<?xml version="1.0" encoding="UTF-8"?><database name="authrhythm" schema="public" type="PostgreSQL - 18.4 (Ubuntu 18.4-1.pgdg24.04+1)">
   <sequences>
      <sequence increment="1" name="biometric_accounts_id_seq" startValue="1"/>
      <sequence increment="1" name="biometric_device_keys_id_seq" startValue="1"/>
      <sequence increment="1" name="ssh_audit_log_id_seq" startValue="1"/>
      <sequence increment="1" name="ssh_auth_events_id_seq" startValue="1"/>
      <sequence increment="1" name="ssh_compliance_results_id_seq" startValue="1"/>
   </sequences>
   <tables>
      <table name="auth_states" remarks="" schema="public" type="TABLE">
         <column autoUpdated="false" defaultValue="null" digits="0" id="0" name="state_key" nullable="false" remarks="{&quot;what&quot;:&quot;Unique random string identifying an auth state; used as lookup key.&quot;,&quot;why&quot;:&quot;Without it, callback cannot be matched to the initiating request.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:54:38.908995707+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="1" name="state" nullable="false" remarks="{&quot;what&quot;:&quot;Serialized binary payload of the auth state (e.g., token, nonce).&quot;,&quot;why&quot;:&quot;Without it, the state's content is lost, breaking validation.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:54:38.932199694+00:00&quot;}" size="2147483647" type="bytea" typeCode="-2"/>
         <column autoUpdated="false" defaultValue="now()" digits="6" id="2" name="created_at" nullable="false" remarks="{&quot;what&quot;:&quot;Timestamp when the state was created, in UTC.&quot;,&quot;why&quot;:&quot;Without it, stale states cannot be expired or cleaned up.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:54:38.945499420+00:00&quot;}" size="35" type="timestamptz" typeCode="93"/>
         <primaryKey column="state_key" sequenceNumberInPK="1"/>
         <index name="auth_states_pkey" unique="true">
            <column ascending="true" name="state_key"/>
         </index>
      </table>
      <table name="biometric_accounts" remarks="{&quot;what&quot;:&quot;Accounts for biometric authentication; each row is one user account.&quot;,&quot;why&quot;:&quot;Without it, biometric authentication cannot be tied to a user identity.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:54:41.883164274+00:00&quot;}" schema="public" type="TABLE">
         <column autoUpdated="true" defaultValue="nextval('biometric_accounts_id_seq'::regclass)" digits="0" id="0" name="id" nullable="false" remarks="{&quot;what&quot;:&quot;Unique integer identifier for each account; auto-generated from sequence.&quot;,&quot;why&quot;:&quot;Without it, rows cannot be uniquely referenced by foreign keys or updates.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:54:41.949063234+00:00&quot;}" size="10" type="serial" typeCode="4">
            <child column="account_id" foreignKey="biometric_device_keys_account_id_fkey" implied="false" onDeleteCascade="false" schema="public" table="biometric_device_keys"/>
         </column>
         <column autoUpdated="false" defaultValue="null" digits="0" id="1" name="name" nullable="false" remarks="{&quot;what&quot;:&quot;Account display name; free-form text.&quot;,&quot;why&quot;:&quot;Without it, accounts cannot be distinguished by a human-readable label.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:54:41.996542141+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="'user'::text" digits="0" id="2" name="role" nullable="false" remarks="{&quot;what&quot;:&quot;Access role such as 'user' or 'admin'; default is 'user'.&quot;,&quot;why&quot;:&quot;Without it, authorization decisions cannot differentiate user privileges.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:54:42.120580238+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="now()" digits="6" id="3" name="created_at" nullable="false" remarks="{&quot;what&quot;:&quot;UTC timestamp when the account row was created; set to current time on insert.&quot;,&quot;why&quot;:&quot;Without it, audit trails and ordering by creation time are impossible.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:54:42.834637036+00:00&quot;}" size="35" type="timestamptz" typeCode="93"/>
         <primaryKey column="id" sequenceNumberInPK="1"/>
         <index name="biometric_accounts_pkey" unique="true">
            <column ascending="true" name="id"/>
         </index>
         <index name="biometric_accounts_name_key" unique="true">
            <column ascending="true" name="name"/>
         </index>
      </table>
      <table name="biometric_auth_config" remarks="{&quot;what&quot;:&quot;Configuration settings for biometric authentication, each row a key-value pair.&quot;,&quot;why&quot;:&quot;Without it, biometric auth parameters would be hardcoded, requiring code changes to adjust.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:54:50.785850669+00:00&quot;}" schema="public" type="TABLE">
         <column autoUpdated="false" defaultValue="null" digits="0" id="0" name="key" nullable="false" remarks="{&quot;what&quot;:&quot;Setting name such as 'max_attempts' or 'timeout_ms'.&quot;,&quot;why&quot;:&quot;Without it, settings cannot be uniquely referenced, so updates or lookups become ambiguous.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:54:50.819788547+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="1" name="value" nullable="false" remarks="{&quot;what&quot;:&quot;Setting's value as text; format depends on the key.&quot;,&quot;why&quot;:&quot;Without it, the setting has no content, so configuration is incomplete.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:54:50.855919338+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <primaryKey column="key" sequenceNumberInPK="1"/>
         <index name="biometric_auth_config_pkey" unique="true">
            <column ascending="true" name="key"/>
         </index>
      </table>
      <table name="biometric_device_keys" remarks="{&quot;what&quot;:&quot;Public keys for biometric authenticators (e.g., fingerprint, face) bound to an account.&quot;,&quot;why&quot;:&quot;Without it, biometric authentication cannot verify a device's signature or revoke a lost device.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:00.976547968+00:00&quot;}" schema="public" type="TABLE">
         <column autoUpdated="true" defaultValue="nextval('biometric_device_keys_id_seq'::regclass)" digits="0" id="0" name="id" nullable="false" remarks="{&quot;what&quot;:&quot;Unique integer ID for this device key record.&quot;,&quot;why&quot;:&quot;Without it, there is no way to target a specific device key for revocation or update.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:00.993134633+00:00&quot;}" size="10" type="serial" typeCode="4"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="1" name="account_id" nullable="false" remarks="{&quot;what&quot;:&quot;Integer ID of the user account this key belongs to.&quot;,&quot;why&quot;:&quot;Without it, we cannot determine which account a device key authorizes.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:01.009539760+00:00&quot;}" size="10" type="int4" typeCode="4">
            <parent column="id" foreignKey="biometric_device_keys_account_id_fkey" implied="false" onDeleteCascade="false" schema="public" table="biometric_accounts"/>
         </column>
         <column autoUpdated="false" defaultValue="null" digits="0" id="2" name="device_name" nullable="false" remarks="{&quot;what&quot;:&quot;Human-readable label for the device, e.g., 'iPhone 12'.&quot;,&quot;why&quot;:&quot;Without it, users cannot distinguish multiple devices in account settings.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:01.050837834+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="'secure_enclave'::text" digits="0" id="3" name="key_type" nullable="false" remarks="{&quot;what&quot;:&quot;Type of key storage, e.g., 'secure_enclave' or 'tpm'.&quot;,&quot;why&quot;:&quot;Without it, we cannot enforce platform-specific key handling or security policies.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:01.063988244+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="4" name="public_key_der" nullable="false" remarks="{&quot;what&quot;:&quot;DER-encoded public key bytes used for signature verification.&quot;,&quot;why&quot;:&quot;Without it, the server cannot verify a biometric device's cryptographic proof.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:01.083104540+00:00&quot;}" size="2147483647" type="bytea" typeCode="-2"/>
         <column autoUpdated="false" defaultValue="now()" digits="6" id="5" name="registered_at" nullable="false" remarks="{&quot;what&quot;:&quot;Date and time (with time zone) when this key was added.&quot;,&quot;why&quot;:&quot;Without it, we cannot track device enrollment history or enforce key rotation.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:01.098272719+00:00&quot;}" size="35" type="timestamptz" typeCode="93"/>
         <column autoUpdated="false" defaultValue="null" digits="6" id="6" name="last_auth_at" nullable="true" remarks="{&quot;what&quot;:&quot;Timestamp of the last successful authentication using this key, with time zone.&quot;,&quot;why&quot;:&quot;Without it, we cannot identify inactive devices for security review or user notification.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:01.124100683+00:00&quot;}" size="35" type="timestamptz" typeCode="93"/>
         <primaryKey column="id" sequenceNumberInPK="1"/>
         <index name="biometric_device_keys_pkey" unique="true">
            <column ascending="true" name="id"/>
         </index>
         <index name="biometric_device_keys_account_id_device_name_key" unique="true">
            <column ascending="true" name="account_id"/>
            <column ascending="true" name="device_name"/>
         </index>
         <index name="biometric_device_keys_public_key_der_key" unique="true">
            <column ascending="true" name="public_key_der"/>
         </index>
      </table>
      <table name="changelogs" remarks="{&quot;what&quot;:&quot;Audit trail of field-level changes to entities.&quot;,&quot;why&quot;:&quot;Without it, audit history and rollback decisions are impossible.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:54:59.345750166+00:00&quot;}" schema="public" type="TABLE">
         <column autoUpdated="false" defaultValue="null" digits="0" id="0" name="record_id" nullable="false" remarks="{&quot;what&quot;:&quot;Unique identifier for this change event, e.g., UUID.&quot;,&quot;why&quot;:&quot;Without it, change events cannot be referenced or deduplicated.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:54:59.370541627+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="1" name="entity_type" nullable="false" remarks="{&quot;what&quot;:&quot;Type of entity that changed, e.g., 'user' or 'order'.&quot;,&quot;why&quot;:&quot;Without it, changes across different entity types are indistinguishable.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:54:59.401864726+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="2" name="entity_id" nullable="false" remarks="{&quot;what&quot;:&quot;Identifier of the entity instance that changed.&quot;,&quot;why&quot;:&quot;Without it, cannot locate which record was modified.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:54:59.430791399+00:00&quot;}" size="2147483647" type="text" typeCode="12">
            <parent column="id" foreignKey="Implied Constraint" implied="true" onDeleteCascade="false" schema="public" table="ssh_pending_approvals"/>
         </column>
         <column autoUpdated="false" defaultValue="null" digits="0" id="3" name="old_record_id" nullable="true" remarks="{&quot;what&quot;:&quot;Previous entity ID if the entity's identifier changed; null otherwise.&quot;,&quot;why&quot;:&quot;Without it, an entity's history breaks when its ID is updated.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:54:59.448236524+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="4" name="new_record_id" nullable="true" remarks="{&quot;what&quot;:&quot;New entity ID if the entity's identifier changed; null otherwise.&quot;,&quot;why&quot;:&quot;Without it, the new identity of the entity is unknown after an ID change.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:54:59.462553746+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="5" name="field_name" nullable="false" remarks="{&quot;what&quot;:&quot;Name of the field that was modified, e.g., 'status'.&quot;,&quot;why&quot;:&quot;Without it, the specific change cannot be pinpointed.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:54:59.477735823+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="6" name="old_value" nullable="true" remarks="{&quot;what&quot;:&quot;Value of the field before the change, as text.&quot;,&quot;why&quot;:&quot;Without it, the previous state is lost.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:54:59.507235539+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="7" name="new_value" nullable="true" remarks="{&quot;what&quot;:&quot;Value of the field after the change, as text.&quot;,&quot;why&quot;:&quot;Without it, the new state is unknown.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:54:59.523183316+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="now()" digits="6" id="8" name="changed_at" nullable="false" remarks="{&quot;what&quot;:&quot;Timestamp of the change, with time zone, defaulting to current time.&quot;,&quot;why&quot;:&quot;Without it, the order and timing of changes is unknown.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:54:59.538770879+00:00&quot;}" size="35" type="timestamptz" typeCode="93"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="9" name="changed_by" nullable="false" remarks="{&quot;what&quot;:&quot;Identifier of the user or system that made the change.&quot;,&quot;why&quot;:&quot;Without it, accountability for changes is lost.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:54:59.556042545+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="10" name="change_reason" nullable="true" remarks="{&quot;what&quot;:&quot;Optional free-text reason for the change.&quot;,&quot;why&quot;:&quot;Without it, the motivation behind a change is unknown.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:54:59.571013150+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <primaryKey column="record_id" sequenceNumberInPK="1"/>
         <index name="changelogs_pkey" unique="true">
            <column ascending="true" name="record_id"/>
         </index>
         <index name="idx_cl_entity" unique="false">
            <column ascending="true" name="entity_type"/>
            <column ascending="true" name="entity_id"/>
            <column ascending="false" name="changed_at"/>
         </index>
      </table>
      <table name="email_change_requests" remarks="{&quot;what&quot;:&quot;Requests to change a user's email address, each with a verification token.&quot;,&quot;why&quot;:&quot;Without it, email changes could not be tracked or verified.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:11.361319674+00:00&quot;}" schema="public" type="TABLE">
         <column autoUpdated="false" defaultValue="null" digits="0" id="0" name="record_id" nullable="false" remarks="{&quot;what&quot;:&quot;Unique identifier for this request, e.g. UUID.&quot;,&quot;why&quot;:&quot;Without it, requests cannot be referenced or updated uniquely.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:11.395098715+00:00&quot;}" size="2147483647" type="text" typeCode="12">
            <child column="request_id" foreignKey="email_changes_request_id_fkey" implied="false" onDeleteCascade="false" schema="public" table="email_changes"/>
         </column>
         <column autoUpdated="false" defaultValue="null" digits="0" id="1" name="user_id" nullable="false" remarks="{&quot;what&quot;:&quot;Identifier of the user requesting the email change.&quot;,&quot;why&quot;:&quot;Without it, the request cannot be linked to an account.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:11.419626865+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="2" name="old_email" nullable="false" remarks="{&quot;what&quot;:&quot;Current email address that will be replaced.&quot;,&quot;why&quot;:&quot;Without it, the previous address is unknown after change.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:11.472528353+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="3" name="new_email" nullable="false" remarks="{&quot;what&quot;:&quot;Proposed new email address to switch to.&quot;,&quot;why&quot;:&quot;Without it, the target address is unknown and cannot be verified.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:11.520464790+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="'pending'::text" digits="0" id="4" name="status" nullable="false" remarks="{&quot;what&quot;:&quot;Current state: pending, confirmed, or expired.&quot;,&quot;why&quot;:&quot;Without it, the request's lifecycle stage is unknown.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:11.540518897+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="5" name="token_hash" nullable="false" remarks="{&quot;what&quot;:&quot;Hashed verification token sent to new email.&quot;,&quot;why&quot;:&quot;Without it, the confirmation link cannot be validated.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:11.571553085+00:00&quot;}" size="2147483647" type="text" typeCode="12">
            <parent column="token_hash" foreignKey="Implied Constraint" implied="true" onDeleteCascade="false" schema="public" table="oauth_refresh_tokens"/>
         </column>
         <column autoUpdated="false" defaultValue="now()" digits="6" id="6" name="requested_at" nullable="false" remarks="{&quot;what&quot;:&quot;Timestamp when the request was created.&quot;,&quot;why&quot;:&quot;Without it, request age and expiry cannot be computed.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:11.608389651+00:00&quot;}" size="35" type="timestamptz" typeCode="93"/>
         <column autoUpdated="false" defaultValue="null" digits="6" id="7" name="confirmed_at" nullable="true" remarks="{&quot;what&quot;:&quot;Timestamp when the user confirmed the new email.&quot;,&quot;why&quot;:&quot;Without it, confirmation status and timing are unknown.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:11.645701499+00:00&quot;}" size="35" type="timestamptz" typeCode="93"/>
         <column autoUpdated="false" defaultValue="null" digits="6" id="8" name="expired_at" nullable="true" remarks="{&quot;what&quot;:&quot;Timestamp when the request was marked expired.&quot;,&quot;why&quot;:&quot;Without it, the actual expiration time is unknown.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:11.672290730+00:00&quot;}" size="35" type="timestamptz" typeCode="93"/>
         <column autoUpdated="false" defaultValue="null" digits="6" id="9" name="expires_at" nullable="false" remarks="{&quot;what&quot;:&quot;Deadline by which the request must be confirmed.&quot;,&quot;why&quot;:&quot;Without it, the request cannot be automatically expired.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:11.715852629+00:00&quot;}" size="35" type="timestamptz" typeCode="93"/>
         <primaryKey column="record_id" sequenceNumberInPK="1"/>
         <index name="email_change_requests_pkey" unique="true">
            <column ascending="true" name="record_id"/>
         </index>
         <index name="idx_ecr_user" unique="false">
            <column ascending="true" name="user_id"/>
            <column ascending="false" name="requested_at"/>
         </index>
      </table>
      <table name="email_changes" remarks="{&quot;what&quot;:&quot;Audit log of email address changes per user.&quot;,&quot;why&quot;:&quot;Without it, no history of email updates exists for security review or rollback.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:58.335636977+00:00&quot;}" schema="public" type="TABLE">
         <column autoUpdated="false" defaultValue="null" digits="0" id="0" name="record_id" nullable="false" remarks="{&quot;what&quot;:&quot;Unique identifier for each change event; primary key.&quot;,&quot;why&quot;:&quot;Ensures each change row is addressable and deduplicable.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:58.347897831+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="1" name="user_id" nullable="false" remarks="{&quot;what&quot;:&quot;Identifier of the user whose email was changed.&quot;,&quot;why&quot;:&quot;Links the change to the user account; without it, changes cannot be attributed.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:58.358428616+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="2" name="request_id" nullable="true" remarks="{&quot;what&quot;:&quot;Optional identifier of the originating request or workflow.&quot;,&quot;why&quot;:&quot;Correlates the change to a specific action or batch; without it, provenance is lost.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:58.377536379+00:00&quot;}" size="2147483647" type="text" typeCode="12">
            <parent column="record_id" foreignKey="email_changes_request_id_fkey" implied="false" onDeleteCascade="false" schema="public" table="email_change_requests"/>
         </column>
         <column autoUpdated="false" defaultValue="null" digits="0" id="3" name="old_email" nullable="false" remarks="{&quot;what&quot;:&quot;Email address before the change.&quot;,&quot;why&quot;:&quot;Needed to verify previous contact and to support revert or audit.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:58.404360448+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="4" name="new_email" nullable="false" remarks="{&quot;what&quot;:&quot;Email address after the change.&quot;,&quot;why&quot;:&quot;Records the new value; without it, the change is meaningless.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:58.423241264+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="5" name="old_user_record" nullable="true" remarks="{&quot;what&quot;:&quot;Snapshot of the user record before the change, if captured.&quot;,&quot;why&quot;:&quot;Preserves prior state for rollback or comparison; without it, only email is known.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:58.437067344+00:00&quot;}" size="2147483647" type="text" typeCode="12">
            <parent column="record_id" foreignKey="email_changes_old_user_record_fkey" implied="false" onDeleteCascade="false" schema="public" table="users"/>
         </column>
         <column autoUpdated="false" defaultValue="null" digits="0" id="6" name="new_user_record" nullable="true" remarks="{&quot;what&quot;:&quot;Snapshot of the user record after the change, if captured.&quot;,&quot;why&quot;:&quot;Captures post-change state for audit or restoration; without it, later state is unknown.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:58.462552642+00:00&quot;}" size="2147483647" type="text" typeCode="12">
            <parent column="record_id" foreignKey="email_changes_new_user_record_fkey" implied="false" onDeleteCascade="false" schema="public" table="users"/>
         </column>
         <column autoUpdated="false" defaultValue="now()" digits="6" id="7" name="changed_at" nullable="false" remarks="{&quot;what&quot;:&quot;Timestamp when the change was recorded, defaulting to now.&quot;,&quot;why&quot;:&quot;Provides chronological order and audit timeline; without it, sequence is ambiguous.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:58.478959356+00:00&quot;}" size="35" type="timestamptz" typeCode="93"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="8" name="changed_by" nullable="false" remarks="{&quot;what&quot;:&quot;Identifier of the actor who performed the change.&quot;,&quot;why&quot;:&quot;Attributes responsibility; without it, accountability is lost.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:58.498182386+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <primaryKey column="record_id" sequenceNumberInPK="1"/>
         <index name="email_changes_pkey" unique="true">
            <column ascending="true" name="record_id"/>
         </index>
      </table>
      <table name="email_verification_tokens" remarks="{&quot;what&quot;:&quot;Tokens that verify a user's ownership of a new email address.&quot;,&quot;why&quot;:&quot;Without it, email changes could be made without proof of control.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:29.617335886+00:00&quot;}" schema="public" type="TABLE">
         <column autoUpdated="false" defaultValue="null" digits="0" id="0" name="record_id" nullable="false" remarks="{&quot;what&quot;:&quot;Unique identifier for each verification record.&quot;,&quot;why&quot;:&quot;Without it, records could not be uniquely referenced or updated.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:29.631667954+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="1" name="user_id" nullable="false" remarks="{&quot;what&quot;:&quot;User account that requested the email change.&quot;,&quot;why&quot;:&quot;Without it, we cannot know which user the token belongs to.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:29.659078813+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="2" name="new_email" nullable="false" remarks="{&quot;what&quot;:&quot;Email address being verified for the user.&quot;,&quot;why&quot;:&quot;Without it, the target address for verification is unknown.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:29.717786920+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="3" name="token_hash" nullable="false" remarks="{&quot;what&quot;:&quot;Hashed token value sent to the new email.&quot;,&quot;why&quot;:&quot;Without it, the token cannot be validated without storing plaintext.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:29.733105352+00:00&quot;}" size="2147483647" type="text" typeCode="12">
            <parent column="token_hash" foreignKey="Implied Constraint" implied="true" onDeleteCascade="false" schema="public" table="oauth_refresh_tokens"/>
         </column>
         <column autoUpdated="false" defaultValue="now()" digits="6" id="4" name="created_at" nullable="false" remarks="{&quot;what&quot;:&quot;Timestamp when the token was issued.&quot;,&quot;why&quot;:&quot;Without it, we cannot enforce token age or audit issuance.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:29.803669975+00:00&quot;}" size="35" type="timestamptz" typeCode="93"/>
         <column autoUpdated="false" defaultValue="null" digits="6" id="5" name="expires_at" nullable="false" remarks="{&quot;what&quot;:&quot;Timestamp after which the token is invalid.&quot;,&quot;why&quot;:&quot;Without it, tokens would never expire, allowing indefinite reuse.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:29.819371961+00:00&quot;}" size="35" type="timestamptz" typeCode="93"/>
         <column autoUpdated="false" defaultValue="null" digits="6" id="6" name="used_at" nullable="true" remarks="{&quot;what&quot;:&quot;Timestamp when the token was consumed, null if unused.&quot;,&quot;why&quot;:&quot;Without it, we cannot prevent token reuse or know if it was used.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:29.841319386+00:00&quot;}" size="35" type="timestamptz" typeCode="93"/>
         <primaryKey column="record_id" sequenceNumberInPK="1"/>
         <index name="email_verification_tokens_pkey" unique="true">
            <column ascending="true" name="record_id"/>
         </index>
         <index name="idx_evt_hash" unique="false">
            <column ascending="true" name="token_hash"/>
         </index>
      </table>
      <table name="login_attempts" remarks="{&quot;what&quot;:&quot;Log of each login attempt with outcome and context.&quot;,&quot;why&quot;:&quot;Without it, security incidents and account lockouts cannot be investigated.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:24.089241297+00:00&quot;}" schema="public" type="TABLE">
         <column autoUpdated="false" defaultValue="null" digits="0" id="0" name="record_id" nullable="false" remarks="{&quot;what&quot;:&quot;Unique opaque identifier for each attempt; primary key.&quot;,&quot;why&quot;:&quot;Without it, attempts cannot be referenced individually for updates or deduplication.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:24.116298167+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="1" name="user_id" nullable="true" remarks="{&quot;what&quot;:&quot;User account identifier if known at attempt time.&quot;,&quot;why&quot;:&quot;Without it, attempts cannot be directly associated with a user account for lockout or audit.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:24.130503652+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="2" name="email" nullable="false" remarks="{&quot;what&quot;:&quot;Email address submitted in the login form.&quot;,&quot;why&quot;:&quot;Without it, attempts cannot be matched to a user when user_id is absent.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:24.170361232+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="3" name="method" nullable="false" remarks="{&quot;what&quot;:&quot;Authentication method used (e.g., password, oauth, magic-link).&quot;,&quot;why&quot;:&quot;Without it, security analysis cannot distinguish between credential attacks and token failures.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:24.184492667+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="4" name="success" nullable="false" remarks="{&quot;what&quot;:&quot;Whether the attempt authenticated successfully.&quot;,&quot;why&quot;:&quot;Without it, success/failure rates and lockout triggers cannot be computed.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:24.199468198+00:00&quot;}" size="1" type="bool" typeCode="-7"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="5" name="failure_reason" nullable="true" remarks="{&quot;what&quot;:&quot;Reason for failure when success is false (e.g., wrong password, expired token).&quot;,&quot;why&quot;:&quot;Without it, support cannot diagnose why a specific attempt failed.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:24.225749381+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="6" name="ip_address" nullable="true" remarks="{&quot;what&quot;:&quot;Client IP address from which the attempt originated.&quot;,&quot;why&quot;:&quot;Without it, brute-force detection and geo-blocking are impossible.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:24.294374085+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="7" name="user_agent" nullable="true" remarks="{&quot;what&quot;:&quot;Client user-agent string from the login request.&quot;,&quot;why&quot;:&quot;Without it, anomalous device patterns cannot be identified.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:24.403790708+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="now()" digits="6" id="8" name="attempted_at" nullable="false" remarks="{&quot;what&quot;:&quot;UTC timestamp when the attempt was recorded.&quot;,&quot;why&quot;:&quot;Without it, rate limiting and time-based analysis of attack patterns are impossible.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:24.551865094+00:00&quot;}" size="35" type="timestamptz" typeCode="93"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="9" name="duration_ms" nullable="true" remarks="{&quot;what&quot;:&quot;Elapsed time of the authentication attempt in milliseconds.&quot;,&quot;why&quot;:&quot;Without it, performance degradation of the login flow cannot be measured.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:24.627112470+00:00&quot;}" size="10" type="int4" typeCode="4"/>
         <primaryKey column="record_id" sequenceNumberInPK="1"/>
         <index name="login_attempts_pkey" unique="true">
            <column ascending="true" name="record_id"/>
         </index>
         <index name="idx_la_email" unique="false">
            <column ascending="true" name="email"/>
            <column ascending="false" name="attempted_at"/>
         </index>
         <index name="idx_la_user" unique="false">
            <column ascending="true" name="user_id"/>
            <column ascending="false" name="attempted_at"/>
         </index>
      </table>
      <table name="oauth_authorization_codes" remarks="{&quot;what&quot;:&quot;Issued OAuth2 authorization codes with client, user, scope, and PKCE metadata.&quot;,&quot;why&quot;:&quot;Without it, the token endpoint cannot validate and redeem codes to issue access tokens.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:33.373890377+00:00&quot;}" schema="public" type="TABLE">
         <column autoUpdated="false" defaultValue="null" digits="0" id="0" name="record_id" nullable="false" remarks="{&quot;what&quot;:&quot;Unique opaque identifier for this authorization code record.&quot;,&quot;why&quot;:&quot;Without it, there is no stable way to reference a specific issuance for revocation or audit.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:33.425050026+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="1" name="code_hash" nullable="false" remarks="{&quot;what&quot;:&quot;Cryptographic hash of the authorization code value; the code itself is never stored.&quot;,&quot;why&quot;:&quot;Without it, a presented code cannot be matched to its issuance record, so authorization fails.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:33.453641895+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="2" name="client_id" nullable="false" remarks="{&quot;what&quot;:&quot;Identifier of the OAuth client that requested the code.&quot;,&quot;why&quot;:&quot;Without it, the token endpoint cannot verify that the presenting client matches the original requester.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:33.471783852+00:00&quot;}" size="2147483647" type="text" typeCode="12">
            <parent column="client_id" foreignKey="oauth_authorization_codes_client_id_fkey" implied="false" onDeleteCascade="false" schema="public" table="oauth_clients"/>
         </column>
         <column autoUpdated="false" defaultValue="null" digits="0" id="3" name="user_id" nullable="false" remarks="{&quot;what&quot;:&quot;Identifier of the user who granted authorization for this code.&quot;,&quot;why&quot;:&quot;Without it, the token endpoint cannot associate the issued token with the correct user account.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:33.503620147+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="4" name="redirect_uri" nullable="false" remarks="{&quot;what&quot;:&quot;Exact redirect URI used in the authorization request.&quot;,&quot;why&quot;:&quot;Without it, the token endpoint cannot validate the redirect URI in the token request, enabling open redirect attacks.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:33.519994704+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="5" name="scope" nullable="false" remarks="{&quot;what&quot;:&quot;Space-separated list of OAuth scopes granted for this code.&quot;,&quot;why&quot;:&quot;Without it, the token endpoint cannot issue a token with the correct permissions, and resource access limits break.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:33.541341091+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="6" name="nonce" nullable="true" remarks="{&quot;what&quot;:&quot;Optional nonce value from the authorization request, used to bind the ID token to the session.&quot;,&quot;why&quot;:&quot;Without it, the client cannot detect replay of an ID token, breaking OpenID Connect security.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:33.553316232+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="7" name="code_challenge" nullable="true" remarks="{&quot;what&quot;:&quot;PKCE code challenge derived from the verifier; used to prove possession of the verifier.&quot;,&quot;why&quot;:&quot;Without it, the token endpoint cannot perform PKCE verification, leaving public clients vulnerable to code interception.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:33.566781638+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="8" name="code_challenge_method" nullable="true" remarks="{&quot;what&quot;:&quot;Method used to derive the code challenge, either 'S256' or 'plain'.&quot;,&quot;why&quot;:&quot;Without it, the token endpoint cannot compute the challenge from the verifier, so PKCE verification fails.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:33.581532226+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="now()" digits="6" id="9" name="created_at" nullable="false" remarks="{&quot;what&quot;:&quot;Timestamp when the authorization code was issued.&quot;,&quot;why&quot;:&quot;Without it, the token endpoint cannot enforce the code's lifetime or determine if it has expired.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:33.601198954+00:00&quot;}" size="35" type="timestamptz" typeCode="93"/>
         <column autoUpdated="false" defaultValue="null" digits="6" id="10" name="expires_at" nullable="false" remarks="{&quot;what&quot;:&quot;Timestamp after which the authorization code is no longer valid.&quot;,&quot;why&quot;:&quot;Without it, codes would never expire, allowing indefinite reuse and increasing theft risk.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:33.624337600+00:00&quot;}" size="35" type="timestamptz" typeCode="93"/>
         <column autoUpdated="false" defaultValue="false" digits="0" id="11" name="consumed" nullable="false" remarks="{&quot;what&quot;:&quot;Flag indicating whether the code has already been redeemed; true after successful token exchange.&quot;,&quot;why&quot;:&quot;Without it, the same code could be redeemed multiple times, breaking the one-time-use requirement of OAuth2.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:33.652557444+00:00&quot;}" size="1" type="bool" typeCode="-7"/>
         <primaryKey column="record_id" sequenceNumberInPK="1"/>
         <index name="oauth_authorization_codes_pkey" unique="true">
            <column ascending="true" name="record_id"/>
         </index>
         <index name="idx_oac_expiry" unique="false">
            <column ascending="true" name="expires_at"/>
         </index>
         <index name="oauth_authorization_codes_code_hash_key" unique="true">
            <column ascending="true" name="code_hash"/>
         </index>
      </table>
      <table name="oauth_clients" remarks="{&quot;what&quot;:&quot;Registered OAuth client applications and their configuration.&quot;,&quot;why&quot;:&quot;Without it, the authorization server cannot validate client requests or issue tokens.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:59:53.360452296+00:00&quot;}" schema="public" type="TABLE">
         <column autoUpdated="false" defaultValue="null" digits="0" id="0" name="client_id" nullable="false" remarks="{&quot;what&quot;:&quot;Unique client identifier string, e.g., UUID or generated value.&quot;,&quot;why&quot;:&quot;Without it, clients cannot be referenced in authorization requests or token issuance.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:59:53.515606925+00:00&quot;}" size="2147483647" type="text" typeCode="12">
            <child column="client_id" foreignKey="oauth_authorization_codes_client_id_fkey" implied="false" onDeleteCascade="false" schema="public" table="oauth_authorization_codes"/>
            <child column="client_id" foreignKey="oauth_refresh_tokens_client_id_fkey" implied="false" onDeleteCascade="false" schema="public" table="oauth_refresh_tokens"/>
         </column>
         <column autoUpdated="false" defaultValue="null" digits="0" id="1" name="client_secret_hash" nullable="true" remarks="{&quot;what&quot;:&quot;Hashed client secret for confidential clients; null for public clients.&quot;,&quot;why&quot;:&quot;Without it, confidential clients cannot prove their identity during token requests.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:59:53.556978796+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="2" name="client_name" nullable="false" remarks="{&quot;what&quot;:&quot;Human-readable client name shown on consent screens.&quot;,&quot;why&quot;:&quot;Without it, users cannot identify which application requests access.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:59:53.602960955+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="3" name="redirect_uris" nullable="false" remarks="{&quot;what&quot;:&quot;Allowed redirect URIs for authorization code flow.&quot;,&quot;why&quot;:&quot;Without it, authorization responses cannot be safely sent to the client.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:59:53.719222839+00:00&quot;}" size="2147483647" type="_text" typeCode="2003"/>
         <column autoUpdated="false" defaultValue="'{}'::text[]" digits="0" id="4" name="post_logout_redirect_uris" nullable="false" remarks="{&quot;what&quot;:&quot;Allowed post-logout redirect URIs for end-session flow.&quot;,&quot;why&quot;:&quot;Without it, logout redirects would be unrestricted or impossible.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:59:53.782676171+00:00&quot;}" size="2147483647" type="_text" typeCode="2003"/>
         <column autoUpdated="false" defaultValue="'{openid}'::text[]" digits="0" id="5" name="allowed_scopes" nullable="false" remarks="{&quot;what&quot;:&quot;Scopes the client is permitted to request, e.g., openid, profile.&quot;,&quot;why&quot;:&quot;Without it, clients could request any scope, risking over-privileged tokens.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:59:53.795760868+00:00&quot;}" size="2147483647" type="_text" typeCode="2003"/>
         <column autoUpdated="false" defaultValue="'{authorization_code}'::text[]" digits="0" id="6" name="grant_types" nullable="false" remarks="{&quot;what&quot;:&quot;OAuth grant types the client may use, e.g., authorization_code, refresh_token.&quot;,&quot;why&quot;:&quot;Without it, clients could use unintended flows, weakening security.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:59:53.896463088+00:00&quot;}" size="2147483647" type="_text" typeCode="2003"/>
         <column autoUpdated="false" defaultValue="false" digits="0" id="7" name="is_first_party" nullable="false" remarks="{&quot;what&quot;:&quot;True if client is owned by the same organization.&quot;,&quot;why&quot;:&quot;Without it, first-party clients cannot be given elevated trust or different UX.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:59:53.908895678+00:00&quot;}" size="1" type="bool" typeCode="-7"/>
         <column autoUpdated="false" defaultValue="false" digits="0" id="8" name="is_public" nullable="false" remarks="{&quot;what&quot;:&quot;True if client cannot keep a secret, e.g., SPA or mobile app.&quot;,&quot;why&quot;:&quot;Without it, token endpoint cannot enforce appropriate client authentication.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:59:54.717569382+00:00&quot;}" size="1" type="bool" typeCode="-7"/>
         <column autoUpdated="false" defaultValue="false" digits="0" id="9" name="include_role_claim" nullable="false" remarks="{&quot;what&quot;:&quot;True if ID token should include user's role claim.&quot;,&quot;why&quot;:&quot;Without it, role information may be missing from tokens for this client.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:59:54.798438218+00:00&quot;}" size="1" type="bool" typeCode="-7"/>
         <column autoUpdated="false" defaultValue="false" digits="0" id="10" name="disabled" nullable="false" remarks="{&quot;what&quot;:&quot;True if client is deactivated and cannot authenticate.&quot;,&quot;why&quot;:&quot;Without it, compromised or deprecated clients cannot be revoked.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:59:54.864494227+00:00&quot;}" size="1" type="bool" typeCode="-7"/>
         <column autoUpdated="false" defaultValue="now()" digits="6" id="11" name="created_at" nullable="false" remarks="{&quot;what&quot;:&quot;Timestamp when client record was created, in UTC.&quot;,&quot;why&quot;:&quot;Without it, audit and lifecycle decisions lose temporal context.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:59:54.893420106+00:00&quot;}" size="35" type="timestamptz" typeCode="93"/>
         <primaryKey column="client_id" sequenceNumberInPK="1"/>
         <index name="oauth_clients_pkey" unique="true">
            <column ascending="true" name="client_id"/>
         </index>
      </table>
      <table name="oauth_refresh_tokens" remarks="{&quot;what&quot;:&quot;Issued refresh tokens, keyed by token hash, with client, user, scope, and rotation state.&quot;,&quot;why&quot;:&quot;Without it, refresh tokens cannot be validated, rotated, or revoked.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:47.671337368+00:00&quot;}" schema="public" type="TABLE">
         <column autoUpdated="false" defaultValue="null" digits="0" id="0" name="token_hash" nullable="false" remarks="{&quot;what&quot;:&quot;Cryptographic hash of the refresh token string; the row's primary key.&quot;,&quot;why&quot;:&quot;Without it, the raw token cannot be looked up without storing it in plaintext.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:47.694636278+00:00&quot;}" size="2147483647" type="text" typeCode="12">
            <child column="token_hash" foreignKey="Implied Constraint" implied="true" onDeleteCascade="false" schema="public" table="email_change_requests"/>
            <child column="token_hash" foreignKey="Implied Constraint" implied="true" onDeleteCascade="false" schema="public" table="email_verification_tokens"/>
            <child column="token_hash" foreignKey="Implied Constraint" implied="true" onDeleteCascade="false" schema="public" table="password_change_requests"/>
            <child column="token_hash" foreignKey="Implied Constraint" implied="true" onDeleteCascade="false" schema="public" table="password_reset_tokens"/>
         </column>
         <column autoUpdated="false" defaultValue="null" digits="0" id="1" name="client_id" nullable="false" remarks="{&quot;what&quot;:&quot;Identifier of the OAuth client that requested the token.&quot;,&quot;why&quot;:&quot;Without it, a token cannot be tied to its originating client for validation or revocation.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:47.712182821+00:00&quot;}" size="2147483647" type="text" typeCode="12">
            <parent column="client_id" foreignKey="oauth_refresh_tokens_client_id_fkey" implied="false" onDeleteCascade="false" schema="public" table="oauth_clients"/>
         </column>
         <column autoUpdated="false" defaultValue="null" digits="0" id="2" name="user_id" nullable="false" remarks="{&quot;what&quot;:&quot;Identifier of the user who authorized the token.&quot;,&quot;why&quot;:&quot;Without it, tokens cannot be associated with a user for account-level revocation.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:47.749249422+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="3" name="scope" nullable="false" remarks="{&quot;what&quot;:&quot;Space-separated list of granted OAuth scopes.&quot;,&quot;why&quot;:&quot;Without it, the token's allowed permissions are undefined.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:47.763429958+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="now()" digits="6" id="4" name="created_at" nullable="false" remarks="{&quot;what&quot;:&quot;UTC timestamp when the token was issued.&quot;,&quot;why&quot;:&quot;Without it, token age cannot be computed for rotation or cleanup.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:47.778217088+00:00&quot;}" size="35" type="timestamptz" typeCode="93"/>
         <column autoUpdated="false" defaultValue="null" digits="6" id="5" name="expires_at" nullable="false" remarks="{&quot;what&quot;:&quot;UTC timestamp after which the token is no longer valid.&quot;,&quot;why&quot;:&quot;Without it, expired tokens would be accepted indefinitely.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:47.794206770+00:00&quot;}" size="35" type="timestamptz" typeCode="93"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="6" name="rotated_from" nullable="true" remarks="{&quot;what&quot;:&quot;Hash of the token that was rotated to create this one; null for first token.&quot;,&quot;why&quot;:&quot;Without it, token rotation chains cannot be followed to invalidate old tokens.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:47.827385382+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="7" name="rotated_to" nullable="true" remarks="{&quot;what&quot;:&quot;Hash of the token that replaced this one after rotation; null if not yet rotated.&quot;,&quot;why&quot;:&quot;Without it, the system cannot know which token superseded this one for revocation.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:47.840542279+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="false" digits="0" id="8" name="revoked" nullable="false" remarks="{&quot;what&quot;:&quot;Boolean flag indicating whether the token has been revoked.&quot;,&quot;why&quot;:&quot;Without it, a revoked token cannot be distinguished from an active one.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:47.854409596+00:00&quot;}" size="1" type="bool" typeCode="-7"/>
         <column autoUpdated="false" defaultValue="null" digits="6" id="9" name="revoked_at" nullable="true" remarks="{&quot;what&quot;:&quot;UTC timestamp when the token was revoked; null if not revoked.&quot;,&quot;why&quot;:&quot;Without it, the time of revocation is unknown, preventing audit and cleanup.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:47.871051182+00:00&quot;}" size="35" type="timestamptz" typeCode="93"/>
         <primaryKey column="token_hash" sequenceNumberInPK="1"/>
         <index name="oauth_refresh_tokens_pkey" unique="true">
            <column ascending="true" name="token_hash"/>
         </index>
         <index name="idx_ort_user" unique="false">
            <column ascending="true" name="client_id"/>
            <column ascending="true" name="user_id"/>
         </index>
      </table>
      <table name="oauth_signing_keys" remarks="{&quot;what&quot;:&quot;Signing key records for OAuth2 token issuance; each row is a key pair with lifecycle timestamps.&quot;,&quot;why&quot;:&quot;Without it, there is no record of which key signed a token, so verification and rotation become impossible.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:40.449685566+00:00&quot;}" schema="public" type="TABLE">
         <column autoUpdated="false" defaultValue="null" digits="0" id="0" name="kid" nullable="false" remarks="{&quot;what&quot;:&quot;Key identifier, a short string used in JWT header 'kid' to select the signing key.&quot;,&quot;why&quot;:&quot;Without it, clients cannot indicate which key signed a token, breaking verification during rotation.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:40.462754343+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="1" name="public_jwk" nullable="false" remarks="{&quot;what&quot;:&quot;Public key in JSON Web Key format, used to verify token signatures.&quot;,&quot;why&quot;:&quot;Without it, verifiers cannot check token signatures, so tokens become untrusted.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:40.476923968+00:00&quot;}" size="2147483647" type="jsonb" typeCode="1111"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="2" name="private_key_path" nullable="false" remarks="{&quot;what&quot;:&quot;Filesystem path to the private key used for signing tokens.&quot;,&quot;why&quot;:&quot;Without it, the signing service cannot produce signatures, so token issuance fails.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:40.492207365+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="'RS256'::text" digits="0" id="3" name="alg" nullable="false" remarks="{&quot;what&quot;:&quot;JWT signing algorithm, e.g., RS256; default is RS256.&quot;,&quot;why&quot;:&quot;Without it, the algorithm for signing/verifying is ambiguous, causing interoperability issues.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:40.514534086+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="now()" digits="6" id="4" name="created_at" nullable="false" remarks="{&quot;what&quot;:&quot;Timestamp when the key was created and made available for signing.&quot;,&quot;why&quot;:&quot;Without it, key rotation history is lost, making it unclear which key was active at a given time.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:40.547436045+00:00&quot;}" size="35" type="timestamptz" typeCode="93"/>
         <column autoUpdated="false" defaultValue="null" digits="6" id="5" name="retired_at" nullable="true" remarks="{&quot;what&quot;:&quot;Timestamp when the key was retired; null means still active.&quot;,&quot;why&quot;:&quot;Without it, retired keys remain usable, risking acceptance of old tokens after rotation.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:40.568550003+00:00&quot;}" size="35" type="timestamptz" typeCode="93"/>
         <primaryKey column="kid" sequenceNumberInPK="1"/>
         <index name="oauth_signing_keys_pkey" unique="true">
            <column ascending="true" name="kid"/>
         </index>
      </table>
      <table name="password_change_requests" remarks="{&quot;what&quot;:&quot;Password change requests, each with a user, method, status, and expiry.&quot;,&quot;why&quot;:&quot;Without it, password reset attempts cannot be tracked, validated, or expired.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:04.239530030+00:00&quot;}" schema="public" type="TABLE">
         <column autoUpdated="false" defaultValue="null" digits="0" id="0" name="record_id" nullable="false" remarks="{&quot;what&quot;:&quot;Unique identifier for the request, e.g., UUID.&quot;,&quot;why&quot;:&quot;Without it, requests cannot be referenced or updated unambiguously.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:04.256819377+00:00&quot;}" size="2147483647" type="text" typeCode="12">
            <child column="request_id" foreignKey="password_changes_request_id_fkey" implied="false" onDeleteCascade="false" schema="public" table="password_changes"/>
         </column>
         <column autoUpdated="false" defaultValue="null" digits="0" id="1" name="user_id" nullable="false" remarks="{&quot;what&quot;:&quot;Identifier of the user who requested the password change.&quot;,&quot;why&quot;:&quot;Without it, the request cannot be linked to a user account.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:04.310009244+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="2" name="method" nullable="false" remarks="{&quot;what&quot;:&quot;Verification method such as email, SMS, or authenticator.&quot;,&quot;why&quot;:&quot;Without it, the channel for delivering the reset token is unknown.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:04.346755295+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="'pending'::text" digits="0" id="3" name="status" nullable="false" remarks="{&quot;what&quot;:&quot;Lifecycle state: pending, completed, or expired.&quot;,&quot;why&quot;:&quot;Without it, it is unclear whether a request is still valid or already used.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:04.397649699+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="4" name="token_hash" nullable="true" remarks="{&quot;what&quot;:&quot;Hashed reset token for verification.&quot;,&quot;why&quot;:&quot;Without it, the token cannot be validated without storing plaintext.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:04.409823869+00:00&quot;}" size="2147483647" type="text" typeCode="12">
            <parent column="token_hash" foreignKey="Implied Constraint" implied="true" onDeleteCascade="false" schema="public" table="oauth_refresh_tokens"/>
         </column>
         <column autoUpdated="false" defaultValue="now()" digits="6" id="5" name="requested_at" nullable="false" remarks="{&quot;what&quot;:&quot;Timestamp when the request was created.&quot;,&quot;why&quot;:&quot;Without it, we cannot know when the request was initiated or audit the flow.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:04.427795832+00:00&quot;}" size="35" type="timestamptz" typeCode="93"/>
         <column autoUpdated="false" defaultValue="null" digits="6" id="6" name="completed_at" nullable="true" remarks="{&quot;what&quot;:&quot;Timestamp when the request was successfully completed.&quot;,&quot;why&quot;:&quot;Without it, we cannot know if and when the password change was finalized.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:04.442232749+00:00&quot;}" size="35" type="timestamptz" typeCode="93"/>
         <column autoUpdated="false" defaultValue="null" digits="6" id="7" name="expired_at" nullable="true" remarks="{&quot;what&quot;:&quot;Timestamp when the request was explicitly marked as expired.&quot;,&quot;why&quot;:&quot;Without it, we cannot record when a request was invalidated before its scheduled expiry.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:04.466023775+00:00&quot;}" size="35" type="timestamptz" typeCode="93"/>
         <column autoUpdated="false" defaultValue="null" digits="6" id="8" name="expires_at" nullable="false" remarks="{&quot;what&quot;:&quot;Scheduled expiration time after which the request is no longer valid.&quot;,&quot;why&quot;:&quot;Without it, there is no deadline for using the reset token.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:04.482785615+00:00&quot;}" size="35" type="timestamptz" typeCode="93"/>
         <primaryKey column="record_id" sequenceNumberInPK="1"/>
         <index name="password_change_requests_pkey" unique="true">
            <column ascending="true" name="record_id"/>
         </index>
         <index name="idx_pcr_user" unique="false">
            <column ascending="true" name="user_id"/>
            <column ascending="false" name="requested_at"/>
         </index>
      </table>
      <table name="password_changes" remarks="{&quot;what&quot;:&quot;Log of password change events with before/after user snapshots.&quot;,&quot;why&quot;:&quot;Provides audit trail for password modifications and supports rollback or investigation.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-23T00:00:06.644831200+00:00&quot;}" schema="public" type="TABLE">
         <column autoUpdated="false" defaultValue="null" digits="0" id="0" name="record_id" nullable="false" remarks="{&quot;what&quot;:&quot;Unique identifier for each password change event.&quot;,&quot;why&quot;:&quot;Enables referencing a specific change record for audit or correction.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-23T00:00:06.688141703+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="1" name="user_id" nullable="false" remarks="{&quot;what&quot;:&quot;Identifier of the user whose password was changed.&quot;,&quot;why&quot;:&quot;Links the change to the affected account for per-user history.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-23T00:00:06.699570953+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="2" name="request_id" nullable="true" remarks="{&quot;what&quot;:&quot;Optional identifier of the request that triggered the change.&quot;,&quot;why&quot;:&quot;Correlates the change with an originating workflow or ticket.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-23T00:00:06.712402088+00:00&quot;}" size="2147483647" type="text" typeCode="12">
            <parent column="record_id" foreignKey="password_changes_request_id_fkey" implied="false" onDeleteCascade="false" schema="public" table="password_change_requests"/>
         </column>
         <column autoUpdated="false" defaultValue="null" digits="0" id="3" name="old_user_record" nullable="true" remarks="{&quot;what&quot;:&quot;Snapshot of the user record before the password change.&quot;,&quot;why&quot;:&quot;Preserves prior state for rollback or comparison.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-23T00:00:06.766789877+00:00&quot;}" size="2147483647" type="text" typeCode="12">
            <parent column="record_id" foreignKey="password_changes_old_user_record_fkey" implied="false" onDeleteCascade="false" schema="public" table="users"/>
         </column>
         <column autoUpdated="false" defaultValue="null" digits="0" id="4" name="new_user_record" nullable="true" remarks="{&quot;what&quot;:&quot;Snapshot of the user record after the password change.&quot;,&quot;why&quot;:&quot;Captures the new state to verify the applied change.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-23T00:00:06.784853758+00:00&quot;}" size="2147483647" type="text" typeCode="12">
            <parent column="record_id" foreignKey="password_changes_new_user_record_fkey" implied="false" onDeleteCascade="false" schema="public" table="users"/>
         </column>
         <column autoUpdated="false" defaultValue="now()" digits="6" id="5" name="changed_at" nullable="false" remarks="{&quot;what&quot;:&quot;Timestamp when the password change was recorded.&quot;,&quot;why&quot;:&quot;Establishes chronological order for audit and time-based queries.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-23T00:00:06.809907654+00:00&quot;}" size="35" type="timestamptz" typeCode="93"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="6" name="changed_by" nullable="false" remarks="{&quot;what&quot;:&quot;Identifier of the actor who performed the change.&quot;,&quot;why&quot;:&quot;Attributes responsibility and supports accountability.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-23T00:00:06.846657173+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <primaryKey column="record_id" sequenceNumberInPK="1"/>
         <index name="password_changes_pkey" unique="true">
            <column ascending="true" name="record_id"/>
         </index>
      </table>
      <table name="password_reset_tokens" remarks="{&quot;what&quot;:&quot;Records of password reset requests, each with a hashed token and expiry.&quot;,&quot;why&quot;:&quot;Without it, password reset links cannot be verified, expired, or revoked.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:05.516414418+00:00&quot;}" schema="public" type="TABLE">
         <column autoUpdated="false" defaultValue="null" digits="0" id="0" name="record_id" nullable="false" remarks="{&quot;what&quot;:&quot;Unique text key for a single password reset request; primary key.&quot;,&quot;why&quot;:&quot;Without it, individual reset requests cannot be distinguished or targeted.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:05.531851230+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="1" name="user_id" nullable="false" remarks="{&quot;what&quot;:&quot;Text identifier of the user account that requested the reset.&quot;,&quot;why&quot;:&quot;Without it, the reset cannot be tied to a specific account, and per-user token revocation is impossible.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:05.549859486+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="2" name="token_hash" nullable="false" remarks="{&quot;what&quot;:&quot;Cryptographic hash of the reset token; the raw token is never stored.&quot;,&quot;why&quot;:&quot;Without it, reset tokens would have to be stored in plaintext, risking theft and impersonation.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:05.563580439+00:00&quot;}" size="2147483647" type="text" typeCode="12">
            <parent column="token_hash" foreignKey="Implied Constraint" implied="true" onDeleteCascade="false" schema="public" table="oauth_refresh_tokens"/>
         </column>
         <column autoUpdated="false" defaultValue="now()" digits="6" id="3" name="created_at" nullable="false" remarks="{&quot;what&quot;:&quot;UTC timestamp (with time zone) of when the reset request was created.&quot;,&quot;why&quot;:&quot;Without it, token age cannot be computed, and expiry enforcement becomes impossible.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:05.579924663+00:00&quot;}" size="35" type="timestamptz" typeCode="93"/>
         <column autoUpdated="false" defaultValue="null" digits="6" id="4" name="expires_at" nullable="false" remarks="{&quot;what&quot;:&quot;UTC timestamp after which the token is no longer valid.&quot;,&quot;why&quot;:&quot;Without it, reset links would remain valid forever, increasing account takeover risk.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:05.599752485+00:00&quot;}" size="35" type="timestamptz" typeCode="93"/>
         <column autoUpdated="false" defaultValue="null" digits="6" id="5" name="used_at" nullable="true" remarks="{&quot;what&quot;:&quot;UTC timestamp when the token was consumed; null if not yet used.&quot;,&quot;why&quot;:&quot;Without it, a token could be reused multiple times, and redemption status would be unknown.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:05.613214856+00:00&quot;}" size="35" type="timestamptz" typeCode="93"/>
         <primaryKey column="record_id" sequenceNumberInPK="1"/>
         <index name="password_reset_tokens_pkey" unique="true">
            <column ascending="true" name="record_id"/>
         </index>
         <index name="idx_prt_hash" unique="false">
            <column ascending="true" name="token_hash"/>
         </index>
      </table>
      <table name="reg_states" remarks="" schema="public" type="TABLE">
         <column autoUpdated="false" defaultValue="null" digits="0" id="0" name="user_id" nullable="false" remarks="{&quot;what&quot;:&quot;User identifier (text) that uniquely owns a state row.&quot;,&quot;why&quot;:&quot;Without it, states cannot be attributed to a specific user.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:51.629212742+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="1" name="state" nullable="false" remarks="{&quot;what&quot;:&quot;Serialized registration state as binary data (e.g., JSON or protocol buffer).&quot;,&quot;why&quot;:&quot;Without it, the registration flow cannot resume after a redirect or page refresh.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:51.667450921+00:00&quot;}" size="2147483647" type="bytea" typeCode="-2"/>
         <column autoUpdated="false" defaultValue="now()" digits="6" id="2" name="created_at" nullable="false" remarks="{&quot;what&quot;:&quot;Timestamp (with time zone) when the state row was created.&quot;,&quot;why&quot;:&quot;Without it, stale states cannot be expired or cleaned up.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:55:51.679151881+00:00&quot;}" size="35" type="timestamptz" typeCode="93"/>
         <primaryKey column="user_id" sequenceNumberInPK="1"/>
         <index name="reg_states_pkey" unique="true">
            <column ascending="true" name="user_id"/>
         </index>
      </table>
      <table name="sessions" remarks="{&quot;what&quot;:&quot;A row per authenticated user session, with JWT and expiry.&quot;,&quot;why&quot;:&quot;Without it, there is no record of issued JWTs, so revocation and expiry checks are impossible.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-23T00:00:40.038533937+00:00&quot;}" schema="public" type="TABLE">
         <column autoUpdated="false" defaultValue="null" digits="0" id="0" name="record_id" nullable="false" remarks="{&quot;what&quot;:&quot;Unique opaque identifier for this session row.&quot;,&quot;why&quot;:&quot;Without it, there is no stable key to update or revoke a specific session.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-23T00:00:40.054785457+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="1" name="jti" nullable="false" remarks="{&quot;what&quot;:&quot;JWT ID (jti claim) from the token, unique per issued token.&quot;,&quot;why&quot;:&quot;Without it, a token cannot be matched to its session for revocation or blacklisting.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-23T00:00:40.070239896+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="2" name="user_id" nullable="false" remarks="{&quot;what&quot;:&quot;Identifier of the user who owns this session.&quot;,&quot;why&quot;:&quot;Without it, sessions cannot be listed or revoked per user.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-23T00:00:40.082481981+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="6" id="3" name="issued_at" nullable="false" remarks="{&quot;what&quot;:&quot;Timestamp of session creation, with time zone.&quot;,&quot;why&quot;:&quot;Without it, session age and ordering cannot be determined.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-23T00:00:40.096624258+00:00&quot;}" size="35" type="timestamptz" typeCode="93"/>
         <column autoUpdated="false" defaultValue="null" digits="6" id="4" name="expires_at" nullable="false" remarks="{&quot;what&quot;:&quot;Timestamp when the session becomes invalid, with time zone.&quot;,&quot;why&quot;:&quot;Without it, expired sessions cannot be identified and rejected.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-23T00:00:40.116949740+00:00&quot;}" size="35" type="timestamptz" typeCode="93"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="5" name="device_info" nullable="true" remarks="{&quot;what&quot;:&quot;Free-form description of the client device or browser.&quot;,&quot;why&quot;:&quot;Without it, suspicious logins from new devices cannot be flagged.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-23T00:00:40.129275153+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="6" name="ip_address" nullable="true" remarks="{&quot;what&quot;:&quot;IP address of the client at session start.&quot;,&quot;why&quot;:&quot;Without it, the origin of a session cannot be audited or compared.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-23T00:00:40.143957312+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="6" id="7" name="revoked_at" nullable="true" remarks="{&quot;what&quot;:&quot;Timestamp when the session was explicitly revoked, null if active.&quot;,&quot;why&quot;:&quot;Without it, revoked sessions cannot be distinguished from active ones.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-23T00:00:40.160697279+00:00&quot;}" size="35" type="timestamptz" typeCode="93"/>
         <primaryKey column="record_id" sequenceNumberInPK="1"/>
         <index name="sessions_pkey" unique="true">
            <column ascending="true" name="record_id"/>
         </index>
         <index name="idx_ss_jti" unique="false">
            <column ascending="true" name="jti"/>
         </index>
         <index name="idx_ss_user" unique="false">
            <column ascending="true" name="user_id"/>
         </index>
         <index name="sessions_jti_key" unique="true">
            <column ascending="true" name="jti"/>
         </index>
      </table>
      <table name="ssh_audit_log" remarks="{&quot;what&quot;:&quot;Audit log for SSH events, one row per event.&quot;,&quot;why&quot;:&quot;Without it, there is no record of SSH activity for security review or incident response.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-23T00:00:33.970205201+00:00&quot;}" schema="public" type="TABLE">
         <column autoUpdated="true" defaultValue="nextval('ssh_audit_log_id_seq'::regclass)" digits="0" id="0" name="id" nullable="false" remarks="{&quot;what&quot;:&quot;Unique integer assigned by sequence; primary key for the log row.&quot;,&quot;why&quot;:&quot;Without it, rows cannot be uniquely referenced for updates or deletions.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-23T00:00:33.986399372+00:00&quot;}" size="10" type="serial" typeCode="4"/>
         <column autoUpdated="false" defaultValue="null" digits="6" id="1" name="timestamp" nullable="false" remarks="{&quot;what&quot;:&quot;UTC timestamp with timezone when the SSH event occurred.&quot;,&quot;why&quot;:&quot;Without it, event ordering and time-based analysis are impossible.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-23T00:00:34.000625124+00:00&quot;}" size="35" type="timestamptz" typeCode="93"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="2" name="event_type" nullable="false" remarks="{&quot;what&quot;:&quot;Category of SSH event; exact values depend on application.&quot;,&quot;why&quot;:&quot;Without it, filtering or grouping by event category is impossible.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-23T00:00:34.037633844+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="3" name="details" nullable="true" remarks="{&quot;what&quot;:&quot;Free-form text with additional context about the event.&quot;,&quot;why&quot;:&quot;Without it, context needed for debugging or investigation is lost.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-23T00:00:34.071604213+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="'info'::text" digits="0" id="4" name="severity" nullable="true" remarks="{&quot;what&quot;:&quot;Log severity level; default is 'info'.&quot;,&quot;why&quot;:&quot;Without it, filtering by importance or alerting on critical events is impossible.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-23T00:00:34.083092379+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <primaryKey column="id" sequenceNumberInPK="1"/>
         <index name="ssh_audit_log_pkey" unique="true">
            <column ascending="true" name="id"/>
         </index>
         <index name="idx_ssh_audit_ts" unique="false">
            <column ascending="true" name="timestamp"/>
         </index>
      </table>
      <table name="ssh_auth_events" remarks="{&quot;what&quot;:&quot;One row per SSH authentication event, capturing attempt outcome and client details.&quot;,&quot;why&quot;:&quot;Without it, no audit trail for SSH access attempts, making intrusion detection and compliance reporting impossible.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:23.625614782+00:00&quot;}" schema="public" type="TABLE">
         <column autoUpdated="true" defaultValue="nextval('ssh_auth_events_id_seq'::regclass)" digits="0" id="0" name="id" nullable="false" remarks="{&quot;what&quot;:&quot;Unique numeric identifier for each event row.&quot;,&quot;why&quot;:&quot;Without it, rows cannot be uniquely referenced for updates, deletes, or joins.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:23.939524353+00:00&quot;}" size="10" type="serial" typeCode="4"/>
         <column autoUpdated="false" defaultValue="null" digits="6" id="1" name="timestamp" nullable="false" remarks="{&quot;what&quot;:&quot;UTC timestamp of when the SSH event occurred.&quot;,&quot;why&quot;:&quot;Without it, event ordering and time-based analysis (e.g., brute-force detection) are impossible.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:23.958689700+00:00&quot;}" size="35" type="timestamptz" typeCode="93"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="2" name="event_type" nullable="false" remarks="{&quot;what&quot;:&quot;Outcome category such as 'success', 'failed', 'timeout'.&quot;,&quot;why&quot;:&quot;Without it, cannot distinguish successful logins from failed attempts, hiding security breaches.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:23.974531127+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="3" name="source_ip" nullable="false" remarks="{&quot;what&quot;:&quot;IP address of the client that initiated the SSH connection.&quot;,&quot;why&quot;:&quot;Without it, cannot identify attack sources or geolocate suspicious activity.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:23.991322241+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="4" name="username" nullable="true" remarks="{&quot;what&quot;:&quot;Account name attempted or used in the SSH authentication.&quot;,&quot;why&quot;:&quot;Without it, cannot attribute events to specific users or detect username enumeration attacks.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:24.003911525+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="5" name="auth_method" nullable="true" remarks="{&quot;what&quot;:&quot;Authentication mechanism used, e.g., 'password', 'publickey'.&quot;,&quot;why&quot;:&quot;Without it, cannot assess security posture or enforce policies on weak methods.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:24.033724340+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="6" name="key_fingerprint" nullable="true" remarks="{&quot;what&quot;:&quot;SHA256 fingerprint of the SSH public key used, if any.&quot;,&quot;why&quot;:&quot;Without it, cannot track key-based access or revoke compromised keys.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:24.047465874+00:00&quot;}" size="2147483647" type="text" typeCode="12">
            <parent column="fingerprint" foreignKey="Implied Constraint" implied="true" onDeleteCascade="false" schema="public" table="ssh_key_inventory"/>
         </column>
         <column autoUpdated="false" defaultValue="null" digits="0" id="7" name="details" nullable="true" remarks="{&quot;what&quot;:&quot;Free-form additional context such as error messages or client version.&quot;,&quot;why&quot;:&quot;Without it, diagnostic information for troubleshooting or forensic analysis is lost.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:24.123038148+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <primaryKey column="id" sequenceNumberInPK="1"/>
         <index name="ssh_auth_events_pkey" unique="true">
            <column ascending="true" name="id"/>
         </index>
         <index name="idx_ssh_auth_source" unique="false">
            <column ascending="true" name="source_ip"/>
         </index>
         <index name="idx_ssh_auth_ts" unique="false">
            <column ascending="true" name="timestamp"/>
         </index>
      </table>
      <table name="ssh_compliance_results" remarks="{&quot;what&quot;:&quot;Results of automated SSH configuration compliance checks, one row per check per scan.&quot;,&quot;why&quot;:&quot;Without it, there is no record of which SSH settings passed or failed over time.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:29.839675515+00:00&quot;}" schema="public" type="TABLE">
         <column autoUpdated="true" defaultValue="nextval('ssh_compliance_results_id_seq'::regclass)" digits="0" id="0" name="id" nullable="false" remarks="{&quot;what&quot;:&quot;Unique numeric identifier for each compliance result row.&quot;,&quot;why&quot;:&quot;Without it, rows cannot be uniquely referenced for updates or deletions.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:29.856849679+00:00&quot;}" size="10" type="serial" typeCode="4"/>
         <column autoUpdated="false" defaultValue="null" digits="6" id="1" name="scan_timestamp" nullable="false" remarks="{&quot;what&quot;:&quot;Time the scan ran, in UTC with timezone offset.&quot;,&quot;why&quot;:&quot;Without it, results from different scans cannot be ordered or compared over time.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:29.874371884+00:00&quot;}" size="35" type="timestamptz" typeCode="93"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="2" name="check_name" nullable="false" remarks="{&quot;what&quot;:&quot;Name of the SSH compliance check, e.g., 'PermitRootLogin'.&quot;,&quot;why&quot;:&quot;Without it, it is unclear which specific SSH setting or rule the result refers to.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:29.887630740+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="3" name="status" nullable="false" remarks="{&quot;what&quot;:&quot;Compliance outcome, e.g., 'pass', 'fail', 'error'.&quot;,&quot;why&quot;:&quot;Without it, it is unknown whether the check passed or failed, so no action can be taken.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:29.903029104+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="4" name="severity" nullable="false" remarks="{&quot;what&quot;:&quot;Importance level of the check, e.g., 'high', 'medium', 'low'.&quot;,&quot;why&quot;:&quot;Without it, failed checks cannot be prioritized for remediation.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:29.916511114+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="5" name="current_value" nullable="true" remarks="{&quot;what&quot;:&quot;Value found on the system for the checked setting, if any.&quot;,&quot;why&quot;:&quot;Without it, the actual configuration is unknown, so the failure cannot be diagnosed.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:29.932703830+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="6" name="expected_value" nullable="true" remarks="{&quot;what&quot;:&quot;Value the check expects for the setting, if defined.&quot;,&quot;why&quot;:&quot;Without it, the target configuration is unknown, so the gap cannot be measured.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:29.947507531+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="7" name="description" nullable="false" remarks="{&quot;what&quot;:&quot;Human-readable explanation of what the check verifies.&quot;,&quot;why&quot;:&quot;Without it, engineers lack context on the purpose of the check.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:29.965011637+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="false" digits="0" id="8" name="auto_fixable" nullable="true" remarks="{&quot;what&quot;:&quot;Whether the check can be automatically remediated, default false.&quot;,&quot;why&quot;:&quot;Without it, it is unknown which failures can be fixed automatically, blocking automation decisions.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:29.989796967+00:00&quot;}" size="1" type="bool" typeCode="-7"/>
         <primaryKey column="id" sequenceNumberInPK="1"/>
         <index name="ssh_compliance_results_pkey" unique="true">
            <column ascending="true" name="id"/>
         </index>
      </table>
      <table name="ssh_key_inventory" remarks="{&quot;what&quot;:&quot;Inventory of SSH public keys found on hosts; one row per key.&quot;,&quot;why&quot;:&quot;Central registry to track key usage and audit compliance.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:34.268243296+00:00&quot;}" schema="public" type="TABLE">
         <column autoUpdated="false" defaultValue="null" digits="0" id="0" name="fingerprint" nullable="false" remarks="{&quot;what&quot;:&quot;SHA-256 fingerprint of the SSH key, e.g. SHA256:...; unique identifier.&quot;,&quot;why&quot;:&quot;Uniquely identifies a key across hosts; used for deduplication and lookups.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:34.294431030+00:00&quot;}" size="2147483647" type="text" typeCode="12">
            <child column="key_fingerprint" foreignKey="Implied Constraint" implied="true" onDeleteCascade="false" schema="public" table="ssh_auth_events"/>
         </column>
         <column autoUpdated="false" defaultValue="null" digits="0" id="1" name="key_file" nullable="false" remarks="{&quot;what&quot;:&quot;Absolute path to the key file on the host, e.g. /home/user/.ssh/id_rsa.pub.&quot;,&quot;why&quot;:&quot;Locates the key on disk for rotation or removal; without it the key cannot be managed.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:34.310947977+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="2" name="key_type" nullable="false" remarks="{&quot;what&quot;:&quot;SSH key algorithm, e.g. ssh-rsa, ecdsa-sha2-nistp256.&quot;,&quot;why&quot;:&quot;Determines compatibility and strength; needed for policy checks.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:34.324506411+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="3" name="comment" nullable="true" remarks="{&quot;what&quot;:&quot;Free-text comment from the key file, often user@host.&quot;,&quot;why&quot;:&quot;Provides human-readable context for ownership; helps identify responsible party.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:34.336105361+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="4" name="bits" nullable="true" remarks="{&quot;what&quot;:&quot;Key length in bits, e.g. 2048 for RSA.&quot;,&quot;why&quot;:&quot;Assesses cryptographic strength; flags weak keys for replacement.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:34.349488298+00:00&quot;}" size="10" type="int4" typeCode="4"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="5" name="age_days" nullable="true" remarks="{&quot;what&quot;:&quot;Number of days since the key was first seen or created.&quot;,&quot;why&quot;:&quot;Identifies stale keys that may need review or revocation.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:34.361751454+00:00&quot;}" size="10" type="int4" typeCode="4"/>
         <column autoUpdated="false" defaultValue="null" digits="6" id="6" name="last_audited" nullable="false" remarks="{&quot;what&quot;:&quot;Timestamp of the most recent audit of this key.&quot;,&quot;why&quot;:&quot;Tracks audit frequency; ensures keys are reviewed periodically.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:34.382908783+00:00&quot;}" size="35" type="timestamptz" typeCode="93"/>
         <column autoUpdated="false" defaultValue="'active'::text" digits="0" id="7" name="status" nullable="false" remarks="{&quot;what&quot;:&quot;Lifecycle state: active, revoked, expired, etc.&quot;,&quot;why&quot;:&quot;Filters usable keys from disabled ones; prevents use of invalid keys.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:34.408361961+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <primaryKey column="fingerprint" sequenceNumberInPK="1"/>
         <index name="ssh_key_inventory_pkey" unique="true">
            <column ascending="true" name="fingerprint"/>
         </index>
      </table>
      <table name="ssh_mux_sockets" remarks="{&quot;what&quot;:&quot;Registry of SSH multiplexing control sockets, keyed by socket path.&quot;,&quot;why&quot;:&quot;Without it, no central record of which sockets exist, their status, or session usage.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:39.483635570+00:00&quot;}" schema="public" type="TABLE">
         <column autoUpdated="false" defaultValue="null" digits="0" id="0" name="socket_path" nullable="false" remarks="{&quot;what&quot;:&quot;Absolute filesystem path of the Unix socket used for SSH multiplexing.&quot;,&quot;why&quot;:&quot;Without it, sockets cannot be uniquely referenced or deduplicated.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:39.517238081+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="1" name="host" nullable="false" remarks="{&quot;what&quot;:&quot;Hostname or IP address the socket connects to.&quot;,&quot;why&quot;:&quot;Without it, sockets for different hosts are indistinguishable, causing cross-host cleanup errors.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:39.529232683+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="2" name="owner_pid" nullable="true" remarks="{&quot;what&quot;:&quot;Process ID of the SSH client that created the socket.&quot;,&quot;why&quot;:&quot;Without it, orphaned sockets cannot be attributed to a dead process for cleanup.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:39.548666320+00:00&quot;}" size="10" type="int4" typeCode="4"/>
         <column autoUpdated="false" defaultValue="'active'::text" digits="0" id="3" name="status" nullable="false" remarks="{&quot;what&quot;:&quot;Lifecycle state, default 'active'.&quot;,&quot;why&quot;:&quot;Without it, unusable or closed sockets would be treated as active, breaking connection logic.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:39.561048541+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="0" digits="0" id="4" name="session_count" nullable="true" remarks="{&quot;what&quot;:&quot;Number of active sessions currently using the socket.&quot;,&quot;why&quot;:&quot;Without it, idle sockets cannot be identified for closing, wasting resources.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:39.577754289+00:00&quot;}" size="10" type="int4" typeCode="4"/>
         <column autoUpdated="false" defaultValue="now()" digits="6" id="5" name="first_seen" nullable="false" remarks="{&quot;what&quot;:&quot;Timestamp when this socket was first recorded.&quot;,&quot;why&quot;:&quot;Without it, socket age is unknown, preventing time-based cleanup.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:39.598684441+00:00&quot;}" size="35" type="timestamptz" typeCode="93"/>
         <column autoUpdated="false" defaultValue="now()" digits="6" id="6" name="last_checked" nullable="false" remarks="{&quot;what&quot;:&quot;Timestamp of the last health or liveness check.&quot;,&quot;why&quot;:&quot;Without it, stale sockets cannot be detected, risking connections to dead sockets.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:39.627338324+00:00&quot;}" size="35" type="timestamptz" typeCode="93"/>
         <primaryKey column="socket_path" sequenceNumberInPK="1"/>
         <index name="ssh_mux_sockets_pkey" unique="true">
            <column ascending="true" name="socket_path"/>
         </index>
      </table>
      <table name="ssh_pending_approvals" remarks="{&quot;what&quot;:&quot;Holds SSH action requests that require approval before execution.&quot;,&quot;why&quot;:&quot;Without it, unauthorized SSH actions could run and there would be no audit trail of approvals.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:44.524051567+00:00&quot;}" schema="public" type="TABLE">
         <column autoUpdated="false" defaultValue="null" digits="0" id="0" name="id" nullable="false" remarks="{&quot;what&quot;:&quot;Unique identifier for the approval request, typically a UUID.&quot;,&quot;why&quot;:&quot;Without it, requests cannot be referenced individually in logs or API calls.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:44.535693957+00:00&quot;}" size="2147483647" type="text" typeCode="12">
            <child column="entity_id" foreignKey="Implied Constraint" implied="true" onDeleteCascade="false" schema="public" table="changelogs"/>
         </column>
         <column autoUpdated="false" defaultValue="null" digits="6" id="1" name="created_at" nullable="false" remarks="{&quot;what&quot;:&quot;Timestamp when the request was submitted, in UTC.&quot;,&quot;why&quot;:&quot;Without it, expiry and audit of request timing are impossible.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:44.545987307+00:00&quot;}" size="35" type="timestamptz" typeCode="93"/>
         <column autoUpdated="false" defaultValue="null" digits="6" id="2" name="expires_at" nullable="false" remarks="{&quot;what&quot;:&quot;Timestamp after which the pending request becomes invalid, in UTC.&quot;,&quot;why&quot;:&quot;Without it, stale requests would remain pending and could be approved too late.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:44.559197512+00:00&quot;}" size="35" type="timestamptz" typeCode="93"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="3" name="action_type" nullable="false" remarks="{&quot;what&quot;:&quot;Type of SSH action requested, e.g., 'command' or 'tunnel'.&quot;,&quot;why&quot;:&quot;Without it, approvers cannot know what kind of operation they are approving.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:44.581505112+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="4" name="target" nullable="true" remarks="{&quot;what&quot;:&quot;Target host or resource the SSH action applies to, if any.&quot;,&quot;why&quot;:&quot;Without it, the scope of the approval is ambiguous for host-specific actions.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:44.603633195+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="5" name="description" nullable="false" remarks="{&quot;what&quot;:&quot;Free-text explanation of the requested action, written by the requester.&quot;,&quot;why&quot;:&quot;Without it, approvers lack context to make an informed decision.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:44.615181159+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="6" name="action_payload" nullable="false" remarks="{&quot;what&quot;:&quot;Serialized details of the SSH action, e.g., command line or JSON payload.&quot;,&quot;why&quot;:&quot;Without it, the exact operation to be executed is unknown, so approval cannot be tied to a concrete action.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:44.626075558+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="'pending'::text" digits="0" id="7" name="status" nullable="false" remarks="{&quot;what&quot;:&quot;Current state of the request: 'pending', 'approved', 'denied', or 'expired'.&quot;,&quot;why&quot;:&quot;Without it, it is impossible to know whether the request is still actionable or has been resolved.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:44.636789748+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="6" id="8" name="resolved_at" nullable="true" remarks="{&quot;what&quot;:&quot;Timestamp when the request was approved or denied, in UTC; null while pending.&quot;,&quot;why&quot;:&quot;Without it, audit trails cannot show when a decision was made, and expiry logic cannot distinguish resolved from unresolved.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:56:44.649500763+00:00&quot;}" size="35" type="timestamptz" typeCode="93"/>
         <primaryKey column="id" sequenceNumberInPK="1"/>
         <index name="ssh_pending_approvals_pkey" unique="true">
            <column ascending="true" name="id"/>
         </index>
         <index name="idx_ssh_approvals_status" unique="false">
            <column ascending="true" name="status"/>
         </index>
      </table>
      <table name="ssh_sessions" remarks="" schema="public" type="TABLE">
         <column autoUpdated="false" defaultValue="null" digits="0" id="0" name="sshd_pid" nullable="false" remarks="{&quot;what&quot;:&quot;Process ID of the sshd daemon handling this session; unique per session.&quot;,&quot;why&quot;:&quot;Without it, sessions cannot be uniquely identified or referenced by other tables.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:59:59.882038428+00:00&quot;}" size="10" type="int4" typeCode="4"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="1" name="parent_pid" nullable="false" remarks="{&quot;what&quot;:&quot;Process ID of the parent process that spawned this sshd.&quot;,&quot;why&quot;:&quot;Needed to trace session origin and group sessions by parent process.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:59:59.900058393+00:00&quot;}" size="10" type="int4" typeCode="4"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="2" name="username" nullable="false" remarks="{&quot;what&quot;:&quot;Login name of the authenticated user.&quot;,&quot;why&quot;:&quot;Without it, we cannot attribute sessions to users or enforce per-user policies.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:59:59.983693474+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="3" name="source_ip" nullable="false" remarks="{&quot;what&quot;:&quot;IPv4 or IPv6 address of the connecting client.&quot;,&quot;why&quot;:&quot;Needed for security audits, geolocation, and detecting multiple sessions from same source.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-23T00:00:00.007285495+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="4" name="source_port" nullable="true" remarks="{&quot;what&quot;:&quot;TCP port number used by the client on its side.&quot;,&quot;why&quot;:&quot;Helps distinguish multiple connections from the same IP and aids in network troubleshooting.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-23T00:00:00.031295703+00:00&quot;}" size="10" type="int4" typeCode="4"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="5" name="pts" nullable="true" remarks="{&quot;what&quot;:&quot;Pseudo-terminal device name (e.g., /dev/pts/3) allocated to the session.&quot;,&quot;why&quot;:&quot;Identifies the terminal device for the session, needed to associate with process I/O.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-23T00:00:00.051262629+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="6" name="session_type" nullable="false" remarks="{&quot;what&quot;:&quot;Kind of SSH session such as interactive, sftp, or exec.&quot;,&quot;why&quot;:&quot;Without it, we cannot differentiate session behaviors or apply session-specific limits.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-23T00:00:00.084200262+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="7" name="device_name" nullable="true" remarks="{&quot;what&quot;:&quot;Hostname or device identifier reported by the client.&quot;,&quot;why&quot;:&quot;Used to identify the client machine when IP is dynamic or shared.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-23T00:00:00.103010535+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="6" id="8" name="started_at" nullable="false" remarks="{&quot;what&quot;:&quot;UTC timestamp when the session was established.&quot;,&quot;why&quot;:&quot;Needed to compute session duration and to order sessions chronologically.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-23T00:00:00.116504673+00:00&quot;}" size="35" type="timestamptz" typeCode="93"/>
         <column autoUpdated="false" defaultValue="null" digits="6" id="9" name="last_seen_at" nullable="false" remarks="{&quot;what&quot;:&quot;UTC timestamp of the most recent activity in the session.&quot;,&quot;why&quot;:&quot;Without it, we cannot determine if a session is stale or idle.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-23T00:00:00.214211897+00:00&quot;}" size="35" type="timestamptz" typeCode="93"/>
         <column autoUpdated="false" defaultValue="0" digits="0" id="10" name="idle_seconds" nullable="true" remarks="{&quot;what&quot;:&quot;Number of seconds since the last activity in the session.&quot;,&quot;why&quot;:&quot;Used to identify idle sessions for cleanup or monitoring.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-23T00:00:00.270304055+00:00&quot;}" size="10" type="int4" typeCode="4"/>
         <column autoUpdated="false" defaultValue="false" digits="0" id="11" name="has_children" nullable="true" remarks="{&quot;what&quot;:&quot;True if the session has spawned any child processes.&quot;,&quot;why&quot;:&quot;Indicates if the session is still actively running commands or just a shell.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-23T00:00:00.283637965+00:00&quot;}" size="1" type="bool" typeCode="-7"/>
         <column autoUpdated="false" defaultValue="0" digits="0" id="12" name="child_count" nullable="true" remarks="{&quot;what&quot;:&quot;Count of child processes currently spawned by the session.&quot;,&quot;why&quot;:&quot;Provides a measure of session activity and helps detect resource usage.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-23T00:00:00.309792991+00:00&quot;}" size="10" type="int4" typeCode="4"/>
         <primaryKey column="sshd_pid" sequenceNumberInPK="1"/>
         <index name="ssh_sessions_pkey" unique="true">
            <column ascending="true" name="sshd_pid"/>
         </index>
      </table>
      <table name="users" remarks="{&quot;what&quot;:&quot;Versioned user account records; each row is one version of a user.&quot;,&quot;why&quot;:&quot;Without it, no history of user changes or current-state lookup.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-23T00:00:15.851038020+00:00&quot;}" schema="public" type="TABLE">
         <column autoUpdated="false" defaultValue="null" digits="0" id="0" name="record_id" nullable="false" remarks="{&quot;what&quot;:&quot;Unique opaque key for this version row.&quot;,&quot;why&quot;:&quot;Without it, rows cannot be uniquely referenced for updates or joins.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-23T00:00:15.865443233+00:00&quot;}" size="2147483647" type="text" typeCode="12">
            <child column="new_user_record" foreignKey="email_changes_new_user_record_fkey" implied="false" onDeleteCascade="false" schema="public" table="email_changes"/>
            <child column="old_user_record" foreignKey="email_changes_old_user_record_fkey" implied="false" onDeleteCascade="false" schema="public" table="email_changes"/>
            <child column="new_user_record" foreignKey="password_changes_new_user_record_fkey" implied="false" onDeleteCascade="false" schema="public" table="password_changes"/>
            <child column="old_user_record" foreignKey="password_changes_old_user_record_fkey" implied="false" onDeleteCascade="false" schema="public" table="password_changes"/>
            <child column="superseded_by" foreignKey="users_superseded_by_fkey" implied="false" onDeleteCascade="false" schema="public" table="users"/>
         </column>
         <column autoUpdated="false" defaultValue="null" digits="0" id="1" name="user_id" nullable="false" remarks="{&quot;what&quot;:&quot;Stable identifier for the user across all versions.&quot;,&quot;why&quot;:&quot;Without it, versions of the same user cannot be grouped.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-23T00:00:15.885839915+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="1" digits="0" id="2" name="version" nullable="false" remarks="{&quot;what&quot;:&quot;Monotonic version number for this user, starting at 1.&quot;,&quot;why&quot;:&quot;Without it, ordering of versions and detecting the latest is impossible.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-23T00:00:15.905302084+00:00&quot;}" size="10" type="int4" typeCode="4"/>
         <column autoUpdated="false" defaultValue="true" digits="0" id="3" name="is_current" nullable="false" remarks="{&quot;what&quot;:&quot;True if this row is the latest version of the user.&quot;,&quot;why&quot;:&quot;Without it, the current user record cannot be distinguished from historical ones.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-23T00:00:15.933069235+00:00&quot;}" size="1" type="bool" typeCode="-7"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="4" name="superseded_by" nullable="true" remarks="{&quot;what&quot;:&quot;record_id of the version that replaced this one; null if current.&quot;,&quot;why&quot;:&quot;Without it, the chain of version replacements is unknown.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-23T00:00:15.954418975+00:00&quot;}" size="2147483647" type="text" typeCode="12">
            <parent column="record_id" foreignKey="users_superseded_by_fkey" implied="false" onDeleteCascade="false" schema="public" table="users"/>
         </column>
         <column autoUpdated="false" defaultValue="null" digits="0" id="5" name="email" nullable="false" remarks="{&quot;what&quot;:&quot;Login email address for the user.&quot;,&quot;why&quot;:&quot;Without it, user cannot authenticate or be contacted.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-23T00:00:15.971375143+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="6" name="display_name" nullable="false" remarks="{&quot;what&quot;:&quot;Human-readable name shown in UI.&quot;,&quot;why&quot;:&quot;Without it, no friendly label for the user.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-23T00:00:15.990193694+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="7" name="password_hash" nullable="false" remarks="{&quot;what&quot;:&quot;Hashed password for authentication.&quot;,&quot;why&quot;:&quot;Without it, password-based login is impossible.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-23T00:00:16.005911319+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="8" name="totp_secret" nullable="true" remarks="{&quot;what&quot;:&quot;Base32-encoded secret for TOTP two-factor authentication; null if not set.&quot;,&quot;why&quot;:&quot;Without it, TOTP 2FA cannot be verified.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-23T00:00:16.019148565+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="false" digits="0" id="9" name="totp_enabled" nullable="false" remarks="{&quot;what&quot;:&quot;True if TOTP two-factor authentication is active for this user.&quot;,&quot;why&quot;:&quot;Without it, login flow cannot decide whether to require a TOTP code.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-23T00:00:16.036624580+00:00&quot;}" size="1" type="bool" typeCode="-7"/>
         <column autoUpdated="false" defaultValue="'user'::text" digits="0" id="10" name="role" nullable="false" remarks="{&quot;what&quot;:&quot;Access role, e.g., 'user' or 'admin'.&quot;,&quot;why&quot;:&quot;Without it, authorization decisions cannot be made.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-23T00:00:16.057643992+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="now()" digits="6" id="11" name="created_at" nullable="false" remarks="{&quot;what&quot;:&quot;Timestamp when this version row was inserted.&quot;,&quot;why&quot;:&quot;Without it, version creation time is unknown.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-23T00:00:16.070021273+00:00&quot;}" size="35" type="timestamptz" typeCode="93"/>
         <column autoUpdated="false" defaultValue="now()" digits="6" id="12" name="updated_at" nullable="false" remarks="{&quot;what&quot;:&quot;Timestamp of last update to this version row; equals created_at if never modified.&quot;,&quot;why&quot;:&quot;Without it, staleness of the version cannot be assessed.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-23T00:00:16.080060027+00:00&quot;}" size="35" type="timestamptz" typeCode="93"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="13" name="change_reason" nullable="true" remarks="{&quot;what&quot;:&quot;Free-text reason for creating this version, e.g., 'email change'.&quot;,&quot;why&quot;:&quot;Without it, audit trail lacks context for why a version was created.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-23T00:00:16.102232584+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <primaryKey column="record_id" sequenceNumberInPK="1"/>
         <index name="users_pkey" unique="true">
            <column ascending="true" name="record_id"/>
         </index>
         <index name="idx_users_current" unique="false">
            <column ascending="true" name="user_id"/>
         </index>
         <index name="idx_users_email" unique="false">
            <column ascending="true" name="email"/>
         </index>
         <index name="idx_users_uid_ver" unique="true">
            <column ascending="true" name="user_id"/>
            <column ascending="true" name="version"/>
         </index>
      </table>
      <table name="webauthn_credentials" remarks="{&quot;what&quot;:&quot;Collection of WebAuthn credentials, each row is one registered authenticator for a user.&quot;,&quot;why&quot;:&quot;Without it, users cannot authenticate via WebAuthn and we lose the mapping between user and authenticator.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:57:12.482573903+00:00&quot;}" schema="public" type="TABLE">
         <column autoUpdated="false" defaultValue="null" digits="0" id="0" name="record_id" nullable="false" remarks="{&quot;what&quot;:&quot;Unique identifier for this credential record, a UUID or similar text key.&quot;,&quot;why&quot;:&quot;Without it, rows cannot be uniquely referenced for updates or deletion.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:57:12.499589295+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="1" name="user_id" nullable="false" remarks="{&quot;what&quot;:&quot;Identifier of the user who owns this credential, matches user table's id.&quot;,&quot;why&quot;:&quot;Without it, we cannot know which user a credential belongs to, breaking authentication lookup.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:57:12.533847483+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="2" name="credential" nullable="false" remarks="{&quot;what&quot;:&quot;Binary WebAuthn credential data, typically the public key and attestation info.&quot;,&quot;why&quot;:&quot;Without it, we cannot verify authentication signatures or perform WebAuthn assertions.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:57:12.576585214+00:00&quot;}" size="2147483647" type="bytea" typeCode="-2"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="3" name="friendly_name" nullable="true" remarks="{&quot;what&quot;:&quot;Human-readable label for the credential, e.g., 'YubiKey' or 'Phone'.&quot;,&quot;why&quot;:&quot;Without it, users cannot distinguish multiple credentials in a management UI.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:57:12.602238633+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="null" digits="0" id="4" name="platform" nullable="true" remarks="{&quot;what&quot;:&quot;Platform or device type where the credential was created, e.g., 'cross-platform' or 'platform'.&quot;,&quot;why&quot;:&quot;Without it, we cannot filter credentials by authenticator type for UX or security decisions.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:57:12.626620234+00:00&quot;}" size="2147483647" type="text" typeCode="12"/>
         <column autoUpdated="false" defaultValue="now()" digits="6" id="5" name="created_at" nullable="false" remarks="{&quot;what&quot;:&quot;Timestamp when the credential was registered, in UTC with timezone.&quot;,&quot;why&quot;:&quot;Without it, we cannot track credential age or enforce rotation policies.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:57:12.650224040+00:00&quot;}" size="35" type="timestamptz" typeCode="93"/>
         <column autoUpdated="false" defaultValue="null" digits="6" id="6" name="last_used_at" nullable="true" remarks="{&quot;what&quot;:&quot;Timestamp of the last successful authentication using this credential, in UTC.&quot;,&quot;why&quot;:&quot;Without it, we cannot identify inactive credentials for cleanup or security review.&quot;,&quot;by&quot;:&quot;fleet-annotator-worker&quot;,&quot;at&quot;:&quot;2026-09-22T23:57:12.735476851+00:00&quot;}" size="35" type="timestamptz" typeCode="93"/>
         <primaryKey column="record_id" sequenceNumberInPK="1"/>
         <index name="webauthn_credentials_pkey" unique="true">
            <column ascending="true" name="record_id"/>
         </index>
         <index name="idx_wc_user" unique="false">
            <column ascending="true" name="user_id"/>
         </index>
      </table>
   </tables>
</database>
