Product Inventory: Objects, Layers, and Surfaces
Status: July 2026 · aligned to canon generation 8. This replaces the May 2026 quantitative snapshot of routers, migrations, and adapters from the earlier AWS-era codebase. Those counts are retained under 07 Technical as labeled history; they are not current deployment proof. What follows is the inventory that actually governs the product: the canonical objects, the four layers, and the five surfaces, each with an honest status.
1. Canonical objects
The system converges on a small set of objects so features cannot create parallel truths:
| Object | What it is |
|---|---|
| Person and Passport | Global identity root; worker-controlled portable evidence, consent, and professional state |
| Work Relationship | Organization-confirmed relationship between a worker and an employer, contractor, agency, or facility |
| Organization and Facility | Tenant, operating units, locations, departments, authority hierarchy |
| RoleRequirement | Versioned, human-authored requirements for a defined work context |
| Evidence Record and Source Receipt | Extracted or imported evidence with provenance; immutable proof a source check occurred and what it returned |
| Resolution Case and Impact Edge | One deduplicated owner of missing, expiring, ambiguous, or disputed work; tenant-isolated links to everything it affects |
| Decision Record | Named-human decision with authority, rationale, evidence basis, and policy basis |
| Work Activation and its Receipt | The atomic transaction: approved to start, with proof. Context-specific approved state with a signed, time-bound receipt and invalidation rules |
| Monitoring Job | Durable recheck and change-detection work |
| Opportunity, Requisition, Assignment | Organization demand, worker-facing job context, and version-bound units of scheduled work the organization controls |
| Consent Grant, Dispute, Correction | Explicit revocable permission; worker-visible challenge, re-verification, and propagation history |
2. The four layers
| Layer | Governing question | Canonical objects |
|---|---|---|
| RECORD | What is known about the person and active work relationship? | Person, Passport, Work Relationship |
| POLICY | What does this organization and jurisdiction require here? | RoleRequirement, organization policy, Recognition Regime |
| OPERATION | What must happen next, and who must act? | Resolution Case, Impact Edge, monitoring, governed agents |
| PROOF | Why was the outcome allowed, and what proves every step? | Source Receipt, Decision Record, Work Activation Receipt, audit ledger |
3. Surface status, July 2026
| Surface | Status | Honest boundary |
|---|---|---|
| Passport (worker) | Demonstrable, synthetic | worker.demo.rovn.to: synthetic clinician Maria Alvarez. Read-only demonstration, no real worker data |
| Readiness (facility wedge) | Demonstrable, open, synthetic | readiness.rovn.to, no login, restored 2026-07-22: Maya Patel, Sunbelt Surgical Partners, 235 synthetic clinicians |
| Operator (facility, complete) | Demonstrable, synthetic; activated in stages | operator.demo.rovn.to: synthetic Alder Crest Health Network, 1,248 synthetic workers |
| HIRE (opportunity surface) | Building | Posting, applicant capture, and apply-with-Passport flows are in active build. Launches dark; the founder flips it public. No liquidity claims |
| READ (governed API) | Designed, partially built | Governed reads of evidence state, readiness, Work Relationships, Work Activations, consent, and receipts. Ecosystem access is earned, versioned, and consent-aware |
4. Platform inventory
- Cloud spine: Google Cloud Run services, Cloud SQL for PostgreSQL, governed staging and demo hosts, secret management, and least-privilege service identities. Details in 07.1 Architecture.
- Verification adapters: registered, contract-ready, sandbox, and live transport-proven are different states, and the framework keeps them labeled. No adapter is called live without contract, credentials, transport proof, and a current source receipt.
- Audit: append-only, tamper-evident receipt design; the hash chain is one control, not proof of compliance by itself.
- Data: synthetic only. The real-data gate is fail-closed; no real roster or PHI has run through the product.
5. The counting rule
This room does not count routers, migrations, or adapters as product proof. The units that matter are completed Resolution Cases, named-human Decision Records, signed Work Activation receipts, and the measured cost of the second Work Activation versus the first. All four are instrumented targets for the first pilot, and none has a real-data value yet.