> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bijection.com/llms.txt
> Use this file to discover all available pages before exploring further.

# The model

> One directory of declared source that is the whole product.

A model directory is the only production composition input, and it is a complete
product: it must boot with no Go or React registration.

## Canonical layout

Only `requel.toml`, `events.star`, and an optional `home.star` live at the root.
Everything else has one home:

| Directory          | Holds                                          |
| ------------------ | ---------------------------------------------- |
| `actions/`         | Governed mutations                             |
| `automations/`     | Standing rules                                 |
| `dashboards/`      | Panel compositions                             |
| `data/connectors/` | Connector and live source-dataset declarations |
| `functions/`       | Governed read/computation boundaries           |
| `models/`          | External-model terminals                       |
| `objects/`         | Object types                                   |
| `policy/`          | Authority declarations                         |
| `queries/`         | SQL entrypoints                                |
| `relations/`       | Reusable semantic relations                    |
| `scenarios/`       | Qualification assets                           |
| `workshops/`       | Task-oriented applications                     |

`data/secrets.lock` belongs to the directory and selects exact immutable secret
versions. Secret bytes never belong in Git.

<Note>
  There is no derived-dataset asset and no `data/*.star` namespace. If something
  feels like it needs one, it is usually a function.
</Note>

## Publishing a change

Publication is a Git operation performed through `eclipse`, not a runtime
capability:

```bash theme={null}
eclipse validate
eclipse publish
```

The result is one validated, signed review branch. Merging it publishes the
product change. A deployment then loads that exact revision along with the
secret-version lock it was built against.

Product publication is **not** a workspace capability, and it never bypasses the
plan/review/execute rail for the live world.

## Connectors and credentials

`eclipse connector authorize` is the one interactive OAuth installation rail. It
performs a single loopback PKCE authorization-code flow, sends the client secret
only to the declared token endpoint, stores client ID, client secret, and refresh
token as immutable secret versions, and atomically changes their three lock
references for ordinary Git review.

It creates no runtime connection store and no mutable credential registry.

## The domain-blindness rule

Business vocabulary lives only in the model — Go, Rust and TypeScript module source,
acceptance code, and seed data. It never appears in the Go kernel, the platform
schema, the API shape, or the frontend.

The test is simple: swapping model directories must yield a different
operational product with zero kernel changes.