01must proveProposed | Creation requires an enabled installation and supported authentication, pins the current published release and waits for credentials; a platform-account connection instead begins verification with a job. | lifecycle | service | test |
02must proveProposed | A connection uses its supplied identifier or one derived from its name, conforms to configuration identifier syntax and is unique within the workspace; conflicts identify the taken value. | validation | api, service, database | test |
03must proveProposed | An installation cannot hold two non-disconnected connections for the same provider account; verification of a duplicate ends in failed verification with its cause. | invariant | service, database | test |
04must proveProposed | Connection changes use permitted named transitions, leave disconnected final and write both audit trails and binding notifications; a refused transition makes no change. | invariant | service | test |
05must proveProposed | Passing verification records the account and supported features, activates the connection and provisions its declared webhook endpoints; failure records the provider’s reason and can be retried. | lifecycle | service | test |
06must proveProposed | Only active or degraded connections can be suspended, suspension blocks their use, and suspension and resume record the actor and reason. | lifecycle | service | test |
07must proveProposed | Disconnection accepts active, degraded, suspended, re-authorization-required or previously verified failed connections, but refuses while any current binding selects it, identifies the bindings and offers no override. | policy | api, service | test |
08must proveProposed | An initial connection awaiting authentication, verifying for the first time or failed without prior success may be discarded into disconnected, with a discard reason, so it no longer prevents uninstall. | lifecycle | service | test |
09must proveProposed | Disconnection disables webhook endpoints, revokes credentials for later secret deletion, clears connection notices and records the responsible person and reason. | policy | service | test |
10must proveProposed | Only active or degraded connections can move to a different published release of the same integration; newly requested access must already be covered by the old release or acceptance, and the pin changes after successful verification of the same account. | policy | service | observed |
11must proveProposed | Concurrent requests for the same open verification or health check reuse its job rather than create another. no proof recorded yet | invariant | service | test |
12must proveProposed | Connection discovery can filter for active connections with a verified capability feature, without exposing credentials. no proof recorded yet | policy | api, service | test |