Skip to content

CAP-PFM-TNL-005Apply workspace availability consistently

Markdown

CAP-PFM-TNL-005

Apply workspace availability consistently

Markdown
  • DocumentDraft
  • Product intentProposed
  • ImplementationObserved

KindCapabilityProduct areaPlatformModuleWorkspace Lifecycle Across ApplicationsRevision2

Read atservices-platform ad3f6a65services-crm a8d1364fservices-commerce c8b66a98services-committees 36129c24services-membership 5994c270services-submissions 64236c19services-websites 5fc6823cservices-marketing d071a159

The Formal Contract

The narrative above explains; the sections below are authoritative — the rules, scenarios and tests this document binds.

Outcomes
Ordinary use requires active lifecycle and an enabled business mode.Authorized system access remains available to staff, becoming read-only during destruction.Platform background enumeration excludes non-operational workspaces.
Surfaces
consoleportalapijob
Intent sources
services-platform:docs/tenants/tenant-lifecycle-plan.md#§4.5services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.6services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.9services-platform:docs/proposals/rhythm-data-job-engine-plan.md#§12.1

Controls

30 controls apply, from the corpus control catalogue.

TC-AVL-001 TC-AVL-004 TC-AZ-001 TC-AZ-002 TC-AZ-003 TC-AZ-004 TC-AZ-006 TC-DAT-001 TC-DAT-002 TC-DAT-003 TC-DAT-004 TC-IAM-001 TC-IAM-006 TC-LOG-001 TC-LOG-004 TC-LOG-005 TC-MON-001 TC-PI-001 TC-PI-002 TC-PI-003 TC-PI-004 TC-PI-005 TC-PRV-001 TC-PRV-002 TC-TEN-001 TC-TEN-002 TC-TEN-003 TC-VEN-001 TC-VEN-002 TC-VEN-003

Business Rules

9 rules, 7 to be proved before approval. A rule's product intent is derived from its origin: 0 confirmed by a product decision, the rest inheriting this capability's proposed.

IdRuleKindEnforced atProvenance
01must prove
Proposed
Ordinary workspace access requires active lifecycle and a non-disabled business status; other states receive the same unavailable response.
origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.6 The access gate (approved 2026-10-09)
no proof recorded yet
policyapitest
services-platform:modules/tenants/tests/e2e/tenant-availability-gate.e2e.spec.js#is refused 403 in a tenant whose customer has been cut off
02must prove
Proposed
The staff exception applies to authorized system routes, allowing support to inspect workspaces closed to customer callers.
no proof recorded yet
permissionapitest
services-platform:modules/tenants/tests/e2e/tenant-availability-gate.e2e.spec.js#is past the gate in a tenant its own customer could not reach, because staff reach every tenant
03must prove
Proposed
The workspace availability gate limits staff requests to reads during destruction and refuses mutations on the routes it gates.
origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.9 Writes (approved 2026-10-09)
no proof recorded yet
policyapitest
services-platform:modules/tenants/tests/e2e/tenant-availability-gate.e2e.spec.js#may not write to a tenant being deleted, which the same caller being served above is the premise for
04must prove
Proposed
Loading allows data-job requests in customer context and continues to admit authorized staff system routes.
no proof recorded yet
policyapi, serviceobserved
05must prove
Proposed
A missing workspace is unavailable even to an authorized staff caller.
no proof recorded yet
policyapitest
06must prove
Proposed
Each process caches lifecycle facts for no more than thirty seconds; lifecycle workflows clear the changing process’s entry, while ordinary business-status updates can retain it until expiry.
origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.6 The cut-off is within the cache window (approved)
no proof recorded yet
policyserviceobserved
07must prove
Proposed
Platform’s background enumeration selects active workspaces whose business status is not disabled.
origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§4.5, §5.6 Background loops (approved)
no proof recorded yet
policyservicetest
08
Proposed
Derived-data messages remain processable for disabled or unfinished workspaces and are discarded for deleting or absent workspaces.
origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.6 (narrowed in review 2026-10-10)
policyservicedocumented
09
Proposed
Staff-entry grants apply to operational workspaces and to loading implementation workspaces, excluding other lifecycle states.
policyservicetest
services-platform:modules/tenants/tests/unit/services/lifecycle/lifecycle-transitions.spec.js#admits an implementation tenant that is loading, so a Data Run can act in the tenant it loads

Scenarios

IdGivenWhenThenProvenance
01Staff have disabled a departed customer’s workspace.A customer caller opens an ordinary workspace route.The route reports unavailable while authorized system support access remains possible.test
services-platform:modules/tenants/tests/e2e/tenant-availability-gate.e2e.spec.js#is refused 403 in a tenant whose customer has been cut off
02An implementation workspace is loading.A customer-context import operator submits a bulk job and reads the ordinary contact list.The data-job request is admitted and the ordinary list is refused.test
services-crm:modules/tenant-lifecycle/tests/e2e/tenant-availability.e2e.spec.js#is refused the contact list 403 TenantUnavailable, because nothing but the import may touch the tenant

The Markdown files under specs/ in rhythmsoftware/rhythm-v2-docs are the canonical source of truth. This reader is a generated, read-only projection of them.