Rhythm 2.0 Specifications

Appearance

CAP-PFM-NOT-019Inspect communication outcomes and provider feedback

Markdown

CAP-PFM-NOT-019

Inspect communication outcomes and provider feedback

Markdown
  • DocumentDraft
  • Product intentProposed
  • ImplementationObserved

Planning

Feature
FEAT-PFM-NOT-07
Key concepts
CON-PFM-NOT-005
Actors
ACT-PFM-028, ACT-PFM-030, ACT-PFM-031
Journeys
JNY-PFM-NOT-006
Depends on
CAP-PFM-NOT-018
Related
CAP-PFM-NOT-020, CAP-PFM-NOT-017
Proved by
ATS-PFM-NOT-019
Executed by
TST-PFM-NOT-023, TST-PFM-NOT-024, TST-PFM-NOT-030, TST-PFM-NOT-039, TST-PFM-NOT-041, TST-PFM-NOT-042, TST-PFM-NOT-043, TST-PFM-NOT-054, TST-PFM-NOT-060

KindCapabilityProduct areaPlatformModuleStaff Notifications and Association CommunicationsRevision1

Read atservices-platform ad3f6a65react-console baf6dae3

Inspect communication outcomes and provider feedback ​

Purpose ​

Staff and producing services can distinguish Platform submission activity from provider-reported delivery and engagement.

How It Works ​

Platform stores submission attempts separately from provider delivery feedback. Provider correlation tags locate the message and workspace. New events update monotone delivery state, timestamps and counters; duplicates leave them unchanged. Staff list and inspect requests and messages through permission-controlled routes. Body reading requires an additional sensitive permission. Content that is no longer available is reported explicitly. A changed-message feed selects the supplied submitting-service filter without returning addresses or bodies. That filter is not independently verified service identity.

The rule rows define this outcome; the acceptance set identifies existing proof and proposed checks. Implementation evidence alone does not approve the observed details.

Relationships ​

Provider submission supplies the dispatch history and correlation needed for feedback.

The Formal Contract

The narrative above explains; the sections below are authoritative — the rules, scenarios and tests this document binds.

Outcomes
Authorized readers inspect communication requests, content and delivery outcomes.Changed-message feeds filter by the supplied requesting service, whose caller ownership remains unverified.
Surfaces
apijob
Intent sources
services-platform:docs/communications/architecture.md#15. Decisions for Andrewservices-platform:docs/communications/architecture.md#2026-10-09 — Final acceptanceservices-platform:docs/communications/architecture.md#16.5 CC and BCC (Andrew, 2026-10-09)services-platform:docs/communications/architecture.md#18. Rework 2026-10-10: queue pointers, S3 for request data and bodies, SQS owns retries

Controls

30 controls apply, from the corpus control catalogue.

TC-AVL-004 TC-AZ-001 TC-AZ-002 TC-AZ-003 TC-AZ-004 TC-DAT-001 TC-DAT-002 TC-DAT-003 TC-IAM-001 TC-IAM-002 TC-IAM-004 TC-IAM-005 TC-IAM-006 TC-LOG-002 TC-LOG-003 TC-LOG-005 TC-MON-001 TC-PI-001 TC-PI-002 TC-PI-003 TC-PI-004 TC-PI-005 TC-PRV-001 TC-PRV-002 TC-TEN-001 TC-TEN-002 TC-TEN-003 TC-VEN-001 TC-VEN-002 TC-VEN-003

Permissions

KeyChecked atScope
platform.communication-messages.readapitenant
platform.communication-messages.read-contentapitenant

Business Rules

12 rules, 8 to be proved before approval. A rule's product intent is derived from its origin: 0 confirmed by a product decision, the rest inheriting this capability's proposed.

IdRuleKindEnforced atProvenance
01must prove
Proposed
Provider send, delivery, deferral, bounce, complaint, rejection, open and click feedback uses submission tags to find the workspace message; Untagged reports are acknowledged as unrelated; missing tagged messages retry and eventually dead-letter.
no proof recorded yet
policyserviceobserved
services-platform:modules/communications/services/feedback/process-ses-event.ts:rhythm-message
02must prove
Proposed
Event identity prevents duplicate recording; Delivery states only advance in precedence, first occurrences retain the earliest instant and counters increase for new reports, making report order immaterial.
no proof recorded yet
calculationservicetest
services-platform:modules/communications/tests/integration/lifecycle/contact-role-compliance-communication.integration.spec.js#keeps the message delivered when a deferral arrives after the delivery
03must prove
Proposed
Transactional mail also tracks opens and clicks; Proxy and scanner signals count as events but not likely-human activity; retained click links omit query strings.
origin: services-platform:docs/communications/architecture.md#15. Decisions for Andrew
no proof recorded yet
calculationservicetest
services-platform:modules/communications/tests/integration/lifecycle/contact-role-compliance-communication.integration.spec.js#counts an open by an image proxy as an open, not as a likely human one
04
Proposed
Dispatch state records Platform's actions separately from delivery state reported by the provider.
invariantservicetest
services-platform:modules/communications/tests/e2e/messages.e2e.spec.js#says what Rhythm did and what the provider reported, as separate facts
05must prove
Proposed
Message-read permission exposes newest-first workspace messages with request, recipient, source record, dispatch, delivery and purpose filters; source-record filtering considers the latest five hundred requests; pages cap at two hundred; invented cursors and incomplete source filters are rejected.
no proof recorded yet
validationapi, servicetest
services-platform:modules/communications/tests/e2e/messages.e2e.spec.js#refuses a source type given without its id as 400
06
Proposed
Detail includes the originating request, rendering version, ordered attempts and up to the oldest two hundred provider events.
policyservicetest
services-platform:modules/communications/tests/integration/services/persistence/messages.queries.integration.spec.js#answers the two hundred oldest, in the order they occurred
07must prove
Proposed
Body access requires sensitive content-read permission; missing stored bodies are reported as unavailable rather than returned as empty content.
no proof recorded yet
permissionapi, servicetest
services-platform:modules/communications/tests/integration/services/storage/communication-objects.integration.spec.js#says the content is gone, rather than answering an empty e-mail, when the object is not there
08
Proposed
Request detail records purpose, classification, outcome, source, pinned version, actor, correlation, key and processing times, plus message counts by both states and blocking reasons; source-record requests list newest first with a fifty-row limit.
policyapi, servicetest
services-platform:modules/communications/tests/e2e/requests.e2e.spec.js#answers a blocked request with the reasons, which an accepted one has none of
09must prove
Proposed
The changed-message feed filters by the caller-supplied submitting service and returns oldest changes after a cursor, up to two hundred, without addresses or content; Further changes reappear with updated state; the service filter excludes other service names.
no proof recorded yet
policyservicetest
services-platform:modules/communications/tests/integration/services/persistence/messages.changes.queries.integration.spec.js#leaves out another service’s messages in the same tenant
10must prove
Proposed
Workspace boundaries apply to requests, messages, content and events; records belonging elsewhere are not found.
no proof recorded yet
invariantservice, databasetest
services-platform:modules/communications/tests/integration/lifecycle/contact-role-compliance-communication.integration.spec.js#shows another tenant nothing of it
11
Proposed
Rendered bodies have no age-based storage expiry; request objects expire after thirty days, and attachment bytes remain in those objects rather than relational records.
policyservicedocumented
services-platform:docs/communications/architecture.md#18.2 The bucket
12must prove
Proposed
Copy feedback enters message history, but primary-recipient feedback alone determines delivery state; a copy bounce suppresses that copy address only.
origin: services-platform:docs/communications/architecture.md#16.5 CC and BCC (Andrew, 2026-10-09)
no proof recorded yet
calculationservicetest
services-platform:modules/communications/tests/integration/services/dispatch/template-copies.integration.spec.js#does not suppress the contact

Scenarios

IdGivenWhenThenProvenance
01Compliance feedback includes delivery, an image-proxy open and a click.Staff inspect message detail.Detail separates Platform submission from provider delivery and shows delivery time, one automated open and one click.test
services-platform:modules/communications/tests/integration/lifecycle/contact-role-compliance-communication.integration.spec.js#keeps the send’s own record of the submission beside the provider’s

The Markdown files under specs/ in rhythmsoftware/rhythm-v2-docs are the canonical source of truth. This reader is a generated, read-only projection of them.

Rhythm Software