--- id: CAP-PFM-TNL-011 title: Control the initial import and subsequent opening feature: FEAT-PFM-TNL-04 product_area: platform module: tenant-lifecycle revision: 2 status: draft product_intent: confirmed implementation_evidence: observed supersedes: [] source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 intent_sources: - 'services-platform:docs/proposals/rhythm-data-job-engine-plan.md#§12.1' - 'services-platform:docs/proposals/rhythm-data-job-engine-plan.md#§12.2' - 'services-platform:docs/proposals/rhythm-data-job-engine-plan.md#§21.3 D5' - 'services-platform:docs/proposals/rhythm-data-job-engine-plan.md#§21.4' purpose: Staff bracket initial loading with separate import and activation authority. outcomes: - >- An active implementation workspace can enter loading with an accountable load record. - >- Repeated loading requests preserve the record and never-loaded activation is refused. - Activation restores active lifecycle without deciding live business status. concepts: - CON-PFM-TNL-004 - CON-PFM-TNL-001 actors: - ACT-PFM-040 - ACT-PFM-041 surfaces: - console - api preconditions: [] postconditions: [] permissions: - key: hq.data-runs.manage where_checked: api scope: global - key: hq.tenants.activate where_checked: api scope: global rules: - id: BR-CAP-PFM-TNL-011-01 proved_by: [ATS-PFM-TNL-011-01, TST-PFM-TNL-049] statement: >- Opening loading requires import authority; activation-only staff, customer administrators and anonymous callers are refused. kind: permission enforced_at: - api must_prove: true provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses the staff member who may only activate a tenant, the two keys being separate origin: >- services-platform:docs/proposals/rhythm-data-job-engine-plan.md#§12.2 step 8, §16 (approved 2026-10-12) - id: BR-CAP-PFM-TNL-011-02 proved_by: [ATS-PFM-TNL-011-02] statement: >- Loading can begin only for an active implementation workspace, leaving live or disabled workspaces unchanged on refusal. kind: validation enforced_at: - service - database must_prove: true provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses a live tenant, an initial import going only into an implementation tenant origin: >- services-platform:docs/proposals/rhythm-data-job-engine-plan.md#§21.4 (Andrew, 2026-10-11) - id: BR-CAP-PFM-TNL-011-03 proved_by: [ATS-PFM-TNL-011-03] statement: >- Opening loading records the operator, time and optional reason of up to five hundred characters; repeating it preserves the existing loading record. kind: lifecycle enforced_at: - service - database must_prove: true provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#records who opened the load and why, which is what the row is evidence of origin: 'services-platform:docs/proposals/rhythm-data-job-engine-plan.md#§12.1 (D5)' - id: BR-CAP-PFM-TNL-011-04 proved_by: [ATS-PFM-TNL-011-04, TST-PFM-TNL-049] statement: >- Activation uses the separate go-live permission, which import authority alone does not supply. kind: permission enforced_at: - api must_prove: true provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses the staff member who ran the import, activation being the other key origin: >- services-platform:docs/proposals/rhythm-data-job-engine-plan.md#§12.2 step 8 (approved) - id: BR-CAP-PFM-TNL-011-05 proved_by: [ATS-PFM-TNL-011-05, ATS-PFM-TNL-011-07] statement: >- Activation returns loading to active without changing business status or load history; it rejects never-loaded workspaces and accepts an already activated load without further change. kind: lifecycle enforced_at: - service must_prove: true provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#leaves the status where it was, going live being the separate decision origin: >- services-platform:docs/proposals/rhythm-data-job-engine-plan.md#§12.2 step 10 (approved) - id: BR-CAP-PFM-TNL-011-06 proved_by: [] statement: >- Loading blocks ordinary customer routes while permitting data-job requests and authorized staff system requests. kind: policy enforced_at: - api must_prove: true provenance: observed source: >- services-platform:modules/tenants/services/access/tenant-availability.ts:tenantAvailabilityOf origin: 'services-platform:docs/proposals/rhythm-data-job-engine-plan.md#§12.1 (D5)' scenarios: - id: SC-CAP-PFM-TNL-011-01 given: A newly provisioned workspace is in implementation mode. when: The import operator starts loading with a package explanation. then: >- Loading is recorded with its operator and explanation, and ordinary customer access closes. provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#records who opened the load and why, which is what the row is evidence of edge_cases: [] constraints: [] depends_on: - CAP-PFM-TNL-006 related: - CAP-PFM-TNL-005 - CAP-PFM-TNL-012 journeys: - JNY-PFM-TNL-003 open_questions: [] evidence: - >- Inspected source: services-platform:docs/proposals/rhythm-data-job-engine-plan.md#§12.1 - >- Inspected source: services-platform:docs/proposals/rhythm-data-job-engine-plan.md#§12.2 - >- Inspected source: services-platform:docs/proposals/rhythm-data-job-engine-plan.md#§21.3 D5 - >- Inspected source: services-platform:docs/proposals/rhythm-data-job-engine-plan.md#§21.4 - >- Inspected source: services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses the staff member who may only activate a tenant, the two keys being separate - >- Inspected source: services-platform:docs/proposals/rhythm-data-job-engine-plan.md#§12.2 step 8, §16 (approved 2026-10-12) - >- Inspected source: services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses a live tenant, an initial import going only into an implementation tenant - >- Inspected source: services-platform:docs/proposals/rhythm-data-job-engine-plan.md#§21.4 (Andrew, 2026-10-11) - >- Inspected source: services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#records who opened the load and why, which is what the row is evidence of - >- Inspected source: services-platform:docs/proposals/rhythm-data-job-engine-plan.md#§12.1 (D5) - >- Inspected source: services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses the staff member who ran the import, activation being the other key - >- Inspected source: services-platform:docs/proposals/rhythm-data-job-engine-plan.md#§12.2 step 8 (approved) - >- Inspected source: services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#leaves the status where it was, going live being the separate decision - >- Inspected source: services-platform:docs/proposals/rhythm-data-job-engine-plan.md#§12.2 step 10 (approved) - >- Inspected source: services-platform:modules/tenants/services/access/tenant-availability.ts:tenantAvailabilityOf controls: [TC-AVL-001, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-005, TC-IAM-003, TC-LOG-001, TC-LOG-002, TC-LOG-003, TC-LOG-004, TC-LOG-005, TC-MON-001, TC-PI-001, TC-PI-005, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-VEN-001, TC-VEN-002, TC-VEN-003] exercised_by: [FAS-PFM-TNL-02-03, FAS-PFM-TNL-04-01, FAS-PFM-TNL-04-02, FAS-PFM-TNL-04-03, FAS-PFM-TNL-04-04, FAS-PFM-TNL-04-05] suites: [TST-PFM-TNL-049] --- # Control the initial import and subsequent opening ## Purpose Staff bracket initial loading with separate import and activation authority. ## How It Works The import operator opens an active implementation workspace for loading. Rhythm records the person, time and optional explanation. A repeated opening returns that existing record. Ordinary customer routes close while the data-job surface remains usable. Authorized staff system routes retain their availability exception. Import permission also supports starting over through reset. Activation uses a different permission for the decision that loading is ready. Activation returns the workspace to active and retains the loading record. Taking its business status live is a separate staff action. ## Relationships - Preserve valid workspace lifecycle states: Its result establishes the state or declared resources needed by this operation. - Apply workspace availability consistently: Its access decision determines when callers can use the workspace. - Recover an incorrect initial import: Its reset classification distinguishes imported records from retained setup.