API modules

The HTTP data plane separates authenticated execution signaling, transfer credentials, proxy requests and global operator management.

DataPlaneModule

DataPlaneService reports the stable worker ID and HTTP pull profile through GET /management/state. The control plane owns tenant registrations. This module does not register participants, publish catalogs or provide a registration API. The state endpoint requires an allowlisted human operator.

DataflowModule

DataflowController receives prepare, start, suspend, resume, completion, termination, status and lease-renewal signaling. The common DataPlaneSignalingGuard verifies the token and matches its execution owner against controlPlane.executionScopes before the service stores or reads a flow. DataflowDao persists that immutable owner and its execution lease alongside the backend configuration and transfer state.

DataAccessTokens signs short-lived access JWTs and rotates single-use refresh grants. DataAccessController verifies refresh proofs and rejects expired or revoked execution authority. Preserve the signing key and database across restarts. See data access credentials.

DataflowManagementController lists flows for global operators. Tenant management and dataset configuration stay in the control plane.

TransferModule

ProxyController exposes the transfer capability endpoint. The transfer handler validates access credentials, flow state and the persisted lease before proxying a request to the stored backend. Consumers use the endpoint and authorization headers returned through the control plane. The consumer HTTP pull side needs no local data plane.

Logging and operator policy

LoggingModule stores request logs. The common audit module records audit events. The operator policy protects flow lists, worker state, logs and settings with management.operatorPrincipals. It accepts only allowlisted global humans; workload tokens and tokens carrying tenant_id cannot grant operator access.

ConfigController exposes UI appearance settings and updates to global operators. It does not edit execution scopes or authentication settings at runtime. Change those in the worker configuration and restart it.