Venruk data flow, contract flow, and event flow diagrams showing how data transforms from snapshot to user outputs and how events propagate through the system
Data flow and contract flow
Venruk data and contract flow — from intelligence snapshot through scan report v1 and view DTOs to all output surfaces
Shows canonical objects at top flowing into ScanReport v1 public contract and internal ViewDTO, then branching to export surfaces and experience surfaces respectively.
Canonical objects — never persisted as derived
IntelligenceSnapshot · Finding · Scan · EngineeringWorkspace · Decision · Capability
Engineering Projection — derived at read time, never stored
ProjectionBuilder merges contexts · normalizes data · builds immutable DTO graph
public contract
internal contract
ScanReport v1
THE only public external contract
ReportProfile controls redaction
ViewDTO + WidgetDTO
Internal only — never expose raw workspace
Profile-filtered · density-aware
X-Content-Hash header
BFF only reads ViewDTO
Export Surfaces
SARIF 2.1.0 · JSON · HTML
PDF · PR Markdown (DiffEngine)
Compliance export (control mapping, GPG)
Experience Surfaces
Web workspace (Next.js)
CLI/Rich · VS Code · JetBrains
MCP tools (ReportProfile.mcp)
Auditors · CI/CD · GRC platforms
SARIF ingested · signed report verified
Engineers · agents · executives
Web workspace · IDE · agent tools
ReportProfile redaction — applied at ScanReport generation, not at display time
developer full detail, CVE IDs, fix commands
lead no fix commands, full rationale
executive business language only, no CVEs, no tool names
Event flow architecture — Venruk Face and Venruk 2031
Venruk event flow — scan triggers fan out to SSE browser updates, fleet materialization, notifications, PR comments, and threat alerts
Shows four event triggers on the left fanning into the central event bus and scan engine, which then dispatches to five output channels on the right. Venruk 2031 adds a continuous scan path using file watching and SSE workspace patches.
Triggers
Event bus + scan engine
Output channels
File save / push
PR opened
CVE published
Manual scan
Scan Engine
compute → snapshot → projection
Continuous Scanner (2031)
file watcher → incremental scan
WorkspacePatch → SSE stream
SSE → browser
workspace refresh
Fleet materializer
event-driven, debounced
Notifications
in-app · webhook · email
PR comment
DiffEngine, 60k limit
CVE alert SSE
SLO: < 60 seconds
ScanEvent types emitted
scan.started · scan.stage.completed · scan.completed · scan.failed
snapshot.persisted · workspace.invalidated · projection.rebuilt · pr.comment.posted
2031 adds: WorkspacePatch events (finding.added · finding.resolved · indicator.updated · brief.updated)
All events carry: scan_id, repo_id, tenant_id, timestamp — tenant isolation enforced at event bus level