--- id: CAP-ACC-BKS-019 title: Manage Accounting data through workspace lifecycle jobs feature: FEAT-ACC-BKS-06 product_area: accounting module: books revision: 1 status: draft product_intent: proposed implementation_evidence: observed supersedes: - CAP-ACC-SEC-013 source_sha: services-accounting: f47cb263875bbc0c5640fba7dae6785ec32695f8 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f intent_sources: - >- services-accounting:docs/architecture/accounting-2.0/02-decisions.md#2.11 The payment methods, deferred payment and order collection decisions (Andrew, 2026-10-18 evening); decision D-01 purpose: >- Accounting participates in Platform’s provisioning, availability, export and deletion workflows. outcomes: - Provisioning supplies methods needed to begin recording payments. - >- Lifecycle availability limits ordinary work during loading, disabling and deletion, retaining the defined staff and data-job exceptions. - >- Exports follow declared customer datasets and secret guards; resumable erasure removes the target workspace’s declared data without affecting another workspace. concepts: - CON-ACC-BKS-006 actors: - ACT-ACC-005 surfaces: - job preconditions: [] postconditions: [] permissions: - key: accounting.application.access where_checked: api scope: tenant rules: - id: BR-CAP-ACC-BKS-019-01 proved_by: [ATS-ACC-BKS-012-09, ATS-ACC-BKS-019-01, TST-ACC-BKS-093, TST-ACC-BKS-183] statement: >- Provisioning inserts the workspace’s five system payment methods once, preserves previously renamed methods on retry and reports no provisioning work for other participants. kind: lifecycle enforced_at: - service must_prove: true provenance: test source: >- services-accounting:modules/maintenance/tests/integration/services/participants/configuration-participant.integration.spec.js#answers provision done, having written the tenant’s five system payment methods (WP-01) origin: none - id: BR-CAP-ACC-BKS-019-02 proved_by: [ATS-ACC-BKS-019-02, TST-ACC-BKS-180, TST-ACC-BKS-183] statement: >- Erasure proceeds resumably in bounded batches through dependent records before configuration, with reconciliation first and billing, transaction and fiscal-close data ahead of their referenced configuration. kind: lifecycle enforced_at: - service - database must_prove: true provenance: test source: >- services-accounting:modules/maintenance/tests/integration/services/participants/configuration-participant.integration.spec.js#resumes to done when it is called again origin: none - id: BR-CAP-ACC-BKS-019-03 proved_by: [ATS-ACC-BKS-019-03, TST-ACC-BKS-183] statement: >- Purge refuses an unknown workspace, one not being deleted or one whose deletion was cancelled, without removing records. kind: validation enforced_at: - service must_prove: true provenance: test source: >- services-accounting:modules/maintenance/tests/integration/services/participants/configuration-participant.integration.spec.js#refuses a tenant that is not being deleted origin: none - id: BR-CAP-ACC-BKS-019-04 proved_by: [ATS-ACC-BKS-019-04, ATS-ACC-BKS-019-09, TST-ACC-BKS-178, TST-ACC-BKS-183] statement: Purging one workspace leaves every other workspace’s records unchanged. kind: invariant enforced_at: - database must_prove: true provenance: test source: >- services-accounting:modules/maintenance/tests/integration/services/participants/configuration-participant.integration.spec.js#leaves the other tenant’s rows exactly as they were, table for table origin: none - id: BR-CAP-ACC-BKS-019-05 proved_by: [ATS-ACC-BKS-019-04, TST-ACC-BKS-178, TST-ACC-BKS-183] statement: >- Lifecycle declarations assign every workspace-owned Accounting table to exactly one purge participant and exclude shared vocabularies. kind: invariant enforced_at: - service must_prove: true provenance: test source: >- services-accounting:modules/maintenance/tests/integration/db/declaration-completeness.integration.spec.js#leaves no tenant-keyed table undeclared origin: none - id: BR-CAP-ACC-BKS-019-06 proved_by: [ATS-ACC-BKS-019-05, TST-ACC-BKS-181] statement: >- Exports batch one dataset up to the creation cut-off, include workspace identity and processor references without credentials, and block before staging when a Stripe API-key, webhook-secret or client-secret pattern is detected. kind: policy enforced_at: - service must_prove: true provenance: test source: >- services-accounting:modules/maintenance/tests/integration/services/exports/seed-everything.integration.spec.js#stops a batch whose record carries a Stripe secret’s shape, blocked with nothing staged origin: none - id: BR-CAP-ACC-BKS-019-07 proved_by: [ATS-ACC-BKS-016-14, ATS-ACC-BKS-019-06, TST-ACC-BKS-194] statement: >- Ordinary users are served only in active enabled workspaces; deleting workspaces permit staff reads, loading workspaces permit data-job routes, unknown workspaces are unavailable and state lookup is cached for up to thirty seconds. kind: policy enforced_at: - api must_prove: true provenance: test source: >- services-accounting:modules/maintenance/tests/unit/lifecycle/tenant-availability.spec.js#serves only an active tenant that is not disabled, and refuses every other combination origin: none - id: BR-CAP-ACC-BKS-019-08 proved_by: [ATS-ACC-BKS-019-07, TST-ACC-BKS-195] statement: >- Lifecycle requests refuse reset, unknown operations or participants, missing workspace or run identity and batch sizes outside bounded whole-number limits. kind: validation enforced_at: - service must_prove: true provenance: test source: >- services-accounting:modules/maintenance/tests/unit/lifecycle/tenant-lifecycle-operations.spec.js#refuses a reset, which Accounting does not serve origin: none - id: BR-CAP-ACC-BKS-019-09 proved_by: [ATS-ACC-BKS-019-08] statement: >- Export blocks undeclared datasets, completes excluded history with an empty part and warning, and permits not-applicable only for an initial request with neither dataset data nor financial history. kind: policy enforced_at: - service must_prove: true provenance: observed source: >- services-accounting:modules/maintenance/services/exports/dataset-exports.ts:exportParticipantDataset origin: none scenarios: - id: SC-CAP-ACC-BKS-019-01 given: Platform is deleting a workspace. when: >- It repeats Accounting purge calls, including resumption after an interrupted call. then: >- Completed batches stay removed, processing reaches completion and other workspaces retain their data. provenance: test source: >- services-accounting:modules/maintenance/tests/integration/services/participants/configuration-participant.integration.spec.js#keeps what the batches before the interruption removed edge_cases: [] constraints: [] depends_on: - CAP-ACC-BKS-012 related: - CAP-ACC-BKS-016 journeys: [] open_questions: [] evidence: - 'Verified source file: services-accounting:aws/accounting.service.ts' - >- Verified source file: services-accounting:docs/architecture/accounting-2.0/02-decisions.md - >- Verified source file: services-accounting:modules/books/tests/integration/services/persistence/payment-methods.integration.spec.js - >- Verified source file: services-accounting:modules/maintenance/services/exports/dataset-exports.ts - >- Verified source file: services-accounting:modules/maintenance/tests/integration/db/declaration-completeness.integration.spec.js - >- Verified source file: services-accounting:modules/maintenance/tests/integration/db/export-coverage.integration.spec.js - >- Verified source file: services-accounting:modules/maintenance/tests/integration/db/purge-order.integration.spec.js - >- Verified source file: services-accounting:modules/maintenance/tests/integration/services/exports/seed-everything.integration.spec.js - >- Verified source file: services-accounting:modules/maintenance/tests/integration/services/participants/billing-participant.integration.spec.js - >- Verified source file: services-accounting:modules/maintenance/tests/integration/services/participants/configuration-participant.integration.spec.js - >- Verified source file: services-accounting:modules/maintenance/tests/integration/services/participants/fiscal-close-participant.integration.spec.js - >- Verified source file: services-accounting:modules/maintenance/tests/integration/services/persistence/tenant-exports.queries.integration.spec.js - >- Verified source file: services-accounting:modules/maintenance/tests/integration/services/persistence/tenants.queries.integration.spec.js - >- Verified source file: services-accounting:modules/maintenance/tests/unit/exports/export-coverage.spec.js - >- Verified source file: services-accounting:modules/maintenance/tests/unit/exports/round-trip.spec.js - >- Verified source file: services-accounting:modules/maintenance/tests/unit/exports/secret-guard.spec.js - >- Verified source file: services-accounting:modules/maintenance/tests/unit/lifecycle/tenant-availability.spec.js - >- Verified source file: services-accounting:modules/maintenance/tests/unit/lifecycle/tenant-lifecycle-operations.spec.js - >- Verified source file: services-accounting:modules/maintenance/tests/unit/participants/billing-manifest.spec.js - >- Verified source file: services-accounting:modules/maintenance/tests/unit/participants/manifests.spec.js controls: [TC-IAM-001, TC-IAM-002, TC-IAM-004, TC-IAM-005, TC-IAM-006, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-005, TC-AZ-006, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-SEC-001, TC-SEC-002, TC-SEC-003, TC-SEC-004, TC-CRY-001, TC-DAT-002, TC-DAT-004, TC-DAT-005, TC-LOG-001, TC-LOG-002, TC-LOG-003, TC-LOG-004, TC-LOG-005, TC-AVL-001, TC-AVL-004, TC-MON-001, TC-MON-002, TC-MON-004, TC-PI-001, TC-PI-002, TC-PI-004, TC-PI-005] exercised_by: [FAS-ACC-BKS-04-03, FAS-ACC-BKS-06-01, FAS-ACC-BKS-06-03] suites: [TST-ACC-BKS-093, TST-ACC-BKS-178, TST-ACC-BKS-180, TST-ACC-BKS-181, TST-ACC-BKS-183, TST-ACC-BKS-194, TST-ACC-BKS-195] --- # Manage Accounting data through workspace lifecycle jobs ## Purpose Accounting participates in Platform’s provisioning, availability, export and deletion workflows. ## How It Works Platform calls Accounting when it creates, exports or deletes a workspace. Accounting’s participants describe and process their own data. Provisioning supplies initial payment methods without constructing the customer’s units or chart. Availability checks govern whether ordinary work can proceed during lifecycle changes. Export follows the declared datasets and explains exclusions rather than treating every internal record as customer data. A detected secret stops the batch before it is staged. Deletion can continue from completed batches after an interruption. ## Relationships Platform owns lifecycle orchestration; payment configuration and other Accounting modules supply the participant data.