Rhythm 2.0 Specifications

Appearance

SVC-PFM-SEC-tenantsWorkspaces Service Module

Markdown

SVC-PFM-SEC-tenants

Workspaces Service Module

Markdown
  • DocumentDraft
  • ImplementationObserved

KindService contractProduct areaPlatformModuleSecurity, Customers and WorkspacesRevision1ExaminercodexExamined on2026-10-23

Read atservices-platform ad3f6a65

Workspaces Service Module ​

What This Service Is For ​

The Workspaces service owns workspace identity, business status and lifecycle, plus provisioning, loading/reset and retirement requests. Participants own the resources they prepare or remove; generic Jobs owns execution and monitoring.

Boundary ​

Participants own execution and removal of their resources under the lifecycle protocol; the final module boundary remains a planning decision. The Data Job Engine owns import runs admitted while loading. Licensing owns licenses and application state; commercial-link changes request refresh. Notifications owns sender identities, though provisioning writes their selected setting through the shared capability. Jobs owns durable execution, generic reconciliation and monitoring.

Operations in Words ​

Workspace operations group ordinary/HQ record reads and edits, shortcuts, provisioning and initialization, initial-load/reset/activation, commercial linking and controlled retirement/recovery.

The operation rows describe every declared route, including the direct-delete refusal and the separate commercial-link operation. No route declares a Submissions binding and no module path makes a model inference call.

Events and Jobs ​

The declared job inventory covers durable execution and queued background work. Event declarations distinguish actual provisioning notifications from the absence of domain-change events.

Consistency Guarantees ​

Durable intent commits before execution starts. Lifecycle availability, gateway authority and provider state have separate consistency bounds. Notification and external ledger effects are not atomic with the owning record.

Retirement remains cancellable until the destructive boundary. Purge recovery moves forward, and finalization can complete the retained request before the ledger succeeds. The module split, initial-import proof and recovery gaps stay recorded as planning disagreements and findings.

Owns
DOM-PFM-SEC-002
Repository
services-platform

Controls

52 controls apply, from the corpus control catalogue.

TC-AVL-001 TC-AVL-002 TC-AVL-003 TC-AVL-004 TC-AVL-005 TC-AZ-001 TC-AZ-002 TC-AZ-003 TC-AZ-004 TC-AZ-005 TC-AZ-006 TC-CHG-001 TC-CHG-002 TC-CHG-003 TC-CHG-004 TC-CHG-005 TC-CHG-006 TC-CHG-007 TC-DAT-001 TC-DAT-002 TC-DAT-003 TC-DAT-004 TC-DAT-006 TC-DAT-007 TC-IAM-001 TC-IAM-002 TC-IAM-003 TC-IAM-004 TC-IAM-005 TC-IAM-006 TC-LOG-001 TC-LOG-002 TC-LOG-003 TC-LOG-004 TC-LOG-005 TC-MON-001 TC-MON-002 TC-MON-003 TC-PI-001 TC-PI-002 TC-PI-003 TC-PI-004 TC-PI-005 TC-PRV-001 TC-PRV-002 TC-TEN-001 TC-TEN-002 TC-TEN-003 TC-TEN-004 TC-VEN-001 TC-VEN-002 TC-VEN-003

Does Not Own

  • Participants own execution and removal of their resources under the lifecycle protocol; the final module boundary remains a planning decision.
  • The Data Job Engine owns import runs admitted while loading.
  • Licensing owns licenses and application state; commercial-link changes request refresh.
  • Notifications owns sender identities, though provisioning writes their selected setting through the shared capability.
  • Jobs owns durable execution, generic reconciliation and monitoring.

The Markdown files under specs/ in rhythmsoftware/rhythm-v2-docs are the canonical source of truth. This reader is a generated, read-only projection of them.

Rhythm Software