--- id: CAP-PFM-NOT-013 title: Send operational alerts to Rhythm HQ feature: FEAT-PFM-NOT-05 product_area: platform module: notifications revision: 1 status: draft product_intent: proposed implementation_evidence: observed supersedes: - NT-ACC-0150 - PLAT-M23-S14 source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f intent_sources: - >- services-platform:docs/milestones/PLAT-M23-notifications-core-and-in-app.md#D1 - 'services-platform:docs/proposals/notifications/23-decisions.md#D-12' - >- services-platform:docs/milestones/plans/PLAT-M23-plan.humanized.md#PLAT-M23-S14 purpose: >- Rhythm operations staff receive pipeline-backed Slack alerts for Platform events. outcomes: - Operational events create Slack work for Rhythm staff. - Retained outcomes and payloads exclude the Slack credential. concepts: - CON-PFM-NOT-003 actors: - ACT-PFM-029 - ACT-PFM-031 surfaces: - slack - job preconditions: [] postconditions: [] permissions: [] rules: - id: BR-CAP-PFM-NOT-013-01 statement: >- HQ alerts use ordinary pipeline requests, notices and deliveries inside the reserved Rhythm system workspace; the Platform publication interface bypasses personal preferences, identities and workspace configuration. kind: policy enforced_at: - service must_prove: true provenance: test source: >- services-platform:modules/notifications/tests/integration/services/system/system-audience.integration.spec.js#is accepted as one request, one instance with no recipient and one queued slack_system delivery with the Block Kit payload origin: none note: >- The reserved workspace is observed implementation, and disagrees with the approved plan; see the linked record. - id: BR-CAP-PFM-NOT-013-02 statement: >- System audiences are accepted only in the Rhythm system workspace and do not select people; Customer system-audience requests are invalid; recipient-less notices belong only to the system workspace. kind: invariant enforced_at: - service - database must_prove: true provenance: test source: >- services-platform:modules/notifications/tests/integration/services/system/system-audience.integration.spec.js#is refused in a customer’s tenant as audience_kind_not_allowed, even for a definition that declares it, and nothing is made origin: none - id: BR-CAP-PFM-NOT-013-03 statement: >- A code-maintained channel map routes system definitions, including both provisioning outcomes to operations; missing mappings reject registration and make corresponding requests invalid. kind: validation enforced_at: - service must_prove: true provenance: test source: >- services-platform:modules/notifications/tests/unit/hq-channels.spec.js#refuses a system definition with no entry in the map, naming the definition and the audience_kinds path origin: none - id: BR-CAP-PFM-NOT-013-04 statement: >- Each mapped channel receives a separate notice and Slack delivery without a console delivery or personal recipient; repeated publication of the same occurrence is deduplicated. kind: invariant enforced_at: - service must_prove: true provenance: test source: >- services-platform:modules/notifications/tests/integration/services/system/system-audience.integration.spec.js#writes one instance and one delivery for each channel of the map origin: none - id: BR-CAP-PFM-NOT-013-05 statement: >- Slack payloads include a bold title, body, HQ context with Eastern time, open-action link buttons and plain-text fallback; operation actions are omitted, text is escaped and capped at 3,000 characters, and routing uses channel keys rather than stored Slack identifiers. kind: calculation enforced_at: - service must_prove: true provenance: test source: >- services-platform:modules/notifications/tests/unit/slack-system-render.spec.js#is exactly a bold title and the body, the Rhythm HQ context line in Eastern time, one URL button and a plain fallback origin: none - id: BR-CAP-PFM-NOT-013-06 statement: >- A secret supplies the Slack bot token; Success retains the provider message reference; throttling respects Slack's minimum delay; missing channels, membership, valid credentials or active accounts fail permanently; other errors retry; missing secret or channel configuration skips delivery with a warning. kind: policy enforced_at: - service must_prove: true provenance: test source: >- services-platform:modules/notifications/tests/unit/slack-system-adapter.spec.js#answers a 429 as a retryable failure carrying Retry-After origin: none - id: BR-CAP-PFM-NOT-013-07 statement: >- The Slack credential is absent from retained delivery outcomes and payloads. kind: invariant enforced_at: - service must_prove: true provenance: test source: >- services-platform:modules/notifications/tests/unit/slack-system-adapter.spec.js#never puts the token in a log line, an outcome or the payload it stored origin: none - id: BR-CAP-PFM-NOT-013-08 statement: >- Permanent HQ-alert failure increments failure accounting and alerts the operations topic. kind: policy enforced_at: - service must_prove: false provenance: documented source: 'services-platform:docs/notifications.md#10. Rhythm HQ alerts' origin: none - id: BR-CAP-PFM-NOT-013-09 statement: >- Provisioning completion and failure publish once-per-job alerts at the requester-notification points; Requester e-mail remains independent, and alert publication failure does not fail provisioning. kind: policy enforced_at: - service must_prove: false provenance: documented source: 'services-platform:docs/notifications.md#9. Producers' origin: none - id: BR-CAP-PFM-NOT-013-10 statement: >- Installing the HQ Slack adapter does not enable personal Slack delivery before its milestone. kind: policy enforced_at: - service must_prove: false provenance: test source: >- services-platform:modules/notifications/tests/integration/services/system/system-audience.integration.spec.js#is still skipped until its milestone, though the system adapter is installed beside it origin: none - id: BR-CAP-PFM-NOT-013-11 statement: >- System-workspace initialization creates a missing reserved support workspace once, under its demonstration customer, without live status or a licence. kind: invariant enforced_at: - service - database must_prove: true provenance: test source: >- services-platform:modules/notifications/tests/integration/services/system/system-audience.integration.spec.js#is a support tenant of its own demo customer, active but never live, with no licence company origin: none note: >- The the relevant milestone plan's record of D1 says there is no reserved workspace; see the finding on the reserved system scope. scenarios: - id: SC-CAP-PFM-NOT-013-01 given: HQ provisioning for Acme Dental ends in failure. when: The provisioning job settles. then: >- Operations Slack receives the failed-provisioning alert with its reason and job link; customer History receives no copy. provenance: test source: >- react-console:acceptance/notifications/playwright/journeys/hq/NT-ACC-0150.spec.ts#NT-ACC-0150 edge_cases: [] constraints: [] depends_on: - CAP-PFM-NOT-001 - CAP-PFM-NOT-007 related: - CAP-PFM-NOT-012 journeys: - JNY-PFM-NOT-004 open_questions: - OQ-PFM-NOT-003 evidence: - >- Pinned evidence inventory 1: services-platform:docs/milestones/PLAT-M23-notifications-core-and-in-app.md; services-platform:docs/milestones/plans/PLAT-M23-plan.humanized.md; services-platform:modules/notifications/tests/unit/hq-channels.spec.js; services-platform:modules/notifications/tests/unit/slack-system-adapter.spec.js; react-console:acceptance/notifications/playwright/journeys/hq/NT-ACC-0150.spec.ts - >- Pinned evidence inventory 2: services-platform:docs/proposals/notifications/23-decisions.md; services-platform:modules/notifications/tests/integration/services/system/system-audience.integration.spec.js; services-platform:modules/notifications/tests/unit/slack-system-render.spec.js; services-platform:docs/notifications.md controls: [TC-AVL-004, TC-AVL-005, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-005, TC-CHG-001, TC-CHG-002, TC-CHG-003, TC-CHG-004, TC-CHG-005, TC-CHG-006, TC-CRY-001, TC-CRY-002, TC-CRY-003, TC-CRY-004, TC-DAT-001, TC-DAT-002, TC-DAT-003, TC-DAT-006, TC-IAM-001, TC-IAM-002, TC-IAM-003, TC-IAM-004, TC-IAM-005, TC-LOG-001, TC-LOG-002, TC-LOG-003, TC-LOG-005, TC-MON-001, TC-MON-002, TC-PI-001, TC-PI-002, TC-PI-004, TC-PI-005, TC-PRV-001, TC-PRV-002, TC-PRV-004, TC-SEC-001, TC-SEC-002, TC-SEC-003, TC-SEC-004, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-VEN-001, TC-VEN-002, TC-VEN-003] --- # Send operational alerts to Rhythm HQ ## Purpose Rhythm operations staff receive pipeline-backed Slack alerts for Platform events. ## How It Works Platform publishes an operational event using its reserved system workspace. The system audience addresses HQ channels rather than customer staff. A code-maintained mapping selects the Slack channels. Each selected channel receives a notice and delivery through the ordinary processing pipeline. The adapter builds a readable Slack message and uses the configured secret to authenticate. Missing configuration skips delivery, while transient and permanent provider failures follow their respective handling. Provisioning alerts supplement the requester's own e-mail. The reserved-workspace implementation remains in disagreement with the recorded approval wording. Operational alerting is implemented, but Andrew must resolve the reserved-workspace disagreement and the deployed Slack proof gap. ## Relationships Registration supplies the event contract that later work validates and renders. Channel processing supplies the delivery states and reasons inspected here.