Export and verify a tenant
Tenant export format
Look up export files, manifest fields and table inclusion rules.
For: cluster and tenant administrators.
Look up export files, manifest fields and table inclusion rules.
The format
The format is oz0-tenant-export/1. Within it files are only added: a new column appears in its table's file and in
the manifest, so read columns by name and allow ones you do not know. A renamed or removed column, or a changed
meaning, is a new format version, never a patch release's change.
| Path | What it holds |
|---|---|
README.txt | What the export holds and how to check it |
manifest.json, manifest.sig | The manifest below, and the audit key's signature over "oz0-tenant-export/1\n" + sha256(manifest.json) |
keys/audit.json, keys/gateway.json | The public keys that sign the manifests (id, kind, public_key in base64, fingerprint, created_at, retired_at) |
tables/<table>.jsonl | One JSON object per row: the table's columns by name (text as strings, integers as numbers, bytes in base64); times are UTC milliseconds in integer columns; text columns that hold JSON stay JSON text |
plugins/<name>/<version>.tar.gz | Each installed plugin's files, the gzipped tar the cluster installed |
audit/log.jsonl | The tenant's audit chain as oz0 audit export writes it, ending with the head line |
evidence/ | The evidence bundle for the period, with its own manifest.json and signature; made without the content permission, whoever exports, since audit/log.jsonl carries the private parts |
usage/usage.jsonl | The usage export's rows (schema version 1) |
inventory/inventory.json | The inventory export as JSON |
recipients/recipients.json | The recipient map of every agent and flow as oz0 inventory recipients --format json writes it (format oz0-recipients/1), computed when the export is made |
purposes/purposes.json | The tenant's purposes and legal bases, each agent's declared purposes and the findings (format oz0-purposes/1) |
content/manifest.json, content/manifest.sig | With --content: the jobs an edge exported, signed with its gateway key over "oz0-tenant-export-content/1\n" + sha256(content/manifest.json) |
content/jobs/<job>.json | Each job as oz0 job export --content writes it (format oz0.job-export/v1) |
manifest.json:
| Field | What it holds |
|---|---|
format | oz0-tenant-export/1 |
tenant, created_at, created_by | Whose export, when, and who made it |
cluster | id, name, version (the server's) and schema_version (the database's) |
since | The start of the period, when --since was given |
content | Whether content is in it |
key_id | The audit key that signs it |
tables | Per exported table: name, rule, file, rows, sha256, columns (name and type: text, integer, real, bytes, boolean), redacted and sealed (never in the rows), withheld (content columns, null without content), since (the column --since filtered on), erased_rows (rows left out as an erased subject's), private_rows (rows whose content columns are null as someone else's private chat's), walled_rows (rows whose content columns are null because a wall closes them to the exporter) |
skipped | Every table not in tables/, with its rule and reason: carried by a part, transient, or the cluster's |
parts | The parts (audit, evidence, usage, inventory, recipients, purposes, content), each with its path and format |
plugins | Each installed plugin: name, version, artifact (its digest) and file |
content_manifest | With content: the content manifest's sha256, the gateway key that signed it and the number of jobs |
private_chats | With content: withheld and read_with_reason (other people's private chats), and the rows and audit_entries whose content was withheld |
walls | With content, when the tenant's walls apply to the exporter: the rows and audit_entries whose content a wall withheld, and a note on how it was decided |
files | Every other file's path, size and sha256, but the content part's files, which the content manifest lists |
content/manifest.json has format (oz0-tenant-export-content/1), tenant, created_at, created_by,
since, key_id, jobs (each id, file, content, redactions and a note), left (jobs left out with the
reason, such as an erased subject), truncated and files.
Tables
Every table of the database has one rule, and a test fails when a new table has none, so this list is complete for
the version you run. export exports every column but those named; part means another part carries the table;
skip and cluster tables are not in the export, for the reason given. The third column is the column --since
filters on.
| Table | Rule | --since |
|---|---|---|
tenants | export | |
plugins | export | |
plugin_versions | export | |
plugin_contract_changes | export | created_at |
plugin_uses_grants | export | |
plugin_uses_pending | export | |
plugin_optional_secrets | export | |
plugin_provides | export | |
tool_policies | export | |
tool_rule_shadow | export | last_at |
llm_providers | export | |
model_aliases | export | |
model_alias_seeds | export | |
model_map_rules | export | |
agent_budgets | export | |
agent_changes | export | proposed_at |
plugin_change_budgets | export | |
model_canaries | export | |
teams | export | |
team_members | export | |
quotas | export | |
routines | export | |
routine_versions | export | |
plugin_hidden_skills | export | |
channel_bindings | export | |
channel_members | export | |
channel_rooms | export | |
connections | export; redacted nonce, nonce_expires_at (the one-time nonce of a flow under way) | |
credential_bindings | export | |
tenant_settings | export | |
tenant_retention | export | |
mfa_policies | export | |
notification_rules | export | |
kill_switches | export | created_at |
inventory | export | |
memberships | export | |
provisioner_tenants | export | |
api_keys | export; redacted secret_hash (a key's hash is a credential) | |
join_tokens | export; redacted secret_hash (a token's hash is a credential) | |
nodes | export | |
rollouts | export | created_at |
tenant_backend_moves | export | started_at |
change_requests | export; content diff, payload, error only with --content; digests delta_sha256 keyed without --content | requested_at |
tenant_region_moves | export | started_at |
workspace_folders | export | |
workspace_revisions | export | |
workspace_revision_files | export | |
workspace_blobs | export | |
workspace_drafts | export | |
workspace_draft_files | export | |
tenant_secrets | export; sealed sealed left out | |
tenant_payload_keys | export; sealed sealed left out | |
subject_keys | export; sealed sealed left out | |
job_summaries | export; content error, findings only with --content | started_at |
job_owners | export | started_at |
job_starters | export | started_at |
job_runs | export | started_at |
job_tags | export | added_at |
job_step_summaries | export | started_at |
job_errors | export; content message, example only with --content | last_at |
harness_sessions | export | recorded_at |
job_budgets | export | created_at |
job_board | export; redacted dedupe; content body only with --content | created_at |
job_conversations | export | started_at |
event_waits | export | created_at |
routine_outputs | export; content output, arguments, result, answer only with --content | created_at |
budget_requests | export | created_at |
loop_events | export | |
chats | export | |
chat_people | export | |
chat_shares | export | |
chat_texts | export; sealed sealed left out | started_at |
channel_threads | export; redacted reply_token, reply_until; content request only with --content (a chat message's reply token lasts minutes) | created_at |
subject_jobs | export | started_at |
erasures | export | requested_at |
held_histories | export; sealed data left out, its digest keyed without content (a held history's copy is the history itself: read it with oz0 retention held --out) | copied_at |
eval_runs | export | started_at |
eval_findings | export | opened_at |
eval_kept | export | kept_at |
audit_log | part audit | recorded_at |
audit_chain | part audit | |
gateway_records | part evidence | recorded_at |
gateway_chain | part evidence | |
llm_usage | part usage | at |
outside_spend | part usage | imported_at |
payloads | skip: content stored apart from the histories, sealed with the tenant's payload key: each job's export (--content) carries it decrypted | |
quota_usage | skip: per-person spend figures (R6): the usage part holds the tenant's spend, by team where works-council mode shows it | |
job_summary_cursors | skip: internal: the summarizer's place | |
channel_handled | skip: transient: chat messages acted on, kept a day for deduplication | |
channel_link_codes | skip: transient: codes that link a chat identity, for ten minutes | |
connection_tokens | skip: transient: rebuilt by use | |
eval_keep_calls | skip: transient: a kept case's model calls, sealed, while it is kept | |
event_deliveries | skip: transient: events, kept a day for deduplication | |
feeds | skip: transient: browser tabs' feeds | |
job_replay_calls | skip: transient: the test bench's recorded model calls | |
job_replays | skip: transient: the test bench's recordings | |
notification_deliveries | skip: transient: notifications' tries, kept 30 days | |
plugin_candidates | skip: transient: private candidates their developers renew | |
plugin_uploads | skip: transient: bundles waiting to be installed, a day at most | |
provider_key_hashes | skip: transient: hashes of provider keys, rebuilt by use | |
provider_pool_state | skip: transient: what edges saw of pool members, rebuilt by use | |
quota_pending_charges | skip: transient: charges an edge buffered | |
stream_tickets | skip: transient: one-time stream tickets, for a minute | |
blobs | cluster: plugin artifacts by digest, shared; the export carries each installed plugin's artifact under plugins/ | |
temporal_retention | cluster: each backend namespace's retention as the edge found it; the tenant's retention is in tenant_retention | |
cluster | cluster: the cluster's identity and its CA keys | |
operators | cluster: the cluster's operators | |
users | cluster: the cluster's accounts and their password hashes; the tenant's members are in memberships | |
user_identities | cluster: accounts' sign-in identities | |
user_mfa | cluster: accounts' second factors | |
recovery_codes | cluster: accounts' recovery codes | |
pending_links | cluster: accounts waiting to link a sign-in identity | |
notification_addresses | cluster: accounts' own addresses | |
removed_accounts | cluster: accounts removed from the cluster | |
directory_groups | cluster: a directory's groups of accounts | |
provisioners | cluster: the cluster's provisioners | |
oidc_providers | cluster: the cluster's sign-in providers | |
plugin_indexes | cluster: the cluster's plugin indexes | |
signing_keys | cluster: the cluster's signing keys; the public ones are in keys/ | |
audit_key_seals | cluster: the audit keys' sealed halves | |
key_backups | cluster: what operators confirmed of the cluster's key copies | |
servers | cluster: servers' heartbeats | |
node_status | cluster: nodes' connections | |
sessions | cluster: sign-in sessions | |
signin_failures | cluster: failed sign-ins of the last minutes, by keyed hash | |
leases | cluster: servers' leases | |
edge_registry | cluster: what edges applied of the registry | |
registry_confirmations | cluster: registry confirmations | |
registry_version | cluster: the registry's version | |
edge_applied | cluster: writes edges buffered | |
edge_sealing | cluster: the cluster's record that the edges re-sealed every key of a kind | |
feed_bells | cluster: the feeds' doorbell | |
authority_envelopes | export; a block's digest of its input keyed and its MAC left out without content | created_at |
authority_epochs | export | |
authority_revocations | export | created_at |
receipts | export | created_at |
revocation_fences | cluster: which servers fenced a receipt's epoch | |
file_labels | export; digests keyed without content | |
file_scopes | export; digests keyed without content | |
tenant_mail | export | |
apps | export | |
erasure_deferrals | export | |
erasure_policies | export | |
agent_keep_for | export | |
subject_rules | export | |
job_keys | export | |
job_key_wraps | export; sealed wrapped left out | |
tenant_secret_history | skip: previous secret values, sealed and kept 24 hours: never exported | |
secret_ref_state | skip: transient: what a secret store last answered | |
secret_stores | cluster: the secret stores each edge reaches | |
key_sources | cluster: where each server's keys come from | |
role_sets | cluster: the cluster's role sets; a member's roles are in memberships | |
budget_reservations | export; redacted budgets (a call's budget keys name the person whose quota it charged (R6)) | created_at |
budget_holds | skip: transient: per-budget counters recomputed from llm_usage; quota: | |
tree_admissions | export | created_at |
comparisons | export | created_at |
comparison_runs | export | finished_at |
incidents | export | |
incident_links | export | |
incident_stages | export | |
incident_notes | export; content body only with --content | |
incident_reminders | export | |
incident_settings | export | |
tenant_legal_bases | export | |
tenant_purposes | export | |
agent_legal_bases | export | |
inventory_assessment | export | |
purpose_counts | export | |
plugin_reads | export | |
plugin_read_targets | export | |
results_seen | skip: edges' claims of the results source's routed events, kept a week | |
inventory_seen | skip: edges' change-detection state, rebuilt quietly on the next look | |
tool_sequence_facts | skip: transient: the sequence rules that fired in a running job tree, which the edge prunes | |
plugin_vuln_scans | export | |
plugin_vuln_findings | export | |
advisories | cluster: the cluster's imported advisories, which every tenant's scans read | |
advisory_sources | cluster: where the cluster's advisories came from, and who imported them | |
spend_root_kinds | skip: derived: the kind of each root job that spent money, read again from its workflow | |
spend_anomaly_days | export | |
governance_replays | export | created_at |
governance_replay_jobs | export | at |
oidc_issuers | export | |
mcp_grants | export; redacted code_hash, code_challenge, refresh_hash, refresh_prev_hash, last_used_at | created_at |
mcp_client_policies | export | |
plugin_records | export; redacted dedupe; content body only with --content | created_at |
tenant_memory | export | |
agent_memory | export | |
test_approvals | export | |
approval_asks | skip: transient: the ladder's first steps, kept a day for the flood finding | |
judge_anchor_runs | export | started_at |
sampled_judgments | export | sampled_at |
subject_restrictions | export | |
decision_records | export | started_at |
decision_contests | export; content reason only with --content | created_at |
agent_tombstones | export | |
team_orphans | export | |
idempotency_keys | skip: transient: the admin API's answers to calls made with an Idempotency-Key, kept a day | |
plugin_set_members | export | |
plugin_version_provenance | export | |
agent_starts | skip: transient: the running jobs of agents with limits.concurrent, which each start counts again | |
tool_snapshot_checks | skip: a queue: node listings management has still to check against the tool policy; the snapshots are exported with the plugins | |
job_outcomes | export; content detail only with --content | reported_at |
plugin_rollout_quality | export | |
candidate_checks | skip: transient: the candidate checks of agent-made changesets, each for its job's changes approval, holding code no person has read yet; a job asks again | |
model_vettings | export | |
held_history_heads | export; current and published retained-history generations | |
held_history_captures | export; private source, checkpoint and manifest internals left out | |
held_history_objects | export; source identities left out, payload digests only with content permission | |
held_history_chunks | export; chunk bytes left out, payload digests only with content permission | |
held_history_discovery | export; private scan and source checkpoint internals left out | |
held_history_erased_trees | export; erasure markers that prevent capture from bringing erased jobs back |