Submit a background job and start its execution
What It Does
Create the job beside the business change, then start its execution after commit. This lets operators inspect the submission even when orchestration cannot start. The engine requires callers to keep secrets and customer content out of execution inputs but does not validate arbitrary domain fields.
The Flow
When Something Fails
A failed submission transaction leaves no recorded business change or job. A failed start leaves both committed, with no recorded execution handle. Forgiving callers return the job; workspace provisioning retry uses the strict path and can report an error after commit. Reconciliation can later fail an unstarted run and invoke business recovery, subject to successful passes and candidate limits.
Open Design Questions
Insertion conflicts inside a caller transaction require caller retry. The stronger input-safety obligation and start-recovery guarantees need the proof and limits recorded in findings.