Control the initial import and subsequent opening

Purpose

Staff bracket initial loading with separate import and activation authority.

How It Works

The import operator opens an active implementation workspace for loading. Rhythm records the person, time and optional explanation. A repeated opening returns that existing record. Ordinary customer routes close while the data-job surface remains usable. Authorized staff system routes retain their availability exception. Import permission also supports starting over through reset. Activation uses a different permission for the decision that loading is ready. Activation returns the workspace to active and retains the loading record. Taking its business status live is a separate staff action.

Relationships

Preserve valid workspace lifecycle states: Its result establishes the state or declared resources needed by this operation.
Apply workspace availability consistently: Its access decision determines when callers can use the workspace.
Recover an incorrect initial import: Its reset classification distinguishes imported records from retained setup.

Show evidence (sources, provenance, origins, pinned commits)

The Formal Contract

The narrative above explains; the sections below are authoritative — the rules, scenarios and tests this document binds.

Outcomes: An active implementation workspace can enter loading with an accountable load record.Repeated loading requests preserve the record and never-loaded activation is refused.Activation restores active lifecycle without deciding live business status.
Surfaces: consoleapi
Intent sources: services-platform:docs/proposals/rhythm-data-job-engine-plan.md#§12.1services-platform:docs/proposals/rhythm-data-job-engine-plan.md#§12.2services-platform:docs/proposals/rhythm-data-job-engine-plan.md#§21.3 D5services-platform:docs/proposals/rhythm-data-job-engine-plan.md#§21.4

Controls

21 controls apply, from the corpus control catalogue.

TC-AVL-001 TC-AZ-001 TC-AZ-002 TC-AZ-003 TC-AZ-004 TC-AZ-005 TC-IAM-003 TC-LOG-001 TC-LOG-002 TC-LOG-003 TC-LOG-004 TC-LOG-005 TC-MON-001 TC-PI-001 TC-PI-005 TC-TEN-001 TC-TEN-002 TC-TEN-003 TC-VEN-001 TC-VEN-002 TC-VEN-003

Permissions

Key	Checked at	Scope
`hq.data-runs.manage`	api	global
`hq.tenants.activate`	api	global

Business Rules

6 rules, 6 to be proved before approval. A rule's product intent is derived from its origin: 6 confirmed by a product decision, the rest inheriting this capability's confirmed.

Id	Rule	Kind	Enforced at	Provenance
`01`must prove Confirmed	Opening loading requires import authority; activation-only staff, customer administrators and anonymous callers are refused. origin: services-platform:docs/proposals/rhythm-data-job-engine-plan.md#§12.2 step 8, §16 (approved 2026-10-12) no proof recorded yet	permission	api	test services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses the staff member who may only activate a tenant, the two keys being separate
`02`must prove Confirmed	Loading can begin only for an active implementation workspace, leaving live or disabled workspaces unchanged on refusal. origin: services-platform:docs/proposals/rhythm-data-job-engine-plan.md#§21.4 (Andrew, 2026-10-11) no proof recorded yet	validation	service, database	test services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses a live tenant, an initial import going only into an implementation tenant
`03`must prove Confirmed	Opening loading records the operator, time and optional reason of up to five hundred characters; repeating it preserves the existing loading record. origin: services-platform:docs/proposals/rhythm-data-job-engine-plan.md#§12.1 (D5) no proof recorded yet	lifecycle	service, database	test services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#records who opened the load and why, which is what the row is evidence of
`04`must prove Confirmed	Activation uses the separate go-live permission, which import authority alone does not supply. origin: services-platform:docs/proposals/rhythm-data-job-engine-plan.md#§12.2 step 8 (approved) no proof recorded yet	permission	api	test services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses the staff member who ran the import, activation being the other key
`05`must prove Confirmed	Activation returns loading to active without changing business status or load history; it rejects never-loaded workspaces and accepts an already activated load without further change. origin: services-platform:docs/proposals/rhythm-data-job-engine-plan.md#§12.2 step 10 (approved) no proof recorded yet	lifecycle	service	test services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#leaves the status where it was, going live being the separate decision
`06`must prove Confirmed	Loading blocks ordinary customer routes while permitting data-job requests and authorized staff system requests. origin: services-platform:docs/proposals/rhythm-data-job-engine-plan.md#§12.1 (D5) no proof recorded yet	policy	api	observed services-platform:modules/tenants/services/access/tenant-availability.ts:tenantAvailabilityOf

Scenarios

Id	Given	When	Then	Provenance
`01`	A newly provisioned workspace is in implementation mode.	The import operator starts loading with a package explanation.	Loading is recorded with its operator and explanation, and ordinary customer access closes.	test services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#records who opened the load and why, which is what the row is evidence of

Planning

Control the initial import and subsequent opening ​

Purpose ​

How It Works ​

Relationships ​