The WineGraph Open Data Model

Typed grant flow (diwine-sharing-policy steps 1+4): account gains customer_type (distributor|retailer|restaurant|trade_other) — the normative trade class grant eligibility keys off (distinct from the tenant-CRM `type` label). Grant rule: price grants → any trade member; quantity grants → distributor accounts ONLY (venues structurally ineligible, even on request). Storage: Ring-2 data_grant (RLS), migration 0062.

Customer-relationship publishing (diwine-sharing-policy step 2/3): new PUBLIC `supplies` edge (importer|distributor → retailer|restaurant|distributor) — the tenant-ELECTED customer relationship (who sells to whom, which wines as skuIds/wineCount on the edge). Price and quantity NEVER ride this edge (Ring-2, grant-only). Minted by the tenant_supplies job strictly behind the contributes_public_edges gate.

Wall hardening (no schema change): the public_entity view now strips the already-gated person.channels sub-key at the boundary (migration 0055), instead of relying on no writer ever populating it; and the assertClassified CI gate now also checks EDGES (an edge touching a gated/private entity type, or a PII-shaped edge metadata field, must be non-public) and uses a broadened identity/PII field-name pattern. Closes Fable5 C1/C3/M6 and the latent person.channels leak.

Terroir depth (supply group, additive + public): two new entities and three edges fill in the vine-to-cellar chain. `vine` — a planting/block within a vineyard (plantedYear, density, rootstock, trainingSystem, area) — sits below `vineyard` via the new `grows` edge (vineyard→vine) and links to variety via `yields` (vine→grape). `cellar` — the physical chai where wine is vinified/aged, distinct from producer and vineyard — links via `vinified_in` (sku|producer→cellar), modeled to resolve contract/shared/neighbor cellars. Ships unpopulated (no connector yet); the public views + standard expose them so data can land cleanly. API is type-agnostic (no route change).

Distribution partners: new GATED `distributed_by` edge (importer→distributor, with per-state coverage) — the importer↔distributor partnership distinct from the wine-level distributes edge. Captured by the custom importer-portfolio adapters (producers + people + distribution partners). See docs/plan/importer-registry.md.

Trade-relationship + people expansion. (1) Territory: a first-class GATED `territory` entity (scope national|regional|state, exclusive, states[]) reifying the importer↔producer grant via holds/covers edges; `represents` gains role + exclusive metadata; new public `sources_via` (importer→export_agent) models the courtier chain. (2) People unified: `person` is now the universal people entity across the whole trade (moved to a `people` group, gated person.channels); the former gated `contact` entity folds into it. Public org roles use the generalized `person_of` (now → producer|importer|distributor|export_agent, expanded roles); the buyer graph is the new GATED `buys_for` edge (person→group/venue/account), replacing contact→leads_beverage_for. The wall holds: a person enters the public tier only via a public person_of edge, so buyers (buys_for only) + channels stay gated.

Edge resolution: the `represents` edge now spans export_agent OR importer → producer (was export_agent only). The propagate_importer connector infers importer→producer representation where all of a producer’s imported wines come through one importer (418 candidates vs. 3 prior), resolving the producer-view import link. See docs/plan/edge-resolution.md.

Prospect-intelligence layer (the L2 moat from the D-I adoption proposal): new GATED `prospect` entity group — restaurant_group (ownership parent: who-operates-what, beverage-buying model, unit count) + contact (trade buyer / beverage decision-maker, name+title public, channels gated) — and gated edges operated_by (venue → group) + leads_beverage_for (contact → group/venue). Demand venues gain public Places triage signals (web.rating/reviewCount/category, facets.category) that power the prospect fit score. Served via the gated GET /v1/prospects endpoint. Sell-the-parent, deploy-to-all-units.

Classification governance (tenant #1 redline §11): assertClassified() CI invariant (no tenant/PII field may default public); price reframed default-private + tenant-elected visibility (hard fence = Ring-3 cross-tenant aggregates only); gated reframed as a redaction marker (paid-serving deferred + counsel-gated, not a dossier product).

Data classification (the wall): every entity/edge/field carries a sensitivity tier (public/gated/private). Adds gated license-holder/legal/contact blocks on producer/importer/distributor + the private commerce group (price [tier×jurisdiction×volume], inventory, account [sales/CRM]). Pricing is always private + per-recipient. See data-classification-and-diwine-coverage.md.

People + vineyards + export agents: person/vineyard entities and person_of/farms/sourced_from/farmed_as/uses_technique/represents edges (additive). Roadmap: deep vineyard terroir + winemaking cellar models.

Initial published standard — supply/trade/demand entities, edges, provenance, identifiers, vocab.