Reference

Database schema — `cro.*` ERD

The canonical data model. Tables are color-coded by category: regulated tables carry provenance and require a Part 11 signature to promote staging → live. Click any table in the diagram to jump to its details card below, or open `/schema?table=study` to deep link.

Tables

Columns

174

Foreign keys

Regulated tables

Regulated9

Carries created_at / updated_at / created_by / provenance_id. Promotion requires a Part 11 signature.

Staging2

Where agents land their writes. State machine: proposed → reviewing → signed → promoted.

Audit2

Append-only provenance and ops logs. Not part of the regulated write path.

Reference2

External or read-only data we index but do not own.

LegendRegulatedStagingAuditReferencePKprimary keyFKforeign key

Table reference

2 of 15 tables shown (Audit only)

cro

provenance_event

Append-only ALCOA+ provenance spine. Every regulated action emits a row here before any write. Inspectors join through subject_kind/subject_id to reconstruct chain of custody.

Audit

Column	Type	Key	References	Notes
`id`	uuid	PK	—
`study_id`	uuid	nullable	—
`actor_kind`	text	required	—	human \| agent \| system
`actor_id`	text	required	—
`model_provider`	text	nullable	—
`model_id`	text	nullable	—
`model_version_id`	uuid	FK	→ cro.model_registry_version
`action`	text	required	—
`subject_kind`	text	required	—
`subject_id`	text	required	—
`retrieved_context`	jsonb	required	—
`reviewer_user_id`	uuid	nullable	—
`signature_id`	uuid	nullable	—
`occurred_at`	timestamptz	required	—
`payload`	jsonb	required	—

cro

app_log

Ops-support structured log. Also acts as the transactional outbox for buffered events (per CLAUDE.md event bus default). Not regulated; no provenance requirement.

Audit

Column	Type	Key	References
`id`	uuid	PK	—
`level`	text	required	—
`component`	text	required	—
`message`	text	required	—
`provenance_id`	uuid	FK	→ cro.provenance_event
`payload`	jsonb	required	—
`logged_at`	timestamptz	required	—