--- title: 'Security, Customers and Workspaces Design Examination' examined_at: '2026-10-23' examiner: codex source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f branch: agent/platform-security-test-exam-3 examination_status: complete method: implementation: static examination at the pinned commits planning: consistency review; no planning artifacts edited runtime: 'no backend integration, concurrency or browser execution claimed' approval: no approval or confirmed product intent inferred from code counts: design_artifacts_examined: 80 design_artifacts_rewritten: 80 by_kind: ADR: 16 DOM: 3 SCR: 31 STATE: 11 SVC: 3 WF: 16 object_invariants: 41 state_rows: 48 transitions: 66 invalid_transition_rows: 31 workflow_hops: 91 screen_state_rows: 85 responsibility_rows_examined: 1 new_findings: 14 new_open_questions: 0 new_inference_operations: 0 coverage: operations: business_declarations: 146 contracted_business_operations: 146 by_service: security: 102 tenants: 34 customers: 10 shared_health_operations: 3 total_contract_rows: 149 tables: physical_postgres_tables: 50 tables_with_object: 50 by_service: security: 31 tenants: 18 customers: 1 object_inventory: DOM-PFM-SEC-001: - platform.customers DOM-PFM-SEC-002: - platform.tenants - platform.tenant_provisioning_jobs - platform.tenant_provisioning_job_steps - platform.tenant_provisioning_job_events - platform.tenant_reset_jobs - platform.tenant_reset_job_steps - platform.tenant_reset_job_events - platform.tenant_deletion_requests - platform.tenant_deletion_notices - platform.tenant_deletion_schedule_jobs - platform.tenant_deletion_schedule_job_steps - platform.tenant_deletion_schedule_job_events - platform.tenant_purge_jobs - platform.tenant_purge_job_steps - platform.tenant_purge_job_events - platform.tenant_resources - platform.tenant_seed_applications - platform.staff_tenant_shortcuts DOM-PFM-SEC-003: - platform.users - platform.user_invitations - platform.user_lifecycle_events - platform.user_password_events - platform.authentication_identities - platform.external_identities - platform.identity_link_sessions - platform.former_users - platform.pool_account_removals - platform.identity_pools - platform.portal_contact_challenges - platform.security_catalog_releases - platform.security_permissions - platform.security_policies - platform.security_rules - platform.security_roles - platform.security_role_policies - platform.security_assignments - platform.derived_assignment_reconciles - platform.derived_assignment_reconcile_jobs - platform.derived_assignment_reconcile_job_steps - platform.derived_assignment_reconcile_job_events - platform.staff_access_grants - platform.service_principals - platform.security_audit_events - platform.authorizer_flush_jobs - platform.authorizer_flush_job_steps - platform.authorizer_flush_job_events - platform.tenant_portal_onboarding_jobs - platform.tenant_portal_onboarding_job_steps - platform.tenant_portal_onboarding_job_events external_stores: >- Registry and deletion-ledger stores remain documented workflow dependencies; they are not Postgres tables. screens: contracts: 31 routes_with_contract: 31 distinct_component_files: 27 invitation_route_alias: /acceptInvite uses the /invite contract state_machines: declared: 7 with_workflow: 7 mapping: tenant-provisioning: WF-PFM-SEC-001 tenant-reset: WF-PFM-SEC-002 tenant-deletion-schedule: WF-PFM-SEC-003 tenant-purge: WF-PFM-SEC-004 security-authorizer-flush: WF-PFM-SEC-008 security-derived-assignment-reconcile: WF-PFM-SEC-010 security-onboard-tenant-portal: WF-PFM-SEC-013 queues: primary: 2 with_workflow: 2 dead_letter_companions: 2 mapping: security-pool-account-removals: WF-PFM-SEC-007 security-derived-assignment-reconciles: WF-PFM-SEC-010 schedules: declared: 3 with_workflow: 3 pool_removals: WF-PFM-SEC-007; every minute derived_dispatch: WF-PFM-SEC-010; every minute derived_nightly: 'WF-PFM-SEC-010; 07:00 UTC' inference: model_calls_found: 0 contracts_requiring_inference_arrays: 50 empty_arrays_verified: 50 task_names: [] planning_omission: FND-PFM-SEC-041 custom_fields: >- No enabling capabilities.customFields registration found; declarations remain none under R2-ARCH-001. submissions: >- No operation binding found; all 149 operation rows declare unpublished status and a reason under R2-ARCH-002. preservation: permanent_ids: unchanged; new finding reservations allocated before writing artifact_status: unchanged design_intent: unchanged source_sha: unchanged decision_origins: unchanged operation_ids: unchanged service_access_and_permission: unchanged; verified against declarations inference_arrays: unchanged; all empty unknown_invariants_excluded_from_responsibility_guarantees: - INV-DOM-PFM-SEC-003-18 - INV-DOM-PFM-SEC-003-20 - INV-DOM-PFM-SEC-003-22 finding_ids_added: - FND-PFM-SEC-044 - FND-PFM-SEC-045 - FND-PFM-SEC-046 - FND-PFM-SEC-047 - FND-PFM-SEC-048 - FND-PFM-SEC-049 - FND-PFM-SEC-050 - FND-PFM-SEC-051 - FND-PFM-SEC-052 - FND-PFM-SEC-053 - FND-PFM-SEC-054 - FND-PFM-SEC-055 - FND-PFM-SEC-056 - FND-PFM-SEC-057 existing_draft_findings_rewritten: - FND-PFM-SEC-037 - FND-PFM-SEC-038 - FND-PFM-SEC-039 - FND-PFM-SEC-040 - FND-PFM-SEC-041 - FND-PFM-SEC-042 - FND-PFM-SEC-043 open_questions_retained: - OQ-PFM-SEC-001 - OQ-PFM-SEC-002 - OQ-PFM-SEC-003 - OQ-PFM-SEC-004 open_disagreements: - subject: Planning ownership and decisions references: - OQ-PFM-SEC-001 - OQ-PFM-SEC-002 - OQ-PFM-SEC-003 remaining: >- Workspace execution ownership, disabled-workspace exceptions and derived contact subjects require product decisions. The existing User Account concept grouping is cited, not re-decided. - subject: External effects and recovery references: - FND-PFM-SEC-037 - FND-PFM-SEC-042 - FND-PFM-SEC-045 - FND-PFM-SEC-046 - FND-PFM-SEC-047 - FND-PFM-SEC-050 - FND-PFM-SEC-051 - FND-PFM-SEC-052 - FND-PFM-SEC-053 - FND-PFM-SEC-057 remaining: >- Provider synchronization, registry activation, delivery, purge completion, shared job recovery and CRM linking are not atomic with all related records. Runtime proof and remediation decisions remain open. - subject: Concurrency and history guarantees references: - FND-PFM-SEC-054 - FND-PFM-SEC-055 - FND-PFM-SEC-056 remaining: >- Contact/challenge and requested staff-entry exclusion are unproved under concurrent calls; append-only database enforcement and general credential-payload rejection are not established. - subject: Observed interfaces and planning expectations references: - FND-PFM-SEC-038 - FND-PFM-SEC-039 - FND-PFM-SEC-040 - FND-PFM-SEC-044 - FND-PFM-SEC-048 - FND-PFM-SEC-049 remaining: >- Missing staff screens or pool writers, undeclared change events, loaded-activation timestamp behavior, permission mismatches and the fixed Security redirect remain findings. - subject: Prior proof and planning debt references: - FND-PFM-SEC-032 - FND-PFM-SEC-033 - FND-PFM-SEC-035 - FND-PFM-SEC-036 - FND-PFM-SEC-041 remaining: >- Replacement-field tests, HQ standing-access reconciliation, asynchronous recovery coverage and the planning no-inference declaration remain open. protected_value_changes: - artifact: DOM-PFM-SEC-001 field: '.invariants[4].enforced_at' before: - service - database after: - service - artifact: DOM-PFM-SEC-001 field: '.invariants[4].source' before: 'services-platform:modules/customers/db/customers.table.ts:customers (lockedCheck)' after: >- services-platform:modules/customers/services/persistence/customers.ts:updateCustomer, deleteCustomer - artifact: DOM-PFM-SEC-001 field: '.invariants[6].source' before: >- services-platform:modules/security/tests/integration/services/staff-access/rhythm-administrator-standing-access.integration.spec.js#gives each Rhythm Administrator one active customer-level standing grant in every customer but Rhythm’s own after: >- services-platform:modules/security/tests/integration/services/staff-access/rhythm-administrator-standing-access.integration.spec.js#gives each Rhythm Administrator one active customer-level standing grant in every customer but Rhythm’s own; modules/security/services/staff-access/ensure-standing-access.ts:ensureStandingAccess - artifact: DOM-PFM-SEC-002 field: '.invariants[2].source' before: >- services-platform:modules/tenants/services/lifecycle/lifecycle-transitions.ts:assertLifecycleTransition after: >- services-platform:modules/tenants/services/lifecycle/lifecycle-transitions.ts:assertLifecycleTransition; modules/tenants/services/persistence/tenants.ts:activateProvisionedTenant - artifact: DOM-PFM-SEC-002 field: .physical before: - platform.tenants - platform.tenant_provisioning_jobs - platform.tenant_provisioning_job_steps - platform.tenant_provisioning_job_events - platform.tenant_reset_jobs - platform.tenant_reset_job_steps - platform.tenant_reset_job_events - platform.tenant_deletion_requests - platform.tenant_deletion_notices - platform.tenant_deletion_schedule_jobs - platform.tenant_deletion_schedule_job_steps - platform.tenant_deletion_schedule_job_events - platform.tenant_purge_jobs - platform.tenant_purge_job_steps - platform.tenant_purge_job_events - platform.tenant_resources - platform.tenant_seed_applications - platform.staff_tenant_shortcuts - the deletion ledger bucket (one object per completed deletion) after: - platform.tenants - platform.tenant_provisioning_jobs - platform.tenant_provisioning_job_steps - platform.tenant_provisioning_job_events - platform.tenant_reset_jobs - platform.tenant_reset_job_steps - platform.tenant_reset_job_events - platform.tenant_deletion_requests - platform.tenant_deletion_notices - platform.tenant_deletion_schedule_jobs - platform.tenant_deletion_schedule_job_steps - platform.tenant_deletion_schedule_job_events - platform.tenant_purge_jobs - platform.tenant_purge_job_steps - platform.tenant_purge_job_events - platform.tenant_resources - platform.tenant_seed_applications - platform.staff_tenant_shortcuts - artifact: DOM-PFM-SEC-003 field: '.invariants[17].provenance' before: observed after: unknown - artifact: DOM-PFM-SEC-003 field: '.invariants[17].source' before: >- services-platform:modules/security/db/staff-access-grants.table.ts (staff_access_grants_active_uidx, EMERGENCY_MAX_MINUTES, EMERGENCY_REASON_MIN_LENGTH) after: >- services-platform:modules/security/db/staff-access-grants.table.ts (staff_access_grants_active_uidx, EMERGENCY_MAX_MINUTES, EMERGENCY_REASON_MIN_LENGTH); modules/security/services/staff-access/request-tenant-access.ts:requestTenantAccess - artifact: DOM-PFM-SEC-003 field: '.invariants[19].enforced_at' before: - service - database after: - service - artifact: DOM-PFM-SEC-003 field: '.invariants[19].provenance' before: observed after: unknown - artifact: DOM-PFM-SEC-003 field: '.invariants[19].source' before: 'services-platform:modules/security/services/audit/refused-attempts.ts:auditedAttempt' after: >- services-platform:modules/security/services/audit/refused-attempts.ts:auditedAttempt; modules/security/services/persistence/audit-events.ts:recordSecurityAuditEvent - artifact: DOM-PFM-SEC-003 field: '.invariants[21].provenance' before: observed after: unknown - artifact: DOM-PFM-SEC-003 field: '.invariants[21].source' before: 'services-platform:modules/security/services/portal/contact-match.ts:startContactChallenge' after: >- services-platform:modules/security/services/portal/contact-match.ts:startContactChallenge; modules/security/services/persistence/users.ts:linkPortalMemberContact; modules/security/services/persistence/portal-contact-challenges.ts:startPortalContactChallenge - artifact: DOM-PFM-SEC-003 field: .physical before: - platform.users - platform.user_invitations - platform.user_lifecycle_events - platform.user_password_events - platform.authentication_identities - platform.external_identities - platform.identity_link_sessions - platform.former_users - platform.pool_account_removals - platform.identity_pools - platform.portal_contact_challenges - platform.security_catalog_releases - platform.security_permissions - platform.security_policies - platform.security_rules - platform.security_roles - platform.security_role_policies - platform.security_assignments - platform.derived_assignment_reconciles - platform.derived_assignment_reconcile_jobs - platform.derived_assignment_reconcile_job_steps - platform.derived_assignment_reconcile_job_events - platform.staff_access_grants - platform.service_principals - platform.security_audit_events - platform.authorizer_flush_jobs - platform.authorizer_flush_job_steps - platform.authorizer_flush_job_events - platform.tenant_portal_onboarding_jobs - platform.tenant_portal_onboarding_job_steps - platform.tenant_portal_onboarding_job_events - platform_security_api_registry (the gateway's route registry) after: - platform.users - platform.user_invitations - platform.user_lifecycle_events - platform.user_password_events - platform.authentication_identities - platform.external_identities - platform.identity_link_sessions - platform.former_users - platform.pool_account_removals - platform.identity_pools - platform.portal_contact_challenges - platform.security_catalog_releases - platform.security_permissions - platform.security_policies - platform.security_rules - platform.security_roles - platform.security_role_policies - platform.security_assignments - platform.derived_assignment_reconciles - platform.derived_assignment_reconcile_jobs - platform.derived_assignment_reconcile_job_steps - platform.derived_assignment_reconcile_job_events - platform.staff_access_grants - platform.service_principals - platform.security_audit_events - platform.authorizer_flush_jobs - platform.authorizer_flush_job_steps - platform.authorizer_flush_job_events - platform.tenant_portal_onboarding_jobs - platform.tenant_portal_onboarding_job_steps - platform.tenant_portal_onboarding_job_events - artifact: SCR-PFM-SEC-001 field: .permission before: >- Any of the Security area keys (users, roles, policies, Rhythm access); the console shell gates the item after: 'none: fixed redirect; destination and console navigation apply their own guards' - artifact: SCR-PFM-SEC-001 field: '.displays[0].source' before: The security context (allowed keys) after: >- react-console:app/(console)/console/[tenantId]/security/page.tsx:SecurityPage; components/console/nav-config.ts:SECURITY_HOME - artifact: SCR-PFM-SEC-003 field: '.actions[2].confirm' before: true after: false - artifact: SCR-PFM-SEC-004 field: .permission before: platform.security-access.manage after: >- platform.users.read (SecurityPage view guard; editor additionally requires management authority and redirects when absent) - artifact: SCR-PFM-SEC-008 field: .permission before: platform.security-roles.manage after: >- platform.security-roles.read (SecurityPage view guard; editor additionally requires management authority and redirects when absent) - artifact: SCR-PFM-SEC-012 field: .permission before: platform.security-policies.manage after: >- platform.security-policies.read (SecurityPage view guard; editor additionally requires management authority and redirects when absent) - artifact: SCR-PFM-SEC-023 field: .permission before: hq.tenants.read (and any HQ key; the staff context gate) after: staff membership (context.user.isStaff); cards and actions check their individual HQ keys - artifact: SCR-PFM-SEC-028 field: '.actions[0].confirm' before: true after: false - artifact: SCR-PFM-SEC-029 field: '.actions[2].permission' before: hq.staff.disable after: hq.staff.update - artifact: SCR-PFM-SEC-029 field: '.actions[2].confirm' before: true after: false - artifact: SCR-PFM-SEC-029 field: '.actions[3].permission' before: hq.staff.disable after: hq.staff.update - artifact: SCR-PFM-SEC-029 field: '.actions[3].confirm' before: true after: false - artifact: SCR-PFM-SEC-030 field: '.actions[1].permission' before: hq.staff.disable after: hq.staff.update - artifact: SCR-PFM-SEC-030 field: '.actions[1].confirm' before: true after: false - artifact: SCR-PFM-SEC-030 field: '.actions[2].permission' before: hq.staff.disable after: hq.staff.update - artifact: SCR-PFM-SEC-030 field: '.actions[2].confirm' before: true after: false - artifact: SCR-PFM-SEC-031 field: .permission before: hq.staff.read after: hq.roles.read - artifact: WF-PFM-SEC-002 field: '.hops[1].seam' before: queue after: sync - artifact: WF-PFM-SEC-003 field: '.hops[1].provenance' before: observed after: documented - artifact: WF-PFM-SEC-003 field: '.hops[2].source' before: 'services-platform:modules/tenants/aws/logic/tenant-deletion-notice.alarm.ts' after: >- services-platform:modules/tenants/aws/logic/tenant-deletion-notice.alarm.ts; modules/tenants/services/deletion/tenant-deletion-schedule-workflow.ts:NOTICE_TASK_RETRY; modules/tenants/services/deletion/notices/send-notices.ts:sendOneNotice - artifact: WF-PFM-SEC-009 field: '.hops[3].source' before: 'services-platform:modules/security/authorizer/authorize.ts:authorize (steps 11 to 13)' after: >- services-platform:modules/security/authorizer/authorize.ts:authorize (steps 11 to 13); modules/security/authorizer/grants/possible-grant.ts (licensing mode); modules/security/authorizer/authorize.ts:AuthorizerDependencies verification_additions: - examiner and examined_at on all 80 design artifacts - provenance and source on every Service Contract operation - provenance and source on State Model states and invalid transitions - 'provenance and source on Screen Contract displays, actions and states' - >- api_permission and confirmation_condition where needed to distinguish observed client behavior from API authority artifacts: - id: ADR-PFM-SEC-001 title: Workspace decisions and participant execution path: >- specs/platform/security/design/decisions/ADR-PFM-SEC-001-staff-decisions-stay-here-participant-execution-belongs-to-its.md verification: pinned-source static examination final_text: OpenAI changes: - No technical correction; pinned evidence checked. - id: ADR-PFM-SEC-002 title: User Account aggregates path: >- specs/platform/security/design/decisions/ADR-PFM-SEC-002-user-account-is-one-object-of-four-aggregates.md verification: pinned-source static examination final_text: OpenAI changes: - >- Retained planning grouping and removed language implying the design re-decides superseded concepts. - id: ADR-PFM-SEC-003 title: Permanent readable customer and workspace identity path: >- specs/platform/security/design/decisions/ADR-PFM-SEC-003-customers-and-workspaces-are-named-by-chosen-permanent-readable.md verification: pinned-source static examination final_text: OpenAI changes: - No technical correction; pinned evidence checked. - id: ADR-PFM-SEC-004 title: Separate business status and lifecycle path: >- specs/platform/security/design/decisions/ADR-PFM-SEC-004-a-workspace-has-two-axes-and-only-workflows-write-its-lifecycle.md verification: pinned-source static examination final_text: OpenAI changes: - Qualified the workflow-only lifecycle claim with the restore exception. - id: ADR-PFM-SEC-005 title: Durable execution after committed intent path: >- specs/platform/security/design/decisions/ADR-PFM-SEC-005-long-workspace-work-is-a-durable-job-created-with-its-record.md verification: pinned-source static examination final_text: OpenAI changes: - Corrected universal companion-record transaction and failure-consequence claims. - id: ADR-PFM-SEC-006 title: Retirement boundary and forward recovery path: >- specs/platform/security/design/decisions/ADR-PFM-SEC-006-retirement-waits-re-checks-at-a-point-of-no-return-and-only.md verification: pinned-source static examination final_text: OpenAI changes: - No technical correction; pinned evidence checked. - id: ADR-PFM-SEC-007 title: Scoped authority with bounded cached context path: >- specs/platform/security/design/decisions/ADR-PFM-SEC-007-authority-comes-only-from-assignments-signed-per-request-and.md verification: pinned-source static examination final_text: OpenAI changes: - Included baseline self-service permissions and ninety-second signed-context bound. - id: ADR-PFM-SEC-008 title: Provider synchronization and durable removal path: >- specs/platform/security/design/decisions/ADR-PFM-SEC-008-sign-in-provider-calls-follow-the-commit-removals-are-queued-work.md verification: pinned-source static examination final_text: OpenAI changes: - Corrected contradictory every-provider-call-after-commit wording. - id: ADR-PFM-SEC-009 title: Recorded staff customer entry path: >- specs/platform/security/design/decisions/ADR-PFM-SEC-009-staff-enter-customer-work-only-through-recorded-grants.md verification: pinned-source static examination final_text: OpenAI changes: - Distinguished ordinary customer entry from HQ system-route authority. - id: ADR-PFM-SEC-010 title: Release-controlled shared definitions path: >- specs/platform/security/design/decisions/ADR-PFM-SEC-010-shared-definitions-are-reconciled-from-each-release-and-change.md verification: pinned-source static examination final_text: OpenAI changes: - Narrowed unchanged-deploy no-write claim to built-in content/version equality. - id: ADR-PFM-SEC-011 title: No custom-field capability path: >- specs/platform/security/design/decisions/ADR-PFM-SEC-011-customers-workspaces-and-accounts-carry-no-custom-fields.md verification: pinned-source static examination final_text: OpenAI changes: - No technical correction; pinned evidence checked. - id: ADR-PFM-SEC-012 title: Submissions publication exclusions path: >- specs/platform/security/design/decisions/ADR-PFM-SEC-012-no-operation-of-this-module-is-published-to-submissions.md verification: pinned-source static examination final_text: OpenAI changes: - No technical correction; pinned evidence checked. - id: ADR-PFM-SEC-013 title: Versioned record replacement contract path: >- specs/platform/security/design/decisions/ADR-PFM-SEC-013-replacements-carry-the-complete-record-and-the-version-read.md verification: pinned-source static examination final_text: OpenAI changes: - Separated approved write intent from observed deviations and narrowed protected-field claim. - id: ADR-PFM-SEC-014 title: Dedicated security history and refusal recording path: >- specs/platform/security/design/decisions/ADR-PFM-SEC-014-security-history-is-an-append-only-trail-of-its-own.md verification: pinned-source static examination final_text: OpenAI changes: - No technical correction; pinned evidence checked. - Qualified database append-only and universal secret-exclusion claim. - id: ADR-PFM-SEC-015 title: Source-owned contact-derived access path: >- specs/platform/security/design/decisions/ADR-PFM-SEC-015-derived-assignments-are-contact-keyed-source-owned-and-expire-as.md verification: pinned-source static examination final_text: OpenAI changes: - Restricted universal derived expiry assertion to eligibility renewal. - id: ADR-PFM-SEC-016 title: Confirmed portal self-registration path: >- specs/platform/security/design/decisions/ADR-PFM-SEC-016-portal-members-sign-themselves-up-and-the-confirmed-mailbox-makes.md verification: pinned-source static examination final_text: OpenAI changes: - Corrected trigger-only creation claim and uniform-refusal overstatement. - id: DOM-PFM-SEC-001 title: Customer path: specs/platform/security/design/objects/DOM-PFM-SEC-001-customer.md verification: pinned-source static examination final_text: OpenAI changes: - 'Update/delete locks are service checks, not database lock-value constraints.' - Standing access is conditional on reconciliation and preserves manual revocation. - id: DOM-PFM-SEC-002 title: Workspace path: specs/platform/security/design/objects/DOM-PFM-SEC-002-workspace.md verification: pinned-source static examination final_text: OpenAI changes: - Removed external deletion ledger from physical table inventory. - Corrected sandbox parent/child direction and optional account cardinality. - Scoped lifecycle transition and idempotency claim; retained restore exception. - Separated time-zone recognition from database shape validation. - id: DOM-PFM-SEC-003 title: User Account path: specs/platform/security/design/objects/DOM-PFM-SEC-003-user-account.md verification: pinned-source static examination final_text: OpenAI changes: - Removed gateway route registry from physical Postgres table inventory. - >- Restricted active-membership invariant to fresh evaluation; cached decisions remain bounded separately. - Included retained direct-create identity path. - >- Downgraded invariant 18 open-request exclusion, invariant 20 database/history enforcement and invariant 22 contact/challenge concurrency to unknown with findings. - Removed unsupported database enforcement from invariant 20. - >- Distinguished active-grant uniqueness from unproved request concurrency and scoped history retention. - id: SCR-PFM-SEC-001 title: Security area landing path: specs/platform/security/design/screens/SCR-PFM-SEC-001-security-area-landing.md verification: pinned-source static examination final_text: OpenAI changes: - Corrected first-permitted-section claim to fixed Users redirect. - 'Completed provenance and sources on structured state, refusal or screen rows.' - id: SCR-PFM-SEC-002 title: Users list path: specs/platform/security/design/screens/SCR-PFM-SEC-002-users-list.md verification: pinned-source static examination final_text: OpenAI changes: - Added real status-dependent row actions. - Replaced unsupported standard-layout pattern with observed components. - 'Completed provenance and sources on structured state, refusal or screen rows.' - id: SCR-PFM-SEC-003 title: User view path: specs/platform/security/design/screens/SCR-PFM-SEC-003-user-view.md verification: pinned-source static examination final_text: OpenAI changes: - Corrected reactivation confirmation and actual action labels. - Recorded both Access and History explanation gates. - 'Completed provenance and sources on structured state, refusal or screen rows.' - id: SCR-PFM-SEC-004 title: Edit user path: specs/platform/security/design/screens/SCR-PFM-SEC-004-edit-user.md verification: pinned-source static examination final_text: OpenAI changes: - 'Corrected page read guard, management redirect and read-only state.' - 'Completed provenance and sources on structured state, refusal or screen rows.' - id: SCR-PFM-SEC-005 title: Roles list path: specs/platform/security/design/screens/SCR-PFM-SEC-005-roles-list.md verification: pinned-source static examination final_text: OpenAI changes: - >- Checked component, route, data/actions and permission gates; added row provenance and action component source. - 'Completed provenance and sources on structured state, refusal or screen rows.' - id: SCR-PFM-SEC-006 title: New role path: specs/platform/security/design/screens/SCR-PFM-SEC-006-new-role.md verification: pinned-source static examination final_text: OpenAI changes: - Corrected validation action from button to save-time request. - 'Completed provenance and sources on structured state, refusal or screen rows.' - id: SCR-PFM-SEC-007 title: Role view path: specs/platform/security/design/screens/SCR-PFM-SEC-007-role-view.md verification: pinned-source static examination final_text: OpenAI changes: - >- Checked component, route, data/actions and permission gates; added row provenance and action component source. - 'Completed provenance and sources on structured state, refusal or screen rows.' - id: SCR-PFM-SEC-008 title: Edit role path: specs/platform/security/design/screens/SCR-PFM-SEC-008-edit-role.md verification: pinned-source static examination final_text: OpenAI changes: - Removed unbuilt eligibility action. - 'Corrected editor gates, redirect and save-time validation behavior.' - 'Completed provenance and sources on structured state, refusal or screen rows.' - id: SCR-PFM-SEC-009 title: Policies list path: specs/platform/security/design/screens/SCR-PFM-SEC-009-policies-list.md verification: pinned-source static examination final_text: OpenAI changes: - >- Checked component, route, data/actions and permission gates; added row provenance and action component source. - 'Completed provenance and sources on structured state, refusal or screen rows.' - id: SCR-PFM-SEC-010 title: New policy path: specs/platform/security/design/screens/SCR-PFM-SEC-010-new-policy.md verification: pinned-source static examination final_text: OpenAI changes: - Corrected save-time validation action. - 'Completed provenance and sources on structured state, refusal or screen rows.' - id: SCR-PFM-SEC-011 title: Policy view path: specs/platform/security/design/screens/SCR-PFM-SEC-011-policy-view.md verification: pinned-source static examination final_text: OpenAI changes: - >- Checked component, route, data/actions and permission gates; added row provenance and action component source. - 'Completed provenance and sources on structured state, refusal or screen rows.' - id: SCR-PFM-SEC-012 title: Edit policy path: specs/platform/security/design/screens/SCR-PFM-SEC-012-edit-policy.md verification: pinned-source static examination final_text: OpenAI changes: - 'Corrected read guard, management redirect and save-time validation.' - 'Completed provenance and sources on structured state, refusal or screen rows.' - id: SCR-PFM-SEC-013 title: Rhythm access path: specs/platform/security/design/screens/SCR-PFM-SEC-013-rhythm-access.md verification: pinned-source static examination final_text: OpenAI changes: - >- Checked component, route, data/actions and permission gates; added row provenance and action component source. - 'Completed provenance and sources on structured state, refusal or screen rows.' - id: SCR-PFM-SEC-014 title: Sign in path: specs/platform/security/design/screens/SCR-PFM-SEC-014-sign-in.md verification: pinned-source static examination final_text: OpenAI changes: - >- Checked component, route, data/actions and permission gates; added row provenance and action component source. - 'Completed provenance and sources on structured state, refusal or screen rows.' - id: SCR-PFM-SEC-015 title: Sign out path: specs/platform/security/design/screens/SCR-PFM-SEC-015-sign-out.md verification: pinned-source static examination final_text: OpenAI changes: - Removed blanket no-protected-access guarantee after sign-out. - 'Completed provenance and sources on structured state, refusal or screen rows.' - id: SCR-PFM-SEC-016 title: Forgot password path: specs/platform/security/design/screens/SCR-PFM-SEC-016-forgot-password.md verification: pinned-source static examination final_text: OpenAI changes: - >- Checked component, route, data/actions and permission gates; added row provenance and action component source. - 'Completed provenance and sources on structured state, refusal or screen rows.' - id: SCR-PFM-SEC-017 title: Check your e-mail path: specs/platform/security/design/screens/SCR-PFM-SEC-017-check-your-e-mail.md verification: pinned-source static examination final_text: OpenAI changes: - Added implemented resend error state and cooldown behavior. - 'Completed provenance and sources on structured state, refusal or screen rows.' - id: SCR-PFM-SEC-018 title: Reset password path: specs/platform/security/design/screens/SCR-PFM-SEC-018-reset-password.md verification: pinned-source static examination final_text: OpenAI changes: - >- Checked component, route, data/actions and permission gates; added row provenance and action component source. - 'Completed provenance and sources on structured state, refusal or screen rows.' - id: SCR-PFM-SEC-019 title: Second-factor code path: specs/platform/security/design/screens/SCR-PFM-SEC-019-second-factor-code.md verification: pinned-source static examination final_text: OpenAI changes: - >- Checked component, route, data/actions and permission gates; added row provenance and action component source. - 'Completed provenance and sources on structured state, refusal or screen rows.' - id: SCR-PFM-SEC-020 title: Session ended path: specs/platform/security/design/screens/SCR-PFM-SEC-020-session-ended.md verification: pinned-source static examination final_text: OpenAI changes: - >- Checked component, route, data/actions and permission gates; added row provenance and action component source. - 'Completed provenance and sources on structured state, refusal or screen rows.' - id: SCR-PFM-SEC-021 title: Sign-in provider return path: specs/platform/security/design/screens/SCR-PFM-SEC-021-sign-in-provider-return.md verification: pinned-source static examination final_text: OpenAI changes: - >- Checked component, route, data/actions and permission gates; added row provenance and action component source. - 'Completed provenance and sources on structured state, refusal or screen rows.' - id: SCR-PFM-SEC-022 title: Accept invitation path: specs/platform/security/design/screens/SCR-PFM-SEC-022-accept-invitation.md verification: pinned-source static examination final_text: OpenAI changes: - >- Checked component, route, data/actions and permission gates; added row provenance and action component source. - 'Completed provenance and sources on structured state, refusal or screen rows.' - id: SCR-PFM-SEC-023 title: HQ home path: specs/platform/security/design/screens/SCR-PFM-SEC-023-hq-home.md verification: pinned-source static examination final_text: OpenAI changes: - Corrected home membership gate and removed nonexistent own-grants display. - 'Completed provenance and sources on structured state, refusal or screen rows.' - id: SCR-PFM-SEC-024 title: HQ customers list path: specs/platform/security/design/screens/SCR-PFM-SEC-024-hq-customers-list.md verification: pinned-source static examination final_text: OpenAI changes: - >- Checked component, route, data/actions and permission gates; added row provenance and action component source. - 'Completed provenance and sources on structured state, refusal or screen rows.' - id: SCR-PFM-SEC-025 title: HQ customer detail path: specs/platform/security/design/screens/SCR-PFM-SEC-025-hq-customer-detail.md verification: pinned-source static examination final_text: OpenAI changes: - >- Checked component, route, data/actions and permission gates; added row provenance and action component source. - 'Completed provenance and sources on structured state, refusal or screen rows.' - id: SCR-PFM-SEC-026 title: HQ workspaces list path: specs/platform/security/design/screens/SCR-PFM-SEC-026-hq-workspaces-list.md verification: pinned-source static examination final_text: OpenAI changes: - >- Checked component, route, data/actions and permission gates; added row provenance and action component source. - 'Completed provenance and sources on structured state, refusal or screen rows.' - id: SCR-PFM-SEC-027 title: HQ workspace detail path: specs/platform/security/design/screens/SCR-PFM-SEC-027-hq-workspace-detail.md verification: pinned-source static examination final_text: OpenAI changes: - Scoped edit confirmation to disabling. - 'Completed provenance and sources on structured state, refusal or screen rows.' - id: SCR-PFM-SEC-028 title: Provision a workspace path: specs/platform/security/design/screens/SCR-PFM-SEC-028-provision-a-workspace.md verification: pinned-source static examination final_text: OpenAI changes: - Corrected extra submit confirmation claim. - 'Completed provenance and sources on structured state, refusal or screen rows.' - id: SCR-PFM-SEC-029 title: HQ staff list path: specs/platform/security/design/screens/SCR-PFM-SEC-029-hq-staff-list.md verification: pinned-source static examination final_text: OpenAI changes: - Recorded exact UI/API permission mismatch and immediate suspend/reinstate behavior. - 'Completed provenance and sources on structured state, refusal or screen rows.' - id: SCR-PFM-SEC-030 title: HQ staff detail path: specs/platform/security/design/screens/SCR-PFM-SEC-030-hq-staff-detail.md verification: pinned-source static examination final_text: OpenAI changes: - Recorded UI/API mismatch and corrected action confirmation. - 'Completed provenance and sources on structured state, refusal or screen rows.' - id: SCR-PFM-SEC-031 title: HQ staff roles path: specs/platform/security/design/screens/SCR-PFM-SEC-031-hq-staff-roles.md verification: pinned-source static examination final_text: OpenAI changes: - Corrected console role gate and API key mismatch; recorded implemented fallback. - 'Completed provenance and sources on structured state, refusal or screen rows.' - id: STATE-PFM-SEC-001 title: Workspace lifecycle path: specs/platform/security/design/state-models/STATE-PFM-SEC-001-workspace-lifecycle.md verification: pinned-source static examination final_text: OpenAI changes: - Loading activation preserves first-activation timestamp. - Loading availability includes HQ exceptions. - Repeated activation can update metadata; lifecycle idempotence is not a record no-op. - 'Completed provenance and sources on structured state, refusal or screen rows.' - id: STATE-PFM-SEC-002 title: Workspace business status path: specs/platform/security/design/state-models/STATE-PFM-SEC-002-workspace-business-status.md verification: pinned-source static examination final_text: OpenAI changes: - No technical correction; pinned evidence checked. - 'Completed provenance and sources on structured state, refusal or screen rows.' - id: STATE-PFM-SEC-003 title: Workspace retirement request path: specs/platform/security/design/state-models/STATE-PFM-SEC-003-workspace-retirement-request.md verification: pinned-source static examination final_text: OpenAI changes: - Separated database completion from external ledger success. - Distinguished human hold permission from system authority-loss hold. - 'Completed provenance and sources on structured state, refusal or screen rows.' - id: STATE-PFM-SEC-004 title: Membership status path: specs/platform/security/design/state-models/STATE-PFM-SEC-004-membership-status.md verification: pinned-source static examination final_text: OpenAI changes: - Scoped lockout transaction claims to guarded destructive changes. - Removed the one-minute provider-completion promise. - 'Completed provenance and sources on structured state, refusal or screen rows.' - id: STATE-PFM-SEC-005 title: Invitation path: specs/platform/security/design/state-models/STATE-PFM-SEC-005-invitation.md verification: pinned-source static examination final_text: OpenAI changes: - Separated token issuance from delivery and corrected delivery-order validity claim. - 'Completed provenance and sources on structured state, refusal or screen rows.' - id: STATE-PFM-SEC-006 title: Role assignment path: specs/platform/security/design/state-models/STATE-PFM-SEC-006-role-assignment.md verification: pinned-source static examination final_text: OpenAI changes: - Clarified derived window labels and representative transitions. - 'Completed provenance and sources on structured state, refusal or screen rows.' - id: STATE-PFM-SEC-007 title: Staff access grant path: specs/platform/security/design/state-models/STATE-PFM-SEC-007-staff-access-grant.md verification: pinned-source static examination final_text: OpenAI changes: - No technical correction; pinned evidence checked. - Corrected active-only uniqueness and the stored requested validity window. - 'Completed provenance and sources on structured state, refusal or screen rows.' - id: STATE-PFM-SEC-008 title: Custom and built-in access definition path: specs/platform/security/design/state-models/STATE-PFM-SEC-008-access-definition.md verification: pinned-source static examination final_text: OpenAI changes: - Corrected mandatory-version guards to reflect optional current route inputs. - 'Completed provenance and sources on structured state, refusal or screen rows.' - id: STATE-PFM-SEC-009 title: Service principal path: specs/platform/security/design/state-models/STATE-PFM-SEC-009-service-principal.md verification: pinned-source static examination final_text: OpenAI changes: - No technical correction; pinned evidence checked. - 'Completed provenance and sources on structured state, refusal or screen rows.' - id: STATE-PFM-SEC-010 title: Portal sign-in pool path: specs/platform/security/design/state-models/STATE-PFM-SEC-010-portal-sign-in-pool.md verification: pinned-source static examination final_text: OpenAI changes: - No technical correction; pinned evidence checked. - 'Completed provenance and sources on structured state, refusal or screen rows.' - id: STATE-PFM-SEC-011 title: Portal contact challenge path: specs/platform/security/design/state-models/STATE-PFM-SEC-011-portal-contact-challenge.md verification: pinned-source static examination final_text: OpenAI changes: - Clarified live-state issuance and delivery-failure supersession. - Removed unproved live-challenge and contact-link uniqueness guarantees. - 'Completed provenance and sources on structured state, refusal or screen rows.' - id: SVC-PFM-SEC-customers title: Customers Service Module path: specs/platform/security/design/contracts/SVC-PFM-SEC-customers.md verification: pinned-source static examination final_text: OpenAI changes: - >- Added declaration-level provenance/source for every operation; all operation ids, primary access levels and permission keys matched. - id: SVC-PFM-SEC-security title: Security Service Module path: specs/platform/security/design/contracts/SVC-PFM-SEC-security.md verification: pinned-source static examination final_text: OpenAI changes: - >- Added declaration-level provenance/source for every operation; all operation ids, primary access levels and permission keys matched. - >- Corrected catalog/registry atomicity, provider-call ordering, bounded queue retry and human-authorizer scope. - id: SVC-PFM-SEC-tenants title: Workspaces Service Module path: specs/platform/security/design/contracts/SVC-PFM-SEC-tenants.md verification: pinned-source static examination final_text: OpenAI changes: - >- Added declaration-level provenance/source for every operation; all operation ids, primary access levels and permission keys matched. - Corrected notice duplication and external-ledger completion boundaries. - id: WF-PFM-SEC-001 title: Provision a workspace path: specs/platform/security/design/workflows/WF-PFM-SEC-001-provision-a-workspace.md verification: pinned-source static examination final_text: OpenAI changes: - Corrected repeated activation from record no-op to lifecycle convergence. - Scoped claimed-notification behavior without a delivery guarantee. - Rewrote the narrative and diagram with conditional and failure branches retained. - id: WF-PFM-SEC-002 title: 'Open, reset and activate an initial load' path: >- specs/platform/security/design/workflows/WF-PFM-SEC-002-open-reset-and-activate-an-initial-load.md verification: pinned-source static examination final_text: OpenAI changes: - Removed unsupported queue mechanism from the admission-only hop. - Corrected loading access exclusivity and loaded activation timestamp. - Rewrote the narrative and diagram with conditional and failure branches retained. - id: WF-PFM-SEC-003 title: Watch a retirement request through its waiting period path: >- specs/platform/security/design/workflows/WF-PFM-SEC-003-watch-a-retirement-request-through-its-waiting-period.md verification: pinned-source static examination final_text: OpenAI changes: - Corrected notice exactly-once claim and added actual retry/delivery anchors. - Removed unconditional successful schedule settlement claim. - Classified shared job-engine start hop as documented rather than observed implementation. - Rewrote the narrative and diagram with conditional and failure branches retained. - id: WF-PFM-SEC-004 title: Purge a retired workspace path: specs/platform/security/design/workflows/WF-PFM-SEC-004-purge-a-retired-workspace.md verification: pinned-source static examination final_text: OpenAI changes: - Removed immediate-flush guarantee. - Corrected completed-request/missing-ledger failure outcome and bounded failure retries. - Rewrote the narrative and diagram with conditional and failure branches retained. - id: WF-PFM-SEC-005 title: Invite a person and deliver the invitation path: >- specs/platform/security/design/workflows/WF-PFM-SEC-005-invite-a-person-and-deliver-the-invitation.md verification: pinned-source static examination final_text: OpenAI changes: - 'Corrected issuance, delivery and resend validity semantics.' - Rewrote the narrative and diagram with conditional and failure branches retained. - id: WF-PFM-SEC-006 title: Accept an invitation path: specs/platform/security/design/workflows/WF-PFM-SEC-006-accept-an-invitation.md verification: pinned-source static examination final_text: OpenAI changes: - >- Restricted single-use and safe-retry claims to database consumption; recorded external credential race. - Rewrote the narrative and diagram with conditional and failure branches retained. - id: WF-PFM-SEC-007 title: 'Suspend, reinstate, revoke or delete a membership' path: >- specs/platform/security/design/workflows/WF-PFM-SEC-007-suspend-reinstate-revoke-or-delete-a-membership.md verification: pinned-source static examination final_text: OpenAI changes: - >- Removed minute-completion and immediate-flush promises; preserved API provider-problem result. - Rewrote the narrative and diagram with conditional and failure branches retained. - id: WF-PFM-SEC-008 title: Flush the gateway's cached decisions path: >- specs/platform/security/design/workflows/WF-PFM-SEC-008-flush-the-gateway-s-cached-decisions.md verification: pinned-source static examination final_text: OpenAI changes: - Removed successful-reset equivalence to actual eviction. - Rewrote the narrative and diagram with conditional and failure branches retained. - id: WF-PFM-SEC-009 title: Authorize a request at the gateway path: specs/platform/security/design/workflows/WF-PFM-SEC-009-authorize-a-request-at-the-gateway.md verification: pinned-source static examination final_text: OpenAI changes: - >- Scoped workflow to human protected routes and distinguished invocation logging from cached traffic. - Rewrote the narrative and diagram with conditional and failure branches retained. - Qualified licensing enforcement by configured mode; an absent mode defaults to off. - id: WF-PFM-SEC-010 title: Reconcile derived role assignments path: specs/platform/security/design/workflows/WF-PFM-SEC-010-reconcile-derived-role-assignments.md verification: pinned-source static examination final_text: OpenAI changes: - Changed one-batch claim to bounded batches. - Scoped expiry fail-safe to eligibility-bound renewals. - Rewrote the narrative and diagram with conditional and failure branches retained. - id: WF-PFM-SEC-011 title: Grant and end staff entry to a customer workspace path: >- specs/platform/security/design/workflows/WF-PFM-SEC-011-grant-and-end-staff-entry-to-a-customer-workspace.md verification: pinned-source static examination final_text: OpenAI changes: - >- Scoped standing reconciliation failures by call boundary and retained HQ system-route exception. - Distinguished sequential request duplicate checks from active-grant uniqueness. - Rewrote the narrative and diagram with conditional and failure branches retained. - id: WF-PFM-SEC-012 title: 'Reconcile shared definitions, founding staff and principals on deploy' path: >- specs/platform/security/design/workflows/WF-PFM-SEC-012-reconcile-shared-definitions-founding-staff-and-principals-on.md verification: pinned-source static examination final_text: OpenAI changes: - Corrected staged-manifest visibility. - Exposed catalog/registry non-atomic activation and narrowed unchanged-release claim. - Rewrote the narrative and diagram with conditional and failure branches retained. - id: WF-PFM-SEC-013 title: Onboard a workspace's portal sign-in pool path: >- specs/platform/security/design/workflows/WF-PFM-SEC-013-onboard-a-workspace-s-portal-sign-in-pool.md verification: pinned-source static examination final_text: OpenAI changes: - Removed same-day recovery guarantee. - Rewrote the narrative and diagram with conditional and failure branches retained. - id: WF-PFM-SEC-014 title: 'Register, confirm and sign in a portal member' path: >- specs/platform/security/design/workflows/WF-PFM-SEC-014-register-confirm-and-sign-in-a-portal-member.md verification: pinned-source static examination final_text: OpenAI changes: - Corrected missing-pool and unavailable-workspace equivalence. - Included confirmed-member sign-in repair and token lifetime after sign-out. - Rewrote the narrative and diagram with conditional and failure branches retained. - id: WF-PFM-SEC-015 title: Link a portal member to a contact path: specs/platform/security/design/workflows/WF-PFM-SEC-015-link-a-portal-member-to-a-contact.md verification: pinned-source static examination final_text: OpenAI changes: - Recorded CRM/link transaction gap and challenge-delivery failure handling. - Restricted directory-unavailable fallback to its actual failure category. - >- Downgraded cross-member link and concurrent challenge-start guarantees pending concurrency proof. - Rewrote the narrative and diagram with conditional and failure branches retained. - id: WF-PFM-SEC-016 title: Sign in to the console and keep the session path: >- specs/platform/security/design/workflows/WF-PFM-SEC-016-sign-in-to-the-console-and-keep-the-session.md verification: pinned-source static examination final_text: OpenAI changes: - Corrected context-read side effects and limited sign-out guarantees. - Rewrote the narrative and diagram with conditional and failure branches retained. responsibilities: module: MOD-PFM-SEC changes: - >- Verified operation, event, object and invariant ownership against the three Service Contracts and Domain Objects. - Preserved cross-module delegations and existing unresolved ownership. - >- Excluded the three unknown invariant claims from guarantees while retaining their permanent identities and findings. - Rewrote every Security prose entry; the console-shell module is unchanged. validation: commands: - npm ci && npm run check - npm test corpus_errors: 0 tests_passed: 4 tests_failed: 0 pinned_source_paths_verified: 161 evidence: - 'specs/CONVENTIONS.md §§6, 9' - specs/templates/* - briefs/design/platform-security.brief.md - specs/platform/security planning artifacts and cited product records - >- services-platform: modules/security/**, modules/tenants/**, modules/customers/** and the standard/permission records cited by those artifacts - 'react-console: the route, component and auth paths cited by the Screen Contracts' - FND-PFM-SEC-057 limits verification of external shared job-engine internals initial_examination_branch: agent/platform-security-desi-exam-1 testing_continuation: examiner: codex examined_at: '2026-10-23' source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f counts: capability_specifications_examined: 20 capability_specifications_rewritten: 20 capability_scenarios: 342 scenarios_added: 4 scenarios_added_by_category: validation: 1 edge: 1 failure: 1 concurrency: 1 feature_suites_examined_and_rewritten: 6 feature_scenarios: 30 executable_suites_examined: 346 existing_suite_records_rewritten: 266 executable_suites_added: 80 by_repository: services-platform: 303 react-console: 43 by_kind: api-lifecycle: 40 browser-lifecycle: 32 unit: 114 integration: 160 bound_capability_scenarios: 213 unbound_capability_scenarios: 129 capability_to_suite_bindings: 338 bindings_added: 4 feature_scenario_bindings: 0 feature_binding_candidates: 1 covered_category_cells: 142 gap_category_cells: 58 coverage_findings: 21 new_findings: 2 resolved_findings: 1 source_files_examined: 346 test_anchors_examined: 730 report: specs/platform/security/reports/EXAMINATION-2026-10-23.md examination_status: complete-with-findings --- # Security, Customers and Workspaces Design Examination ## Scope and Method All eighty design artifacts and the Security responsibility row have been independently examined against the pinned source and the planning layer. Every narrative section and requested prose field now has OpenAI wording. Verification and final wording were committed separately for each artifact; the final audit also checked permanent identities, maturity, intent, decision origins, operation declarations and source pins. The examination is a static account of declared routes, tables, services, browser components and asynchronous infrastructure. Corpus validation and checker tests verify document conformance; they do not demonstrate concurrent execution, deployed recovery or browser behavior. Shared job-engine internals lack an independently pinned implementation, so their start contract remains documented evidence. ## Coverage | Inventory | Examined and represented | | --- | --- | | Domain Objects | 3 objects; 41 invariant rows; all 50 Postgres tables | | State Models | 11 models; 48 states; 66 transitions; 31 invalid-transition rows | | Workflows | 16 workflows; 91 hops; all 7 state machines, 2 primary queues and 3 schedules | | Service Contracts | 3 contracts; all 146 business operations and 3 health operations | | Screen Contracts | 31 routes/contracts using 27 component files | | Decision Records | 16 records; existing origins retained | | Responsibilities | Security ownership, operation inventory and delegations reconciled | | Inference | No model calls found; all 50 required contract arrays are empty | Both primary queues have dead-letter companions. Resource coverage measures representation, not successful recovery after exhaustion. External registry and deletion-ledger stores remain dependencies rather than entries in the Postgres table inventory. ## Changes by Artifact The following table records the examined artifact by its final title. The structured examination record preserves its permanent identity, file location, detailed changes and every changed protected value. Each artifact also received a complete prose rewrite. | Artifact | Verification changes | | --- | --- | | Workspace decisions and participant execution | No technical correction; pinned evidence checked. | | User Account aggregates | Retained planning grouping and removed language implying the design re-decides superseded concepts. | | Permanent readable customer and workspace identity | No technical correction; pinned evidence checked. | | Separate business status and lifecycle | Qualified the workflow-only lifecycle claim with the restore exception. | | Durable execution after committed intent | Corrected universal companion-record transaction and failure-consequence claims. | | Retirement boundary and forward recovery | No technical correction; pinned evidence checked. | | Scoped authority with bounded cached context | Included baseline self-service permissions and ninety-second signed-context bound. | | Provider synchronization and durable removal | Corrected contradictory every-provider-call-after-commit wording. | | Recorded staff customer entry | Distinguished ordinary customer entry from HQ system-route authority. | | Release-controlled shared definitions | Narrowed unchanged-deploy no-write claim to built-in content/version equality. | | No custom-field capability | No technical correction; pinned evidence checked. | | Submissions publication exclusions | No technical correction; pinned evidence checked. | | Versioned record replacement contract | Separated approved write intent from observed deviations and narrowed protected-field claim. | | Dedicated security history and refusal recording | No technical correction; pinned evidence checked. Qualified database append-only and universal secret-exclusion claim. | | Source-owned contact-derived access | Restricted universal derived expiry assertion to eligibility renewal. | | Confirmed portal self-registration | Corrected trigger-only creation claim and uniform-refusal overstatement. | | Customer | Update/delete locks are service checks, not database lock-value constraints. Standing access is conditional on reconciliation and preserves manual revocation. | | Workspace | Removed external deletion ledger from physical table inventory. Corrected sandbox parent/child direction and optional account cardinality. Scoped lifecycle transition and idempotency claim; retained restore exception. Separated time-zone recognition from database shape validation. | | User Account | Removed gateway route registry from physical Postgres table inventory. Restricted active-membership invariant to fresh evaluation; cached decisions remain bounded separately. Included retained direct-create identity path. Downgraded invariant 18 open-request exclusion, invariant 20 database/history enforcement and invariant 22 contact/challenge concurrency to unknown with findings. Removed unsupported database enforcement from invariant 20. Distinguished active-grant uniqueness from unproved request concurrency and scoped history retention. | | Security area landing | Corrected first-permitted-section claim to fixed Users redirect. Completed provenance and sources on structured state, refusal or screen rows. | | Users list | Added real status-dependent row actions. Replaced unsupported standard-layout pattern with observed components. Completed provenance and sources on structured state, refusal or screen rows. | | User view | Corrected reactivation confirmation and actual action labels. Recorded both Access and History explanation gates. Completed provenance and sources on structured state, refusal or screen rows. | | Edit user | Corrected page read guard, management redirect and read-only state. Completed provenance and sources on structured state, refusal or screen rows. | | Roles list | Checked component, route, data/actions and permission gates; added row provenance and action component source. Completed provenance and sources on structured state, refusal or screen rows. | | New role | Corrected validation action from button to save-time request. Completed provenance and sources on structured state, refusal or screen rows. | | Role view | Checked component, route, data/actions and permission gates; added row provenance and action component source. Completed provenance and sources on structured state, refusal or screen rows. | | Edit role | Removed unbuilt eligibility action. Corrected editor gates, redirect and save-time validation behavior. Completed provenance and sources on structured state, refusal or screen rows. | | Policies list | Checked component, route, data/actions and permission gates; added row provenance and action component source. Completed provenance and sources on structured state, refusal or screen rows. | | New policy | Corrected save-time validation action. Completed provenance and sources on structured state, refusal or screen rows. | | Policy view | Checked component, route, data/actions and permission gates; added row provenance and action component source. Completed provenance and sources on structured state, refusal or screen rows. | | Edit policy | Corrected read guard, management redirect and save-time validation. Completed provenance and sources on structured state, refusal or screen rows. | | Rhythm access | Checked component, route, data/actions and permission gates; added row provenance and action component source. Completed provenance and sources on structured state, refusal or screen rows. | | Sign in | Checked component, route, data/actions and permission gates; added row provenance and action component source. Completed provenance and sources on structured state, refusal or screen rows. | | Sign out | Removed blanket no-protected-access guarantee after sign-out. Completed provenance and sources on structured state, refusal or screen rows. | | Forgot password | Checked component, route, data/actions and permission gates; added row provenance and action component source. Completed provenance and sources on structured state, refusal or screen rows. | | Check your e-mail | Added implemented resend error state and cooldown behavior. Completed provenance and sources on structured state, refusal or screen rows. | | Reset password | Checked component, route, data/actions and permission gates; added row provenance and action component source. Completed provenance and sources on structured state, refusal or screen rows. | | Second-factor code | Checked component, route, data/actions and permission gates; added row provenance and action component source. Completed provenance and sources on structured state, refusal or screen rows. | | Session ended | Checked component, route, data/actions and permission gates; added row provenance and action component source. Completed provenance and sources on structured state, refusal or screen rows. | | Sign-in provider return | Checked component, route, data/actions and permission gates; added row provenance and action component source. Completed provenance and sources on structured state, refusal or screen rows. | | Accept invitation | Checked component, route, data/actions and permission gates; added row provenance and action component source. Completed provenance and sources on structured state, refusal or screen rows. | | HQ home | Corrected home membership gate and removed nonexistent own-grants display. Completed provenance and sources on structured state, refusal or screen rows. | | HQ customers list | Checked component, route, data/actions and permission gates; added row provenance and action component source. Completed provenance and sources on structured state, refusal or screen rows. | | HQ customer detail | Checked component, route, data/actions and permission gates; added row provenance and action component source. Completed provenance and sources on structured state, refusal or screen rows. | | HQ workspaces list | Checked component, route, data/actions and permission gates; added row provenance and action component source. Completed provenance and sources on structured state, refusal or screen rows. | | HQ workspace detail | Scoped edit confirmation to disabling. Completed provenance and sources on structured state, refusal or screen rows. | | Provision a workspace | Corrected extra submit confirmation claim. Completed provenance and sources on structured state, refusal or screen rows. | | HQ staff list | Recorded exact UI/API permission mismatch and immediate suspend/reinstate behavior. Completed provenance and sources on structured state, refusal or screen rows. | | HQ staff detail | Recorded UI/API mismatch and corrected action confirmation. Completed provenance and sources on structured state, refusal or screen rows. | | HQ staff roles | Corrected console role gate and API key mismatch; recorded implemented fallback. Completed provenance and sources on structured state, refusal or screen rows. | | Workspace lifecycle | Loading activation preserves first-activation timestamp. Loading availability includes HQ exceptions. Repeated activation can update metadata; lifecycle idempotence is not a record no-op. Completed provenance and sources on structured state, refusal or screen rows. | | Workspace business status | No technical correction; pinned evidence checked. Completed provenance and sources on structured state, refusal or screen rows. | | Workspace retirement request | Separated database completion from external ledger success. Distinguished human hold permission from system authority-loss hold. Completed provenance and sources on structured state, refusal or screen rows. | | Membership status | Scoped lockout transaction claims to guarded destructive changes. Removed the one-minute provider-completion promise. Completed provenance and sources on structured state, refusal or screen rows. | | Invitation | Separated token issuance from delivery and corrected delivery-order validity claim. Completed provenance and sources on structured state, refusal or screen rows. | | Role assignment | Clarified derived window labels and representative transitions. Completed provenance and sources on structured state, refusal or screen rows. | | Staff access grant | No technical correction; pinned evidence checked. Corrected active-only uniqueness and the stored requested validity window. Completed provenance and sources on structured state, refusal or screen rows. | | Custom and built-in access definition | Corrected mandatory-version guards to reflect optional current route inputs. Completed provenance and sources on structured state, refusal or screen rows. | | Service principal | No technical correction; pinned evidence checked. Completed provenance and sources on structured state, refusal or screen rows. | | Portal sign-in pool | No technical correction; pinned evidence checked. Completed provenance and sources on structured state, refusal or screen rows. | | Portal contact challenge | Clarified live-state issuance and delivery-failure supersession. Removed unproved live-challenge and contact-link uniqueness guarantees. Completed provenance and sources on structured state, refusal or screen rows. | | Customers Service Module | Added declaration-level provenance/source for every operation; all operation ids, primary access levels and permission keys matched. | | Security Service Module | Added declaration-level provenance/source for every operation; all operation ids, primary access levels and permission keys matched. Corrected catalog/registry atomicity, provider-call ordering, bounded queue retry and human-authorizer scope. | | Workspaces Service Module | Added declaration-level provenance/source for every operation; all operation ids, primary access levels and permission keys matched. Corrected notice duplication and external-ledger completion boundaries. | | Provision a workspace | Corrected repeated activation from record no-op to lifecycle convergence. Scoped claimed-notification behavior without a delivery guarantee. Rewrote the narrative and diagram with conditional and failure branches retained. | | Open, reset and activate an initial load | Removed unsupported queue mechanism from the admission-only hop. Corrected loading access exclusivity and loaded activation timestamp. Rewrote the narrative and diagram with conditional and failure branches retained. | | Watch a retirement request through its waiting period | Corrected notice exactly-once claim and added actual retry/delivery anchors. Removed unconditional successful schedule settlement claim. Classified shared job-engine start hop as documented rather than observed implementation. Rewrote the narrative and diagram with conditional and failure branches retained. | | Purge a retired workspace | Removed immediate-flush guarantee. Corrected completed-request/missing-ledger failure outcome and bounded failure retries. Rewrote the narrative and diagram with conditional and failure branches retained. | | Invite a person and deliver the invitation | Corrected issuance, delivery and resend validity semantics. Rewrote the narrative and diagram with conditional and failure branches retained. | | Accept an invitation | Restricted single-use and safe-retry claims to database consumption; recorded external credential race. Rewrote the narrative and diagram with conditional and failure branches retained. | | Suspend, reinstate, revoke or delete a membership | Removed minute-completion and immediate-flush promises; preserved API provider-problem result. Rewrote the narrative and diagram with conditional and failure branches retained. | | Flush the gateway's cached decisions | Removed successful-reset equivalence to actual eviction. Rewrote the narrative and diagram with conditional and failure branches retained. | | Authorize a request at the gateway | Scoped workflow to human protected routes and distinguished invocation logging from cached traffic. Rewrote the narrative and diagram with conditional and failure branches retained. Qualified licensing enforcement by configured mode; an absent mode defaults to off. | | Reconcile derived role assignments | Changed one-batch claim to bounded batches. Scoped expiry fail-safe to eligibility-bound renewals. Rewrote the narrative and diagram with conditional and failure branches retained. | | Grant and end staff entry to a customer workspace | Scoped standing reconciliation failures by call boundary and retained HQ system-route exception. Distinguished sequential request duplicate checks from active-grant uniqueness. Rewrote the narrative and diagram with conditional and failure branches retained. | | Reconcile shared definitions, founding staff and principals on deploy | Corrected staged-manifest visibility. Exposed catalog/registry non-atomic activation and narrowed unchanged-release claim. Rewrote the narrative and diagram with conditional and failure branches retained. | | Onboard a workspace's portal sign-in pool | Removed same-day recovery guarantee. Rewrote the narrative and diagram with conditional and failure branches retained. | | Register, confirm and sign in a portal member | Corrected missing-pool and unavailable-workspace equivalence. Included confirmed-member sign-in repair and token lifetime after sign-out. Rewrote the narrative and diagram with conditional and failure branches retained. | | Link a portal member to a contact | Recorded CRM/link transaction gap and challenge-delivery failure handling. Restricted directory-unavailable fallback to its actual failure category. Downgraded cross-member link and concurrent challenge-start guarantees pending concurrency proof. Rewrote the narrative and diagram with conditional and failure branches retained. | | Sign in to the console and keep the session | Corrected context-read side effects and limited sign-out guarantees. Rewrote the narrative and diagram with conditional and failure branches retained. | ## Responsibilities and Planning Consistency The three objects retain the planning concept grain. Separate account aggregates keep their own lifecycles without reinstating superseded concepts. Service ownership agrees with the route inventories, and unresolved workspace execution ownership remains a product question. Unknown concurrency and history protections are excluded from the responsibility guarantees but remain visible in the object and findings. Planning artifacts were not changed. Observed disagreements are findings rather than revised product rules; no approval, confirmed intent or new architectural decision was inferred from implementation. The decision records cite existing origins, distinguish actual alternatives and preserve the previously chosen account grouping. ## Open Disagreements Fourteen new findings record limits exposed by this examination. The previous draft findings also have OpenAI wording, and the existing four questions remain in place. The weakest behavioral evidence concerns concurrent contact linking, challenge creation and staff requests, plus effects divided between database records and identity providers, mail delivery, CRM, the route registry or the purge ledger. A successful sequential check does not prove concurrent exclusion, and a completed database change does not prove that an external effect succeeded. Shared job recovery needs a library source pin and execution evidence. The interface findings retain the fixed Security redirect, staff permission mismatches, absent staff screens, pool states without observed writers and undeclared domain-change events. Product decisions are still needed for workspace execution ownership, disabled-workspace exceptions and derived contact subjects. Earlier replacement-field, standing-access and asynchronous recovery proof gaps remain open; the missing no-inference statement belongs to the planning layer. ## Validation Dependency installation, corpus conformance and the checker tests passed: zero corpus errors and four passing tests. These checks establish document validity and checker behavior; they do not resolve the implementation findings. ## Verdict for Andrew The corrected design is a faithful static account of the module at the pinned commits, with unsupported guarantees explicitly qualified and retained as findings. Its weakest area is proof of concurrency and recovery across database, provider and asynchronous boundaries. Before implementation preparation, decide workspace ownership and the outstanding product exceptions, then prioritize the permission mismatches, stronger consistency requirements and recovery evidence. ## Continuation (pass 2) This continuation examines the detailed testing layer added after the completed design review. It rewrites the coverage explanations and evidence limits of twenty capability specifications, the scenarios and explanatory sections of six feature suites, and the titles, dependency summaries and bodies of 266 existing executable-suite records. It adds eighty omitted unit-suite records and four bound unit scenarios. The review checks every registered executable path at the pinned revisions and verifies existing assertion anchors and bidirectional bindings. Proposed checks, unqualified permission combinations, unreachable transitions, provider failures and concurrency guarantees remain cited findings. Non-test design artifacts, their permanent identifiers and their product authority remain unchanged. The missing testing account is now supplied by the canonical examination report. The requested backfill report filename remains a validator finding because it prevents a conforming commit. Its artifact manifest and coverage table list what this continuation examined and which proof remains open. The findings ledger records the inherited identifier collisions, validator limitations and the distinction between an empty registry loader refusing and a warm loader retaining its last valid manifest. ### Continuation verdict for Andrew The design’s testing layer now has reviewed OpenAI text and an examined register of the executable files available at the pinned commits. Its weakest evidence remains complete feature execution and guarantees spanning concurrent calls, cloud providers or separate services. Resolve the retained product questions, finding-id collisions and registry-fallback wording before qualifying implementation, then obtain execution evidence for the recorded gaps. ## Continuation (pass 3) This continuation examines the testing layer associated with the earlier design review. It verifies the previous OpenAI final-text manifest, coverage categories, pinned executable references and both directions of the suite bindings. The custom-role feature explanation and executable proof paragraph are rewritten and bound to the observed serial browser chain; the findings ledger, registry, charter and testing reports receive the corresponding final text. The protected design contracts are not rewritten in this testing pass. The earlier design examination remains their review evidence. Missing capability and feature execution, retained behavioral disagreements and current executable-register conformance are findings, with the requested backfill report now present. The testing examination is complete with findings and no draft wording left in its prior artifact manifest. Its verified custom-role binding does not replace runtime proof or resolve the remaining product and concurrency questions. Andrew should require the recorded register reconciliation and missing execution before qualification.