A record archive holds everything the hosted service keeps about one candidate
record, so an organisation can hand the candidate their data or keep a copy
before deleting the record (ADR 0011, D7). Owners and admins download it as a
zip from GET /v1/workspaces/{workspaceId}/archive, which carries the
manifest's SHA-256 in X-Archive-Manifest-SHA256. The format is defined by
the Zod schemas in @draft-loop/schemas/record-archive.
| Path | Holds |
|---|---|
manifest.json |
The format, its version, when the archive was made, the record's workspace id, and every other file with its SHA-256 and size |
tables/<table>.json |
The record's rows of one table, as { "table": ..., "rows": [...] } |
objects/<sha256> |
The original bytes of one source version or exported document, named by their SHA-256 |
Table rows keep the service's column names and values. Text payloads keep their stored text, so the checksums recorded beside them still verify them. Times stored as timestamps are ISO 8601 text, and 64-bit integers such as sizes and sequence numbers are decimal strings. Rows never carry the tenant column. A table the record has no rows in is left out, and identical bytes are stored once.
- Settings: the record's workspace settings documents, including its configuration and writing policy text.
- Versions: writing policy, profile and job brief versions.
- Consents: the record's whole consent ledger.
- Applications and runs: applications and their bindings, runs with their snapshots, rounds, step executions, findings, decisions and exports, the orchestrator's run state, retrieval traces and the record's audit trail.
- Screening: the content-screening results of the record's pasted job sources and of the source versions in its knowledge bases, and the releases that lifted a quarantine, with the releasing member's id and written reason. Results hold closed signal codes and screener identities, never the screened text.
- Work journal: the record's "Accept notes from agents" switch, its notes in every status with their content, and the keys of discarded notes whose text was deleted after 30 days, kept so an agent does not record that work again.
- Career interview: the record's interview sessions with their topics, every turn the candidate and the interviewer wrote, and each summary.
- Knowledge: knowledge bases with their sources, source versions and sensitivity rule versions. In sign-in mode these are the bases the record owns. In owner-token mode, which holds one workspace and organisation-wide bases, they are every base the organisation holds.
- Objects: the bytes of every source version of those bases and of every exported document.
The screening tables, content_screening_results and
content_screening_releases, and the work journal tables,
work_journal_intake, work_journal_notes and work_journal_forgotten_keys,
career_interview_sessions, application_material_drafts and
application_research_briefs were added to v1 as more table files. Readers that skip table files they do not
know are unaffected, so the version stays 1.
- Credentials, keys or tokens.
- Another record's data, or another organisation's. Organisation-wide knowledge bases are included only in owner-token mode, which has one record.
- The organisation's member directory, or which members a record is assigned to.
- Provider request bodies, idempotency results, and search indexes derived from the sources.
Each object's bytes are checked against the checksum and size its row recorded
before the download starts, and again as they are written. An object that is
missing or changed fails the download with 409 archive_integrity, or ends a
download already under way without a valid zip; it is never written
unchecked.
The archive is not the local version's portable knowledge backup (ADR 0007), which holds one knowledge store without runs or consents. Converting between them belongs to importing a local workspace (ADR 0011, D12).