# Dataflow Interface Pattern Migration

This migration applies the GovOPlaN interface pattern language to the pipeline
library, graphical and constrained-SQL editors, node inspector, intermediate
preview, automation triggers, and durable run/deployment surfaces.

## Surface Inventory

| Surface | Archetype | Consequence class | Contract |
| --- | --- | --- | --- |
| `/dataflow` library | Governed directory | Select, create, reuse, or retire a pipeline | Stable loading, empty, permission, read-only, disabled-reason, and help states |
| Graph/SQL workspace | Consequential definition editor | Append immutable revision | One canonical graph, guarded draft, constrained SQL compilation, diagnostics, and explicit save/discard |
| Node inspector | Typed configuration editor | Change transform semantics | Contextual node/expression help, typed validation, bounded intermediate preview, and read-only state |
| Trigger editor | Governed automation editor | Create, enable, change, or delete trigger | Guarded nested draft, pinned revision/grant, authorization recheck, and destructive confirmation |
| Preview/results | Bounded evidence preview | Read transient intermediate rows | Selected-node context, diagnostics, privacy boundary, row limit, and no retained preview contents |
| Runs/deployments | Asynchronous command register | Queue, publish, cancel, reconcile, or promote | Explicit consequence confirmation, durable command identity, progress, recovery state, and retained evidence |

## Consequence And Availability Rules

- Saving appends an immutable definition revision. Derivation creates a
  separately governed copy pinned to the source revision and content hash.
- SQL is parsed and compiled into the canonical graph. It is never passed
  directly to a database or execution provider.
- Preview is bounded and transient. A saved run is revision-pinned and records
  actor, authority, idempotency, progress, output, and recovery evidence.
- Publishing appends a governed Datasource materialization. Unknown external
  outcomes require reconciliation before retry.
- Staging and production promotion require confirmation and never rewrite a
  revision. Cancellation cannot promise reversal of acknowledged external
  effects.
- Missing optional Datasources or automation capabilities disable only their
  associated actions; local graph, SQL, validation, and preview behavior stays
  available where authorized.

Backend and WebUI manifests publish matching surface identifiers. English and
German catalogues cover module-owned navigation, states, and core commands.
Contextual help resolves from manifest documentation, main and nested drafts
are guarded, and unavailable actions carry stable reasons.