Architecture (Phase 0)

The seams are in place and mock-first. Full notes live in docs/architecture.md.

Embed, don’t rebuild

The certified report is rendered as a native in-page object; its measures are never re-derived. Reused measures = correctness + governance in one move.

User-owns-data identity spine

One Entra app registration; the app propagates identity and never invents authorization. RLS / Unity Catalog enforce visibility. Tokens are brokered server-side (OBO), never stored.

Grounded answers with a query trail

NL → read-only query → execute → answer anchored in the result, with the exact queries and grids shown as provenance.

One adapter contract, pluggable sources

Every source returns {columns, rows} | {error}. Add a source without touching the agent loop or the API. Read-only guards run server-side.