metadata and the
guide version's required task-example list. At least one nonblank example is
required. An example may be a starting idea or fuller description and need not
repeat requirements supplied by the guide. Unified setup examines both together;
runtime enforcement uses approved machine-readable policies attached to the guide
version.
The Workstream-owned sufficiency record for an exact project guide and source snapshot. After ART readiness automatically triggers unified compilation, a deterministic projection creates the verified report from that compilation's sufficiency component. It records whether the guide passed, is blocked by gaps, or passed with warnings for Project Manager review. Verified material and exact projection custody bind the report to its compilation and setup generation. Manual reports and policies retain their separately authorized diagnostic/manual provenance; they cannot replace or satisfy unified compilation evidence.
A setup execution ledger that does not replace canonical policy truth. The unified path records queue/attempt diagnostics and exact compilation/projection references, then finalizes the run and its receipt immutably. Later approval, post-policy projection and correction have separate operation provenance; they do not resume or update that finalized run. Policy truth remains in the source snapshot, sufficiency report and versioned artifact, effective, pre-submit and post-submit policy rows. Legacy multi-agent continuation fields are not the design for the unified path.
The Workstream-derived, covered-Project-Manager-approved machine-readable contract for what a contributor must submit. It is derived from open-ended project guide material after guide sufficiency passes or passes with warnings, reviewed by an authorized covered Project Manager after any warnings are acknowledged, and attached to a project guide version. It defines required artifacts, evidence requirements, forbidden artifacts, attestation requirements, size limits, and project-specific packaging rules. It can add or tighten requirements, but it cannot weaken Workstream's default submission artifact rules. Server-generated manifests, SHA-256, and the configured storage provider are unconditional platform invariants rather than project policy choices.
The project-specific policy row is still SubmissionArtifactPolicy; Workstream
does not define a separate ProjectSubmissionArtifactPolicy type.
The deterministic merge of Workstream's default submission artifact policy and the project-approved submission artifact policy. Workstream computes this effective project policy before generating the project pre-submit checker policy.
The server-generated project checker matrix produced from the effective project submission artifact policy and one immutable default-catalogue snapshot. The compiled bundle embeds the catalogue version, canonical manifest digest, ordered entry ID/version/configuration hashes, and enabled/disabled state. Its compiled bundle hash therefore commits transitively to that exact snapshot, and each task locks that hash before entering the contributor pipeline. Runtime uses the same snapshot to derive the effective-plan hash. It runs against the uploaded ZIP in bounded scratch before Workstream creates a submission. ART retains bounded check results; the mounted authorized hidden preparation route returns pre_submission_checker_failed with those exact ordered bounded results in the same request. The route remains absent from OpenAPI, and public intake remains pending. POL-07B connects the internal phase service and removes the standalone JSON precheck; broader Submission caller migration remains WS-ARCH-001-02I. Results never use review decision values: accept, needs_revision, or reject.
The hidden 04B2 Workstream-default execution slice and the hidden 04B3 complete
effective execution use the closed entry statuses
passed, warning, failed, advisory_disabled, and
dependency_not_run. These are checker-execution facts, not review decisions.
04B3 executes locked project-policy entries through that same plan and persists
one immutable ordered platform-plus-project evidence set after scratch cleanup.
The contributor-facing domain error code returned when submission-bundle preparation is blocked by pre-submit checks. The mounted authorized hidden route returns this code with the exact ordered bounded results in the same request. It remains absent from OpenAPI, and public intake activation remains pending. The code is not a review decision. It must not be stored as accept, needs_revision, or reject.
A unit of work inside a project.
The contributor-safe API projection of a task's guide, project summary, review policy, revision policy, and lifecycle state. Initial work reads the task's locked context. Human-review revision reads the validated immutable RevisionContextPreparation head and digest, not a moving active-guide pointer. It does not expose source snapshot hashes, private source/import refs, compiled checker bundles, checker configs, Celery ids, or setup errors.
The contributor-safe API projection of the task's locked effective project submission artifact policy. It tells the contributor the exact required artifacts, evidence keys, forbidden artifact rules, storage reference rules, packaging rules, hash algorithm, size limits, and attestation terms before submission. ARCH-03B7 supplies separate immutable contributor and management result types with the same safe fields. Both use the original locked policy, never the current guide. ARCH-03C5 exposes both reads under exact current authority after TASK locking: the contributor requires an active same-project Submitter grant and either a ready, unassigned task or their own current active assignment; the manager requires covered Project Manager authority. The superseded public authority wrapper is removed.
An actor-specific projection of a task's exact historical guide and policy provenance: source snapshot id/hash, effective policy id/hash, pre-submit policy id/bundle hash, post-submit policy id/version/hash, review and revision policy id/generation/hash, and ContributionPolicy version UUID. Management additionally receives a bounded post-submit checker summary; operational and audit projections contain references only. ARCH-03B6 implements the projections; ARCH-03C6 exposes the three separate reads under exact current manager, Operator and Audit Authority grants.
The normalized task fields required for Workstream to screen, assign, check, review, compensate, and audit work.
The contributor supplies a summary, accountability attestation, and one outer ZIP containing every required output/evidence file. Workstream derives the archive hash/size, semantic manifest, evidence facts, verified admission, artifact binding, and immutable Submission version server-side. Clients do not supply canonical hashes, manifests, provider references, or content IDs.
A policy-bound automated check or evaluator. Pre-submission checks assess package fitness and intake quality before Submission creation; post-submission checks evaluate the immutable work against locked task/project requirements and produce durable evidence for review eligibility. They are not the same phase and their evidence is not interchangeable. Neither makes an authorized Review decision.
Checker stage does not determine whether the implementation is deterministic. Deterministic rules and supported model-based evaluators are different execution methods; a recorded model judgment is not a promise of an identical rerun. Only supported registered implementations execute. Setup agents propose policy bindings, not runtime judgments on submitted work; their existence does not mean a model-based submission evaluator is live.
The set of required and warning checks for a project phase. Pre-submit checker policy is generated from the effective project submission artifact policy. Post-submit checker policy governs durable internal checker runs after a submission is finalized into the pre-review gate.
The judgment layer where a reviewer accepts, rejects, or requests revision.
The planned durable admission record connecting one exact finalized Submission
and successful current CheckerRun, through the TASK-owned canonical
allow_review manifest, to server-selected human-review routing. The manifest
is a currentness/lineage handoff, not review authority or a review decision.
The planned permanent identity of one reviewer claim attempt. It binds the canonical human reviewer, queue entry, exact Submission packet, lease timing, and ContributionPolicyVersion copied from the immutable Submission attempt stamp, transitively inherited from Task/Assignment without current-policy lookup.
The immutable result of one valid human decision under an active ReviewLease.
Stored decisions are exactly accept, needs_revision, or reject. Later
rounds append another Review rather than modifying history.
An immutable structured issue stored with a Review. Its lifecycle
meaning is blocking or advisory; it carries bounded area, issue, and
required-fix text.
The planned immutable submitter response to one prior ReviewFinding, with bounded response text. Every unresolved blocking finding requires one response before revision submission. Storage and runtime await revision-preparation custody.
The immutable later-review judgment for one prior finding and revised
Submission: resolved, unresolved, or not_applicable, with bounded rationale.
The immutable Review-rooted next-attempt context. It records the prior
Submission; source and target TaskAssignments; prior and next Project
Guide/source, submission/checker, review, revision, task-execution, and
submitter ContributionPolicy versions; context digest; change summary; and
kept, rebased, or blocked result. A human revision rebase records forward
or backward direction where applicable and publishes one complete next-attempt
context without rewriting prior work.
The internal immutable accept-only fact and sole source of a submitter's
accepted_submission ContributionRecord. REV-04B delivers storage and REV-04C
delivers its hidden FinalAcceptance/TASK/CON participant; exact AUTH custody and
the complete canonical shared operation remain required before runtime use. See Final Acceptance
for human and planned automated source boundaries.
The complete immutable response and resolution history connecting a prior Review's findings to the next Submission and later Review.
Proof supporting task completion or review decision. Examples: logs, hashes, tests, screenshots, diffs, notes.
The provider-neutral ART v2 byte boundary beneath Workstream's typed product
capabilities. Its v0.1 byte-only operations are put, read-only
observe_put_result, open, and head; product services consume narrow typed
capabilities rather than importing the raw store. LocalStorageAdapter
implements it for development and focused tests.
S3CompatibleArtifactStore implements it for MinIO integration and AWS S3
v0.1 production deployments. Providers do
not own Workstream authorization, binding, lifecycle, audit, or integrity
decisions.
The immutable deployment-level PostgreSQL fence that binds Workstream to one configured artifact backend, adapter, provider profile, and non-secret storage namespace fingerprint. Startup and every provider operation must validate the same singleton before provider I/O. Changing a populated deployment requires a separately reviewed storage migration. For LocalStorage, the pre-provisioned private root's normalized path and filesystem identity are hashed into that fingerprint, so replacing the root at the same path fails closed before adapter construction mutates it.
A durable Celery request to read and hash a complete stored object before its replica becomes bindable. PostgreSQL coordinates execution with an executor UUID, lease expiry, and generation fencing. This infrastructure lease is not a contributor task claim or reviewer lease.
A reason- and idempotency-bound Operator authorization/audit envelope with distinct source and retry verification job IDs. It is not executable work and owns no Celery executor, execution lease, or generation; the retry verification job owns those infrastructure coordination fields.
The object-storage adapter that implements ArtifactStore using the S3
protocol. AWS S3 is the v0.1 production provider; MinIO is used for local and CI
integration proof. Cloudflare R2 is deferred to a separate approved initiative.
The award-delivery and fulfillment record set for payable compensation:
immutable CompensationAward and CompensationFulfillmentReceipt records plus
a rebuildable CompensationStatusProjection. Explicitly unpaid contribution
rules create no award.
The deferred outcome-based projection of contributor and reviewer performance. It is not a v0.1 review-transaction side effect.
CON-03C supplies immutable storage; CON-07 supplies hidden submitter participation with complete frozen award staging and exact replay in the caller's transaction. REV-04C composes it with hidden FinalAcceptance/TASK effects. Live recognition still requires source authority, database closure, currentness proof, audit/outbox and runtime composition. Reviewer participation and fulfillment remain separate future work.
The immutable, evidence-backed record of one completed contribution under locked
project context. completed_review is created for every valid recorded human
Review and binds directly to that Review and ReviewLease.
accepted_submission is created only from FinalAcceptance and the exact
TaskAssignment; it is never inferred directly from Review.decision.
Compensation records may attach to either contribution type but do not replace
the contribution record; reputation projections remain deferred.
On the human-review branch, the immutable REV-owned internal fact created only as a lifecycle consequence
of Review(accept). It binds one project, task, existing versioned Submission,
source Review, accepted submitter, recording reviewer, acceptance time, and
locked ReviewPolicy. There is no public/manual create API or separate
authorization action. needs_revision and reject create none. In v0.1 it is
unique per task, source Review, and Submission and is the sole source of an
accepted_submission ContributionRecord.
The existing ReviewPolicy boolean human_review_required
defaults true. False invokes the same acceptance operation through authorized
TASK routing after required checks pass, without a Review, ReviewLease or
reviewer contribution. The canonical shared contract
defines the exclusive Review/routing-manifest provenance and atomic CON effects.
The source flag records which trigger was used, not a second acceptance system.
REV-04C supplies the hidden mechanical participant for both sources. False
runtime activation remains unavailable until mandatory AUTH receipt, database
closure, currentness race, audit/outbox and activation proof land; raw checker
success is not authority.
The person accountable for a submitted packet, even when agents or external tools helped produce the work.
A bounded lifecycle projection for one exact project/task. It contains fixed event facts and validated claim/start assignment and authorization-decision references. ARCH-03B8 supplies its immutable contract; ARCH-03C7 supplies live covered Audit Authority access. It is not a forensic payload export or an authorization token.