Pull-Up / Push-Up Draft Schema Planning

Purpose

This page defines how Renata could eventually store pull-up and push-up draft metadata and future-sensitive draft content using pseudonymous actor references and strict review, retention, deletion, and privacy boundaries.

It is schema planning only. It creates no drafts, stores no submissions, creates no staff decisions, places nothing on the Morning Sheet, and adds no migrations, tables, write endpoints, or runtime database paths.

Current Account/Actor/Role Boundary

Product

Renata

The Sixth Sense at 6th Street

Draft storage

false

not implemented

Live submissions

false

not implemented

Staff decisions

false

not implemented

Pull-up/push-up draft schema is metadata only; no drafts, submissions, accounts, actor records, identity maps, staff decisions, Morning Sheet placements, tables, migrations, or writes exist.

Why Draft Schema Comes After Role Mapping

Draft storage would carry future-sensitive accountability content, so it must come after access boundaries, pseudonymous actor references, and account role mapping are defined. This planning page keeps draft fields conceptual until identity, role, staff review, visibility, retention, deletion, audit, and privacy gates are approved.

No account storage, actor storage, identity mapping, live role assignment, submissions, staff decisions, Morning Sheet placement, database writes, active migrations, or executable SQL files are added.

Draft Schema Principles

Draft records must use pseudonymous actor refs, not real identity.
Draft records must not contain email, name, initials, room number, case number, Cloudflare claim values, JWTs, tokens, resident profiles, or staff profiles.
Draft records must be scoped to community and workflow context.
Drafts must not become attendance, participation, performance, scoring, ranking, discipline, or compliance tracking.
Pull-ups must be structured around repair, accountability, and safety, not public shaming.
Push-ups must be structured around recognition, not popularity scoring.
Drafts must not become searchable gossip, resident dossiers, or staff surveillance.
Drafts must not be collected live until access, actor mapping, role mapping, review, retention, audit, deletion, and privacy gates are approved.

Planned Draft Tables

Table	Purpose	Status	Sensitivity	Fields	Activation gates	Launch blockers
`future_pullup_pushup_drafts`	stores future draft metadata and draft content after approval to collect live drafts	planned-only	future-sensitive-draft-content	id, community_id, workflow_scope, draft_type, draft_status, author_actor_ref, draft_title, draft_body, visibility_status, retention_category, deletion_status, version, created_at, updated_at, archived_at	Cloudflare Access boundary approved; identity policy approved; pseudonymous actor policy approved; account role mapping policy approved; draft content policy approved; pull-up safety policy approved; push-up recognition policy approved; staff review procedure approved; Morning Sheet visibility policy approved; retention policy approved; deletion policy approved; audit policy approved; AI-use policy resolved; D1 schema reviewed; privacy approval complete; rollback plan approved; small pilot approved	no draft storage exists; no live submissions exist; no account storage exists; no actor storage exists; no identity mapping exists; no live role assignment exists; no user admin CRUD exists; no staff decisions exist; no Morning Sheet placement exists; no retention/deletion policy is approved; no audit policy is approved; no active migration is approved; no database write path is approved
`future_pullup_pushup_draft_subject_refs`	stores future pseudonymous subject references for drafts	planned-only	identity-adjacent-subject-reference	id, community_id, workflow_scope, draft_type, subject_actor_ref, visibility_status, created_at, updated_at	Cloudflare Access boundary approved; identity policy approved; pseudonymous actor policy approved; account role mapping policy approved; draft content policy approved; pull-up safety policy approved; push-up recognition policy approved; staff review procedure approved; Morning Sheet visibility policy approved; retention policy approved; deletion policy approved; audit policy approved; AI-use policy resolved; D1 schema reviewed; privacy approval complete; rollback plan approved; small pilot approved	no draft storage exists; no live submissions exist; no account storage exists; no actor storage exists; no identity mapping exists; no live role assignment exists; no user admin CRUD exists; no staff decisions exist; no Morning Sheet placement exists; no retention/deletion policy is approved; no audit policy is approved; no active migration is approved; no database write path is approved
`future_pullup_pushup_draft_status_history`	stores future draft lifecycle transitions	planned-only	draft-lifecycle-audit-sensitive	id, draft_status, version, change_reason, created_at, updated_at, archived_at	Cloudflare Access boundary approved; identity policy approved; pseudonymous actor policy approved; account role mapping policy approved; draft content policy approved; pull-up safety policy approved; push-up recognition policy approved; staff review procedure approved; Morning Sheet visibility policy approved; retention policy approved; deletion policy approved; audit policy approved; AI-use policy resolved; D1 schema reviewed; privacy approval complete; rollback plan approved; small pilot approved	no draft storage exists; no live submissions exist; no account storage exists; no actor storage exists; no identity mapping exists; no live role assignment exists; no user admin CRUD exists; no staff decisions exist; no Morning Sheet placement exists; no retention/deletion policy is approved; no audit policy is approved; no active migration is approved; no database write path is approved
`future_pullup_pushup_draft_review_refs`	stores future staff-review reference metadata, not decisions yet	planned-only	staff-review-reference-sensitive	id, review_ref, reviewer_actor_ref, draft_status, visibility_status, created_at, updated_at	Cloudflare Access boundary approved; identity policy approved; pseudonymous actor policy approved; account role mapping policy approved; draft content policy approved; pull-up safety policy approved; push-up recognition policy approved; staff review procedure approved; Morning Sheet visibility policy approved; retention policy approved; deletion policy approved; audit policy approved; AI-use policy resolved; D1 schema reviewed; privacy approval complete; rollback plan approved; small pilot approved	no draft storage exists; no live submissions exist; no account storage exists; no actor storage exists; no identity mapping exists; no live role assignment exists; no user admin CRUD exists; no staff decisions exist; no Morning Sheet placement exists; no retention/deletion policy is approved; no audit policy is approved; no active migration is approved; no database write path is approved
`future_pullup_pushup_draft_audit_events`	stores future audit metadata for draft changes	planned-only	audit-sensitive	id, audit_event_type, change_reason, author_actor_ref, reviewer_actor_ref, created_at	Cloudflare Access boundary approved; identity policy approved; pseudonymous actor policy approved; account role mapping policy approved; draft content policy approved; pull-up safety policy approved; push-up recognition policy approved; staff review procedure approved; Morning Sheet visibility policy approved; retention policy approved; deletion policy approved; audit policy approved; AI-use policy resolved; D1 schema reviewed; privacy approval complete; rollback plan approved; small pilot approved	no draft storage exists; no live submissions exist; no account storage exists; no actor storage exists; no identity mapping exists; no live role assignment exists; no user admin CRUD exists; no staff decisions exist; no Morning Sheet placement exists; no retention/deletion policy is approved; no audit policy is approved; no active migration is approved; no database write path is approved

Planned Field Map

idcommunity_idworkflow_scopedraft_typedraft_statusauthor_actor_refsubject_actor_refreviewer_actor_refdraft_titledraft_bodyrepair_promptrecognition_promptvisibility_statusmorning_sheet_eligibilityretention_categorydeletion_statusversioncreated_atupdated_atarchived_atreview_refchange_reasonaudit_event_type

these are planning-only fields
no table is active
no draft content is collected
draft_body is future-sensitive and requires staff/privacy approval before any storage
actor refs are conceptual until actor storage is approved
reviewer refs are conceptual until staff review policy is approved
morning_sheet_eligibility is planning metadata only and must not create placement

Relationship Boundaries

Relationship	Status	Allowed future use	Prohibited use
draft to pseudonymous author actor ref	planned-only	Could reference the future draft author after actor storage and role mapping gates are approved.	Must not store real identity, Cloudflare claims, account records, resident profiles, or participation metrics.
draft to optional pseudonymous subject actor ref	planned-only	Could support a subject reference only with visibility, privacy, staff review, and deletion policies.	Must not become a resident dossier, case history, shaming index, attendance record, or scoring record.
draft to future staff-review reference metadata	planned-only	Could connect a draft to a future review workflow after staff review policy is approved.	Must not create approvals, rejections, staff decisions, reviewer profiles, or staff surveillance.
draft to future Morning Sheet eligibility planning	planned-only	Could mark future eligibility only after review and visibility gates are approved.	Must not create automatic Morning Sheet placement or publish content.
draft to future audit metadata	planned-only	Could record lifecycle metadata after audit and retention gates are approved.	Must not store sensitive identity, staff notes, raw Access claims, or community gossip.

Draft Lifecycle States

State	Status	Behavior
`not-created`	planning-only	does not trigger behavior
`draft-started`	planning-only	does not trigger behavior
`resident-review`	planning-only	does not trigger behavior
`revision-needed`	planning-only	does not trigger behavior
`staff-review-pending`	planning-only	does not trigger behavior
`staff-review-blocked`	planning-only	does not trigger behavior
`eligible-for-morning-sheet`	planning-only	does not trigger placement
`held-private`	planning-only	does not trigger behavior
`archived`	planning-only	does not trigger behavior
`deleted`	planning-only	does not trigger behavior

Staff Review and Morning Sheet Boundaries

Staff review boundaries

review_ref is conceptual until staff review policy is approved
reviewer_actor_ref is conceptual until staff review policy is approved
future staff review references are not staff decisions
no approval or rejection state triggers behavior in this phase
staff review references must not store staff names, staff emails, staff profiles, Cloudflare groups, or staff notes

Morning Sheet boundaries

morning_sheet_eligibility is planning metadata only
eligible-for-morning-sheet does not place an item on the Morning Sheet
Morning Sheet visibility policy is required before any placement workflow
no automatic placement is active
no public reading or display is enabled

Validation Rules

Future schema must support

draft type: pull-up or push-up
pseudonymous author reference
optional pseudonymous subject reference
staff review boundary
visibility status
retention category
deletion status
audit planning
Morning Sheet eligibility planning

Future schema must not support

app-level login
email storage
real names
user profiles
resident profiles
staff profiles
live role assignment
live submissions
live staff decisions
automatic Morning Sheet placement
attendance tracking
participation tracking
participation analytics
scoring/ranking/compliance metrics

Excluded Identity, Sensitive, and Tracking Fields

emailnamefirst namelast nameinitialsphoneaddressroom numbercase numberlegal identifiermedical identifierinsurance identifierCloudflare identity headerJWTtokengroup claimraw Access claimsresident profile detailsstaff profile detailsdiagnosis detailsmedication detailslegal case detailstrauma details unless explicitly disclosed and approved under future policyattendance dataparticipation dataparticipation analyticsscoring dataranking datadiscipline pointscompliance metricsresident performance metrics

Audit Requirements

audit policy must exist before draft storage
audit events must use pseudonymous actor refs only
audit events must not store email, name, Cloudflare claims, JWT, token, group, resident profile, or staff profile fields
audit events must distinguish draft lifecycle, visibility, retention, deletion, and review-reference changes
audit events must not become attendance tracking, participation analytics, scoring, compliance reporting, or staff surveillance

Retention And Deletion Considerations

draft content requires a retention category before storage
draft content requires deletion rules before storage
archived drafts must not become resident history
deleted status must not preserve sensitive content in a visible workflow
held-private status must not become a searchable dossier
audit events require a retention boundary before writes exist

Required Gates Before Storage

Cloudflare Access boundary approved
identity policy approved
pseudonymous actor policy approved
account role mapping policy approved
draft content policy approved
pull-up safety policy approved
push-up recognition policy approved
staff review procedure approved
Morning Sheet visibility policy approved
retention policy approved
deletion policy approved
audit policy approved
AI-use policy resolved
D1 schema reviewed
privacy approval complete
rollback plan approved
small pilot approved

What Remains Blocked

live pull-up forms
live push-up forms
input fields
textareas
submit/save buttons
draft creation
draft editing
draft deletion
draft records
draft storage
live submissions
submission collection
staff approval/rejection
staff decisions
Morning Sheet live placement
app-level login
account creation
password fields
email capture
real user names
real resident names
real staff names
real emails
Cloudflare Access email display
Cloudflare Access name display
Cloudflare Access group display
Cloudflare Access JWT display
Cloudflare Access token display
Cloudflare Access header display
Cloudflare Access claim storage
actor records
actor storage
account records
account storage
identity mapping
role assignment
live role assignment
resident profiles
staff profiles
user admin CRUD
database writes
write endpoints
active migrations
executable SQL files
D1 account/user/actor/submission/draft tables
attendance tracking
participation tracking
participation analytics
scoring, ranking, discipline points, or compliance metrics
billing, lead capture, CRM, Stripe, or sales forms
AI for real submissions
sensitive community content storage

Recommended Next Phase

Phase 8.6 - Staff Review Procedure Planning

After draft schema boundaries are planned, the next safe step is planning staff review procedure boundaries before any draft storage or review decisions exist.

Boundaries: no draft storage in Phase 8.5; no live submissions; no account storage; no actor storage; no identity mapping; no live role assignment; no staff decisions; no Morning Sheet placement; no database writes; no active migrations; no executable SQL files.

recommended-next