# Orchestrator run ledger

Purpose
- Immutable record of DAG runs and step executions for audit and replay.

Core fields
- tenant, runId, dagId, dagVersion, runToken, traceId.
- status and timestamps (startedUtc, endedUtc, durationMs).
- inputsHash and outputsHash at run and step levels.

Step records
- stepId, attempt, status, timing, errorCode, retryable.
- logsRef and metricsRef point to content-addressed artifacts.

Storage and exports
- Tenant-scoped PostgreSQL tables with indexes on tenant, status, and time.
- Append-only updates; status transitions are monotonic.
- NDJSON exports are sorted by startedUtc then runId.
 - Artifacts are content-addressed; hashes point to object storage or large objects.

Governance
- Runs are never deleted; cancellation is recorded as an event.
- Admin queries require orchestrator:admin scope.

Related references
- orchestrator/overview.md