Commit 796df594 authored Oct 13, 2026 by amaxilat

docs(data-lab): private catalogues through piveau access control v2

Data Lab architecture brought in line with what is built and tested:

- Access is piveau's access control v2 (hub-repo 4.4.3, hub-search 5.3.11,
  Keycloak 26.4+): a global Operator group for stewards, Viewer / Expert /
  Publisher role groups per catalogue, read from Keycloak by the Data Lab API.
  The group-named-after-the-catalogue rule and the dl-steward role are retired.
- Catalogues are public or private (fixed at creation); a dataset's access
  rights (Public / Restricted / Non-public) map to piveau's public /
  restricted / internal and the stricter of dataset and catalogue applies.
- Members are added at a level: reader, contributor or publisher.
- The public SPARQL endpoint is withdrawn: the triple store mixes private and
  public metadata. UC-DL-05 withdrawn, REQ-DL-06 reworded.
- Signed-in browsing (/browse/*), the catalogue-list home page and the single
  Data Lab UI replacing dataspace-ui.
- New REQ-DL-24 to REQ-DL-27; F2, E3, interfaces, security and revision
  history updated. ADR-0048 and ADR-0049 get dated update notes; the two
  dataspace-ui mentions in the platform architecture are corrected.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nj8JpEyMtCxzQTcFvdz5y3

parent 033e25e7

data-lab/architecture.md

+145 −55

File changed.

Preview size limit exceeded, changes collapsed.

data-lab/index.md

+1 −1

Changes for data-lab/index.md: 1 added line, 1 removed line.
Original line number	Diff line number	Diff line
		@@ -9,4 +9,4 @@ metadata profile is the normative description model.

		# Core specs

		* [Architecture](architecture.md) - the dataspace metadata catalogue (piveau-hub + dataspace-ui): mental model, use cases, scope, interfaces, deployment behind the platform Nginx/Keycloak, and the evolution path to connector, storage and pipelines
		* [Architecture](architecture.md) - the dataspace metadata catalogue (piveau-hub with the Data Lab UI and API): mental model, use cases, scope, interfaces, deployment behind the platform Nginx/Keycloak, and the evolution path to connector, storage and pipelines

decisions/0048-data-lab-piveau-hub-and-6gdali-map.md

+4 −0

Changes for decisions/0048-data-lab-piveau-hub-and-6gdali-map.md: 4 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		@@ -35,6 +35,10 @@ description model for datasets, distributions and data quality; it is vendored u
		`external-specs/` with commit pinning (ADR-0026) and is not restated in OOP specs. OOP-specific
		needs are expressed as profile extensions, never as a competing schema.

		Update 2026-10-13: the 6G-DALI `dataspace-ui` was replaced by an OOP-built Data Lab UI with a small Data Lab
		API behind it (data-lab architecture §H.7), and the pinned piveau images moved to hub-repo 4.4.x and hub-search
		5.3.11 with piveau access control v2. The decision to build on piveau-hub and the 6G-DALI MAP stands.

		The catalogue is not built on the `python-template` / `oop-commons` stack; the platform's
		"Python everywhere" decision applies to OOP-authored services, not to vendored products.

decisions/0049-data-lab-standalone-profile-shared-ingress-and-iam.md

+5 −0

Changes for decisions/0049-data-lab-standalone-profile-shared-ingress-and-iam.md: 5 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		@@ -29,6 +29,11 @@ Option (b). The Data Lab is compose profile `data-lab`, depends on profile `core
		per-component isolation rule (ADR-0025), publishes and consumes no DataBus subjects, exposes
		no `/internal/` surface, and calls no* OEG/SRM/FM API. Portal integration is a link.

		Update 2026-10-13: the realm roles `dl-contributor` and `dl-steward` are retired. Access is piveau's own access
		control v2 — a global Operator group for stewards and Viewer / Expert / Publisher role groups per catalogue, created
		by piveau — read by the Data Lab API from Keycloak (data-lab architecture F2 and §H.7). The dedicated realm, the
		shared Nginx and the compose profile stand; Keycloak must be 26.4 or newer.

		## Consequences

		Easier: zero change to existing components; one IAM and one ingress for operators; the Data

platform/architecture.md

+2 −2

Changes for platform/architecture.md: 2 added lines, 2 removed lines.
Original line number	Diff line number	Diff line
		@@ -905,7 +905,7 @@ A single root `docker-compose.yml` carries all services, gated by Compose profil
		\| `platform` \| OEG, SRM (with TF-SDK), FM, Artefact Manager \|
		\| `ai` \| AI Service, MCP Server, Qdrant \|
		\| `portal` \| Portal (Next.js dev server) + BFF \|
		\| `data-lab` \| piveau-hub-repo, piveau-hub-search, Virtuoso (+ shadow), Elasticsearch, dataspace-ui — depends on `core` for Nginx and Keycloak only (ADR-0049; draft component) \|
		\| `data-lab` \| piveau-hub-repo, piveau-hub-search, Virtuoso (+ shadow), Elasticsearch, Data Lab UI and API — depends on `core` for Nginx and Keycloak only (ADR-0049; draft component) \|
		\| `all` \| Everything \|

		### Scaling Strategy
		@@ -1087,7 +1087,7 @@ These are deliberately deferred so the MVP can land on time. They each have a cl
		\| 4 \| Performance benchmarking and optimization \| All \|
		\| 5 \| Adapter contribution guide for community \| TF-SDK \|
		\| 6 \| Advanced federation: Local Breakout, multi-zone canary \| FM, SRM \|
		\| 7 \| Data Lab — catalogue release: piveau-hub + dataspace-ui behind platform Nginx/Keycloak, 6G-DALI MAP vendored, compose profile `data-lab` ([data-lab/architecture.md](/data-lab/architecture.md), draft) \| Data Lab \|
		\| 7 \| Data Lab — catalogue release: piveau-hub + Data Lab UI and API behind platform Nginx/Keycloak, 6G-DALI MAP vendored, compose profile `data-lab` ([data-lab/architecture.md](/data-lab/architecture.md), draft) \| Data Lab \|
		\| 8 \| Data Lab — connector (Dataspace Protocol/EDC), object storage, DataOps/MLOps registration, automated data-quality service \| Data Lab \|

		---