An HQ operator uses system-only notification routes. Global catalog and dead-letter access require HQ keys. Customer History additionally requires an active access grant for the selected workspace. The HQ screen explains a rejected grant rather than exposing customer records. The dead-letter list targets deliveries whose retry budget was exhausted. Retry checks that the failure is eligible before recreating work. Permanent provider refusal remains final. Because retry initiates another send, the operation belongs to sensitive operator access.
The rule rows define this outcome; the acceptance set identifies existing proof and proposed checks. Implementation evidence alone does not approve the observed details.
Workspace History supplies the customer activity that HQ reviews through granted access.
Channel processing supplies the delivery states and reasons inspected here.
The Formal Contract
The narrative above explains; the sections below are authoritative — the rules, scenarios and tests this document binds.
Outcomes
HQ reviews customer History and requests through an active access grant.Global dead-letter inspection and retry expose retained channel content without that grant check; the intended boundary remains open.
7 rules, 4 to be proved before approval. A rule's product intent is derived from its origin: 0 confirmed by a product decision, the rest inheriting this capability's proposed.
Id
Rule
Kind
Enforced at
Provenance
01must prove
Proposed
HQ routes require system access and HQ notification permissions; Currently only Rhythm Administrator grants both keys; HQ reader policy does not grant them, pending Andrew's role decision.
HQ reads of customer History and requests require an active staff access grant for that workspace and reuse administrator history behavior; missing workspaces or absent and mismatched grants reject the read without returning customer records.
The dead-letter list contains exhausted deliveries in newest-first order with workspace identification; an unfiltered scan covers at most one thousand operational workspaces and returns at most one hundred rows; permanent provider refusals are omitted.
Operator retry accepts only deliveries failed through exhausted attempts, recreating queued work; missing deliveries and permanent provider failures are refused without modification.
HQ dead-letter listing and retry responses include retained channel content without the customer access-grant check used by History, while HQ route permissions still restrict entry.