Object / lake storage
people_bronze, people_silver, people_gold on the People lake. Durable raw and history. Never queried by the website.
Architecture
Where AI sits. Where governance sits.
The public demo is a serving layer over a People data platform. Object storage holds history; a scheduled pipeline builds the lake and publishes governed marts to a serving database. The model only ever talks to the top of this stack.
LiveTarget architectureDashed components are roadmap. Nothing tagged target is shipped.
Data flow
From source document to certified number
Bronze / silver / gold lake layers, a metric registry, lineage and freshness, then a serving layer of people_get_* RPCs. The website never scans lake files.
01
L1Sources
Synthetic HRIS, ATS, LMS, performance, compensation and engagement, plus public O*NET, BLS and Microsoft Learn.
02
L1People Bronze
Immutable extracts in the people lake. Website pages never scan lake files.
03
L1Validation / Data Quality
Row-count, freshness, uniqueness and referential checks. Failures become incidents, not silent dashboard changes.
04
L1People Silver
Normalized worker, assignment, recruiting and learning grains.
05
L1People Gold / Marts
Certified aggregate slices: workforce, retention, mobility, compensation, skills, recruiting, learning.
06
L2Certified Metric Registry
people_metric_definition stores definition, formula, population, exclusions, owner and version.
07
L2Lineage / Freshness / Governance
people_dataset_lineage, source health, and people_serving_snapshot separate current trusted state from incident replay.
08
L2Serving RPC Layer
people_get_* functions. Arithmetic stays in Postgres.
09
L3Workforce Intelligence
Retention, skill coverage and related signals over certified metrics.
10
L4People AI Tools
A bounded tool list over the same RPCs. Not generic NL-to-SQL. The model chooses tools; values and fact sentences come from SQL and templates.
Facts vs model
SQL produces the numbers. The model chooses tools and writes hypotheses.
The model chooses which tools to call. Values and fact sentences are generated by SQL and deterministic templates; the model does not rewrite them.
The only model-authored text is hypotheses.
If the planner fails, headline, facts, and the tool sequence stay the same. That equality is the b2a_diff evidence. Eval scores hypotheses (empty / digits / causal verbs) and required tools; it does not score headline/facts by text similarity.
Suppression threshold
effective_min_cell is the stricter of metric and identity
effective_min_cell = max(metric_min_cell, identity_min_cell). min_cell_source is identity when the identity floor is at least as strict as the YAML metric floor, otherwise metric. Example: compa YAML 10 and Engineering leader 20 → effective 20 (source identity).
Runtime split
Scheduled compute
Daily pipeline, quality tests, gold rebuild, and incident replay extract.
Serving database
people_v2 marts and people_get_* RPCs. Pages call serving functions; they do not scan lake files.
Worked example · Employee Transfer
One source document is mapped, canonicalized, then used in a certified metric. The website never scans lake files; it calls people_get_metric_for.
- Employee Transferfrappe_hr.Employee Transfer
- →Mappingpeople_mappings/frappe_employee_transfer.yml
- →Canonical eventpeople_evt_transfer
- →Certified metricpeople_metric.internal_mobility_rate
Dataset page · synthetic GlobalTech, not a real company.
Incident replay
The APAC incomplete HRIS extract is a historical replay. Current Headcount is the latest certified published snapshot. Replay context marks downstream reporting blocked; it does not overwrite trusted marts.
Connect your own AI client through the MCP endpoint, or walk the five modules on Try It Yourself.