Inspect Payne’s architecture
Payne separates catalog facts, durable product state, bounded interpretation, deterministic decisions, human authority, and verified application.
Operating modes and ownership
Components and ownership
- Visitor browser — Renders public UI Owner: visitor.
- Hosted Next.js — Landing, docs, guided simulation Owner: Payne application.
- Versioned fixture — Checked-in simulation evidence Owner: repository.
- Payne web — Local workspace and server actions Owner: Payne application.
- Payne worker — Durable jobs and monitoring Owner: Payne application.
- PostgreSQL — Payne durable state owner Owner: Payne.
- DataHub + MCP — Current catalog facts and bounded reads Owner: DataHub.
- Inference provider — Bounded interpretation Owner: configured provider.
- Official sandbox — Bounded application and re-ingestion Owner: Payne local-live.
Relationships
- The visitor opens the hosted Next.js application.
- Hosted simulation reads a checked-in fixture and has no live service connection.
- The visitor opens the locally running Payne web process.
- Payne web reads and writes authorized durable product state.
- The worker claims jobs and persists immutable evidence and outcomes.
- Adapters discover bounded reads through MCP and use official interfaces for allowlisted application writes.
- The worker sends bounded evidence for interpretation; the provider cannot set gate state.
- The worker applies the accepted fixture artifact only inside the official sandbox.
- The bounded scenario updates lineage before Payne performs a fresh read.
Open interactive trust map
Interactive diagram loading. The relationship list remains available.
The hosted branch ends at a checked-in fixture. There are no hidden hosted connections to DataHub, PostgreSQL, the worker, or an inference provider.
State ownership
DataHub owns current catalog facts: schemas, lineage, ownership, query context, documents, and written metadata aspects. PostgreSQL owns Shutdown Gates, immutable evidence versions, jobs, approvals, application records, monitoring, invalidations, and notification delivery records. Browser state is presentation only. Worker health proves process reachability, not gate validity.
Evidence-bound approval lifecycle
Components and ownership
- Current DataHub evidence — Catalog fact owner Owner: DataHub.
- Versioned evidence — Normalized immutable snapshot Owner: Payne PostgreSQL.
- Agent interpretation — Investigates and explains; no authority Owner: configured model.
- Deterministic evaluation — Computes contract and gate result Owner: Payne rules.
- Accountable human — Supplies authority-bound decision Owner: recorded owner.
- Apply and write back — Mutation response followed by fresh read Owner: Payne worker.
- Active monitoring — Worker schedules fresh evidence checks Owner: Payne worker.
- Fresh evidence delta — Changed graph, schema, or authority Owner: Payne PostgreSQL.
- Reaffirm or invalidate — Deterministic monitored outcome Owner: Payne rules.
Relationships
- Current DataHub facts become a bounded, versioned evidence set.
- The agent investigates only the evidence bound to the run.
- Interpretation can inform the explanation but cannot set the result.
- Deterministic rules identify whether accountable human authority is required.
- The accountable human approves the exact reviewed artifact and evidence binding.
- A mutation response is provisional until a fresh read matches; then monitoring registers.
- The worker, not a browser refresh, collects fresh evidence on schedule.
- Rules reaffirm current conditions or invalidate the prior approval.
- A reaffirmed gate remains monitored; invalidation preserves the prior decision history.
Open interactive trust map
Interactive diagram loading. The relationship list remains available.
The model cannot set gate state or supply human approval. A write response is followed by a fresh read before verification. Page visits never claim monitoring work.