Security, Customers and Workspaces Design Examination
Scope and Method
All eighty design artifacts and the Security responsibility row have been independently examined against the pinned source and the planning layer. Every narrative section and requested prose field now has OpenAI wording. Verification and final wording were committed separately for each artifact; the final audit also checked permanent identities, maturity, intent, decision origins, operation declarations and source pins.
The examination is a static account of declared routes, tables, services, browser components and asynchronous infrastructure. Corpus validation and checker tests verify document conformance; they do not demonstrate concurrent execution, deployed recovery or browser behavior. Shared job-engine internals lack an independently pinned implementation, so their start contract remains documented evidence.
Coverage
| Inventory | Examined and represented |
|---|---|
| Domain Objects | 3 objects; 41 invariant rows; all 50 Postgres tables |
| State Models | 11 models; 48 states; 66 transitions; 31 invalid-transition rows |
| Workflows | 16 workflows; 91 hops; all 7 state machines, 2 primary queues and 3 schedules |
| Service Contracts | 3 contracts; all 146 business operations and 3 health operations |
| Screen Contracts | 31 routes/contracts using 27 component files |
| Decision Records | 16 records; existing origins retained |
| Responsibilities | Security ownership, operation inventory and delegations reconciled |
| Inference | No model calls found; all 50 required contract arrays are empty |
Both primary queues have dead-letter companions. Resource coverage measures representation, not successful recovery after exhaustion. External registry and deletion-ledger stores remain dependencies rather than entries in the Postgres table inventory.
Changes by Artifact
The following table records the examined artifact by its final title. The structured examination record preserves its permanent identity, file location, detailed changes and every changed protected value. Each artifact also received a complete prose rewrite.
| Artifact | Verification changes |
|---|---|
| Workspace decisions and participant execution | No technical correction; pinned evidence checked. |
| User Account aggregates | Retained planning grouping and removed language implying the design re-decides superseded concepts. |
| Permanent readable customer and workspace identity | No technical correction; pinned evidence checked. |
| Separate business status and lifecycle | Qualified the workflow-only lifecycle claim with the restore exception. |
| Durable execution after committed intent | Corrected universal companion-record transaction and failure-consequence claims. |
| Retirement boundary and forward recovery | No technical correction; pinned evidence checked. |
| Scoped authority with bounded cached context | Included baseline self-service permissions and ninety-second signed-context bound. |
| Provider synchronization and durable removal | Corrected contradictory every-provider-call-after-commit wording. |
| Recorded staff customer entry | Distinguished ordinary customer entry from HQ system-route authority. |
| Release-controlled shared definitions | Narrowed unchanged-deploy no-write claim to built-in content/version equality. |
| No custom-field capability | No technical correction; pinned evidence checked. |
| Submissions publication exclusions | No technical correction; pinned evidence checked. |
| Versioned record replacement contract | Separated approved write intent from observed deviations and narrowed protected-field claim. |
| Dedicated security history and refusal recording | No technical correction; pinned evidence checked. Qualified database append-only and universal secret-exclusion claim. |
| Source-owned contact-derived access | Restricted universal derived expiry assertion to eligibility renewal. |
| Confirmed portal self-registration | Corrected trigger-only creation claim and uniform-refusal overstatement. |
| Customer | Update/delete locks are service checks, not database lock-value constraints. Standing access is conditional on reconciliation and preserves manual revocation. |
| Workspace | Removed external deletion ledger from physical table inventory. Corrected sandbox parent/child direction and optional account cardinality. Scoped lifecycle transition and idempotency claim; retained restore exception. Separated time-zone recognition from database shape validation. |
| User Account | Removed gateway route registry from physical Postgres table inventory. Restricted active-membership invariant to fresh evaluation; cached decisions remain bounded separately. Included retained direct-create identity path. Downgraded invariant 18 open-request exclusion, invariant 20 database/history enforcement and invariant 22 contact/challenge concurrency to unknown with findings. Removed unsupported database enforcement from invariant 20. Distinguished active-grant uniqueness from unproved request concurrency and scoped history retention. |
| Security area landing | Corrected first-permitted-section claim to fixed Users redirect. Completed provenance and sources on structured state, refusal or screen rows. |
| Users list | Added real status-dependent row actions. Replaced unsupported standard-layout pattern with observed components. Completed provenance and sources on structured state, refusal or screen rows. |
| User view | Corrected reactivation confirmation and actual action labels. Recorded both Access and History explanation gates. Completed provenance and sources on structured state, refusal or screen rows. |
| Edit user | Corrected page read guard, management redirect and read-only state. Completed provenance and sources on structured state, refusal or screen rows. |
| Roles list | Checked component, route, data/actions and permission gates; added row provenance and action component source. Completed provenance and sources on structured state, refusal or screen rows. |
| New role | Corrected validation action from button to save-time request. Completed provenance and sources on structured state, refusal or screen rows. |
| Role view | Checked component, route, data/actions and permission gates; added row provenance and action component source. Completed provenance and sources on structured state, refusal or screen rows. |
| Edit role | Removed unbuilt eligibility action. Corrected editor gates, redirect and save-time validation behavior. Completed provenance and sources on structured state, refusal or screen rows. |
| Policies list | Checked component, route, data/actions and permission gates; added row provenance and action component source. Completed provenance and sources on structured state, refusal or screen rows. |
| New policy | Corrected save-time validation action. Completed provenance and sources on structured state, refusal or screen rows. |
| Policy view | Checked component, route, data/actions and permission gates; added row provenance and action component source. Completed provenance and sources on structured state, refusal or screen rows. |
| Edit policy | Corrected read guard, management redirect and save-time validation. Completed provenance and sources on structured state, refusal or screen rows. |
| Rhythm access | Checked component, route, data/actions and permission gates; added row provenance and action component source. Completed provenance and sources on structured state, refusal or screen rows. |
| Sign in | Checked component, route, data/actions and permission gates; added row provenance and action component source. Completed provenance and sources on structured state, refusal or screen rows. |
| Sign out | Removed blanket no-protected-access guarantee after sign-out. Completed provenance and sources on structured state, refusal or screen rows. |
| Forgot password | Checked component, route, data/actions and permission gates; added row provenance and action component source. Completed provenance and sources on structured state, refusal or screen rows. |
| Check your e-mail | Added implemented resend error state and cooldown behavior. Completed provenance and sources on structured state, refusal or screen rows. |
| Reset password | Checked component, route, data/actions and permission gates; added row provenance and action component source. Completed provenance and sources on structured state, refusal or screen rows. |
| Second-factor code | Checked component, route, data/actions and permission gates; added row provenance and action component source. Completed provenance and sources on structured state, refusal or screen rows. |
| Session ended | Checked component, route, data/actions and permission gates; added row provenance and action component source. Completed provenance and sources on structured state, refusal or screen rows. |
| Sign-in provider return | Checked component, route, data/actions and permission gates; added row provenance and action component source. Completed provenance and sources on structured state, refusal or screen rows. |
| Accept invitation | Checked component, route, data/actions and permission gates; added row provenance and action component source. Completed provenance and sources on structured state, refusal or screen rows. |
| HQ home | Corrected home membership gate and removed nonexistent own-grants display. Completed provenance and sources on structured state, refusal or screen rows. |
| HQ customers list | Checked component, route, data/actions and permission gates; added row provenance and action component source. Completed provenance and sources on structured state, refusal or screen rows. |
| HQ customer detail | Checked component, route, data/actions and permission gates; added row provenance and action component source. Completed provenance and sources on structured state, refusal or screen rows. |
| HQ workspaces list | Checked component, route, data/actions and permission gates; added row provenance and action component source. Completed provenance and sources on structured state, refusal or screen rows. |
| HQ workspace detail | Scoped edit confirmation to disabling. Completed provenance and sources on structured state, refusal or screen rows. |
| Provision a workspace | Corrected extra submit confirmation claim. Completed provenance and sources on structured state, refusal or screen rows. |
| HQ staff list | Recorded exact UI/API permission mismatch and immediate suspend/reinstate behavior. Completed provenance and sources on structured state, refusal or screen rows. |
| HQ staff detail | Recorded UI/API mismatch and corrected action confirmation. Completed provenance and sources on structured state, refusal or screen rows. |
| HQ staff roles | Corrected console role gate and API key mismatch; recorded implemented fallback. Completed provenance and sources on structured state, refusal or screen rows. |
| Workspace lifecycle | Loading activation preserves first-activation timestamp. Loading availability includes HQ exceptions. Repeated activation can update metadata; lifecycle idempotence is not a record no-op. Completed provenance and sources on structured state, refusal or screen rows. |
| Workspace business status | No technical correction; pinned evidence checked. Completed provenance and sources on structured state, refusal or screen rows. |
| Workspace retirement request | Separated database completion from external ledger success. Distinguished human hold permission from system authority-loss hold. Completed provenance and sources on structured state, refusal or screen rows. |
| Membership status | Scoped lockout transaction claims to guarded destructive changes. Removed the one-minute provider-completion promise. Completed provenance and sources on structured state, refusal or screen rows. |
| Invitation | Separated token issuance from delivery and corrected delivery-order validity claim. Completed provenance and sources on structured state, refusal or screen rows. |
| Role assignment | Clarified derived window labels and representative transitions. Completed provenance and sources on structured state, refusal or screen rows. |
| Staff access grant | No technical correction; pinned evidence checked. Corrected active-only uniqueness and the stored requested validity window. Completed provenance and sources on structured state, refusal or screen rows. |
| Custom and built-in access definition | Corrected mandatory-version guards to reflect optional current route inputs. Completed provenance and sources on structured state, refusal or screen rows. |
| Service principal | No technical correction; pinned evidence checked. Completed provenance and sources on structured state, refusal or screen rows. |
| Portal sign-in pool | No technical correction; pinned evidence checked. Completed provenance and sources on structured state, refusal or screen rows. |
| Portal contact challenge | Clarified live-state issuance and delivery-failure supersession. Removed unproved live-challenge and contact-link uniqueness guarantees. Completed provenance and sources on structured state, refusal or screen rows. |
| Customers Service Module | Added declaration-level provenance/source for every operation; all operation ids, primary access levels and permission keys matched. |
| Security Service Module | Added declaration-level provenance/source for every operation; all operation ids, primary access levels and permission keys matched. Corrected catalog/registry atomicity, provider-call ordering, bounded queue retry and human-authorizer scope. |
| Workspaces Service Module | Added declaration-level provenance/source for every operation; all operation ids, primary access levels and permission keys matched. Corrected notice duplication and external-ledger completion boundaries. |
| Provision a workspace | Corrected repeated activation from record no-op to lifecycle convergence. Scoped claimed-notification behavior without a delivery guarantee. Rewrote the narrative and diagram with conditional and failure branches retained. |
| Open, reset and activate an initial load | Removed unsupported queue mechanism from the admission-only hop. Corrected loading access exclusivity and loaded activation timestamp. Rewrote the narrative and diagram with conditional and failure branches retained. |
| Watch a retirement request through its waiting period | Corrected notice exactly-once claim and added actual retry/delivery anchors. Removed unconditional successful schedule settlement claim. Classified shared job-engine start hop as documented rather than observed implementation. Rewrote the narrative and diagram with conditional and failure branches retained. |
| Purge a retired workspace | Removed immediate-flush guarantee. Corrected completed-request/missing-ledger failure outcome and bounded failure retries. Rewrote the narrative and diagram with conditional and failure branches retained. |
| Invite a person and deliver the invitation | Corrected issuance, delivery and resend validity semantics. Rewrote the narrative and diagram with conditional and failure branches retained. |
| Accept an invitation | Restricted single-use and safe-retry claims to database consumption; recorded external credential race. Rewrote the narrative and diagram with conditional and failure branches retained. |
| Suspend, reinstate, revoke or delete a membership | Removed minute-completion and immediate-flush promises; preserved API provider-problem result. Rewrote the narrative and diagram with conditional and failure branches retained. |
| Flush the gateway's cached decisions | Removed successful-reset equivalence to actual eviction. Rewrote the narrative and diagram with conditional and failure branches retained. |
| Authorize a request at the gateway | Scoped workflow to human protected routes and distinguished invocation logging from cached traffic. Rewrote the narrative and diagram with conditional and failure branches retained. Qualified licensing enforcement by configured mode; an absent mode defaults to off. |
| Reconcile derived role assignments | Changed one-batch claim to bounded batches. Scoped expiry fail-safe to eligibility-bound renewals. Rewrote the narrative and diagram with conditional and failure branches retained. |
| Grant and end staff entry to a customer workspace | Scoped standing reconciliation failures by call boundary and retained HQ system-route exception. Distinguished sequential request duplicate checks from active-grant uniqueness. Rewrote the narrative and diagram with conditional and failure branches retained. |
| Reconcile shared definitions, founding staff and principals on deploy | Corrected staged-manifest visibility. Exposed catalog/registry non-atomic activation and narrowed unchanged-release claim. Rewrote the narrative and diagram with conditional and failure branches retained. |
| Onboard a workspace's portal sign-in pool | Removed same-day recovery guarantee. Rewrote the narrative and diagram with conditional and failure branches retained. |
| Register, confirm and sign in a portal member | Corrected missing-pool and unavailable-workspace equivalence. Included confirmed-member sign-in repair and token lifetime after sign-out. Rewrote the narrative and diagram with conditional and failure branches retained. |
| Link a portal member to a contact | Recorded CRM/link transaction gap and challenge-delivery failure handling. Restricted directory-unavailable fallback to its actual failure category. Downgraded cross-member link and concurrent challenge-start guarantees pending concurrency proof. Rewrote the narrative and diagram with conditional and failure branches retained. |
| Sign in to the console and keep the session | Corrected context-read side effects and limited sign-out guarantees. Rewrote the narrative and diagram with conditional and failure branches retained. |
Responsibilities and Planning Consistency
The three objects retain the planning concept grain. Separate account aggregates keep their own lifecycles without reinstating superseded concepts. Service ownership agrees with the route inventories, and unresolved workspace execution ownership remains a product question. Unknown concurrency and history protections are excluded from the responsibility guarantees but remain visible in the object and findings.
Planning artifacts were not changed. Observed disagreements are findings rather than revised product rules; no approval, confirmed intent or new architectural decision was inferred from implementation. The decision records cite existing origins, distinguish actual alternatives and preserve the previously chosen account grouping.
Open Disagreements
Fourteen new findings record limits exposed by this examination. The previous draft findings also have OpenAI wording, and the existing four questions remain in place.
The weakest behavioral evidence concerns concurrent contact linking, challenge creation and staff requests, plus effects divided between database records and identity providers, mail delivery, CRM, the route registry or the purge ledger. A successful sequential check does not prove concurrent exclusion, and a completed database change does not prove that an external effect succeeded. Shared job recovery needs a library source pin and execution evidence.
The interface findings retain the fixed Security redirect, staff permission mismatches, absent staff screens, pool states without observed writers and undeclared domain-change events. Product decisions are still needed for workspace execution ownership, disabled-workspace exceptions and derived contact subjects. Earlier replacement-field, standing-access and asynchronous recovery proof gaps remain open; the missing no-inference statement belongs to the planning layer.
Validation
Dependency installation, corpus conformance and the checker tests passed: zero corpus errors and four passing tests. These checks establish document validity and checker behavior; they do not resolve the implementation findings.
Verdict for Andrew
The corrected design is a faithful static account of the module at the pinned commits, with unsupported guarantees explicitly qualified and retained as findings. Its weakest area is proof of concurrency and recovery across database, provider and asynchronous boundaries. Before implementation preparation, decide workspace ownership and the outstanding product exceptions, then prioritize the permission mismatches, stronger consistency requirements and recovery evidence.