--- id: CAP-PFM-QRY-018 title: Request a portable workspace data package feature: FEAT-PFM-QRY-07 product_area: platform module: queries revision: 1 status: draft product_intent: confirmed implementation_evidence: partially-observed supersedes: [] source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f intent_sources: - 'services-platform:docs/proposals/tenant-data-export/20-risks-tradeoffs-decisions.md#D-03' - 'services-platform:docs/proposals/tenant-data-export/20-risks-tradeoffs-decisions.md#D-05' - 'services-platform:docs/proposals/tenant-data-export/20-risks-tradeoffs-decisions.md#D-11' - 'services-platform:docs/proposals/tenant-data-export/20-risks-tradeoffs-decisions.md#D-14' - >- services-platform:docs/proposals/tenant-data-export/20-risks-tradeoffs-decisions.md#1. Decisions (all fifteen decided by Andrew on 2026-10-18) purpose: >- Let an authorized administrator configure and request the workspace’s data package, with the current implementation’s unfinished stages clearly identified. outcomes: - The planned package supports data portability. - Dedicated export permissions protect broad extraction. - Execution and destination widening remain accountable. concepts: - CON-PFM-QRY-004 actors: - ACT-PFM-007 - ACT-PFM-015 - ACT-PFM-012 surfaces: - console - api preconditions: [] postconditions: [] permissions: - key: platform.data-exports.read where_checked: api scope: tenant - key: platform.data-exports.manage where_checked: api scope: tenant - key: platform.data-exports.execute where_checked: api scope: tenant - key: platform.data-exports.download where_checked: api scope: tenant - key: hq.data-exports.read where_checked: api scope: global - key: hq.data-exports.operate where_checked: api scope: global rules: - id: BR-CAP-PFM-QRY-018-01 proved_by: [ATS-PFM-QRY-018-01, TST-PFM-QRY-187] statement: >- Data-export read, manage, execute and download are sensitive administrator permissions excluded from generated policies and granted by the dedicated exporter policy to Administrators rather than Power Users. kind: permission enforced_at: - api must_prove: true provenance: test source: >- services-platform:modules/data-exports/tests/e2e/data-exports.e2e.spec.js#refuses a Power User every data export route origin: 'services-platform:docs/proposals/tenant-data-export/20-risks-tradeoffs-decisions.md#D-03' - id: BR-CAP-PFM-QRY-018-02 proved_by: [ATS-PFM-QRY-018-02, TST-PFM-QRY-187] statement: >- Every export route requires its specific permission independently of the other export permissions and administrator tier. kind: permission enforced_at: - api must_prove: true provenance: test source: >- services-platform:modules/data-exports/tests/e2e/data-exports.e2e.spec.js#is refused the download route when it holds the other three keys and the administrator tier origin: 'services-platform:docs/proposals/tenant-data-export/20-risks-tradeoffs-decisions.md#D-03' - id: BR-CAP-PFM-QRY-018-03 proved_by: [ATS-PFM-QRY-018-03, TST-PFM-QRY-187, TST-PFM-QRY-193, TST-PFM-QRY-197] statement: Export settings creation and execution admission require a live workspace that is not a sandbox. kind: policy enforced_at: - service must_prove: true provenance: test source: >- services-platform:modules/data-exports/tests/integration/services/persistence/definitions.integration.spec.js#refuses a sandbox as TenantNotEligible, though it is live, because its data is its parent’s origin: 'services-platform:docs/proposals/tenant-data-export/20-risks-tradeoffs-decisions.md#D-05' - id: BR-CAP-PFM-QRY-018-04 proved_by: [ATS-PFM-QRY-018-04, TST-PFM-QRY-187, TST-PFM-QRY-197] statement: >- A workspace holds one version-controlled export definition with retention of one to thirty days and at most twenty additional notification users. kind: validation enforced_at: - service - database must_prove: true provenance: test source: >- services-platform:modules/data-exports/tests/integration/services/persistence/definitions.integration.spec.js#refuses a retention beyond thirty days origin: none - id: BR-CAP-PFM-QRY-018-05 proved_by: [ATS-PFM-QRY-018-05, TST-PFM-QRY-200] statement: >- Destinations are limited to five distinct connections with connection-relative paths; adding or enabling one records access widening, and removing one retires its binding. kind: validation enforced_at: - service must_prove: true provenance: test source: >- services-platform:modules/data-exports/tests/integration/services/persistence/destinations.integration.spec.js#refuses a sixth destination, leaving five origin: none - id: BR-CAP-PFM-QRY-018-06 proved_by: [ATS-PFM-QRY-018-06, TST-PFM-QRY-193, TST-PFM-QRY-201] statement: >- Admission queues an export at request time with copied settings, marks allowance consumption except for staff runs, rejects suspended definitions and allows only one queued or running execution per workspace. kind: policy enforced_at: - service - database must_prove: true provenance: test source: >- services-platform:modules/data-exports/tests/integration/services/executions/admit-execution.integration.spec.js#refuses while another execution is queued, creating nothing more origin: none - id: BR-CAP-PFM-QRY-018-07 proved_by: [ATS-PFM-QRY-018-07, TST-PFM-QRY-201] statement: Execution admission records an access-widening export event in the same transaction. kind: invariant enforced_at: - service must_prove: true provenance: test source: >- services-platform:modules/data-exports/tests/integration/services/persistence/executions.integration.spec.js#records the data export event: execute, widening, in its own transaction origin: none - id: BR-CAP-PFM-QRY-018-08 proved_by: [ATS-PFM-QRY-017-14, ATS-PFM-QRY-018-08, ATS-PFM-QRY-018-15, ATS-PFM-QRY-018-16, ATS-PFM-QRY-018-17, ATS-PFM-QRY-019-13, TST-PFM-QRY-187] statement: >- Package generation and delivery completion are unfinished; download, cancellation, early artifact deletion and delivery retry return not implemented, and a manifest is missing before a package exists. kind: lifecycle enforced_at: - api must_prove: true provenance: test source: >- services-platform:modules/data-exports/tests/e2e/data-exports.e2e.spec.js#is answered 409 not_implemented for a download, until the generation job origin: none - id: BR-CAP-PFM-QRY-018-09 proved_by: [ATS-PFM-QRY-018-09, TST-PFM-QRY-187] statement: >- Rhythm staff cannot use customer-console export routes, while HQ export reads require the staff permission, span workspaces and reject customer administrators. kind: permission enforced_at: - api must_prove: true provenance: test source: >- services-platform:modules/data-exports/tests/e2e/data-exports.e2e.spec.js#is refused every console route, whatever it holds at platform scope (rule S1) origin: none - id: BR-CAP-PFM-QRY-018-10 proved_by: [ATS-PFM-QRY-018-10, TST-PFM-QRY-194] statement: >- Coverage reconciliation adds declarations at a new coverage version, reports unchanged-version shape conflicts without replacing them, and retires or restores declarations as releases remove or reintroduce them. kind: lifecycle enforced_at: - service must_prove: true provenance: test source: >- services-platform:modules/data-exports/tests/integration/services/export-coverage/reconcile-coverage.integration.spec.js#refuses a shape changed under an unchanged version, logged at error and counted, leaving the registry as it was origin: none - id: BR-CAP-PFM-QRY-018-11 proved_by: [ATS-PFM-QRY-018-11, TST-PFM-QRY-187] statement: An execution from another workspace is reported as missing. kind: permission enforced_at: - service must_prove: true provenance: test source: >- services-platform:modules/data-exports/tests/e2e/data-exports.e2e.spec.js#answers another tenant’s execution 404, as one that does not exist origin: none - id: BR-CAP-PFM-QRY-018-12 proved_by: [ATS-PFM-QRY-018-12] statement: >- The product should require a sign-in within fifteen minutes for package downloads and destination changes. kind: policy enforced_at: - api must_prove: true provenance: documented source: >- services-platform:docs/proposals/tenant-data-export/20-risks-tradeoffs-decisions.md#D-11. Elevated authentication for download and destination changes: a recent-authentication check in release 1 origin: 'services-platform:docs/proposals/tenant-data-export/20-risks-tradeoffs-decisions.md#D-11' - id: BR-CAP-PFM-QRY-018-13 proved_by: [ATS-PFM-QRY-018-13] statement: >- The product should apply export allowances per workspace, with workspace-specific or customer-wide overrides. kind: calculation enforced_at: - service must_prove: true provenance: documented source: >- services-platform:docs/proposals/tenant-data-export/20-risks-tradeoffs-decisions.md#D-14. Where the allowance attaches (blocks WP-5) — decided: per tenant origin: 'services-platform:docs/proposals/tenant-data-export/20-risks-tradeoffs-decisions.md#D-14' scenarios: - id: SC-CAP-PFM-QRY-018-01 given: A user holds the built-in Power User role. when: They request data-export operations. then: Those routes refuse the user’s default permissions. provenance: test source: >- services-platform:modules/data-exports/tests/e2e/data-exports.e2e.spec.js#refuses a Power User every data export route edge_cases: [] constraints: [] depends_on: [] related: - CAP-PFM-QRY-014 journeys: - JNY-PFM-QRY-006 open_questions: [] operations: - getDataExportDefinition - saveDataExportDefinition - addDataExportDestination - updateDataExportDestination - removeDataExportDestination - requestDataExportExecution - listDataExportExecutions - getDataExportExecution - getDataExportManifest - cancelDataExportExecution - downloadDataExportVolume - deleteDataExportArtifact - retryDataExportDelivery - getDataExportCoverage - getDataExportsHealth - listHqDataExportExecutions - getHqDataExportCoverage - getHqDataExportTenantCoverage - getHqDataExportEntitlements tables: - data-export-definitions.table.ts - data-export-destinations.table.ts - data-export-executions.table.ts - data-export-jobs.table.ts - data-export-job-steps.table.ts - data-export-job-events.table.ts - data-export-parts.table.ts - data-export-artifacts.table.ts - data-export-volumes.table.ts - data-export-deliveries.table.ts - data-export-delivery-attempts.table.ts - data-export-notices.table.ts - export-coverage-datasets.table.ts - export-coverage-versions.table.ts evidence: - 'Pinned reference: services-platform:docs/proposals/tenant-data-export/20-risks-tradeoffs-decisions.md' - 'Pinned reference: services-platform:modules/data-exports/tests/e2e/data-exports.e2e.spec.js' - >- Pinned reference: services-platform:modules/data-exports/tests/integration/services/executions/admit-execution.integration.spec.js - >- Pinned reference: services-platform:modules/data-exports/tests/integration/services/export-coverage/reconcile-coverage.integration.spec.js - >- Pinned reference: services-platform:modules/data-exports/tests/integration/services/persistence/definitions.integration.spec.js - >- Pinned reference: services-platform:modules/data-exports/tests/integration/services/persistence/destinations.integration.spec.js - >- Pinned reference: services-platform:modules/data-exports/tests/integration/services/persistence/executions.integration.spec.js controls: [TC-AVL-004, TC-AVL-005, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-005, TC-DAT-001, TC-DAT-002, TC-DAT-003, TC-DAT-004, TC-DAT-005, TC-IAM-001, TC-IAM-002, TC-IAM-003, TC-IAM-004, TC-IAM-005, TC-IAM-006, TC-LOG-001, TC-LOG-004, TC-LOG-005, TC-MON-001, TC-PI-001, TC-PI-002, TC-PI-003, TC-PI-004, TC-PI-005, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-VEN-001, TC-VEN-002, TC-VEN-003] exercised_by: [FAS-PFM-QRY-07-01, FAS-PFM-QRY-07-02, FAS-PFM-QRY-07-03, FAS-PFM-QRY-07-04, FAS-PFM-QRY-07-05] suites: [TST-PFM-QRY-187, TST-PFM-QRY-193, TST-PFM-QRY-194, TST-PFM-QRY-197, TST-PFM-QRY-200, TST-PFM-QRY-201] --- # Request a portable workspace data package ## Purpose Let an authorized administrator configure and request the workspace’s data package, with the current implementation’s unfinished stages clearly identified. ## How It Works An administrator configures package retention, notifications and destinations. Each operation checks its export authority and workspace eligibility. Export Now records an execution and its copied settings. Another queued or running execution prevents a second admission. Security events explain both execution and changes that widen destinations. At this implementation stage, admission does not progress into completed package production. Download and other unfinished actions respond that they are not implemented. Coverage reconciliation records what applications declare for eventual extraction. The product should retain the already decided recent-sign-in and workspace-allowance requirements for their remaining implementation work. ## Relationships Workspace packages use export definitions and connection destinations. They are distinct from query-result files.