docs: architecture and glossary documentation for Data Lab security and staging catalogue (71127a00) · Commits · OOP / architecture

data-lab/architecture.md

+62 −51

File changed.

Preview size limit exceeded, changes collapsed.

platform/architecture.md

+3 −2

Changes for platform/architecture.md: 3 added lines, 2 removed lines.
Original line number	Diff line number	Diff line
		@@ -796,7 +796,7 @@ this stream or a dedicated stream is carved out is left to FM/platform-infra to
		\| TF-SDK → NEF \| 3GPP OAuth2 or mTLS \| TF-SDK adapter config \|
		\| TF-SDK → Kubernetes \| ServiceAccount token or kubeconfig \| TF-SDK adapter config \|
		\| Developer → Portal \| OIDC Authorization Code Flow with PKCE (Keycloak) \| Portal \|
		\| Contributor / consumer → Nginx → Data Lab \| OIDC Authorization Code + PKCE (Keycloak realm `dataspace`) for the UI; `X-API-Key` or client-credentials token for scripted registration; anonymous read (ADR-0049) \| Data Lab \|
		\| Contributor / consumer → Nginx → Data Lab \| OIDC Authorization Code + PKCE (Keycloak realm `dataspace`) for the UI; client-credentials token of the script's own Keycloak client for scripted registration (the hub API key stays inside the Data Lab API); anonymous read (ADR-0049) \| Data Lab \|

		### Roles

		@@ -843,7 +843,7 @@ All components use `oop-commons` structured JSON logging. Every log entry includ
		\| SRM \| Process alive \| PostgreSQL + DataBus connectivity \|
		\| FM \| Process alive \| PostgreSQL + DataBus connectivity \|
		\| Portal BFF \| Process alive \| OEG reachable + IAM reachable \|
		\| Data Lab (`piveau-hub-repo`) \| HTTP 200 on `/` \| Virtuoso + `piveau-hub-search` (Elasticsearch) reachable \|
		\| Data Lab (`piveau-hub-repo`) \| HTTP 200 on `/` \| Virtuoso + `piveau-hub-search` (Elasticsearch) reachable (planned; today HTTP 200 on `/`) \|

		### Key Metrics (Phase 2)

		@@ -1513,3 +1513,4 @@ Terminology is owned by the single platform glossary — see
		\| 2.0 \| 2026-09-01 \| Ownership Matrix corrected: RFC 7807 problem+json construction for SBI refusals is SRM's, not TF-SDK's. `can_serve_target` interface listing updated to the tri-state answer (ADR-0040) and TF-SDK-owned adapter factory (ADR-0041). \|
		\| 2.0 \| 2026-09-14 \| Data Lab (draft component, next release) registered: component overview row, boundary-matrix rows for the dataset catalogue and the reserved data-transfer responsibility, security and health-check rows, compose profile `data-lab`, scaling row, Phase 4 deliverables 7–8, Intelligence-domain cross-reference (ADR-0048, ADR-0049, ADR-0050). \|
		\| 2.0 \| 2026-09-04 \| Component Boundary Matrix updated: operator-triggered federation establishment is proxied through OEG (`command.fm.*`, ADR-0043); Edge Cloud Zone locality determination for deployment targets moves from OEG to SRM as an interim layer pending a future runtime-coordinator component (ADR-0044). Placement-decisions row absorbs the new locality row (was listing an inconsistent Not-Owner set); federation admin CRUD folded into the existing EWBI row instead of a redundant new one; Not-Owner columns corrected to name the passive consumer (FM) rather than an unrelated component. \|
		\| 2.0 \| 2026-10-16 \| Data Lab security row: scripts register with a client-credentials token of their own Keycloak client; the hub API key stays inside the Data Lab API. Data Lab readiness row marked planned (data-lab architecture REQ-DL-15). \|

platform/glossary.md

+2 −1

Changes for platform/glossary.md: 2 added lines, 1 removed line.
Original line number	Diff line number	Diff line
		@@ -157,6 +157,7 @@ This is the single glossary for all Open Operator Platform (OOP) architecture do
		\| 2.0 \| 2026-07-29 \| RFC 7807 entry corrected: no longer claims all OOP components use it. It is SRM's internal-API format only; OEG's northbound API uses CAMARA's `ErrorInfo` (ADR-0030). \|
		\| 2.0 \| 2026-08-05 \| Capability instance entry corrected: `external_ref` is the backend realization ref, not a caller-facing id — caller-facing identity lives on `service_instance.id` for every family (ADR-0033). \|
		\| 2.0 \| 2026-09-01 \| Placement, Network Domain, and Control path binding entries note the device-targeted control-path-probe exception (no zone/domain pin; adapter probing, ADR-0038/ADR-0040) and TF-SDK's adapter factory (ADR-0041). \|
		\| 2.0 \| 2026-10-16 \| Staging catalogue entry corrected: records are promoted to the production catalogue `oop-org`, not to `6g-dali*` catalogues. \|

		## Data Lab Concepts

		@@ -169,5 +170,5 @@ This is the single glossary for all Open Operator Platform (OOP) architecture do
		\| DQV \| W3C Data Quality Vocabulary; `dqv:QualityMeasurement` records per distribution carry pass/fail results of data-quality expectations. \|
		\| PROV-O \| W3C provenance ontology; `prov:wasDerivedFrom` links derived datasets to their sources. \|
		\| SHACL \| W3C Shapes Constraint Language; the MAP's layered `dali-*` shapes validate records before registration. \|
		\| Staging catalogue \| The Data Lab catalogue holding submitted, not-yet-reviewed records; promotion to the community (`6g-dali*`) catalogues is a steward action. \|
		\| Staging catalogue \| The Data Lab catalogue holding submitted, not-yet-reviewed records; promotion to the production catalogue (`oop-org`) is a steward action. \|
		\| Dataspace Protocol (DSP) / EDC \| IDSA protocol for catalogue exchange, contract negotiation and transfer, and its Eclipse reference connector — the future Data Lab connector (not in the catalogue release). \|

Original line number	Diff line number	Diff line
		@@ -796,7 +796,7 @@ this stream or a dedicated stream is carved out is left to FM/platform-infra to
		\| TF-SDK → NEF \| 3GPP OAuth2 or mTLS \| TF-SDK adapter config \|
		\| TF-SDK → Kubernetes \| ServiceAccount token or kubeconfig \| TF-SDK adapter config \|
		\| Developer → Portal \| OIDC Authorization Code Flow with PKCE (Keycloak) \| Portal \|
		\| Contributor / consumer → Nginx → Data Lab \| OIDC Authorization Code + PKCE (Keycloak realm `dataspace`) for the UI; `X-API-Key` or client-credentials token for scripted registration; anonymous read (ADR-0049) \| Data Lab \|
		\| Contributor / consumer → Nginx → Data Lab \| OIDC Authorization Code + PKCE (Keycloak realm `dataspace`) for the UI; client-credentials token of the script's own Keycloak client for scripted registration (the hub API key stays inside the Data Lab API); anonymous read (ADR-0049) \| Data Lab \|

		### Roles

		@@ -843,7 +843,7 @@ All components use `oop-commons` structured JSON logging. Every log entry includ
		\| SRM \| Process alive \| PostgreSQL + DataBus connectivity \|
		\| FM \| Process alive \| PostgreSQL + DataBus connectivity \|
		\| Portal BFF \| Process alive \| OEG reachable + IAM reachable \|
		\| Data Lab (`piveau-hub-repo`) \| HTTP 200 on `/` \| Virtuoso + `piveau-hub-search` (Elasticsearch) reachable \|
		\| Data Lab (`piveau-hub-repo`) \| HTTP 200 on `/` \| Virtuoso + `piveau-hub-search` (Elasticsearch) reachable (planned; today HTTP 200 on `/`) \|

		### Key Metrics (Phase 2)

		@@ -1513,3 +1513,4 @@ Terminology is owned by the single platform glossary — see
		\| 2.0 \| 2026-09-01 \| Ownership Matrix corrected: RFC 7807 problem+json construction for SBI refusals is SRM's, not TF-SDK's. `can_serve_target` interface listing updated to the tri-state answer (ADR-0040) and TF-SDK-owned adapter factory (ADR-0041). \|
		\| 2.0 \| 2026-09-14 \| Data Lab (draft component, next release) registered: component overview row, boundary-matrix rows for the dataset catalogue and the reserved data-transfer responsibility, security and health-check rows, compose profile `data-lab`, scaling row, Phase 4 deliverables 7–8, Intelligence-domain cross-reference (ADR-0048, ADR-0049, ADR-0050). \|
		\| 2.0 \| 2026-09-04 \| Component Boundary Matrix updated: operator-triggered federation establishment is proxied through OEG (`command.fm.*`, ADR-0043); Edge Cloud Zone locality determination for deployment targets moves from OEG to SRM as an interim layer pending a future runtime-coordinator component (ADR-0044). Placement-decisions row absorbs the new locality row (was listing an inconsistent Not-Owner set); federation admin CRUD folded into the existing EWBI row instead of a redundant new one; Not-Owner columns corrected to name the passive consumer (FM) rather than an unrelated component. \|
		\| 2.0 \| 2026-10-16 \| Data Lab security row: scripts register with a client-credentials token of their own Keycloak client; the hub API key stays inside the Data Lab API. Data Lab readiness row marked planned (data-lab architecture REQ-DL-15). \|

Original line number	Diff line number	Diff line
		@@ -157,6 +157,7 @@ This is the single glossary for all Open Operator Platform (OOP) architecture do
		\| 2.0 \| 2026-07-29 \| RFC 7807 entry corrected: no longer claims all OOP components use it. It is SRM's internal-API format only; OEG's northbound API uses CAMARA's `ErrorInfo` (ADR-0030). \|
		\| 2.0 \| 2026-08-05 \| Capability instance entry corrected: `external_ref` is the backend realization ref, not a caller-facing id — caller-facing identity lives on `service_instance.id` for every family (ADR-0033). \|
		\| 2.0 \| 2026-09-01 \| Placement, Network Domain, and Control path binding entries note the device-targeted control-path-probe exception (no zone/domain pin; adapter probing, ADR-0038/ADR-0040) and TF-SDK's adapter factory (ADR-0041). \|
		\| 2.0 \| 2026-10-16 \| Staging catalogue entry corrected: records are promoted to the production catalogue `oop-org`, not to `6g-dali*` catalogues. \|

		## Data Lab Concepts

		@@ -169,5 +170,5 @@ This is the single glossary for all Open Operator Platform (OOP) architecture do
		\| DQV \| W3C Data Quality Vocabulary; `dqv:QualityMeasurement` records per distribution carry pass/fail results of data-quality expectations. \|
		\| PROV-O \| W3C provenance ontology; `prov:wasDerivedFrom` links derived datasets to their sources. \|
		\| SHACL \| W3C Shapes Constraint Language; the MAP's layered `dali-*` shapes validate records before registration. \|
		\| Staging catalogue \| The Data Lab catalogue holding submitted, not-yet-reviewed records; promotion to the community (`6g-dali*`) catalogues is a steward action. \|
		\| Staging catalogue \| The Data Lab catalogue holding submitted, not-yet-reviewed records; promotion to the production catalogue (`oop-org`) is a steward action. \|
		\| Dataspace Protocol (DSP) / EDC \| IDSA protocol for catalogue exchange, contract negotiation and transfer, and its Eclipse reference connector — the future Data Lab connector (not in the catalogue release). \|