--- id: SVC-PFM-TNL-submissions-tenant-lifecycle title: Submissions Lifecycle Participants product_area: platform module: tenant-lifecycle repository: services-submissions source_module: modules/tenant-lifecycle revision: 1 status: draft design_intent: confirmed origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§6.1 Registration (approved 2026-10-09); services-platform:docs/data-jobs/tenant-reset.md#§3 The contract for a macroservice that holds a tenant's records implementation_evidence: observed inference: [] source_sha: services-submissions: 64236c19be89579ef5897aad7de3925ed3ce03bf services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 owns: [] does_not_own: - Platform’s orchestration plan, integration switch and recorded workflow accounting. - System-owned workspace lifecycle facts. - Business record ownership, which remains with the application’s domain modules. operations: - operation_id: describe route: lifecycle function submissions_tenant_lifecycle operation describe intent: Return participant declarations and the operations the application supports. access: internal permission: 'none: invoked by Platform''s lifecycle jobs through an IAM invoke grant; no person calls it' realises: - CAP-PFM-TNL-007 published_to_submissions: 'not published: internal lifecycle or deployment work is not configurable intake.' provenance: observed source: services-submissions:modules/tenant-lifecycle/services/lifecycle/tenant-lifecycle-operations.ts:TENANT_LIFECYCLE_OPERATIONS - operation_id: provision route: lifecycle function submissions_tenant_lifecycle operation provision intent: Return no work because this participant needs no starter defaults. access: internal permission: 'none: invoked by Platform''s lifecycle jobs through an IAM invoke grant; no person calls it' realises: - CAP-PFM-TNL-002 - CAP-PFM-TNL-008 published_to_submissions: 'not published: internal lifecycle or deployment work is not configurable intake.' provenance: observed source: services-submissions:modules/tenant-lifecycle/services/lifecycle/tenant-lifecycle-operations.ts:TENANT_LIFECYCLE_OPERATIONS - operation_id: verifyProvisioned route: lifecycle function submissions_tenant_lifecycle operation verifyProvisioned intent: Report readiness and the requirements the selected participant finds missing. access: internal permission: 'none: invoked by Platform''s lifecycle jobs through an IAM invoke grant; no person calls it' realises: - CAP-PFM-TNL-002 - CAP-PFM-TNL-008 published_to_submissions: 'not published: internal lifecycle or deployment work is not configurable intake.' provenance: observed source: services-submissions:modules/tenant-lifecycle/services/lifecycle/tenant-lifecycle-operations.ts:TENANT_LIFECYCLE_OPERATIONS - operation_id: purge route: lifecycle function submissions_tenant_lifecycle operation purge intent: Remove a bounded batch of declared participant resources and return progress. access: internal permission: 'none: invoked by Platform''s lifecycle jobs through an IAM invoke grant; no person calls it' realises: - CAP-PFM-TNL-017 published_to_submissions: 'not published: internal lifecycle or deployment work is not configurable intake.' provenance: observed source: services-submissions:modules/tenant-lifecycle/services/lifecycle/tenant-lifecycle-operations.ts:TENANT_LIFECYCLE_OPERATIONS - operation_id: inventory route: lifecycle function submissions_tenant_lifecycle operation inventory intent: Count the selected participant’s remaining declared resources. access: internal permission: 'none: invoked by Platform''s lifecycle jobs through an IAM invoke grant; no person calls it' realises: - CAP-PFM-TNL-017 published_to_submissions: 'not published: internal lifecycle or deployment work is not configurable intake.' provenance: observed source: services-submissions:modules/tenant-lifecycle/services/lifecycle/tenant-lifecycle-operations.ts:TENANT_LIFECYCLE_OPERATIONS - operation_id: export route: lifecycle function submissions_tenant_lifecycle operation export intent: Write the next batch of a declared export dataset and return its part and continuation. access: internal permission: 'none: invoked by Platform''s lifecycle jobs through an IAM invoke grant; no person calls it' realises: - CAP-PFM-TNL-010 published_to_submissions: 'not published: internal lifecycle or deployment work is not configurable intake.' provenance: observed source: services-submissions:modules/tenant-lifecycle/services/lifecycle/tenant-lifecycle-operations.ts:TENANT_LIFECYCLE_OPERATIONS events: [] jobs: - name: submissions_tenant_lifecycle kind: Lambda function, reserved concurrency 1, four-minute timeout trigger: Invoked by the declared lifecycle caller or deployment hook; enablement and recovery limits are stated below. notes: Reset is unsupported and Platform preserves Submissions during initial-load reset. integrations: - system: Platform workspace lifecycle jobs direction: inbound contract: A synchronous invocation selects the operation and participant and supplies workspace, run and batching context as required by that operation. - system: Workspace export staging bucket direction: outbound contract: Export writes a staged dataset part and returns metadata for the coordinator. consistency: - rule: A removal batch commits within its workspace before the invocation returns. kind: transactional compensation: Retry continues removal; completed batches are retained. - rule: Repeated removal works toward empty declared resources; provisioning repeats follow participant-specific behavior. kind: eventual compensation: Recovery retries forward without undoing earlier batches. evidence: - 'services-submissions at 64236c19: modules/tenant-lifecycle/services/lifecycle/{tenant-lifecycle-operations, tenant-availability}.ts; services/participants/*.ts; services/persistence/*.ts; services/export/*.ts; aws/logic/tenant-lifecycle.lambda.ts.' controls: [TC-AVL-001, TC-AVL-004, TC-AVL-005, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-005, TC-AZ-006, TC-CHG-001, TC-CHG-002, TC-CHG-003, TC-CHG-004, TC-CHG-005, TC-CHG-006, TC-CHG-007, TC-CRY-001, TC-CRY-002, TC-CRY-003, TC-CRY-004, TC-DAT-001, TC-DAT-002, TC-DAT-003, TC-DAT-004, TC-DAT-005, TC-DAT-006, TC-IAM-001, TC-IAM-002, TC-IAM-003, TC-IAM-004, TC-IAM-005, TC-IAM-006, TC-LOG-001, TC-LOG-002, TC-LOG-003, TC-LOG-004, TC-LOG-005, TC-MON-001, TC-MON-003, TC-PI-001, TC-PI-002, TC-PI-003, TC-PI-004, TC-PI-005, TC-PRV-001, TC-PRV-002, TC-SEC-001, TC-SEC-002, TC-SEC-003, TC-SEC-004, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-VEN-001, TC-VEN-002, TC-VEN-003] --- # Submissions Lifecycle Participants ## What This Service Is For Submissions accounts for definitions, intake, review and outcomes through four participants. It needs no construction defaults, removes declared records on deletion and exports participant datasets. ## Boundary Submissions owns participant behavior and its business records. Platform drives lifecycle execution. The interface declares no reset, and Platform’s reset classification preserves Submissions records. Its registered availability implementation reads workspace facts for a local gate. ## Operations in Words Description reports dependencies that place outcomes before reviews, intake and definitions during removal. Provisioning returns no work and readiness reports ready. Purge removes one batch per invocation, inventory counts remaining resources, and export validates a declared dataset before writing its next batch. ## Events and Jobs The interface declares no business events. Platform invokes the function synchronously; it reserves concurrency one and allows four minutes per invocation. ## Consistency Guarantees Each removal batch commits within its workspace before returning. Repeated calls can finish an interrupted removal without restoring earlier records. Platform’s count write occurs after the result returns and is not part of that transaction.