Skip to content

CAP-PFM-TNL-016Revalidate the irreversible deletion decision

Markdown

CAP-PFM-TNL-016

Revalidate the irreversible deletion decision

Markdown
  • DocumentDraft
  • Product intentConfirmed
  • ImplementationObserved

KindCapabilityProduct areaPlatformModuleWorkspace Lifecycle Across ApplicationsRevision2

Read atservices-platform ad3f6a65

The Formal Contract

The narrative above explains; the sections below are authoritative — the rules, scenarios and tests this document binds.

Outcomes
The HTTP surface offers no execute-now or force action.Recoverable obstacles wait and terminal requests end without mutation.Concurrent cancellation and destruction yield one consistent winner.
Surfaces
jobapi
Intent sources
services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.2 Executeservices-platform:docs/tenants/tenant-lifecycle-plan.md#§5.4services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.7services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.8

Controls

29 controls apply, from the corpus control catalogue.

TC-AVL-001 TC-AVL-004 TC-AZ-001 TC-AZ-002 TC-AZ-003 TC-AZ-004 TC-AZ-005 TC-DAT-001 TC-DAT-003 TC-DAT-004 TC-IAM-001 TC-IAM-002 TC-IAM-003 TC-IAM-004 TC-IAM-005 TC-IAM-006 TC-LOG-001 TC-MON-001 TC-PI-001 TC-PI-002 TC-PI-003 TC-PI-004 TC-PI-005 TC-TEN-001 TC-TEN-002 TC-TEN-003 TC-VEN-001 TC-VEN-002 TC-VEN-003

Permissions

KeyChecked atScope
platform.tenants.deletion-requestserviceglobal

Business Rules

8 rules, 7 to be proved before approval. A rule's product intent is derived from its origin: 8 confirmed by a product decision, the rest inheriting this capability's confirmed.

IdRuleKindEnforced atProvenance
01must prove
Confirmed
Deletion HTTP routes expose neither immediate execution nor a force option; destruction begins through the schedule’s service call.
origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.2 Execute: nobody (approved)
no proof recorded yet
permissionserviceobserved
02must prove
Confirmed
Before destruction, locked request and workspace facts are rechecked for schedule ownership, eligibility, gating notices, pending-deletion and disabled state, locks, children and protected identity.
origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.4 Begin destruction (approved)
no proof recorded yet
validationservicetest
03must prove
Confirmed
If the requester no longer has active staff deletion authority, the request is held with that reason for human review.
no proof recorded yet
validationservicetest
services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#holds the request in that case, so a person has to look at it rather than a job retrying forever
04must prove
Confirmed
Temporary obstacles cause another check six hours later; terminal or superseded requests and missing workspaces end the watcher without mutation.
no proof recorded yet
lifecycleservicetest
05must prove
Confirmed
One transaction marks execution, moves the disabled workspace to deleting, creates the executing notice and records the purge job.
no proof recorded yet
lifecycleservice, databasetest
services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#names the purge job it submitted in the same transaction, so the point of no return and its destruction commit together
06must prove
Confirmed
A cancellation racing destruction has one winner: either cancellation preserves the records or destruction starts and cancellation is rejected.
origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.4; §10 Acceptance criterion 4 (approved)
no proof recorded yet
invariantservice, databasetest
07must prove
Confirmed
Staff may resume a stopped watcher through a new schedule job, preserving eligibility and holds; a live watcher prevents another resume.
origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.8 Resume a stuck schedule (approved)
no proof recorded yet
policyapi, servicetest
services-platform:modules/tenants/tests/e2e/tenant-deletion-recovery.e2e.spec.js#leaves the request scheduled, and its eligibility exactly where it was: a resume cannot bring a deletion forward
08
Confirmed
The watcher execution permits a year and has no job retry; recovery uses an operator’s resume action.
policyservicedocumented

Scenarios

IdGivenWhenThenProvenance
01The requester loses deletion authority during the wait.The schedule rechecks at eligibility.The request is held with an authority explanation and destruction does not start.test
services-platform:modules/tenants/tests/integration/services/deletion/begin-destruction.integration.spec.js#holds the request in that case, so a person has to look at it rather than a job retrying forever

The Markdown files under specs/ in rhythmsoftware/rhythm-v2-docs are the canonical source of truth. This reader is a generated, read-only projection of them.