--- id: DOM-MBR-STR-006 title: Membership Setup realises: CON-MBR-STR-006 product_area: membership module: structure revision: 1 status: draft design_intent: proposed implementation_evidence: partially-observed source_sha: services-membership: 5994c270e8a37a30f848e99ba5b5ee6b87c08893 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f owned_by: SVC-MBR-STR-configuration readable_by: - SVC-MBR-STR-structure - SVC-PFM-DJE-membership-data-jobs - SVC-PFM-TNL-membership-tenant-lifecycle lifecycle: STATE-MBR-STR-006 custom_fields: none identity: >- Setup describes common governance rather than another persisted record. Configuration identities are readable and permanent, product extensions use product identities, applied seeds use workspace seed keys, and export datasets and bulk verbs use their registered names. attributes: - name: readable identifier kind: text required: true computed: false notes: >- Staff supply or derive readable identifiers using lowercase letters, digits and single underscores, up to 63 characters; package identity comes from Accounting. - name: version kind: number required: true computed: true notes: >- Record versions are positive and advance on writes, including unchanged configuration saves; required checks reject stale mutations. - name: creation and modification stamps kind: computed required: true computed: true notes: The store stamps creation and modification with transaction actor and time. - name: lock flag kind: enum required: true computed: false notes: Configuration records retain a lock flag that these operations neither expose nor enforce. - name: availability kind: enum required: false computed: false notes: >- Programs, types, reasons and policy sets save an activity switch; packages inherit product activity, and units and kinds have separate availability behavior. - name: administration authority kind: reference required: true computed: false notes: >- Six workspace permissions separate read and manage for structure, programs and configuration; workspace requests also require Membership application access. - name: initial records kind: collection required: true computed: false notes: >- Provisioning applies four relationship purposes through the seed ledger. Development additionally supplies known structure and configuration records. - name: bulk operations kind: collection required: false computed: false notes: >- Insert and upsert declarations cover kinds, units, programs, types and packages in dependency order; reasons, policy sets and program requirements lack bulk verbs. - name: export and removal declarations kind: collection required: true computed: false notes: >- Lifecycle declarations distinguish retained reset configuration, deleted data, owner-function version removal and streamed export datasets. relationships: - to: DOM-MBR-STR-001 cardinality: one setup to every kind and placement of the workspace ownership: 'Structure owns hierarchy records; setup describes their import, export and removal contracts.' cross_service: false - to: DOM-MBR-STR-002 cardinality: one setup to every unit of the workspace ownership: Structure owns unit records and relationship purposes; setup describes shared workspace handling. cross_service: false - to: DOM-MBR-STR-003 cardinality: one setup to every program and type ownership: Configuration owns programs and types and supplies common save and version behavior. cross_service: false - to: DOM-MBR-STR-004 cardinality: one setup to every package and policy set ownership: Configuration owns packages and policy sets; extensions retain product-based identity. cross_service: false - to: DOM-PFM-TNL-003 cardinality: Structure registers a single workspace lifecycle participant ownership: >- Platform coordinates the workspace lifecycle, while Membership's registered participant performs its structural work. cross_service: true invariants: - id: INV-DOM-MBR-STR-006-01 statement: >- Configuration updates cannot rename a retained record, and duplicate creation does not modify the existing record. enforced_at: - service - database provenance: observed source: >- services-membership:modules/configuration/services/configuration/configuration-records.ts:updateConfiguration - id: INV-DOM-MBR-STR-006-02 statement: >- Configuration changes and deletions and structure replacements require versions; moves, merges and unit deactivation check optional versions, while unit and kind deletion and link ending take none. enforced_at: - api - service provenance: observed source: >- services-membership:modules/structure/aws/api/structure.routes.ts:structureRoutes; services-membership:aws/api/configuration-routes.ts:configurationRoutes - id: INV-DOM-MBR-STR-006-03 statement: >- Saving configuration and submitted owned lists uses one transaction, so a refused save leaves no partial result. enforced_at: - service provenance: observed source: >- services-membership:modules/configuration/services/configuration/configuration-records.ts:createConfiguration - id: INV-DOM-MBR-STR-006-04 statement: >- Protected foreign-key references block deletion; deleting an unreferenced configuration record removes its owned lists. enforced_at: - service - database provenance: observed source: 'services-membership:modules/configuration/services/persistence/configuration-store.ts:configurationStore' - id: INV-DOM-MBR-STR-006-05 statement: >- Workspace predicates and row isolation confine reads and mutations to the caller's workspace, with other workspaces' records treated as missing. enforced_at: - service - database provenance: test source: >- services-membership:modules/structure/tests/integration/services/persistence/organizational-units.integration.spec.ts#organizational units in the database › row-level security › shows another tenant none of the units - id: INV-DOM-MBR-STR-006-06 statement: >- Structure and configuration routes require workspace-level setup authority and Membership access; unit-scoped grants alone do not satisfy those permissions. enforced_at: - api provenance: test source: >- services-membership:tests/unit/route-authorization.spec.ts#route authorization: every Membership operation names its permission › requires membership.structure.read of every structure read and membership.structure.manage of every change - id: INV-DOM-MBR-STR-006-07 statement: >- Provisioning records applied relationship-purpose seeds once and preserves later customer changes on repeat calls. enforced_at: - service - database provenance: test source: >- services-membership:modules/structure/tests/integration/services/lifecycle/structure-participant.integration.spec.ts#the structure participant in the database › seeds the four relationship types at provisioning - id: INV-DOM-MBR-STR-006-08 statement: >- Purge requires deleting state, reset permits deleting or loading state, and version removal uses the owner's function after ordinary structural data removal. enforced_at: - service - database provenance: test source: >- services-membership:modules/structure/tests/integration/services/lifecycle/structure-participant.integration.spec.ts#the structure participant in the database › refuses to purge a tenant Platform is not deleting, before any row is removed evidence: - >- services-membership at 5994c270: aws/api/configuration-routes.ts, route-inputs.ts; aws/membership.service.ts (permission catalogue); modules/configuration/services/persistence/configuration-store.ts, services/shared/records.ts, services/configuration/configuration-records.ts, services/data-operations/configuration-operations.ts; modules/structure/services/lifecycle/structure-participant.ts, services/tree/tree-loads.ts, services/well-known/well-known-structure.ts; modules/data-jobs/services/operations/structure-data-operations.ts; modules/tenant-lifecycle/services/lifecycle/participants.ts (the configuration tables' participant). - >- rhythm-v2-docs: specs/membership/structure/planning (CAP-MBR-STR-018, 019, 020; FND-MBR-STR-016, 025, 026, 027). --- # Membership Setup ## What It Models Setup is the common handling of membership configuration and structure records. It explains identity, version checks, authority, transactional saves, initial data, imports, exports and workspace removal without creating another stored business entity. ## Identity and Attributes Permanent configuration identities support stable references and imports. Versions and actor stamps describe changes, while lifecycle and bulk declarations describe how whole workspaces are handled. Structure operations have specific exceptions to mandatory version checks. ## Relationships Setup spans hierarchy, units, programs and packages. Platform coordinates lifecycle and data jobs, and Membership supplies participant and operation declarations. Configuration export and lifecycle execution are wired through the memberships participant. ## Invariants The structured rows specify common guarantees and their exceptions. An unchanged configuration save advances the version without creating a content revision. Soft external references remain outside the protection provided by local foreign keys. ## How It Is Stored and Shared Configuration provides the reusable store, route builder and error translation. Structure uses its own replacement and tree operations. Seeds are recorded in the shared ledger, and bulk execution depends on Platform wiring beyond the locally verified operation declarations. ## Open Design Questions Product must settle replacement and paging consistency, the unused lock flag and whether purge should clear applied seeds. Console permission mapping and missing administration screens remain prerequisites for browser-based setup.