Documentation Core concepts

Data, snapshots, and artifacts

Separate persistent service state, immutable data views, and bounded analysis results with exact grants.

Product guide · implementation in progress

On this page

Data, snapshots, and artifacts

Source, persistent application state, and analysis results have separate identities and permissions. Sharing one does not automatically share the others.

Object	Purpose	How access is granted
Cella Data Volume	Persistent mutable application storage, independent of a source revision	Explicit service ownership and storage policy; never a shared agent workspace
Data Snapshot	Immutable point-in-time data with integrity and provenance	Exact Data Grant for a recipient, read-only scope, limits, and expiry
Artifact	Immutable bounded result such as a test report or analysis summary	Exact Artifact Grant without access to the producing Cell's storage
Object Transfer	Digest-verified object ingress and export	Governed object identity, never caller-selected host filesystem access

Example: a Service Cell maintains a database in a Data Volume. A consistent snapshot becomes an approved Analysis Job Cell input. That job produces a bounded, classified report. An Artifact Grant lets the Agent Cell read the report without granting access to the database, job secrets, or service storage.

text

Service Cell + Data Volume
           ↓ consistent snapshot
Data Snapshot + exact Data Grant
           ↓ bounded analysis
Analysis Job Cell
           ↓ classified result
Artifact + exact Artifact Grant
           ↓ permitted read
Agent Cell

Live service communication uses Channels or a trusted query connector rather than mounting a live database file. Database-native backup or storage-consistent procedures must establish a usable snapshot; copying active files is not assumed safe.

Policy may explicitly permit an Agent Cell to read an immutable snapshot. That is a separate data-authority decision: anything given to the agent may reach its model provider. Classification, filtering, provider policy, network restrictions, limits, and expiry must therefore govern that grant. A summary is not assumed safe merely because an analysis job produced it.

Data lifecycles are explicit. Replacing application code does not implicitly replace its Data Volume, and a new runtime generation does not inherit old secret or data bindings. Service Adoption defines consistent migration and rollback boundaries; once the new service accepts writes, rollback may need data reconciliation.

Further reading: Persistent data and analysis.

Source: docs/concepts/components.md · Current feature milestones