Integration

What It Models

An integration connects an adapter offering to the customers allowed to adopt it. Adapter registration creates the global offer and release declaration; staff set availability; a customer administrator creates an installation with selected settings and access. These global and workspace records remain one concept because they describe successive parts of adopting the same offering.

Identity and Attributes

The integration key identifies an offer. Releases combine that key with a semantic version, and deployments add an environment and sequence. A workspace keeps a single installation for each integration, including after removal.

The manifest supplies a permanent lowercase configuration key. The current release supplies the name, description, categories and presentation shown in the catalogue. New offers start internal; staff can make them public or restrict them to named workspaces. For restricted availability, staff replace the complete list of eligible workspaces. Definitions can be active, hidden or retired; catalogue reads also require a published current-release pointer. Publication advances a published pointer only to a newer release, or replaces an absent or unpublished pointer; deprecation leaves it unchanged. Each release retains the manifest, fingerprint, contract package version, release notes and declared status. Capability majors retain execution modes, feature support and constraints, alongside shared contract catalogue entries. Deployments identify the runtime location, service principal and entry points for a release and environment, with active, draining or inactive status. An installation is enabled, suspended with a reason, or uninstalled. Installation values must satisfy the form declared by the current release. The saved capability, event, data-scope and Rhythm-permission lists cannot exceed the current declaration. Declared Rhythm-owned secret purposes expose existence and version metadata without revealing values. Settings and acceptance edits include the installation version previously read.

Relationships

One installation contains any number of connections, each pinned to a release of that integration.. The installation owns the account links and refuses removal until all are disconnected.. A release can implement capability majors used by many calls.. Execution records reference the serving release and deployment without owning the catalogue.. An installation can have several subscriptions, using the release’s event declarations.. Installation removal deletes its subscriptions..

Invariants

Registration accepts an adapter only for its own integration; Platform can register other integrations in non-production environments. A release that has been published rejects a different manifest fingerprint on registration. Deployment replacement drains the preceding deployment and leaves at most one active deployment for that release in each environment. Staff publish validated releases, deprecate published releases and retire deprecated releases only after all live connection pins are removed. Publishing replaces a missing or unpublished current pointer, or advances a published pointer to a newer release. The customer catalogue requires an active definition and published current pointer, with availability granted publicly, explicitly or through staff access. Installation is unique for an integration within a workspace; reinstalling restores the existing uninstalled record. Installation and edits validate accepted access and settings against the current release declaration. Uninstallation refuses every connection that has not reached disconnected. An accepted installation mutation commits its integration and security audit entries together; refusals add neither entry.

How It Is Stored and Shared

The integrations service owns the catalogue, deployment and installation records. Global declarations are shared, while installations and operational history are workspace records. The scoped declarations describe workspace isolation; cross-workspace retirement checks use a privileged count. Custom-field support is not declared.

Open Design Questions

Access restoration remains disputed against the recorded narrowing decision. Deprecating the current release can hide the offer because its pointer is not recomputed. Staff release screens and complete automated lifecycle proof remain unfinished.