--- id: CAP-PFM-TNL-010 title: Supply application data for workspace exports feature: FEAT-PFM-TNL-03 product_area: platform module: tenant-lifecycle revision: 2 status: draft product_intent: proposed implementation_evidence: observed supersedes: [] source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 services-crm: a8d1364f1dd44b723bb5f9acba12f983e9ec8d69 services-commerce: c8b66a98e2490617aec38ba5c8165dd9bd0a8f9b services-committees: 36129c24daeaadcdb339218c38cdeaff9861359d services-membership: 5994c270e8a37a30f848e99ba5b5ee6b87c08893 services-submissions: 64236c19be89579ef5897aad7de3925ed3ce03bf services-websites: 5fc6823c69d5e6f208c21dba8c0eb3132f8bdc4c services-marketing: d071a159fe9782bb71ff246d5c67d5bbfe07fbfa intent_sources: - >- services-platform:docs/proposals/tenant-data-export/20-risks-tradeoffs-decisions.md#D-02 purpose: >- Application participants contribute classified workspace datasets to the separate export process. outcomes: - >- Declared tables have dataset coverage or an explicit withholding classification. - Export batches contain only the requested workspace’s values. - The caller drives continuation within the application’s staging area. concepts: - CON-PFM-TNL-003 actors: - ACT-PFM-012 surfaces: - job preconditions: [] postconditions: [] permissions: [] rules: - id: BR-CAP-PFM-TNL-010-01 proved_by: [ATS-PFM-TNL-010-01, TST-PFM-TNL-022] statement: >- An exporting application returns one workspace dataset batch and the part information and cursor needed to continue. kind: policy enforced_at: - service must_prove: true provenance: test source: >- services-crm:modules/tenant-lifecycle/tests/integration/services/export/tenant-export.integration.spec.js#pages a dataset of more records than a batch holds, the cursor carrying it on origin: >- services-platform:docs/proposals/tenant-data-export/20-risks-tradeoffs-decisions.md#D-02 (Andrew, 2026-10-18) - id: BR-CAP-PFM-TNL-010-02 proved_by: [ATS-PFM-TNL-010-02, ATS-PFM-TNL-010-05] statement: >- Export classification assigns every declared table to a dataset or to a stated withholding class and reason; unclassified tables fail completeness checks. kind: invariant enforced_at: - service must_prove: true provenance: test source: >- services-crm:modules/tenant-lifecycle/tests/integration/services/export/tenant-export.integration.spec.js#withholds every declared table it does not export, each with its class and reason origin: >- services-platform:docs/proposals/tenant-data-export/20-risks-tradeoffs-decisions.md#D-02 - id: BR-CAP-PFM-TNL-010-03 proved_by: [ATS-PFM-TNL-010-03] statement: >- Exported records identify the requested workspace and the package contains no other workspace’s values. kind: invariant enforced_at: - service - database must_prove: true provenance: test source: >- services-crm:modules/tenant-lifecycle/tests/integration/services/export/tenant-export.integration.spec.js#carries no value of the other tenant anywhere in the package origin: >- services-platform:docs/proposals/tenant-data-export/20-risks-tradeoffs-decisions.md#D-02 - id: BR-CAP-PFM-TNL-010-04 proved_by: [ATS-PFM-TNL-010-04, TST-PFM-TNL-022] statement: >- CRM rejects undeclared datasets and staging prefixes outside its application area before export reads. kind: validation enforced_at: - service must_prove: true provenance: test source: >- services-crm:modules/tenant-lifecycle/tests/integration/services/export/tenant-export.integration.spec.js#refuses a staging prefix outside this service’s own as an invalid request, before anything is read origin: >- services-platform:docs/proposals/tenant-data-export/20-risks-tradeoffs-decisions.md#D-02 - id: BR-CAP-PFM-TNL-010-05 proved_by: [] statement: >- Exports omit credentials, connection secrets and operational records such as carrier connection references and workflow approvals. kind: policy enforced_at: - service must_prove: false provenance: test source: >- services-commerce:modules/tenant-lifecycle/tests/unit/exports/export-round-trip.spec.js#withholds a carrier account’s connection reference origin: >- services-platform:docs/proposals/tenant-data-export/20-risks-tradeoffs-decisions.md#D-02 - id: BR-CAP-PFM-TNL-010-06 proved_by: [] statement: >- CRM, Commerce, Submissions, Websites and Membership implement export; Committees and Marketing currently do not. kind: policy enforced_at: - service must_prove: false provenance: observed source: >- services-committees:modules/tenant-lifecycle/services/lifecycle/tenant-lifecycle-operations.ts:TENANT_LIFECYCLE_OPERATIONS origin: none scenarios: - id: SC-CAP-PFM-TNL-010-01 given: The customer requests a complete data package. when: The coordinator pages CRM’s contact dataset. then: >- Contact batches include their custom values and provide continuation until complete. provenance: test source: >- services-crm:modules/tenant-lifecycle/tests/integration/services/export/tenant-export.integration.spec.js#carries every custom-field value on its parent, with its value, and none on a contact role or an activity (R2-ARCH-001) edge_cases: [] constraints: [] depends_on: - CAP-PFM-TNL-007 related: [] journeys: [] open_questions: - OQ-PFM-TNL-004 evidence: - >- Inspected source: services-platform:docs/proposals/tenant-data-export/20-risks-tradeoffs-decisions.md#D-02 - >- Inspected source: services-crm:modules/tenant-lifecycle/tests/integration/services/export/tenant-export.integration.spec.js#pages a dataset of more records than a batch holds, the cursor carrying it on - >- Inspected source: services-platform:docs/proposals/tenant-data-export/20-risks-tradeoffs-decisions.md#D-02 (Andrew, 2026-10-18) - >- Inspected source: services-crm:modules/tenant-lifecycle/tests/integration/services/export/tenant-export.integration.spec.js#withholds every declared table it does not export, each with its class and reason - >- Inspected source: services-crm:modules/tenant-lifecycle/tests/integration/services/export/tenant-export.integration.spec.js#carries no value of the other tenant anywhere in the package - >- Inspected source: services-crm:modules/tenant-lifecycle/tests/integration/services/export/tenant-export.integration.spec.js#refuses a staging prefix outside this service’s own as an invalid request, before anything is read - >- Inspected source: services-commerce:modules/tenant-lifecycle/tests/unit/exports/export-round-trip.spec.js#withholds a carrier account’s connection reference - >- Inspected source: services-committees:modules/tenant-lifecycle/services/lifecycle/tenant-lifecycle-operations.ts:TENANT_LIFECYCLE_OPERATIONS - >- Inspected source: services-crm:modules/tenant-lifecycle/tests/integration/services/export/tenant-export.integration.spec.js#carries every custom-field value on its parent, with its value, and none on a contact role or an activity (R2-ARCH-001) controls: [TC-AVL-004, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-CRY-001, TC-CRY-002, TC-CRY-003, TC-CRY-004, TC-DAT-001, TC-DAT-002, TC-DAT-003, TC-DAT-005, TC-IAM-001, TC-IAM-002, TC-IAM-004, TC-IAM-005, TC-IAM-006, TC-LOG-001, TC-PI-001, TC-PI-002, TC-PI-003, TC-PI-004, TC-PI-005, TC-PRV-001, TC-PRV-002, TC-SEC-001, TC-SEC-002, TC-SEC-003, TC-SEC-004, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-VEN-001, TC-VEN-002, TC-VEN-003] exercised_by: [FAS-PFM-TNL-03-01, FAS-PFM-TNL-03-04, FAS-PFM-TNL-03-05] suites: [TST-PFM-TNL-022] --- # Supply application data for workspace exports ## Purpose Application participants contribute classified workspace datasets to the separate export process. ## How It Works The export coordinator asks an application participant for a dataset batch. The application reads in the requested workspace and writes a part to its staging area. Its answer supplies the information and cursor needed for continuation. Dataset declarations account for included tables and explain withheld records. Credentials and operational bookkeeping can be excluded deliberately. CRM rejects datasets and staging prefixes outside its declaration before reading. Other exporting applications implement their own contract checks. Committees and Marketing do not currently serve export. Scheduling, package delivery and the overall export remain responsibilities of the export module. ## Relationships - Account for each application’s lifecycle responsibilities: Its result establishes the state or declared resources needed by this operation.