app.agreements
TableRow level security on
Agreements prepared for signature (Section 7.4 People): offer letters, contractor agreements, MSAs and NDAs. Sent with a signing token and an access code shown once and stored hashed (invariant 8); signed by the signer through the token or while signed in. A Signed agreement is never revoked or unsigned: its terms, signature and row never change and it moves only to Superseded (journey 9).
Primary key: id
| Column | Type | Nullable | Description |
|---|---|---|---|
| id | uuid | No | Primary key, UUID v7. |
| org_id | uuid | No | Owning org. A row never moves to another org.References app.organizations.id |
| project_id | uuid | Yes | Project the agreement covers, whose org it takes; NULL for an org-wide agreement such as an MSA, which names its org.References app.projects.id |
| offer_id | uuid | Yes | Offer the agreement documents, for an offer letter. The foreign key to app.offers is added from the A28 range, which owns offers.References app.offers.id |
| person_id | uuid | Yes | Person who signs, or the person an organization supplies.References app.people.id |
| counterparty_id | uuid | Yes | External organization party to the agreement.References app.counterparties.id |
| agreement_kind | app.agreement_kind | No | Offer Letter, Contractor Agreement, Master Services Agreement or Non-Disclosure Agreement. |
| title | text | No | Title, Title Case. |
| body | text | No | Full text the signer reads and signs. Changes only while Proposed. |
| token_hash | bytea | Yes | SHA-256 of the signing token; the token is shown once when sent. Never selectable by signed-in callers. |
| access_code_hash | text | Yes | bcrypt hash of the access code that goes with the token. Never selectable by signed-in callers. |
| token_expires_at | timestamp with time zone | Yes | When the signing token stops working. |
| failed_attempts | smallint | No | Wrong access codes entered with the token; the token locks at 5. |
| signed_at | timestamp with time zone | Yes | When the agreement was signed. |
| signed_name | text | Yes | Name the signer typed as their signature. |
| signed_body_sha256 | text | Yes | SHA-256 of the exact text signed, lowercase hex. |
| agreement_state | app.agreement_state | No | Agreement state. Changes only through the agreement RPCs. |
| deleted_at | timestamp with time zone | Yes | Soft delete time. A row with deleted_at set is ignored by every access helper. |
| created_at | timestamp with time zone | No | When the row was inserted. Set by the database. |
| created_by | uuid | Yes | Person who inserted the row, or null for a platform process. Set by the database.References app.people.id |
| updated_at | timestamp with time zone | No | When the row last changed. Set by the database. |
| updated_by | uuid | Yes | Person who last changed the row, or null for a platform process. Set by the database.References app.people.id |