modules/admin.mdEngineering, modules~1 min read

Module: admin

Part of the Travi AI Agent monolith (app/modules/admin/). Read 00-overview.md §3 (hard rules) before changing anything here.
Purpose Tenant/cohort/template configuration with versioned, never-retroactive publication; kill-switch API; eligibility overrides.
Owns (data) tenant, cohort, config_version, templates
Public surface /admin/cohorts|templates|config, /admin/kill-switches, /admin/overrides/eligibility
Depends on all modules (config client, 10 s cache), audit
Requirements owned ADM-004 (config side), ENR-002, AUT-009
Constraining ADRs ADR-011, ADR-016 keys live here
Key references reference/operations.md §16.4 (key registry)

Rules that must never break

  1. Never retroactive (§2.2). A published config_version applies only to episodes created after publication. Active episodes keep the version they enrolled under; migrations require an explicit, recorded plan.
  2. Draft → review → published. No direct edits to live config; every publish stores a diff and approver.
  3. Kill switches (AUT-009). Six scopes (global/tenant/cohort/agent/tool/integration), most-specific-wins, reason mandatory, effective ≤10 s via cache TTL. Read-only patient/clinician surfaces are never disabled by agent kills.
  4. Overrides (ENR-002). Eligibility overrides log user, timestamp, reason; the duplicate-episode guard still applies.