Day Two: Five Things a Streaming Team Can Do Once the Registry Is Governed

Someone posts in the platform channel: does shipped_at ever arrive null on the shipment events topic?

Today that costs somebody half a day: open the subject, squint at a union, discover it changed nine months ago, hunt for whoever changed it, and end up reading a consumer's source code to see what everyone else assumed. The answer you finally give is correct-ish and undocumented, so the next person repeats the exercise.

Once the estate is governed, that question is a lookup. This article is about the rest of day two — the five capabilities a streaming team gets after a single subjects export has been imported into CoreModels, and what each one replaces.

1. Meaning becomes a lookup, not an excavation

Import turns the registry inventory into a model that holds the facts the registry never had a slot for. Each subject becomes a governed Type carrying its Avro record name, with the topic recorded as its physical name and the key-or-value role, registry version, and schema id kept as metadata — so the governed view and the registry view can always be lined up against each other rather than drifting into two competing sources of truth.

Every field becomes an Element with Avro's own optionality preserved: a field with no union-null branch is recorded as required. That is the difference between "I think it's always populated" and "the estate declares it required." Enum symbols become governed taxonomies — a named, shared list rather than four private copies. Named-record references are resolved across subjects at import, so this event embeds that record becomes an explicit governed reference instead of a naming coincidence two engineers happen to recognize.

A new consumer team now onboards by reading the model. Nobody has to find, interrupt, or still employ the person who designed the event.

2. The gate moves left

The second capability is the one that changes incident counts: a schema change can be checked against agreed meaning before it is registered.

The audit takes a fresh subjects export — from a staging registry, or assembled from the .avsc files in the pull request itself — and compares it to the governed model. It answers in coded findings across three sections: coverage (what isn't governed at all), drift (fields removed or retyped, enums narrowed or widened, datasets that vanished from the estate), and conformance (streaming hygiene rules, such as value subjects shipping fields with no doc strings).

In CI, the machine-to-machine surface accepts a user API key and returns both a machine-readable payload and a pull-request-ready markdown report. The build fails when the error count is above zero; the report goes into the job summary, naming the exact subject and field. A removed field or a narrowed enum stops being an incident and becomes a red check with an explanation attached. Warnings — an enum that merely widened — arrive as information rather than a blockage, though a team whose consumers branch on enums can choose to gate on those too.

Before: the change merged, and the consumer teams learned about it from their own error dashboards.

3. The reverse question gets an answer

Every drift discussion assumes the estate moved. The other direction matters just as much and almost nobody checks it: the governed model changed — a taxonomy term retired, a definition tightened — so does the last-known estate still conform?

Because the parsed registry snapshot is stored at import time, that question is one call. Re-audit replays the stored snapshot against the current governed model, with no fresh export, no registry access, and no coordination with whoever owns the extract. The run lands in the audit history automatically, and the result tells you precisely which subjects still carry the thing you just retired.

Governance decisions stop being memos that hope for compliance. They become checks with a list of affected subjects attached.

4. New topics start governed instead of accreting meaning

The loop closes outward as well. From the governed model, CoreModels generates registry-ready Avro record schemas — one .avsc per governed Type. Required fields come out as bare types; optional fields as a union with null and a null default; governed taxonomies as sanitized Avro enums; date-times as timestamp-millis logical types; and references as named record types when the target record is generated alongside. Where generation had to compromise — a reference whose target wasn't in the generated set — the compromise is declared beside the artifact rather than hidden inside it.

You review that output like any other code and register it through whatever process already governs your registry. CoreModels never touches the registry; it hands you an artifact worth registering. A team standing up a topic models the event once, generates, reviews, and ships — instead of hand-writing a schema that becomes load-bearing by Friday.

5. Estate health becomes something you can look at

The last capability is unglamorous and quietly changes meetings. Recorded audit runs accumulate into a rolling history — each with its trigger, severity counts, finding codes, and the fingerprint of the artifacts examined. A status call answers "when did we last import, and how many subjects are governed?" without anyone spelunking. And an SVG badge renders the latest recorded run — green for clean, yellow for warnings, red for errors, gray when nothing has been recorded — served on the API-key surface so it works in a README with no interactive session.

That fourth color matters. "We have no evidence" is displayed as exactly that, never as health.

"Is the streaming estate in good shape?" stops being a vibe and becomes a lookup, with dates.

What you don't give up

Notice what stays exactly where it was. The registry still enforces compatibility — the semantic check sits beside it, not instead of it. Producers still own their release process. No credentials leave your side. And every change to governed meaning still passes through a person: import is additive by construction, so it never rewrites meaning to match the estate, and drift is reported for a human to resolve rather than silently applied.

The entry cost is deliberately boring: one shell loop produces the export, you upload it, and counts come back — subjects added, fields added, plus an itemized list of anything approximated or skipped. Everything above is what compounds afterwards.

Setup — the export recipe, both API surfaces, the CI snippet, and the generate call — is covered end to end in the CoreModels Confluent Schema Registry quickstart in our docs.