--- id: SVC-PFM-TNL-membership-tenant-lifecycle title: Membership Lifecycle Participants product_area: platform module: tenant-lifecycle repository: services-membership source_module: modules/tenant-lifecycle revision: 1 status: draft design_intent: confirmed origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§6.1 Registration (approved 2026-10-09); services-platform:docs/data-jobs/tenant-reset.md#§3 The contract for a macroservice that holds a tenant's records implementation_evidence: observed inference: [] source_sha: services-membership: 5994c270e8a37a30f848e99ba5b5ee6b87c08893 services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 owns: [] does_not_own: - Platform’s orchestration plan, integration switch and recorded workflow accounting. - System-owned workspace lifecycle facts. - Business record ownership, which remains with the application’s domain modules. operations: - operation_id: describe route: lifecycle function membership_tenant_lifecycle operation describe intent: Return participant declarations and the operations the application supports. access: internal permission: 'none: invoked by Platform''s lifecycle jobs through an IAM invoke grant; no person calls it' realises: - CAP-PFM-TNL-007 published_to_submissions: 'not published: internal lifecycle or deployment work is not configurable intake.' provenance: observed source: services-membership:modules/tenant-lifecycle/services/lifecycle/tenant-lifecycle-operations.ts:TENANT_LIFECYCLE_OPERATIONS - operation_id: provision route: lifecycle function membership_tenant_lifecycle operation provision intent: Apply the selected participant’s starter defaults through its construction implementation. access: internal permission: 'none: invoked by Platform''s lifecycle jobs through an IAM invoke grant; no person calls it' realises: - CAP-PFM-TNL-002 - CAP-PFM-TNL-008 published_to_submissions: 'not published: internal lifecycle or deployment work is not configurable intake.' provenance: observed source: services-membership:modules/tenant-lifecycle/services/lifecycle/tenant-lifecycle-operations.ts:TENANT_LIFECYCLE_OPERATIONS - operation_id: verifyProvisioned route: lifecycle function membership_tenant_lifecycle operation verifyProvisioned intent: Report readiness and the requirements the selected participant finds missing. access: internal permission: 'none: invoked by Platform''s lifecycle jobs through an IAM invoke grant; no person calls it' realises: - CAP-PFM-TNL-002 - CAP-PFM-TNL-008 published_to_submissions: 'not published: internal lifecycle or deployment work is not configurable intake.' provenance: observed source: services-membership:modules/tenant-lifecycle/services/lifecycle/tenant-lifecycle-operations.ts:TENANT_LIFECYCLE_OPERATIONS - operation_id: purge route: lifecycle function membership_tenant_lifecycle operation purge intent: Remove a bounded batch of declared participant resources and return progress. access: internal permission: 'none: invoked by Platform''s lifecycle jobs through an IAM invoke grant; no person calls it' realises: - CAP-PFM-TNL-017 published_to_submissions: 'not published: internal lifecycle or deployment work is not configurable intake.' provenance: observed source: services-membership:modules/tenant-lifecycle/services/lifecycle/tenant-lifecycle-operations.ts:TENANT_LIFECYCLE_OPERATIONS - operation_id: inventory route: lifecycle function membership_tenant_lifecycle operation inventory intent: Count the selected participant’s remaining declared resources. access: internal permission: 'none: invoked by Platform''s lifecycle jobs through an IAM invoke grant; no person calls it' realises: - CAP-PFM-TNL-017 published_to_submissions: 'not published: internal lifecycle or deployment work is not configurable intake.' provenance: observed source: services-membership:modules/tenant-lifecycle/services/lifecycle/tenant-lifecycle-operations.ts:TENANT_LIFECYCLE_OPERATIONS - operation_id: reset route: lifecycle function membership_tenant_lifecycle operation reset intent: Run the selected participant’s initial-load removal behavior. access: internal permission: 'none: invoked by Platform''s lifecycle jobs through an IAM invoke grant; no person calls it' realises: - CAP-PFM-TNL-012 published_to_submissions: 'not published: internal lifecycle or deployment work is not configurable intake.' provenance: observed source: services-membership:modules/tenant-lifecycle/services/lifecycle/tenant-lifecycle-operations.ts:TENANT_LIFECYCLE_OPERATIONS - operation_id: initialize route: lifecycle function membership_tenant_lifecycle operation initialize intent: Apply the selected participant’s missing defaults for an existing workspace. access: internal permission: 'none: invoked by Platform''s lifecycle jobs through an IAM invoke grant; no person calls it' realises: - CAP-PFM-TNL-009 published_to_submissions: 'not published: internal lifecycle or deployment work is not configurable intake.' provenance: observed source: services-membership:modules/tenant-lifecycle/services/lifecycle/tenant-lifecycle-operations.ts:TENANT_LIFECYCLE_OPERATIONS - operation_id: export route: lifecycle function membership_tenant_lifecycle operation export intent: Write the next batch of a declared export dataset and return its part and continuation. access: internal permission: 'none: invoked by Platform''s lifecycle jobs through an IAM invoke grant; no person calls it' realises: - CAP-PFM-TNL-010 published_to_submissions: 'not published: internal lifecycle or deployment work is not configurable intake.' provenance: observed source: services-membership:modules/tenant-lifecycle/services/lifecycle/tenant-lifecycle-operations.ts:TENANT_LIFECYCLE_OPERATIONS events: [] jobs: - name: membership_tenant_lifecycle kind: Lambda function, five-minute timeout trigger: Invoked by the declared lifecycle caller or deployment hook; enablement and recovery limits are stated below. notes: Initialization is exposed separately by the application interface. integrations: - system: Platform workspace lifecycle jobs direction: inbound contract: A synchronous invocation selects the operation and participant and supplies workspace, run and batching context as required by that operation. - system: Workspace export bucket direction: outbound contract: Export writes a staged dataset part and returns metadata for the coordinator. consistency: - rule: A removal batch commits within its workspace before the invocation returns. kind: transactional compensation: Retry continues removal; completed batches are retained. - rule: Repeated removal works toward empty declared resources; provisioning repeats follow participant-specific behavior. kind: eventual compensation: Recovery retries forward without undoing earlier batches. - rule: Guarded version removal rejects a workspace different from the transaction context. kind: transactional compensation: No rollback is provided. evidence: - 'services-membership at 5994c270: modules/tenant-lifecycle/services/lifecycle/{participants, tenant-lifecycle-operations}.ts; services/persistence/lifecycle-statements.ts; services/export/*.ts; db/tenant-seed-applications.table.ts; aws/logic/tenant-lifecycle.lambda.ts.' controls: [TC-AVL-001, TC-AVL-004, TC-AVL-005, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-005, TC-AZ-006, TC-CHG-001, TC-CHG-002, TC-CHG-003, TC-CHG-004, TC-CHG-005, TC-CHG-006, TC-CHG-007, TC-CRY-001, TC-CRY-002, TC-CRY-003, TC-CRY-004, TC-DAT-001, TC-DAT-002, TC-DAT-003, TC-DAT-004, TC-DAT-005, TC-DAT-006, TC-IAM-001, TC-IAM-002, TC-IAM-003, TC-IAM-004, TC-IAM-005, TC-IAM-006, TC-LOG-001, TC-LOG-002, TC-LOG-003, TC-LOG-004, TC-LOG-005, TC-MON-001, TC-MON-003, TC-PI-001, TC-PI-002, TC-PI-003, TC-PI-004, TC-PI-005, TC-PRV-001, TC-PRV-002, TC-SEC-001, TC-SEC-002, TC-SEC-003, TC-SEC-004, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-VEN-001, TC-VEN-002, TC-VEN-003] --- # Membership Lifecycle Participants ## What This Service Is For Membership prepares relationship types and a daily status sweep, removes its declared records, resets imported data while retaining configuration and exports declared datasets. It also exposes initialization for existing workspaces. ## Boundary Membership owns its participants, configuration ledger and business records. Platform owns the orchestration plan. The Membership dispatcher has a separate context-factory contract and supports legacy field aliases. Request-gate wiring is outside the registered scope. ## Operations in Words Description reports participants and supported operations. Provisioning applies relationship defaults and ensures the sweep schedule; readiness checks those requirements. Purge removes dependent records before their parents, including protected versions through a guarded function. Reset dispatches participant-specific removal and retains configuration, schedules and the seed ledger. Initialization requests every seed set of the selected participant, while export writes a batch of one declared dataset. ## Events and Jobs The lifecycle interface declares no business events. Provisioning ensures a daily sweep schedule that Membership subsequently owns. Platform drives lifecycle calls through a five-minute function. ## Consistency Guarantees Removal commits before the caller records progress. Default application retains ledger evidence, while reset keeps the ledger instead of reapplying defaults. Protected version deletion requires the same workspace as the transaction.