Aliquot — run ingestion & provenance
A laboratory can only defend a result if it can show where the data came from. Aliquot registers instrument runs once, accepts their files without trusting the network, and keeps a record that cannot be quietly edited.
- INGESTION
- Idempotent run registration
- TRANSFER
- Resumable, hash verified on close
- LINEAGE
- W3C PROV entity / activity / agent
- TENANCY
- PostgreSQL row-level security
- DECISION RECORDS
- 15 ADRs with rejected options
ENTRY n−1
prev 0000…
hash a91f…
prev 0000…
hash a91f…
ENTRY n
prev a91f…
hash 7c02…
prev a91f…
hash 7c02…
ENTRY n+1
prev 7c02…
hash e4b8…
prev 7c02…
hash e4b8…
RUN — entity← wasGeneratedBy
INSTRUMENT PASS — activity
wasAssociatedWith →OPERATOR — agent
THE HARD PART
Row-level security is only isolation if every connection sets its tenant context and no code path can forget. That is a connection-pool problem, not a SQL problem.
WHAT I REJECTED
A database per tenant. Clean isolation, unworkable migrations. RLS moves the cost from operations to review discipline.
OPEN QUESTION
Row-level security holds until one tenant's volume makes the shared indexes on run and audit_event the bottleneck. Partitioning by tenant_id precedes splitting — the threshold is unmeasured.