--- id: SVC-PFM-TNL-websites-tenant-lifecycle title: Websites Lifecycle Participants product_area: platform module: tenant-lifecycle repository: services-websites source_module: modules/tenant-lifecycle revision: 1 status: draft design_intent: confirmed origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§6.1 Registration (approved 2026-10-09); services-platform:docs/data-jobs/tenant-reset.md#§3 The contract for a macroservice that holds a tenant's records implementation_evidence: partially-observed inference: [] source_sha: services-websites: 5fc6823c69d5e6f208c21dba8c0eb3132f8bdc4c services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 owns: [] does_not_own: - Platform’s orchestration plan, integration switch and recorded workflow accounting. - System-owned workspace lifecycle facts. - Business record ownership, which remains with the application’s domain modules. operations: - operation_id: describe route: lifecycle function websites_tenant_lifecycle operation describe intent: Return participant declarations and the operations the application supports. access: internal permission: 'none: invoked by Platform''s lifecycle jobs through an IAM invoke grant; no person calls it' realises: - CAP-PFM-TNL-007 published_to_submissions: 'not published: internal lifecycle or deployment work is not configurable intake.' provenance: observed source: services-websites:modules/tenant-lifecycle/services/lifecycle/tenant-lifecycle-operations.ts:TENANT_LIFECYCLE_OPERATIONS - operation_id: provision route: lifecycle function websites_tenant_lifecycle operation provision intent: Return no work because the participant needs no starter defaults. access: internal permission: 'none: invoked by Platform''s lifecycle jobs through an IAM invoke grant; no person calls it' realises: - CAP-PFM-TNL-002 - CAP-PFM-TNL-008 published_to_submissions: 'not published: internal lifecycle or deployment work is not configurable intake.' provenance: observed source: services-websites:modules/tenant-lifecycle/services/lifecycle/tenant-lifecycle-operations.ts:TENANT_LIFECYCLE_OPERATIONS - operation_id: verifyProvisioned route: lifecycle function websites_tenant_lifecycle operation verifyProvisioned intent: Report readiness and the requirements the selected participant finds missing. access: internal permission: 'none: invoked by Platform''s lifecycle jobs through an IAM invoke grant; no person calls it' realises: - CAP-PFM-TNL-002 - CAP-PFM-TNL-008 published_to_submissions: 'not published: internal lifecycle or deployment work is not configurable intake.' provenance: observed source: services-websites:modules/tenant-lifecycle/services/lifecycle/tenant-lifecycle-operations.ts:TENANT_LIFECYCLE_OPERATIONS - operation_id: purge route: lifecycle function websites_tenant_lifecycle operation purge intent: Remove a bounded batch of declared participant resources and return progress. access: internal permission: 'none: invoked by Platform''s lifecycle jobs through an IAM invoke grant; no person calls it' realises: - CAP-PFM-TNL-017 published_to_submissions: 'not published: internal lifecycle or deployment work is not configurable intake.' provenance: observed source: services-websites:modules/tenant-lifecycle/services/lifecycle/tenant-lifecycle-operations.ts:TENANT_LIFECYCLE_OPERATIONS - operation_id: inventory route: lifecycle function websites_tenant_lifecycle operation inventory intent: Count the selected participant’s remaining declared resources. access: internal permission: 'none: invoked by Platform''s lifecycle jobs through an IAM invoke grant; no person calls it' realises: - CAP-PFM-TNL-017 published_to_submissions: 'not published: internal lifecycle or deployment work is not configurable intake.' provenance: observed source: services-websites:modules/tenant-lifecycle/services/lifecycle/tenant-lifecycle-operations.ts:TENANT_LIFECYCLE_OPERATIONS - operation_id: export route: lifecycle function websites_tenant_lifecycle operation export intent: Write the next batch of a declared export dataset and return its part and continuation. access: internal permission: 'none: invoked by Platform''s lifecycle jobs through an IAM invoke grant; no person calls it' realises: - CAP-PFM-TNL-010 published_to_submissions: 'not published: internal lifecycle or deployment work is not configurable intake.' provenance: observed source: services-websites:modules/tenant-lifecycle/services/lifecycle/tenant-lifecycle-operations.ts:TENANT_LIFECYCLE_OPERATIONS events: [] jobs: - name: websites_tenant_lifecycle kind: Lambda function, reserved concurrency 1, four-minute timeout trigger: Invoked by the declared lifecycle caller or deployment hook; enablement and recovery limits are stated below. notes: Platform must enable the integration before its lifecycle jobs invoke the function. integrations: - system: Platform workspace lifecycle jobs direction: inbound contract: A synchronous invocation selects the operation and participant and supplies workspace, run and batching context as required by that operation. consistency: - rule: A removal batch commits within its workspace before the invocation returns. kind: transactional compensation: Retry continues removal; completed batches are retained. - rule: Repeated removal works toward empty declared resources; provisioning repeats follow participant-specific behavior. kind: eventual compensation: Recovery retries forward without undoing earlier batches. - rule: CMS documents and media remain outside implemented purge and inventory. kind: eventual compensation: No compensation removes that retained content. evidence: - 'services-websites at 5fc6823c: modules/tenant-lifecycle/services/lifecycle/{tenant-lifecycle-operations, tenant-availability}.ts; services/participants/{registry, content-participant, changes-participant, purge-batches}.ts; services/persistence/*.ts; aws/logic/tenant-lifecycle.lambda.ts.' - 'services-platform at ad3f6a65: modules/tenants/services/lifecycle/remote-participant-manifests.ts (websites.content, enabled false).' controls: [TC-AVL-001, TC-AVL-004, TC-AVL-005, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-005, TC-AZ-006, TC-CHG-001, TC-CHG-002, TC-CHG-003, TC-CHG-004, TC-CHG-005, TC-CHG-006, TC-CHG-007, TC-CRY-001, TC-CRY-002, TC-CRY-003, TC-CRY-004, TC-DAT-001, TC-DAT-002, TC-DAT-003, TC-DAT-004, TC-DAT-005, TC-DAT-006, TC-IAM-001, TC-IAM-002, TC-IAM-003, TC-IAM-004, TC-IAM-005, TC-IAM-006, TC-LOG-001, TC-LOG-002, TC-LOG-003, TC-LOG-004, TC-LOG-005, TC-MON-001, TC-MON-003, TC-PI-001, TC-PI-002, TC-PI-003, TC-PI-004, TC-PI-005, TC-PRV-001, TC-PRV-002, TC-SEC-001, TC-SEC-002, TC-SEC-003, TC-SEC-004, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-VEN-001, TC-VEN-002, TC-VEN-003] --- # Websites Lifecycle Participants ## What This Service Is For Websites declares participants for content and Website Studio changes, but Platform does not currently include their work in its lifecycle executions. Content removal remains incomplete even if the integration is enabled. ## Boundary Websites owns the participant implementations and website records. Platform’s content switch is off, and its static manifest omits the changes participant. Websites exposes no reset operation. Its registered availability implementation reads workspace facts for a local gate. ## Operations in Words Description reports content and changes participants, neither of which needs construction work. Table purge operates in batches. CMS documents and media have no purge implementation, and their participant returns an empty inventory. The changes participant exports declared changes, while content export is deferred. The export dispatcher requires the configured staging bucket. ## Events and Jobs The interface declares no business events. The function reserves concurrency one with a four-minute timeout. Platform’s disabled integration keeps its lifecycle jobs from invoking Websites at the pinned revision. ## Consistency Guarantees Table removal commits within the selected workspace. Empty reported inventory does not prove CMS content or media was removed, because those resources are outside the implemented purge. Enabling the integration alone does not close that gap.