Status. Proposed design only. Nothing in this vault is GGA client approval. The GGA client documents are supplied drafts: see GGA-Source-Digest. No application, service or test has been executed; every scenario is Not executed. Delivery fees and dates are open.

Data model and invariants

Sources: Blueprint pp. 12 to 13 (GGA-Requirement-Register). Logical entities for the first release; the developer turns them into migrations, indexes and typed schemas. Not a final physical schema.

flowchart TD
  U[User<br/>verified email] --> M[Company membership<br/>user, company, role]
  M --> C[Company<br/>owner, status]
  C --> PV[Profile version<br/>attested_at, due_at]
  C --> I[Interest<br/>company, opportunity, pitch]
  O[Opportunity<br/>owner_user_id, partner_id, state] --> OV[Opportunity version<br/>public / member / restricted payloads]
  O --> I
  I -->|0 or 1| INT[Introduction<br/>interest_id unique]
  INT --> CON[Consent and grant records]
  INT --> OUT[Outcome<br/>company, introduction]
  OUT --> CT[Contribution term<br/>opt-in, 12 months]
  CT --> INV[Invoice and payment]

Entities and key constraints

Entity	Minimum fields and constraints
Users and memberships	user_id, verified_email, auth_subject; membership role and active flag; unique active membership per company and user; owner transfer needs confirmation
Company invitations	invite_id, company_id, invited email, issuing owner, state, expiry_at; only an owner-authorised colleague invitation grants membership; an email domain match never does
Companies and profiles	company_id, owner_user_id, review_state; profile versions with required fields, source, attested_by, attested_at, due_at; exactly one active attested version
Partners	partner_id, accountable_user_id, country, approved_status, agreement_reference, scope; only an approved partner publishes through review
Opportunities and versions	owner_user_id, partner_id, category, country, expiry_at, state, version; public, member and restricted payloads stored separately; approved_version_id; review reason and reviewer
Interests and introductions	pitch, permitted_profile_fields, state; one active interest per company and opportunity; one introduction per interest
Consents and grants	consent: subject, recipient, scope, resource version, purpose, expiry, status. Grant: resource, grantee, issued and revoked times. Consent and grant are different records
Events and registrations	event, occurrence (start, end, timezone, capacity, meeting or venue, state); registration unique per occurrence and user; attendance stored separately
Outcomes and terms	outcome with reporting company, optional introduction or event, company_confirmed_at, type, evidence; contribution term with opt_in_at, terms_version, dates, state
Invoices and payments	invoice with external reference, currency, approved total, status; payment with unique external reference, amount, settlement date, reconciliation state
Files and operations	file owner, classification, storage key, scan state; audit actor, action, object, time; outbox job type, key, payload, status, attempts; notices, preferences, configuration versions

Integrity rules

• Every company-owned row carries company_id; every opportunity has an accountable owner and, where applicable, a partner.
• Eligibility is derived from authoritative timestamps and review status; never trust a browser-supplied eligibility flag.
• One processed settlement per provider transaction or verified bank reference; one paid term per settlement; no overlapping active terms.
• Money is stored as integer minor units with an explicit currency; operational timestamps are UTC and rendered in the user’s timezone.
• Optimistic version checks prevent concurrent edits from overwriting each other. Record state changes, consent versions, invoice actions and access grants. Never store raw secrets in audit logs.
• Index company ownership, listing state and expiry, interest status and due jobs.
• Retention periods by record type, the withdrawal path and deletion ownership are a GGA launch decision (Blueprint p. 20). The workflows themselves are requirements: correction, export and deletion-request handling owned by GGA, expiry of temporary uploads and grants, and deletion across files, indexes and future restores (p. 17).

Retained from revision 1.3

Interest records the opportunity version it responded to and no company can respond to its own listing (both Proposed carry-forwards, no GGA feedback). Immutable approved versions, one active interest per respondent per opportunity (now per company), repeat acceptance creating one record, assignee must be an authorised member, approval and outbox and delivery attempts stored separately, never logging private bodies.

Superseded

Conversation, message and next-action entities: no GGA feedback received; Proposed carry-forward only. Membership-by-invitation claim records are replaced by verified registration with owner-approved colleague invitations.