--- id: SVC-PFM-INT-integrations title: 'Integration gateway, connections and messages service' product_area: platform module: integrations revision: 1 status: draft repository: services-platform source_module: modules/integrations design_intent: proposed implementation_evidence: observed inference: [] source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 macroservice-libraries: 54536a441935c6e09fdb7f96f0bec71c52ba4e03 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f owns: - DOM-PFM-INT-001 - DOM-PFM-INT-002 - DOM-PFM-INT-003 - DOM-PFM-INT-004 does_not_own: - Accounting owns payment meaning and consumes execution and provider outcomes. - Applications that own source records publish the changes used by subscriptions. - >- Security owns grants, authorization evaluation, principals and security audits; integration mutations use its audit writer. - 'The jobs service owns the durable roots, steps and monitoring used for account checks.' - Adapters implement provider-specific behavior within the shared contracts. - Workspace lifecycle schedules deletion and calls the integration cleanup participant. operations: - operation_id: getIntegrationsHealth intent: Return deployment health for the integration API. access: public permission: 'none: public health route' realises: [] published_to_submissions: 'not published: deployment health, not a business operation' - operation_id: tryIntegrationConnectionCall intent: Exercise a connection through the test caller’s gateway path without selecting a capability binding. access: console permission: platform.integrations.manage realises: - CAP-PFM-INT-012 published_to_submissions: 'not published: configuration or operational administration by staff, not an intake capture' - operation_id: listIntegrationWebhookEndpoints intent: Browse the endpoints registered for a connection. access: console permission: platform.integrations.read realises: - CAP-PFM-INT-013 published_to_submissions: 'not published: a read or explanation, not a capture' - operation_id: rotateIntegrationWebhookEndpoint intent: Replace an endpoint’s signing secret with a bounded overlap period. access: console permission: platform.integrations.manage realises: - CAP-PFM-INT-013 published_to_submissions: 'not published: configuration or operational administration by staff, not an intake capture' - operation_id: replayIntegrationWebhookEndpoint intent: Create replay work from saved endpoint requests within a period of at most seven days. access: console permission: platform.integration-executions.operate realises: - CAP-PFM-INT-013 published_to_submissions: 'not published: configuration or operational administration by staff, not an intake capture' - operation_id: listIntegrationWebhookEvents intent: Browse received provider messages and their verification and processing results. access: console permission: platform.integrations.read realises: - CAP-PFM-INT-013 published_to_submissions: 'not published: a read or explanation, not a capture' - operation_id: getIntegrationWebhookEvent intent: 'Inspect a received message, its derived events and its duplicate or replay links.' access: console permission: platform.integrations.read realises: - CAP-PFM-INT-013 published_to_submissions: 'not published: a read or explanation, not a capture' - operation_id: replayIntegrationWebhookEvent intent: 'Create replay work for one message using its saved body, without another provider request.' access: console permission: platform.integration-executions.operate realises: - CAP-PFM-INT-013 published_to_submissions: 'not published: configuration or operational administration by staff, not an intake capture' - operation_id: listIntegrationSubscriptions intent: 'Browse subscriptions, optionally narrowing them to an installation or account link.' access: console permission: platform.integrations.read realises: - CAP-PFM-INT-014 published_to_submissions: 'not published: a read or explanation, not a capture' - operation_id: createIntegrationSubscription intent: >- Subscribe an installation or account link to an allowed domain event type, with optional shared-grammar conditions. access: console permission: platform.integrations.manage realises: - CAP-PFM-INT-014 published_to_submissions: 'not published: configuration or operational administration by staff, not an intake capture' - operation_id: updateIntegrationSubscription intent: Edit a subscription using its previously read record version. access: console permission: platform.integrations.manage realises: - CAP-PFM-INT-014 published_to_submissions: 'not published: configuration or operational administration by staff, not an intake capture' - operation_id: deleteIntegrationSubscription intent: Remove a subscription while retaining its existing delivery history. access: console permission: platform.integrations.manage realises: - CAP-PFM-INT-014 published_to_submissions: 'not published: configuration or operational administration by staff, not an intake capture' - operation_id: replayIntegrationSubscription intent: 'Replay existing delivered, failed or dead deliveries within a period of at most seven days.' access: console permission: platform.integration-executions.operate realises: - CAP-PFM-INT-014 published_to_submissions: 'not published: configuration or operational administration by staff, not an intake capture' - operation_id: listIntegrationDeliveries intent: Browse domain-event deliveries for the workspace. access: console permission: platform.integrations.read realises: - CAP-PFM-INT-014 published_to_submissions: 'not published: a read or explanation, not a capture' - operation_id: getIntegrationDelivery intent: 'Inspect a delivery’s projection, attempt history, error and adapter response.' access: console permission: platform.integrations.read realises: - CAP-PFM-INT-014 published_to_submissions: 'not published: a read or explanation, not a capture' - operation_id: retryIntegrationDelivery intent: 'Reset an eligible delivered, failed or dead delivery for another first attempt.' access: console permission: platform.integration-executions.operate realises: - CAP-PFM-INT-014 published_to_submissions: 'not published: configuration or operational administration by staff, not an intake capture' - operation_id: listIntegrationEvents intent: Browse recorded integration events for an application’s own tooling. access: console permission: platform.integrations.read realises: - CAP-PFM-INT-015 published_to_submissions: 'not published: a read or explanation, not a capture' - operation_id: listIntegrationEventsEverywhere intent: Browse unclaimed integration events across workspaces for staff investigation. access: system permission: hq.integrations.operate (Rhythm staff only) realises: - CAP-PFM-INT-015 published_to_submissions: 'not published: Rhythm staff operation, not a customer capture' - operation_id: invokeIntegrationCapabilityFromConsole intent: Request a capability operation through the console gateway. access: console permission: 'platform.integrations.invoke, plus the capability’s own permission' realises: - CAP-PFM-INT-009 published_to_submissions: 'not published: configuration or operational administration by staff, not an intake capture' - operation_id: listIntegrationExecutions intent: >- Browse online executions from the retained thirteen-month window; older individual records remain available from archive. access: console permission: platform.integrations.read realises: - CAP-PFM-INT-011 published_to_submissions: 'not published: a read or explanation, not a capture' - operation_id: getIntegrationExecution intent: >- Inspect an execution’s selected account, binding revision, release, deployment, initiator, attempts and settled response. access: console permission: platform.integrations.read realises: - CAP-PFM-INT-011 published_to_submissions: 'not published: a read or explanation, not a capture' - operation_id: listIntegrationExecutionAttempts intent: Browse the attempt sequence of one execution. access: console permission: platform.integrations.read realises: - CAP-PFM-INT-011 published_to_submissions: 'not published: a read or explanation, not a capture' - operation_id: retryIntegrationExecution intent: >- Schedule another attempt for an eligible execution using the same provider idempotency key; duplicate provider effects still depend on adapter compliance. access: console permission: platform.integration-executions.operate realises: - CAP-PFM-INT-011 published_to_submissions: 'not published: configuration or operational administration by staff, not an intake capture' - operation_id: cancelIntegrationExecution intent: >- Cancel an unstarted execution and release its key, or ask an asynchronous adapter to stop work already running. access: console permission: platform.integration-executions.operate realises: - CAP-PFM-INT-011 published_to_submissions: 'not published: configuration or operational administration by staff, not an intake capture' - operation_id: resolveIntegrationExecution intent: Record a successful or failed outcome and explanatory note for an execution awaiting human resolution. access: console permission: platform.integration-executions.operate realises: - CAP-PFM-INT-011 published_to_submissions: 'not published: configuration or operational administration by staff, not an intake capture' - operation_id: listIntegrationExecutionsNeedingAttention intent: Browse executions awaiting human resolution across workspaces. access: system permission: hq.integrations.operate (Rhythm staff only) realises: - CAP-PFM-INT-011 published_to_submissions: 'not published: Rhythm staff operation, not a customer capture' - operation_id: resetIntegrationCircuit intent: Close a provider circuit so its deployment and connection can admit calls again. access: system permission: hq.integrations.operate (Rhythm staff only) realises: - CAP-PFM-INT-011 published_to_submissions: 'not published: Rhythm staff operation, not a customer capture' - operation_id: invokeIntegrationCapability intent: Request a capability through ordinary gateway admission and binding resolution. access: service permission: platform.integrations.invoke; the principal acts only for its own application realises: - CAP-PFM-INT-009 published_to_submissions: 'not published: a service or adapter call made by code, never a person’s intake' - operation_id: renewIntegrationLease intent: Issue a replacement lease for continuing adapter work. access: service permission: >- platform.integrations.invoke, for an adapter principal the registry admits, on a connection its deployment serves realises: - CAP-PFM-INT-005 published_to_submissions: 'not published: a service or adapter call made by code, never a person’s intake' - operation_id: reportIntegrationExecutionProgress intent: Save asynchronous progress and return the pending cancellation request. access: service permission: >- platform.integrations.invoke, for an adapter principal the registry admits, on a connection its deployment serves realises: - CAP-PFM-INT-010 published_to_submissions: 'not published: a service or adapter call made by code, never a person’s intake' - operation_id: completeIntegrationExecution intent: Accept and validate an asynchronous outcome from the deployment serving the execution. access: service permission: >- platform.integrations.invoke, for an adapter principal the registry admits, on a connection its deployment serves realises: - CAP-PFM-INT-010 published_to_submissions: 'not published: a service or adapter call made by code, never a person’s intake' - operation_id: emitIntegrationEvents intent: Record integration events emitted by an adapter for an account it serves. access: service permission: >- platform.integrations.invoke, for an adapter principal the registry admits, on a connection its deployment serves realises: - CAP-PFM-INT-015 published_to_submissions: 'not published: a service or adapter call made by code, never a person’s intake' - operation_id: getIntegrationSyncCursor intent: Read synchronization cursor state for the adapter’s account. access: service permission: >- platform.integrations.invoke, for an adapter principal the registry admits, on a connection its deployment serves realises: - CAP-PFM-INT-014 published_to_submissions: 'not published: a service or adapter call made by code, never a person’s intake' - operation_id: putIntegrationSyncCursor intent: Advance a pull subscription’s cursor using its profile identifier. access: service permission: >- platform.integrations.invoke, for an adapter principal the registry admits, on a connection its deployment serves realises: - CAP-PFM-INT-014 published_to_submissions: 'not published: a service or adapter call made by code, never a person’s intake' - operation_id: listIntegrationCatalog intent: Browse integrations visible and installable to this workspace. access: console permission: platform.integrations.read realises: - CAP-PFM-INT-002 published_to_submissions: 'not published: a read or explanation, not a capture' - operation_id: getIntegrationCatalogEntry intent: >- Inspect current capabilities, available releases, access requests, settings schemas and the workspace’s installation. access: console permission: platform.integrations.read realises: - CAP-PFM-INT-002 published_to_submissions: 'not published: a read or explanation, not a capture' - operation_id: listIntegrationInstallations intent: Browse installations with standing and paging filters. access: console permission: platform.integrations.read realises: - CAP-PFM-INT-003 published_to_submissions: 'not published: a read or explanation, not a capture' - operation_id: createIntegrationInstallation intent: Create the workspace’s installation of an integration. access: console permission: platform.integrations.manage realises: - CAP-PFM-INT-003 published_to_submissions: 'not published: configuration or operational administration by staff, not an intake capture' - operation_id: getIntegrationInstallation intent: Inspect one installation. access: console permission: platform.integrations.read realises: - CAP-PFM-INT-003 published_to_submissions: 'not published: a read or explanation, not a capture' - operation_id: updateIntegrationInstallation intent: Edit installation settings or accepted access using the previously read version. access: console permission: platform.integrations.manage realises: - CAP-PFM-INT-003 published_to_submissions: 'not published: configuration or operational administration by staff, not an intake capture' - operation_id: suspendIntegrationInstallation intent: Pause an installation and record the reason. access: console permission: platform.integrations.manage realises: - CAP-PFM-INT-003 published_to_submissions: 'not published: configuration or operational administration by staff, not an intake capture' - operation_id: resumeIntegrationInstallation intent: Restore an installation that is currently suspended. access: console permission: platform.integrations.manage realises: - CAP-PFM-INT-003 published_to_submissions: 'not published: configuration or operational administration by staff, not an intake capture' - operation_id: uninstallIntegrationInstallation intent: Remove an installation after its account links are disconnected. access: console permission: platform.integrations.manage realises: - CAP-PFM-INT-003 published_to_submissions: 'not published: configuration or operational administration by staff, not an intake capture' - operation_id: listIntegrationConnections intent: 'Browse account links with installation, standing and paging filters.' access: console permission: platform.integrations.read realises: - CAP-PFM-INT-004 published_to_submissions: 'not published: a read or explanation, not a capture' - operation_id: createIntegrationConnection intent: Create an account link under an enabled installation and pin the current release. access: console permission: platform.integrations.manage realises: - CAP-PFM-INT-004 published_to_submissions: 'not published: configuration or operational administration by staff, not an intake capture' - operation_id: getIntegrationConnection intent: 'Inspect an account link’s release, verified features, health and live administrator notices.' access: console permission: platform.integrations.read realises: - CAP-PFM-INT-004 published_to_submissions: 'not published: a read or explanation, not a capture' - operation_id: listIntegrationConnectionNotices intent: Browse live account notices with paging. access: console permission: platform.integrations.read realises: - CAP-PFM-INT-006 published_to_submissions: 'not published: a read or explanation, not a capture' - operation_id: updateIntegrationConnection intent: 'Edit an account link’s label, settings, tags or business unit at the previously read version.' access: console permission: platform.integrations.manage realises: - CAP-PFM-INT-004 published_to_submissions: 'not published: configuration or operational administration by staff, not an intake capture' - operation_id: verifyIntegrationConnection intent: Request immediate account verification. access: console permission: platform.integrations.manage realises: - CAP-PFM-INT-004 published_to_submissions: 'not published: configuration or operational administration by staff, not an intake capture' - operation_id: checkIntegrationConnectionHealth intent: Request a health probe for an active or degraded account. access: console permission: platform.integrations.manage realises: - CAP-PFM-INT-006 published_to_submissions: 'not published: configuration or operational administration by staff, not an intake capture' - operation_id: reauthorizeIntegrationConnection intent: Begin replacement authorization for an account link. access: console permission: platform.integration-credentials.manage realises: - CAP-PFM-INT-005 published_to_submissions: 'not published: configuration or operational administration by staff, not an intake capture' - operation_id: startIntegrationConnectionOauth intent: Begin provider sign-in for an OAuth account link. access: console permission: platform.integration-credentials.manage realises: - CAP-PFM-INT-005 published_to_submissions: 'not published: configuration or operational administration by staff, not an intake capture' - operation_id: completeIntegrationOauth intent: Handle the provider’s return to the shared public authorization callback. access: public permission: 'none: public route; the unguessable endpoint token or the signed single-use state is the proof' realises: - CAP-PFM-INT-005 published_to_submissions: 'not published: a provider-facing endpoint, not a capture' - operation_id: getIntegrationConnectionCredential intent: Inspect active credential metadata without disclosing its values. access: console permission: platform.integrations.read realises: - CAP-PFM-INT-005 published_to_submissions: 'not published: a read or explanation, not a capture' - operation_id: putIntegrationConnectionCredential intent: >- Validate and store replacement credentials appropriate to the integration’s declared authentication method. access: console permission: platform.integration-credentials.manage realises: - CAP-PFM-INT-005 published_to_submissions: 'not published: configuration or operational administration by staff, not an intake capture' - operation_id: suspendIntegrationConnection intent: Pause use of an account link. access: console permission: platform.integrations.manage realises: - CAP-PFM-INT-004 published_to_submissions: 'not published: configuration or operational administration by staff, not an intake capture' - operation_id: resumeIntegrationConnection intent: Restore a suspended account link. access: console permission: platform.integrations.manage realises: - CAP-PFM-INT-004 published_to_submissions: 'not published: configuration or operational administration by staff, not an intake capture' - operation_id: disconnectIntegrationConnection intent: Permanently disconnect an account link after its binding references are removed. access: console permission: platform.integrations.manage realises: - CAP-PFM-INT-004 published_to_submissions: 'not published: configuration or operational administration by staff, not an intake capture' - operation_id: moveIntegrationConnectionBindings intent: 'Attempt to move active bindings to a replacement account, returning partial successes and refusals.' access: console permission: platform.integrations.manage realises: - CAP-PFM-INT-007 published_to_submissions: 'not published: configuration or operational administration by staff, not an intake capture' - operation_id: updateIntegrationConnectionVersion intent: 'Verify and adopt a published release, selecting the current release when none is specified.' access: console permission: platform.integrations.manage realises: - CAP-PFM-INT-004 published_to_submissions: 'not published: configuration or operational administration by staff, not an intake capture' - operation_id: listIntegrationBindings intent: Browse capability bindings for this workspace. access: console permission: platform.integrations.read realises: - CAP-PFM-INT-007 published_to_submissions: 'not published: a read or explanation, not a capture' - operation_id: putIntegrationBinding intent: Assign a capability major to an eligible account at an allowed scope. access: console permission: platform.integrations.manage realises: - CAP-PFM-INT-007 published_to_submissions: 'not published: configuration or operational administration by staff, not an intake capture' - operation_id: listIntegrationBindingRevisions intent: Browse historical revisions of a binding’s scope. access: console permission: platform.integrations.read realises: - CAP-PFM-INT-007 published_to_submissions: 'not published: a read or explanation, not a capture' - operation_id: migrateIntegrationBindings intent: Attempt to move current bindings from one capability major to another. access: console permission: platform.integrations.manage realises: - CAP-PFM-INT-007 published_to_submissions: 'not published: configuration or operational administration by staff, not an intake capture' - operation_id: deleteIntegrationBinding intent: Supersede a binding without a successor so resolution falls back to broader scope. access: console permission: platform.integrations.manage realises: - CAP-PFM-INT-007 published_to_submissions: 'not published: configuration or operational administration by staff, not an intake capture' - operation_id: resolveIntegrationBinding intent: 'Explain scope traversal, candidate bindings and eligibility checks without making a provider call.' access: console permission: platform.integrations.read realises: - CAP-PFM-INT-008 published_to_submissions: 'not published: a read or explanation, not a capture' - operation_id: listIntegrationAuditEvents intent: Browse the integration change audit trail. access: console permission: platform.integrations.read realises: - CAP-PFM-INT-006 published_to_submissions: 'not published: a read or explanation, not a capture' - operation_id: getTenantIntegrationHealth intent: Summarize account standing and administrator attention for the workspace. access: console permission: platform.integrations.read realises: - CAP-PFM-INT-006 published_to_submissions: 'not published: a read or explanation, not a capture' - operation_id: listStaffIntegrationCatalog intent: Browse the staff catalogue regardless of availability. access: system permission: hq.integrations.operate (Rhythm staff only) realises: - CAP-PFM-INT-001 published_to_submissions: 'not published: Rhythm staff operation, not a customer capture' - operation_id: publishIntegrationVersion intent: Publish a validated release and update the current pointer when publication ordering permits. access: system permission: hq.integrations.publish (Rhythm staff only) realises: - CAP-PFM-INT-001 published_to_submissions: 'not published: Rhythm staff operation, not a customer capture' - operation_id: deprecateIntegrationVersion intent: Mark a published release deprecated without recomputing the current pointer. access: system permission: hq.integrations.publish (Rhythm staff only) realises: - CAP-PFM-INT-001 published_to_submissions: 'not published: Rhythm staff operation, not a customer capture' - operation_id: retireIntegrationVersion intent: Mark a deprecated release retired. access: system permission: hq.integrations.publish (Rhythm staff only) realises: - CAP-PFM-INT-001 published_to_submissions: 'not published: Rhythm staff operation, not a customer capture' - operation_id: setIntegrationAvailability intent: Change the audiences allowed to discover an integration. access: system permission: hq.integrations.publish (Rhythm staff only) realises: - CAP-PFM-INT-001 published_to_submissions: 'not published: Rhythm staff operation, not a customer capture' - operation_id: listIntegrationPlatformSecrets intent: Browse names and versions of Rhythm-owned integration secrets. access: system permission: hq.integrations.publish (Rhythm staff only) realises: - CAP-PFM-INT-001 published_to_submissions: 'not published: Rhythm staff operation, not a customer capture' - operation_id: putIntegrationPlatformSecret intent: Store a declared Rhythm-owned credential as a string-valued JSON object. access: system permission: hq.integrations.publish (Rhythm staff only) realises: - CAP-PFM-INT-001 published_to_submissions: 'not published: Rhythm staff operation, not a customer capture' - operation_id: registerIntegrationVersion intent: Register an adapter release and its deployment declaration. access: service permission: hq.integrations.publish (service caller) realises: - CAP-PFM-INT-001 published_to_submissions: 'not published: a service or adapter call made by code, never a person’s intake' - operation_id: registerIntegrationEventConsumer intent: Register the calling application’s integration-event consumer. access: service permission: hq.integrations.publish (service caller) realises: - CAP-PFM-INT-015 published_to_submissions: 'not published: a service or adapter call made by code, never a person’s intake' - operation_id: receiveIntegrationWebhook intent: Accept a provider message addressed by an endpoint’s secret token. access: public permission: 'none: public route; the unguessable endpoint token or the signed single-use state is the proof' realises: - CAP-PFM-INT-013 published_to_submissions: 'not published: a provider-facing endpoint, not a capture' - operation_id: queryIntegrationDataGrant intent: 'Validate an adapter connection for a granted query, then return the current not-implemented response.' access: service permission: >- platform.integrations.invoke, for an adapter principal the registry admits, on a connection its deployment serves realises: - CAP-PFM-INT-015 published_to_submissions: 'not published: a service or adapter call made by code, never a person’s intake' - operation_id: projectIntegrationDataGrant intent: >- Validate an adapter connection for a granted record projection, then return the current not-implemented response. access: service permission: >- platform.integrations.invoke, for an adapter principal the registry admits, on a connection its deployment serves realises: - CAP-PFM-INT-015 published_to_submissions: 'not published: a service or adapter call made by code, never a person’s intake' events: - name: rhythm.integration.execution.completed direction: produced when: 'An asynchronous execution settles, or a synchronous caller did not receive its final result.' payload_summary: >- Execution identity, capability, final outcome and persisted result or error, addressed to the initiating application. - name: Provider-produced integration event types direction: produced when: An adapter interprets a verified message or explicitly emits typed events. payload_summary: Typed provider data plus account identity and any matching record or execution references. - name: Rhythm domain change events (remote-handler batches) direction: consumed when: A source application invokes its registered remote change handler. payload_summary: 'A stream batch of no more than one hundred changes, restricted to fields in the subscribed type.' - name: Provider webhook requests direction: consumed when: A provider calls a registered token-addressed endpoint. payload_summary: 'The incoming body and approved headers, saved before verification and processing.' - name: Subscription deliveries to adapters direction: produced when: The delivery worker invokes a subscribed adapter. payload_summary: The projected domain change and stable delivery identity in the shared event envelope. - name: Executions work queue messages direction: produced when: The dispatcher submits an asynchronous attempt. payload_summary: Execution identity and the numbered asynchronous attempt. - name: 'Webhook, event and delivery work queue messages' direction: produced when: The dispatcher submits due message work. payload_summary: Record identity and timing for due message work; the queue does not carry the saved business payload. jobs: - Durable account verification runs through the jobs engine and its state machine. - Durable account health probes run through the jobs engine and its state machine. - Recent-failure health scanning runs every fifteen minutes; verification also has a daily pass. - 'Token refresh runs each minute; credential cleanup runs daily at 06:17 UTC.' - Execution dispatch and reconciliation run each minute alongside the asynchronous attempt consumer. - >- Message dispatch responds to nudges and a minute schedule; separate workers process webhooks, events and deliveries. - >- Monthly storage maintenance manages execution partitions and archives execution, attempt and response history. integrations: - system: Provider adapters (Lambda functions per release deployment) direction: outbound contract: >- Adapter invocations use the shared invoke, webhook and event envelopes, with execution identity supplied for provider deduplication. - system: Provider adapters (callbacks) direction: inbound contract: Seven SDK callback operations authorize an adapter against the account named by its call. - system: Provider OAuth authorization and token endpoints direction: outbound contract: >- Provider authorization-code flows negotiate proof-key protection and use HTTP Basic authentication at token exchange when supported. - system: AWS Secrets Manager direction: outbound contract: >- Account credentials occupy separate secrets; integration-level credentials used by Rhythm have their own prefix. - system: Object storage (module bucket) direction: outbound contract: >- The module bucket retains incoming bodies, captured payloads and monthly execution archives under workspace prefixes. - system: Admission permit store (Valkey) direction: outbound contract: >- Connection rate admission obtains temporary permits from the shared store and follows its configured availability behavior. - system: Platform e-mail sender direction: outbound contract: Administrator mail runs after commit; send failure is recorded without automatic retry. consistency: - rule: >- Account state, dependent binding reassessment and both audit records commit in a single database transaction. kind: transactional compensation: A database error rolls back these changes together. - rule: >- Installation lifecycle changes include affected accounts, bindings and subscriptions in their transaction. kind: transactional compensation: No partial database cascade commits. - rule: >- Credential replacement and verification work commit after external secret creation; usable accounts need not change standing while the replacement is checked. kind: transactional compensation: Database refusal requests cleanup of the new secret; cleanup itself can fail or be delayed. - rule: >- Execution admission commits its key claim with the record, and settlement commits any required completion event with the outcome. kind: transactional compensation: Ambiguous provider outcomes require lookup rather than automatic reversal. - rule: >- Provider effects and saved outcomes converge through lookup, reconciliation and eventual operator resolution. kind: eventual compensation: No automatic provider compensation occurs; the consuming application decides subsequent business action. - rule: Queue-backed routing and delivery provide repeated attempts rather than exactly-once transport. kind: eventual compensation: Backoff ends in dead work that authorized operators can retry or replay. - rule: Administrator mail is requested after the database mutation commits. kind: eventual compensation: Send errors are logged without an automatic mail retry. - rule: Provider endpoint registration follows successful account verification. kind: eventual compensation: Failed setup can leave a locally saved endpoint without a provider reference. evidence: - >- services-platform at ad3f6a65: modules/integrations/aws/api/*.routes.ts (127 declared operations and the health route), gateway.routes.ts (two not-built data-grant operations); aws/logic/*; services/**; aws/platform.service.ts (permission declarations) - >- services-platform at ad3f6a65: docs/integrations/README.md; docs/standards/submission-compatible-operations.md (R2-ARCH-002); docs/queued-work.md; docs/jobs.md - 'rhythm-v2-docs: specs/platform/integrations/MODULE.md (operation ownership table)' controls: [TC-AVL-001, TC-AVL-004, TC-AVL-005, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-005, TC-AZ-006, TC-CHG-001, TC-CHG-002, TC-CHG-003, TC-CHG-004, TC-CHG-005, TC-CHG-006, TC-CHG-007, TC-CRY-001, TC-CRY-002, TC-CRY-003, TC-CRY-004, TC-DAT-001, TC-DAT-002, TC-DAT-003, TC-DAT-004, TC-IAM-001, TC-IAM-002, TC-IAM-003, TC-IAM-004, TC-IAM-005, TC-IAM-006, TC-LOG-001, TC-LOG-002, TC-LOG-003, TC-LOG-004, TC-LOG-005, TC-MON-001, TC-MON-002, TC-MON-003, TC-PI-001, TC-PI-002, TC-PI-003, TC-PI-004, TC-PI-005, TC-PRV-001, TC-PRV-002, TC-PRV-004, TC-SEC-001, TC-SEC-002, TC-SEC-003, TC-SEC-004, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-TEN-004, TC-VEN-001, TC-VEN-002, TC-VEN-003] --- # Integration gateway, connections and messages service ## What the Service Owns This service owns the integration catalogue, installations, account links, capability selection, execution history and message delivery. Applications request provider work through the gateway and interpret the returned business outcomes themselves. ## Operations The operation rows define the callable boundary, its access class, exact permission declarations and planning coverage. Configuration and operational administration are not published as intake captures. Public health and provider callbacks retain their declared access boundaries. ## Consistency and Failure Account state, dependent binding reassessment and both audit records commit in a single database transaction. A database error rolls back these changes together. Installation lifecycle changes include affected accounts, bindings and subscriptions in their transaction. No partial database cascade commits. Credential replacement and verification work commit after external secret creation; usable accounts need not change standing while the replacement is checked. Database refusal requests cleanup of the new secret; cleanup itself can fail or be delayed. Execution admission commits its key claim with the record, and settlement commits any required completion event with the outcome. Ambiguous provider outcomes require lookup rather than automatic reversal. Provider effects and saved outcomes converge through lookup, reconciliation and eventual operator resolution. No automatic provider compensation occurs; the consuming application decides subsequent business action. Queue-backed routing and delivery provide repeated attempts rather than exactly-once transport. Backoff ends in dead work that authorized operators can retry or replay. Administrator mail is requested after the database mutation commits. Send errors are logged without an automatic mail retry. Provider endpoint registration follows successful account verification. Failed setup can leave a locally saved endpoint without a provider reference. ## Events and Jobs The declarations distinguish application events, incoming requests, queue work and direct host reads. These are different transport boundaries; registering a declaration does not by itself publish an application event. ## Open Questions Provider effects, secret writes and post-commit mail do not share database rollback. Reconciliation has no execution mutex and consults the connection’s current release, so it does not guarantee use of the deployment that originally served the call. No scoped operation calls a language model.