---
id: WF-PFM-INT-023
title: Provision and erase a workspace’s integration-area records
trigger: Workspace lifecycle requests preparation or removal.
product_area: platform
module: integrations
revision: 1
status: draft
design_intent: proposed
implementation_evidence: observed
inference: []
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
implements:
  - CAP-PFM-INT-003
  - CAP-PFM-INT-022
crosses: []
idempotency: >-
  The seed ledger prevents duplicate provisioning, and purge resumes from remaining records after committed
  batches.
concurrency: >-
  Lifecycle participants execute bounded batches with independent commits, so interruptions leave observable
  partial purge progress.
hops:
  - 'n': 1
    actor_or_service: Workspace lifecycle job
    action: Invoke each participant’s workspace-provisioning step.
    anchor: 'services-platform:modules/workflow-actions/services/maintenance/tenant-participant.ts'
    seam: state_machine
    on_failure: The lifecycle job can retry the failed step.
    left_inconsistent: Workspace preparation can wait for the initial calendar.
    observer: Job monitor
    provenance: observed
    source: 'services-platform:modules/workflow-actions/services/maintenance/tenant-participant.ts'
  - 'n': 2
    actor_or_service: Workflow-actions participant
    action: >-
      Seed the Standard week default in the workspace time zone through the seed ledger; the other two
      services create no initial configuration.
    anchor: 'services-platform:modules/workflow-actions/services/maintenance/tenant-participant.ts'
    seam: sync
    on_failure: Return the failed seed step for retry.
    left_inconsistent: No successful seed is duplicated and a deliberately deleted seed is not restored.
    observer: Job monitor
    provenance: observed
    source: 'services-platform:modules/workflow-actions/services/maintenance/tenant-participant.ts'
  - 'n': 3
    actor_or_service: Workspace lifecycle job
    action: Repeatedly request bounded purge steps from each participant until it reports completion.
    anchor: 'services-platform:modules/integrations/services/maintenance/tenant-participant.ts'
    seam: state_machine
    on_failure: Retry the failed lifecycle batch.
    left_inconsistent: Earlier committed batches leave the workspace partly removed.
    observer: Job monitor
    provenance: observed
    source: 'services-platform:modules/integrations/services/maintenance/tenant-participant.ts'
  - 'n': 4
    actor_or_service: Integrations participant
    action: >-
      Purge protected integration history first through its privileged function, then remove ordinary records
      in declared dependency order.
    anchor: 'services-platform:modules/integrations/services/maintenance/tenant-participant.ts'
    seam: sync
    on_failure: A failed batch is retried independently.
    left_inconsistent: 'Undeclared credential secrets and stored provider bodies, payloads and archives remain.'
    observer: Inventory counts
    provenance: observed
    source: 'services-platform:modules/integrations/services/maintenance/tenant-participant.ts'
  - 'n': 5
    actor_or_service: Extensions participant
    action: 'Remove extension invocations, bindings and handlers while retaining declared handler secrets.'
    anchor: 'services-platform:modules/extensions/services/maintenance/tenant-participant.ts'
    seam: sync
    on_failure: Retry failed database purge batches.
    left_inconsistent: Handler secrets remain because the service cannot enumerate and remove them.
    observer: Inventory counts
    provenance: observed
    source: 'services-platform:modules/extensions/services/maintenance/tenant-participant.ts'
  - 'n': 6
    actor_or_service: Workflow-actions participant
    action: >-
      Remove automation configuration, customer recipes and calendars through bounded workflow-configuration
      batches.
    anchor: 'services-platform:modules/workflow-actions/services/maintenance/tenant-participant.ts'
    seam: sync
    on_failure: Retry an incomplete or failed batch.
    left_inconsistent: Other participant batches can already have committed.
    observer: Inventory counts
    provenance: observed
    source: 'services-platform:modules/workflow-actions/services/maintenance/tenant-participant.ts'
evidence:
  - >-
    services-platform at ad3f6a65: modules/integrations/services/maintenance/tenant-participant.ts;
    modules/extensions/services/maintenance/tenant-participant.ts;
    modules/workflow-actions/services/maintenance/tenant-participant.ts;
    modules/tenants/services/lifecycle/participants.ts
  - >-
    services-platform:modules/workflow-actions/tests/integration/services/maintenance/tenant-participant.integration.spec.js#gives
    the tenant Standard week in its own zone, as its default
  - >-
    services-platform:modules/integrations/tests/integration/services/maintenance/tenant-participant.integration.spec.js#leaves
    every table of the module empty of the tenant, the ones the application can delete included
controls: [TC-AVL-004, TC-AVL-005, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-005, TC-CRY-001, TC-CRY-002, TC-CRY-003, TC-CRY-004, TC-DAT-001, TC-DAT-002, TC-DAT-003, TC-DAT-004, TC-IAM-001, TC-IAM-002, TC-IAM-003, TC-IAM-004, TC-IAM-005, TC-IAM-006, TC-LOG-001, TC-LOG-002, TC-LOG-003, TC-LOG-004, TC-LOG-005, TC-MON-001, TC-PI-001, TC-PI-002, TC-PI-003, TC-PI-004, TC-PI-005, TC-PRV-001, TC-PRV-002, TC-SEC-001, TC-SEC-002, TC-SEC-003, TC-SEC-004, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-VEN-001, TC-VEN-002, TC-VEN-003]
---

# Provision and erase a workspace’s integration-area records

## What It Does

Workspace lifecycle calls bounded participants rather than deleting all configuration in one transaction. Provisioning seeds a default calendar. Purge removes database records in dependency order but does not establish destruction of every external secret or stored provider object.

## The Flow

```mermaid
sequenceDiagram
  participant P0 as Workspace lifecycle job
  participant P1 as Workflow-actions participant
  participant P2 as Integrations participant
  participant P3 as Extensions participant
  P0->>P0: 1. Invoke each participant’s workspace-provisioning step.
  P1->>P1: 2. Seed the Standard week default in the workspace time zone through the seed ledger
  P0->>P0: 3. Repeatedly request bounded purge steps from each participant until it reports completion.
  P2->>P2: 4. Purge protected integration history first through its privileged function
  P3->>P3: 5. Remove extension invocations
  P1->>P1: 6. Remove automation configuration
```

## When Something Fails

The lifecycle job can retry the failed step. Workspace preparation can wait for the initial calendar. Return the failed seed step for retry. No successful seed is duplicated and a deliberately deleted seed is not restored. Retry the failed lifecycle batch. Earlier committed batches leave the workspace partly removed. A failed batch is retried independently. Undeclared credential secrets and stored provider bodies, payloads and archives remain. Retry failed database purge batches. Handler secrets remain because the service cannot enumerate and remove them. Retry an incomplete or failed batch. Other participant batches can already have committed.

## Open Design Questions

Product must decide how workspace deletion removes retained handler and connection secrets, provider bodies and payloads, and execution archives without expiry.