--- id: CAP-PFM-NOT-012 title: Investigate and retry notifications from HQ feature: FEAT-PFM-NOT-04 product_area: platform module: notifications revision: 1 status: draft product_intent: proposed implementation_evidence: observed supersedes: [] source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f intent_sources: - 'services-platform:docs/milestones/plans/PLAT-M23-plan.humanized.md#2. Scope' - >- services-platform:docs/milestones/plans/PLAT-M23-plan.humanized.md#PLAT-M23-S04 purpose: >- Authorized HQ operators investigate customer notification history and recover exhausted deliveries. outcomes: - HQ reviews customer History and requests through an active access grant. - >- Global dead-letter inspection and retry expose retained channel content without that grant check; the intended boundary remains open. concepts: - CON-PFM-NOT-003 actors: - ACT-PFM-029 surfaces: - console - api preconditions: [] postconditions: [] permissions: - key: hq.notifications.read where_checked: api scope: global - key: hq.notifications.operate where_checked: api scope: global rules: - id: BR-CAP-PFM-NOT-012-01 statement: >- HQ routes require system access and HQ notification permissions; Currently only Rhythm Administrator grants both keys; HQ reader policy does not grant them, pending Andrew's role decision. kind: permission enforced_at: - api must_prove: true provenance: test source: >- services-platform:modules/notifications/tests/unit/permissions.spec.js#leaves both HQ keys out of the HQ reader policy: the Rhythm Administrator holds them through hq.*.* origin: none - id: BR-CAP-PFM-NOT-012-02 statement: >- HQ reads of customer History and requests require an active staff access grant for that workspace and reuse administrator history behavior; missing workspaces or absent and mismatched grants reject the read without returning customer records. kind: permission enforced_at: - api - service must_prove: true provenance: test source: >- services-platform:modules/notifications/tests/integration/services/centre/hq-notifications.integration.spec.js#is refused without an active staff access grant, naming nothing of the tenant origin: >- services-platform:docs/milestones/plans/PLAT-M23-plan.humanized.md#PLAT-M23-S04 - id: BR-CAP-PFM-NOT-012-03 statement: >- The dead-letter list contains exhausted deliveries in newest-first order with workspace identification; an unfiltered scan covers at most one thousand operational workspaces and returns at most one hundred rows; permanent provider refusals are omitted. kind: policy enforced_at: - api - service must_prove: false provenance: observed source: >- services-platform:modules/notifications/services/centre/hq-notifications.ts:listDeadLetters origin: none - id: BR-CAP-PFM-NOT-012-04 statement: >- Operator retry accepts only deliveries failed through exhausted attempts, recreating queued work; missing deliveries and permanent provider failures are refused without modification. kind: lifecycle enforced_at: - api - service must_prove: true provenance: test source: >- services-platform:modules/notifications/tests/integration/services/dispatch/deliver-delivery.integration.spec.js#queues a delivery that ran out of receives again, with its work row, and nothing else origin: none - id: BR-CAP-PFM-NOT-012-05 statement: >- Delivery retry is sensitive because it initiates another message to customer staff. kind: permission enforced_at: - api must_prove: false provenance: observed source: 'services-platform:aws/platform.service.ts:HQ_NOTIFICATIONS_PERMISSIONS' origin: none - id: BR-CAP-PFM-NOT-012-06 statement: >- HQ History selects a workspace and reads through the staff route; grant refusal prompts the operator to obtain active access. kind: policy enforced_at: - console must_prove: false provenance: test source: >- react-console:components/notifications/__tests__/notifications.test.tsx#shows the access-grant sentence when Platform answers 403 origin: none - id: BR-CAP-PFM-NOT-012-07 statement: >- HQ dead-letter listing and retry responses include retained channel content without the customer access-grant check used by History, while HQ route permissions still restrict entry. kind: permission enforced_at: - api - service must_prove: true provenance: observed source: >- services-platform:modules/notifications/services/centre/hq-notifications.ts origin: none note: >- The intended grant or redaction boundary is unresolved in the operator-content finding and product question. scenarios: - id: SC-CAP-PFM-NOT-012-01 given: A customer asks support to investigate Jane's assignment announcement. when: >- An authorized Rhythm administrator selects that customer's History with an active grant. then: The response matches the workspace administrator's history view. provenance: inferred source: >- react-console:acceptance/notifications/playwright/journeys/history/NT-ACC-0100.spec.ts#NT-ACC-0100 note: >- The API test proves the grant boundary; the illustrative HQ navigation combines that result with the inspected History component. edge_cases: [] constraints: [] depends_on: - CAP-PFM-NOT-011 - CAP-PFM-NOT-007 related: - CAP-PFM-NOT-013 journeys: - JNY-PFM-NOT-004 open_questions: - OQ-PFM-NOT-002 evidence: - >- Pinned evidence inventory 1: services-platform:docs/milestones/plans/PLAT-M23-plan.humanized.md; services-platform:modules/notifications/tests/integration/services/centre/hq-notifications.integration.spec.js; services-platform:modules/notifications/tests/integration/services/dispatch/deliver-delivery.integration.spec.js; react-console:components/notifications/__tests__/notifications.test.tsx - >- Pinned evidence inventory 2: services-platform:modules/notifications/tests/unit/permissions.spec.js; services-platform:modules/notifications/services/centre/hq-notifications.ts; services-platform:aws/platform.service.ts; react-console:acceptance/notifications/playwright/journeys/history/NT-ACC-0100.spec.ts controls: [TC-AVL-001, TC-AVL-004, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-005, TC-DAT-001, TC-DAT-002, TC-DAT-003, TC-IAM-001, TC-IAM-003, TC-IAM-006, TC-LOG-001, TC-LOG-002, TC-LOG-003, TC-LOG-004, TC-LOG-005, TC-MON-001, TC-PI-001, TC-PI-002, TC-PI-004, TC-PI-005, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-VEN-001, TC-VEN-002, TC-VEN-003] --- # Investigate and retry notifications from HQ ## Purpose Authorized HQ operators investigate customer notification history and recover exhausted deliveries. ## How It Works An HQ operator uses system-only notification routes. Global catalog and dead-letter access require HQ keys. Customer History additionally requires an active access grant for the selected workspace. The HQ screen explains a rejected grant rather than exposing customer records. The dead-letter list targets deliveries whose retry budget was exhausted. Retry checks that the failure is eligible before recreating work. Permanent provider refusal remains final. Because retry initiates another send, the operation belongs to sensitive operator access. The rule rows define this outcome; the acceptance set identifies existing proof and proposed checks. Implementation evidence alone does not approve the observed details. ## Relationships Workspace History supplies the customer activity that HQ reviews through granted access. Channel processing supplies the delivery states and reasons inspected here.