Rhythm 2.0 Specifications

Appearance

CAP-PFM-TNL-001Request a complete customer workspace

Markdown

CAP-PFM-TNL-001

Request a complete customer workspace

Markdown
  • DocumentDraft
  • Product intentProposed
  • ImplementationObserved

Planning

Feature
FEAT-PFM-TNL-01
Key concepts
CON-PFM-TNL-002, CON-PFM-TNL-001
Actors
ACT-PFM-004, ACT-PFM-012
Journeys
JNY-PFM-TNL-001
Depends on
CAP-PFM-TNL-007
Related
CAP-PFM-TNL-002, CAP-PFM-TNL-003, CAP-PFM-TNL-004, CAP-PFM-TNL-018
Proved by
ATS-PFM-TNL-001

KindCapabilityProduct areaPlatformModuleWorkspace Lifecycle Across ApplicationsRevision2

Read atservices-platform ad3f6a65

Request a complete customer workspace ​

Purpose ​

Staff submit a workspace request that Rhythm carries through the participating applications.

How It Works ​

A Rhythm administrator supplies the workspace identifier, name and customer. The request can also name the opening business status, a first administrator for a new customer and an e-mail sender. Rhythm records the request and build job together. A duplicate submission returns the recorded result. A conflicting identifier produces a refusal instead. After the transaction commits, the job starts the application work. If execution cannot start immediately, the committed job remains available to reconciliation. Staff follow the build separately while customer access remains closed.

Relationships ​

  • Account for each application’s lifecycle responsibilities: Participant declarations establish which application areas the build must reach.
  • Open a workspace after its applications are ready: Its readiness and activation finish workspace construction.
  • Understand and recover a workspace build: Its snapshots and recovery explain interrupted construction.
  • Prepare the customer’s first access and sender: Its first-administrator and sender setup use the recorded creation choices.
  • Retain deletion evidence and prevent identifier reuse: Retired identifiers and retained removal history also constrain this work.

The Formal Contract

The narrative above explains; the sections below are authoritative — the rules, scenarios and tests this document binds.

Outcomes
Customer creation when needed, workspace creation and job recording succeed together.A repeated submission retains the original workspace and job.The new workspace stays closed during construction.
Surfaces
consoleapijob
Intent sources
services-platform:docs/tenants/tenant-lifecycle-plan.md#§4.1services-platform:docs/hq/rhythm-hq-plan.md#§Iservices-platform:docs/tenants/tenant-identity.md#The rules

Controls

32 controls apply, from the corpus control catalogue.

TC-AVL-001 TC-AZ-001 TC-AZ-002 TC-AZ-003 TC-AZ-004 TC-AZ-005 TC-CRY-001 TC-CRY-002 TC-CRY-003 TC-CRY-004 TC-DAT-001 TC-DAT-002 TC-DAT-003 TC-DAT-004 TC-IAM-003 TC-LOG-001 TC-LOG-002 TC-LOG-003 TC-LOG-004 TC-LOG-005 TC-MON-001 TC-PI-001 TC-PI-003 TC-PI-005 TC-PRV-001 TC-PRV-002 TC-TEN-001 TC-TEN-002 TC-TEN-003 TC-VEN-001 TC-VEN-002 TC-VEN-003

Permissions

KeyChecked atScope
hq.tenants.provisionapiglobal

Business Rules

10 rules, 9 to be proved before approval. A rule's product intent is derived from its origin: 0 confirmed by a product decision, the rest inheriting this capability's proposed.

IdRuleKindEnforced atProvenance
01must prove
Proposed
Provisioning requests require Rhythm staff authority and the provisioning permission; customer administrators cannot create a workspace this way.
origin: services-platform:docs/hq/rhythm-hq-plan.md#§H1 (approved 2026-10-11)
no proof recorded yet
permissionapitest
services-platform:modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js#may not ask for a tenant at all
02must prove
Proposed
Staff supply a readable workspace identifier; omitted, generated-looking and reserved identifiers are rejected.
origin: services-platform:docs/tenants/tenant-identity.md#The rules (Andrew, 2026-10-17)
no proof recorded yet
validationapi, databasetest
services-platform:modules/tenants/tests/e2e/tenants.e2e.spec.js#refuses a create that names no id as 400 tenant_id_required, naming id
03must prove
Proposed
Resubmitting the same submission returns its original workspace and job without creating another of either.
origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§4.1 (approved 2026-10-09)
no proof recorded yet
invariantservice, databasetest
services-platform:modules/tenants/tests/integration/services/provisioning/provision-tenant.integration.spec.js#answers the same tenant and the same job when the same submission is sent twice
04must prove
Proposed
A new submission cannot claim an identifier already assigned to a workspace, and the refusal identifies the collision.
origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§4.1 (approved 2026-10-09)
no proof recorded yet
validationservice, databasetest
services-platform:modules/tenants/tests/integration/services/provisioning/provision-tenant.integration.spec.js#refuses a different submission that names a tenant id somebody already has
05must prove
Proposed
Creation of a new customer when needed, its workspace, the sender setting and the provisioning job commits together; a rejected request retains none of those writes.
origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§4.1 (approved 2026-10-09)
no proof recorded yet
invariantservice, databasetest
services-platform:modules/tenants/tests/integration/services/provisioning/tenant-email-strategy.integration.spec.js#creates no tenant at all when the strategy is refused: the request is rejected whole
06must prove
Proposed
A requested workspace begins closed in provisioning and becomes usable after the build succeeds.
origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§4.1, §4.5 (approved 2026-10-09)
no proof recorded yet
lifecycleservice, databasetest
services-platform:modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js#answers a tenant that is not usable yet, because the work has only been asked for
07must prove
Proposed
Job execution starts after the request commits; a failed start leaves the committed workspace and pending job for reconciliation.
origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§4.1 (approved 2026-10-09)
no proof recorded yet
policyservicetest
services-platform:modules/tenants/tests/integration/services/provisioning/provision-tenant.integration.spec.js#leaves the job pending and without a handle, which is what the reconciler settles
08must prove
Proposed
The database permits no more than one pending or running provisioning job for a workspace.
origin: services-platform:docs/hq/rhythm-hq-plan.md#§I Concurrency (approved 2026-10-11)
no proof recorded yet
invariantdatabaseobserved
services-platform:modules/tenants/db/tenant-provisioning-jobs.table.ts:tenant_provisioning_jobs_open_uidx
09
Proposed
Provisioning opens the workspace with the requested live or implementation status, defaulting to implementation.
origin: services-platform:docs/hq/rhythm-hq-plan.md#§D10 (approved 2026-10-11)
policyservice, databaseobserved
services-platform:modules/tenants/db/tenant-provisioning-jobs.table.ts:DEFAULT_PROVISIONED_TENANT_STATUS
10must prove
Proposed
Omitting the commercial company inherits the customer’s company; explicitly clearing it leaves the workspace without that link.
no proof recorded yet
calculationservicedocumented
services-platform:docs/tenants/console-contract.md#The HubSpot company link

Scenarios

IdGivenWhenThenProvenance
01A staff member submits a form twice.Both copies reach provisioning.Both responses identify the single recorded workspace and job.test
services-platform:modules/tenants/tests/integration/services/provisioning/provision-tenant.integration.spec.js#answers the same tenant and the same job when the same submission is sent twice
02An existing association holds the requested identifier.Staff submit a different request for that identifier.The response rejects the identifier collision.test
services-platform:modules/tenants/tests/e2e/tenants.e2e.spec.js#refuses an id another tenant has as 409 tenant_id_taken

The Markdown files under specs/ in rhythmsoftware/rhythm-v2-docs are the canonical source of truth. This reader is a generated, read-only projection of them.

Rhythm Software