Domain model

Status: Accepted · Version: 0.1

Entities are the language of the backend modules. Field-level contracts are the JSON schemas in contracts/schemas/. This page is the relationship contract.

Entities

Entity Owner module Notes
User users The owner
TrustedContact contacts May refer to the same human as a Recipient, but is a different record
Recipient contacts Assignment target. Not an account login until a release portal identity exists
Vault vaults Recipient-scoped container
AssetRecord assets Filed into one vault
Instruction vaults Versioned, encrypted body
LifeCheckPolicy policies Immutable once active
LifeCheckAttempt lifecheck One send attempt; not a confirmation
Escalation escalation One cycle, frozen policy version, current state
ReleasePolicy policies Immutable once active; automatic false
ReleaseCase releases Candidate, simulated, or reviewed case
VerificationEvidence escalation or releases Evidence codes for a cycle or case
Notification notifications Request, template, provider result
AuditEvent audit Append-only fact

Relationships

User
 ├── Vault: Insurance
 │     └── Recipient: Wife
 ├── Vault: Business continuity
 │     └── Recipient: Business partner
 ├── Vault: Personal message
 │     └── Recipient: Child
 │           rule: age >= 18 → HOLD
 ├── TrustedContact: Wife
 ├── TrustedContact: Brother
 └── LifeCheckPolicy (active version)
       ├── frequency: 30d
       ├── reminders: day 0 email, day 3 email, day 7 SMS
       ├── grace: 14d
       └── trusted verification: 1 of N accepted contacts

A person who is both wife-as-contact and wife-as-recipient has two ids. APIs must not treat a shared email as a join that merges privileges.

Invariants

  1. An AssetRecord has one Vault. A Vault has one User.
  2. A ReleaseCase includes only ACTIVE vaults that have an assignment. DRAFT vaults are excluded.
  3. An open Escalation references exactly one LifeCheckPolicy version.
  4. ReleaseCase.policy_version is the version whose evidence rules were applied.
  5. Instruction plaintext is not a property of any other entity, including AuditEvent and Notification.
  6. Deleting a User is a workflow (TITIP-011), not a cascading erase of audit rows.

Identifiers

Strings with a type prefix (usr_, vlt_, rel_, esc_) in the API contract. UUIDs without prefixes are an internal storage choice, not a reason to leak raw rows across modules.