Data model¶

The relational model separates identity, application sessions, intent assessment, journey state, and resource ownership.

Core relationships¶

User
 ├── ApplicationSession
 │    └── IdentityAssurance
 ├── ResourceOwner ──> CitizenIntent
 │                 └─> PersonalJourney
 └── private Supabase document metadata (owner UUID)

CitizenIntent
 └── PersonalJourney
      ├── WorkflowTemplate (versioned reference)
      └── JourneyMilestone [many]

Main entities¶

User¶

Stores:

• internal UUID;
• pseudonymous or provider-derived citizen reference;
• minimized provider profile JSON; and
• creation/update timestamps.

The profile is minimized before storage and response.

ApplicationSession¶

Stores a SHA-256 hash of the eAkto session token, never the raw token. Sessions have a status, assurance level, expiry, and user reference.

CitizenIntent¶

Stores the original and normalized citizen message, validated parsed context, selected workflow, support decision, confidence, and timestamps.

WorkflowTemplate¶

Stores a validated JSON workflow definition under a unique (workflow_code, version) pair. Only active templates are selected for new journeys.

PersonalJourney¶

Stores the selected workflow/version, title, status, current milestone, progress percentage, and resolved context. The resolved context contains normalized intent context, redacted evidence state, high-assurance state, and submitted milestone answers.

JourneyMilestone¶

Stores a resolved snapshot of one candidate milestone:

• applicability and position;
• current status;
• inclusion or skip reason;
• dependencies;
• source rule; and
• action definition with questions and documents.

Because the resolved action is persisted, the client does not need to hardcode a form per agency.

ResourceOwner¶

Connects a user UUID to an owned INTENT or JOURNEY without copying identity fields into domain tables. API routes check this relation before returning or changing a resource.

IdentityAssurance¶

Records assurance purpose, status, level, verified field names, consent time, expiry, and temporary provider references. Services clear sensitive provider references after completion where appropriate.

Document storage¶

Document objects and metadata live in Supabase, not in the local SQLAlchemy journey tables. The backend returns a redacted evidence summary to the journey engine:

• available document codes;
• verified and active document codes; and
• allowlisted record-state attributes.

Storage paths, object hashes, provider secrets, and signed URLs are not added to journey context.

Data retention note¶

The repository implements technical minimization, but it does not define a complete production retention schedule. A deployment must add an approved policy for session, intent, assurance, journey, audit, and document retention.