--- id: CAP-PFM-TNL-013 title: Schedule deliberate workspace deletion feature: FEAT-PFM-TNL-05 product_area: platform module: tenant-lifecycle revision: 2 status: draft product_intent: confirmed implementation_evidence: observed supersedes: [] source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 intent_sources: - 'services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.1' - 'services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.2' - 'services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.3' - 'services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.7' - 'services-platform:docs/tenants/tenant-lifecycle-plan.md#§13 D1, D2, D3' purpose: >- Authorized staff record a deletion decision and its fixed eligibility date before any destruction. outcomes: - >- Deletion starts from a disabled, eligible workspace with typed name confirmation. - Later configuration changes do not shorten the recorded waiting period. - Only one request remains open and cancellation is retained as history. concepts: - CON-PFM-TNL-005 - CON-PFM-TNL-001 actors: - ACT-PFM-004 surfaces: - console - api - job preconditions: [] postconditions: [] permissions: - key: platform.tenants.deletion-request where_checked: api scope: global rules: - id: BR-CAP-PFM-TNL-013-01 statement: >- Deletion requests require Rhythm staff with deletion-request authority and are unavailable to customer administrators. kind: permission enforced_at: - api - service must_prove: true provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenant-deletion-requests.e2e.spec.js#may not ask for a tenant to be deleted origin: >- services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.2 (approved 2026-10-09) - id: BR-CAP-PFM-TNL-013-02 statement: >- The requesting staff member is the sole approver; deletion requires no second authorization person. kind: policy enforced_at: - service must_prove: false provenance: documented source: 'services-platform:docs/tenants/tenant-lifecycle-plan.md#§13 D2' origin: >- services-platform:docs/tenants/tenant-lifecycle-plan.md#§13 D2 (Andrew, 2026-10-09) - id: BR-CAP-PFM-TNL-013-03 statement: >- A request repeats the workspace name, supplies a reason of ten to two thousand characters and includes the version staff reviewed. kind: validation enforced_at: - api - service must_prove: true provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenant-deletion-requests.e2e.spec.js#refuses a confirmation that does not repeat the tenant's name as 400 origin: >- services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.2 (approved); services-platform:docs/hq/rhythm-hq-plan.md#§D4 - id: BR-CAP-PFM-TNL-013-04 statement: >- Deletion accepts a disabled active or provisioning-failed workspace that is unlocked, has no children and is not a protected development workspace. kind: validation enforced_at: - service must_prove: true provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#refuses a tenant that is still live, because people must lose access first origin: >- services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.2 (approved 2026-10-09) - id: BR-CAP-PFM-TNL-013-05 statement: >- Only one deletion request may remain open per workspace; service and database checks reject another and identify the existing request. kind: invariant enforced_at: - service - database must_prove: true provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#refuses a second request, naming the one that is open origin: 'services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.7 (approved)' - id: BR-CAP-PFM-TNL-013-06 statement: >- After cancellation, another deletion request creates a fresh history entry and waiting period rather than reviving the cancelled request. kind: lifecycle enforced_at: - service must_prove: true provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#allows a new request, with a new waiting period, once the first is cancelled origin: 'services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.7 (approved)' - id: BR-CAP-PFM-TNL-013-07 statement: >- Standard eligibility is fixed when requested, defaults to thirty days and refuses a Production setting below fourteen days. kind: calculation enforced_at: - service must_prove: true provenance: test source: >- services-platform:modules/tenants/tests/unit/services/deletion/waiting-period.spec.js#refuses a configured period below fourteen days rather than quietly raising it origin: >- services-platform:docs/tenants/tenant-lifecycle-plan.md#§13 D1 (Andrew, 2026-10-09) - id: BR-CAP-PFM-TNL-013-08 statement: >- A workspace without a first activation time waits one day, including in Production. kind: calculation enforced_at: - service must_prove: true provenance: test source: >- services-platform:modules/tenants/tests/unit/services/deletion/waiting-period.spec.js#waits one day in Production too, where the fourteen-day floor does not apply to it origin: >- services-platform:docs/tenants/tenant-lifecycle-plan.md#§13 D3 (default in force) - id: BR-CAP-PFM-TNL-013-09 statement: >- Outside Production, disposable test workspaces default to ten minutes and may request a shorter wait; the shortcut is refused for other workspaces and in Production. kind: calculation enforced_at: - service must_prove: true provenance: test source: >- services-platform:modules/tenants/tests/unit/services/deletion/waiting-period.spec.js#is refused in Production even for a disposable tenant origin: >- services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.3 Disposable test tenants (approved) - id: BR-CAP-PFM-TNL-013-10 statement: >- The request transaction copies workspace and customer identity, records the actor, reason and time, schedules notices and the watcher job, and moves the workspace to deletion pending. kind: lifecycle enforced_at: - service - database must_prove: true provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#moves the tenant to deletion_pending origin: >- services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.1, §5.4 (approved) - id: BR-CAP-PFM-TNL-013-11 statement: >- Staff may request deletion of the customer with its final workspace; omission keeps the customer record. kind: policy enforced_at: - service must_prove: true provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#carries the answer to what becomes of the customer origin: >- services-platform:docs/tenants/tenant-lifecycle-plan.md#§6.4 shared, platform.customers (approved) - id: BR-CAP-PFM-TNL-013-12 statement: >- Long-disabled workspaces appear in a staff report rather than entering deletion automatically. kind: policy enforced_at: - service must_prove: false provenance: observed source: 'services-platform:modules/tenants/scripts/long-disabled.ts (header)' origin: >- services-platform:docs/tenants/tenant-lifecycle-plan.md#§13 D9 (default in force) scenarios: - id: SC-CAP-PFM-TNL-013-01 given: A departed association’s workspace is disabled. when: Staff confirm its name and request deletion. then: >- A standard request fixes eligibility thirty days later and records the request notice. provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenant-deletion-requests.e2e.spec.js#answers a scheduled request against the tenant asked about - id: SC-CAP-PFM-TNL-013-02 given: A failed build has no first activation time. when: Staff request its deletion after disabling it. then: Eligibility is recorded one day after the request. provenance: test source: >- services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#makes a tenant that was never provisioned wait one day edge_cases: [] constraints: [] depends_on: - CAP-PFM-TNL-006 related: - CAP-PFM-TNL-014 - CAP-PFM-TNL-015 - CAP-PFM-TNL-016 - CAP-PFM-TNL-003 journeys: - JNY-PFM-TNL-002 - JNY-PFM-TNL-004 open_questions: - OQ-PFM-TNL-003 evidence: - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.1 - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.2 - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.3 - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.7 - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§13 D1, D2, D3 - >- Inspected source: services-platform:modules/tenants/tests/e2e/tenant-deletion-requests.e2e.spec.js#may not ask for a tenant to be deleted - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.2 (approved 2026-10-09) - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§13 D2 - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§13 D2 (Andrew, 2026-10-09) - >- Inspected source: services-platform:modules/tenants/tests/e2e/tenant-deletion-requests.e2e.spec.js#refuses a confirmation that does not repeat the tenant's name as 400 - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.2 (approved); services-platform:docs/hq/rhythm-hq-plan.md#§D4 - >- Inspected source: services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#refuses a tenant that is still live, because people must lose access first - >- Inspected source: services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#refuses a second request, naming the one that is open - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.7 (approved) - >- Inspected source: services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#allows a new request, with a new waiting period, once the first is cancelled - >- Inspected source: services-platform:modules/tenants/tests/unit/services/deletion/waiting-period.spec.js#refuses a configured period below fourteen days rather than quietly raising it - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§13 D1 (Andrew, 2026-10-09) - >- Inspected source: services-platform:modules/tenants/tests/unit/services/deletion/waiting-period.spec.js#waits one day in Production too, where the fourteen-day floor does not apply to it - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§13 D3 (default in force) - >- Inspected source: services-platform:modules/tenants/tests/unit/services/deletion/waiting-period.spec.js#is refused in Production even for a disposable tenant - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.3 Disposable test tenants (approved) - >- Inspected source: services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#moves the tenant to deletion_pending - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.1, §5.4 (approved) - >- Inspected source: services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#carries the answer to what becomes of the customer - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§6.4 shared, platform.customers (approved) - >- Inspected source: services-platform:modules/tenants/scripts/long-disabled.ts (header) - >- Inspected source: services-platform:docs/tenants/tenant-lifecycle-plan.md#§13 D9 (default in force) - >- Inspected source: services-platform:modules/tenants/tests/e2e/tenant-deletion-requests.e2e.spec.js#answers a scheduled request against the tenant asked about - >- Inspected source: services-platform:modules/tenants/tests/integration/services/deletion/request-deletion.integration.spec.js#makes a tenant that was never provisioned wait one day controls: [TC-AVL-001, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-005, TC-DAT-001, TC-DAT-003, TC-DAT-004, TC-IAM-001, TC-IAM-002, TC-IAM-003, TC-IAM-004, TC-IAM-005, TC-IAM-006, TC-LOG-001, TC-LOG-002, TC-LOG-003, TC-LOG-004, TC-LOG-005, TC-PI-001, TC-PI-003, TC-PI-005, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-VEN-001, TC-VEN-002, TC-VEN-003] --- # Schedule deliberate workspace deletion ## Purpose Authorized staff record a deletion decision and its fixed eligibility date before any destruction. ## How It Works Staff first disable the workspace to close customer access. They request deletion using the exact workspace name, a reason and the version they reviewed. The service locks the workspace and checks its eligibility. Children, locks, protected identities or an unsuitable state produce a refusal. A successful request records identity snapshots and a waiting period. It also records required notices and the schedule job in the same transaction. The workspace moves to deletion pending, but no records are destroyed. A customer can be marked for removal with its last workspace. Another request cannot coexist with an open one, and a request after cancellation begins a fresh waiting period. ## Relationships - Preserve valid workspace lifecycle states: Its result establishes the state or declared resources needed by this operation. - Pause or cancel deletion while preservation remains possible: The capabilities share the workspace’s recorded lifecycle decision. - Keep deletion decisions visible to staff: The capabilities share the workspace’s recorded lifecycle decision. - Revalidate the irreversible deletion decision: The capabilities share the workspace’s recorded lifecycle decision. - Understand and recover a workspace build: Its snapshots and recovery explain interrupted construction.