| <article class="doc" id="doc-modules-admin" aria-hidden="true"><div class="strip"><span class="path">modules/admin.md</span><span class="tag">Engineering, modules</span><span class="meta">~1 min read</span></div> |
| <h1>Module: <code>admin</code></h1> |
| <blockquote> |
| <p>Part of the Travi AI Agent monolith (<code>app/modules/admin/</code>). Read <code>00-overview.md</code> §3 (hard rules) before changing anything here.</p> |
| </blockquote> |
| <div class="tbl-wrap"><table class="plain col-table compact"><colgroup><col class="col-auto"/><col class="col-lg"/></colgroup> |
| <thead> |
| <tr> |
| <th></th> |
| <th></th> |
| </tr> |
| </thead> |
| <tbody> |
| <tr> |
| <td data-label=""><strong>Purpose</strong></td> |
| <td data-label="">Tenant/cohort/template configuration with versioned, never-retroactive publication; kill-switch API; eligibility overrides.</td> |
| </tr> |
| <tr> |
| <td data-label=""><strong>Owns (data)</strong></td> |
| <td data-label="">tenant, cohort, config_version, templates</td> |
| </tr> |
| <tr> |
| <td data-label=""><strong>Public surface</strong></td> |
| <td data-label=""><code>/admin/cohorts|templates|config</code>, <code>/admin/kill-switches</code>, <code>/admin/overrides/eligibility</code></td> |
| </tr> |
| <tr> |
| <td data-label=""><strong>Depends on</strong></td> |
| <td data-label="">all modules (config client, 10 s cache), audit</td> |
| </tr> |
| <tr> |
| <td data-label=""><strong>Requirements owned</strong></td> |
| <td data-label="">ADM-004 (config side), ENR-002, AUT-009</td> |
| </tr> |
| <tr> |
| <td data-label=""><strong>Constraining ADRs</strong></td> |
| <td data-label="">ADR-011, ADR-016 keys live here</td> |
| </tr> |
| <tr> |
| <td data-label=""><strong>Key references</strong></td> |
| <td data-label="">reference/operations.md §16.4 (key registry)</td> |
| </tr> |
| </tbody> |
| </table></div> |
| <hr/> |
| <h2 id="doc-modules-admin--h1">Rules that must never break</h2> |
| <ol> |
| <li><strong>Never retroactive (§2.2).</strong> A published <code>config_version</code> applies only to episodes created after publication. Active episodes keep the version they enrolled under; migrations require an explicit, recorded plan.</li> |
| <li><strong>Draft → review → published.</strong> No direct edits to live config; every publish stores a diff and approver.</li> |
| <li><strong>Kill switches (AUT-009).</strong> Six scopes (global/tenant/cohort/agent/tool/integration), most-specific-wins, reason mandatory, effective ≤10 s via cache TTL. Read-only patient/clinician surfaces are never disabled by agent kills.</li> |
| <li><strong>Overrides (ENR-002).</strong> Eligibility overrides log user, timestamp, reason; the duplicate-episode guard still applies.</li> |
| </ol> |
| <div class="pn"><a class="pn-prev" href="#"></a><a class="pn-next" href="#"></a></div></article> |
|
|
