--- id: DOM-PFM-TNL-003 title: Lifecycle Participant realises: CON-PFM-TNL-003 product_area: platform module: tenant-lifecycle revision: 1 status: draft design_intent: confirmed origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§6 Participants (approved 2026-10-09); services-platform:docs/standards/baseline-configuration.md#§2 How it is declared (D-48, Andrew 2026-10-19) implementation_evidence: observed source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 services-crm: a8d1364f1dd44b723bb5f9acba12f983e9ec8d69 services-commerce: c8b66a98e2490617aec38ba5c8165dd9bd0a8f9b services-committees: 36129c24daeaadcdb339218c38cdeaff9861359d services-membership: 5994c270e8a37a30f848e99ba5b5ee6b87c08893 services-submissions: 64236c19be89579ef5897aad7de3925ed3ce03bf services-websites: 5fc6823c69d5e6f208c21dba8c0eb3132f8bdc4c services-marketing: d071a159fe9782bb71ff246d5c67d5bbfe07fbfa owned_by: SVC-PFM-TNL-tenants readable_by: - SVC-PFM-TNL-crm-tenant-lifecycle - SVC-PFM-TNL-commerce-tenant-lifecycle - SVC-PFM-TNL-committees-tenant-lifecycle - SVC-PFM-TNL-membership-tenant-lifecycle - SVC-PFM-TNL-submissions-tenant-lifecycle - SVC-PFM-TNL-websites-tenant-lifecycle - SVC-PFM-TNL-marketing-tenant-lifecycle lifecycle: STATE-PFM-TNL-006 custom_fields: none identity: The participant uses its stable service-prefixed key; seed and resource identities additionally include workspace scope. attributes: - name: key kind: text required: true computed: false notes: A stable service-prefixed participant identity. - name: service kind: text required: true computed: false notes: The application responsible for invoking this participant; Platform participants execute locally. - name: depends on kind: collection required: true computed: false notes: Construction predecessors and reverse removal dependencies, with Platform’s workspace row added for remote participants. - name: enabled kind: enum required: true computed: false notes: Platform’s integration switch; disabled declarations can be returned when other participants of that service are enabled. - name: resources kind: collection required: true computed: false notes: Declared tables, provider resources and storage prefixes, with removal and export treatment. - name: seed sets kind: collection required: true computed: false notes: Versioned starter groups; the ledger is the intended application-once mechanism. - name: supported operations kind: collection required: true computed: false notes: Declared construction, readiness, removal, inventory, reset, initialization or dataset-export support. - name: seed ledger entries kind: collection required: false computed: false notes: Per-workspace seed, set version and applying-run evidence in the applications that implement a ledger. - name: registered external resources kind: collection required: false computed: false notes: Scoped external-resource key, recorded state, creation facts and optional removal time. - name: export datasets kind: collection required: false computed: false notes: Named export datasets and treatment of resources excluded from delivery. relationships: - to: DOM-PFM-TNL-002 cardinality: many-to-many ownership: The construction plan invokes participant work. cross_service: true - to: DOM-PFM-TNL-004 cardinality: many-to-many ownership: Reset classification chooses participant removal while preserving retained concerns. cross_service: true - to: DOM-PFM-TNL-005 cardinality: many-to-many ownership: The deletion plan invokes removal and inventory. cross_service: true invariants: - id: INV-DOM-PFM-TNL-003-01 statement: The documented completeness obligation assigns each scoped table to one participant and requires declared tables to exist. enforced_at: - service provenance: documented source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§6.4 Completeness check - id: INV-DOM-PFM-TNL-003-02 statement: The participant plan uses dependency order, with Platform adding the workspace-row dependency to remote manifests. enforced_at: - service provenance: observed source: services-platform:modules/tenants/services/lifecycle/participants.ts:afterTenantRow - id: INV-DOM-PFM-TNL-003-03 statement: Platform’s guarded orchestration refuses invocation of a remote participant it declares disabled. enforced_at: - service provenance: observed source: services-platform:modules/tenants/services/lifecycle/participants.ts:isDisabledRemoteParticipant - id: INV-DOM-PFM-TNL-003-04 statement: The documented seed policy preserves an earlier application even after the customer alters or removes its record. enforced_at: - service - database provenance: documented source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§6.3 Seed ledger - id: INV-DOM-PFM-TNL-003-05 statement: The documented seed contract commits each database default with its ledger evidence. enforced_at: - service provenance: documented source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§4.4 External success, then failure - id: INV-DOM-PFM-TNL-003-06 statement: A unique workspace, participant, resource type and key combination permits one register row. enforced_at: - database provenance: observed source: services-platform:modules/tenants/db/tenant-resources.table.ts:tenant_resources_scope_uidx - id: INV-DOM-PFM-TNL-003-07 statement: CRM’s reviewed dispatcher enters the requested workspace before executing participant work; this source alone does not prove every application’s row policies. enforced_at: - service - database provenance: observed source: services-crm:modules/tenant-lifecycle/services/lifecycle/tenant-lifecycle-operations.ts (withTenant) - id: INV-DOM-PFM-TNL-003-08 statement: A blocked response refuses the purge, but the reviewed code cannot guarantee that every participant reports all retained data. enforced_at: - service provenance: observed source: services-platform:modules/tenants/services/deletion/tenant-purge-operations.ts:purgeParticipant physical: - platform.tenant_resources - platform.tenant_seed_applications - crm.tenant_seed_applications - committees.tenant_seed_applications - membership.tenant_seed_applications evidence: - 'services-platform at ad3f6a65: modules/tenants/services/lifecycle/{participants, remote-participants, remote-participant-manifests, reset-participants, purge-batches}.ts; db/tenant-resources.table.ts; db/tenant-seed-applications.table.ts; services/persistence/tenant-resources.ts.' - 'services-crm, services-commerce, services-committees, services-membership, services-submissions, services-websites, services-marketing at their pinned commits: modules/tenant-lifecycle participant registries, lifecycle operations, seed tables and purge helpers.' - 'FND-PFM-TNL-054: custom-field registration absence is not established within the permitted source scope.' --- # Lifecycle Participant ## What It Models A participant declares one application area’s construction, reset, removal and export responsibilities. Platform orchestrates those declarations while applications retain their implementations. ## Identity and Attributes The participant uses its stable service-prefixed key; seed and resource identities additionally include workspace scope. A stable service-prefixed participant identity. The application responsible for invoking this participant; Platform participants execute locally. Construction predecessors and reverse removal dependencies, with Platform’s workspace row added for remote participants. Platform’s integration switch; disabled declarations can be returned when other participants of that service are enabled. Declared tables, provider resources and storage prefixes, with removal and export treatment. Versioned starter groups; the ledger is the intended application-once mechanism. Declared construction, readiness, removal, inventory, reset, initialization or dataset-export support. Per-workspace seed, set version and applying-run evidence in the applications that implement a ledger. Scoped external-resource key, recorded state, creation facts and optional removal time. Named export datasets and treatment of resources excluded from delivery. ## Relationships The construction plan invokes participant work. Reset classification chooses participant removal while preserving retained concerns. The deletion plan invokes removal and inventory. ## Invariants The structured invariants distinguish service and database enforcement from documented obligations. The participant completeness and seed requirements describe the intended contract; known omissions prevent a universal guarantee. ## How It Is Stored and Shared Platform’s lifecycle service owns this design object. Applications own participant implementations and their local ledgers; Platform retains orchestration declarations and its resource register. ## Open Design Questions Static manifest drift, Commerce’s missing ledger and Websites’ incomplete accounting limit the declared contract. Resource states have no successor guard, and some registration and cross-application policy evidence remains outside this review.