Rhythm 2.0 Specifications

Appearance

CAP-PFM-TNL-017Remove declared workspace resources and verify the result

Markdown

CAP-PFM-TNL-017

Remove declared workspace resources and verify the result

Markdown
  • DocumentDraft
  • Product intentConfirmed
  • ImplementationObserved

Planning

Feature
FEAT-PFM-TNL-06
Exercised by
FAS-PFM-TNL-06-01, FAS-PFM-TNL-06-02, FAS-PFM-TNL-06-03, FAS-PFM-TNL-06-04, FAS-PFM-TNL-06-05
Key concepts
CON-PFM-TNL-005, CON-PFM-TNL-003
Actors
ACT-PFM-012, ACT-PFM-004
Journeys
JNY-PFM-TNL-004
Depends on
CAP-PFM-TNL-016, CAP-PFM-TNL-007
Related
CAP-PFM-TNL-018, CAP-PFM-TNL-015, CAP-PFM-TNL-012
Proved by
ATS-PFM-TNL-017

Implementation

Executable suites
TST-PFM-TNL-003, TST-PFM-TNL-027, TST-PFM-TNL-066, TST-PFM-TNL-067, TST-PFM-TNL-114

KindCapabilityProduct areaPlatformModuleWorkspace Lifecycle Across ApplicationsRevision2

Read atservices-platform ad3f6a65services-crm a8d1364fservices-commerce c8b66a98services-committees 36129c24services-membership 5994c270services-submissions 64236c19services-websites 5fc6823cservices-marketing d071a159

Remove declared workspace resources and verify the result ​

Purpose ​

The purge removes planned participant resources and requires zero inventory before completing deletion.

How It Works ​

The purge begins by requesting cached-authority invalidation. It then asks each planned participant to remove a batch in reverse construction order. Every Platform batch checks the request’s current purge ownership and workspace state. A participant that needs more work is called again. A blocked result fails with the participant’s explanation. Removal totals are recorded after the participant returns and therefore have a separate failure boundary. Verification inventories planned resources and repeats removal when counts remain. The workspace row is removed at finalization, with conditional customer removal and retained deletion evidence. Failed purges can be retried by authorized staff. Missing remote declarations and Websites’ unpurged CMS resources limit what this verification establishes.

Relationships ​

  • Revalidate the irreversible deletion decision: Its result establishes the state or declared resources needed by this operation.
  • Account for each application’s lifecycle responsibilities: Its result establishes the state or declared resources needed by this operation.
  • Retain deletion evidence and prevent identifier reuse: Retired identifiers and retained removal history also constrain this work.
  • Keep deletion decisions visible to staff: The capabilities share the workspace’s recorded lifecycle decision.
  • Recover an incorrect initial import: Its reset classification distinguishes imported records from retained setup.

The Formal Contract

The narrative above explains; the sections below are authoritative — the rules, scenarios and tests this document binds.

Outcomes
Cache-flush work is requested before participant removal.Participants remove data in reverse dependency order through guarded batches.Inventory and neighboring-workspace checks support the completion decision.Failure retains deleting lifecycle until staff recovery.
Surfaces
jobapi
Intent sources
services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.9services-platform:docs/tenants/tenant-lifecycle-plan.md#§6.2services-platform:docs/tenants/tenant-lifecycle-plan.md#§6.4services-platform:docs/tenants/tenant-lifecycle-plan.md#§6.6services-platform:docs/tenants/tenant-lifecycle-plan.md#§13 D5, D6

Controls

34 controls apply, from the corpus control catalogue.

TC-AVL-001 TC-AVL-004 TC-AVL-005 TC-AZ-001 TC-AZ-002 TC-AZ-003 TC-AZ-004 TC-AZ-006 TC-DAT-001 TC-DAT-002 TC-DAT-003 TC-DAT-004 TC-DAT-006 TC-IAM-001 TC-IAM-002 TC-IAM-004 TC-IAM-005 TC-LOG-002 TC-LOG-003 TC-LOG-004 TC-LOG-005 TC-MON-001 TC-MON-003 TC-PI-001 TC-PI-002 TC-PI-003 TC-PI-004 TC-PI-005 TC-TEN-001 TC-TEN-002 TC-TEN-003 TC-VEN-001 TC-VEN-002 TC-VEN-003

Permissions

KeyChecked atScope
platform.tenants.deletion-requestapiglobal

Business Rules

14 rules, 14 to be proved before approval. A rule's product intent is derived from its origin: 14 confirmed by a product decision, the rest inheriting this capability's confirmed.

IdRuleKindEnforced atProvenance
01must prove
Confirmed
Before removal, purge submits a cached-authority flush job and clears local availability facts without awaiting flush completion.
origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.6 At destruction start (approved)
proved by ATS-PFM-TNL-017-01, TST-PFM-TNL-067
policyservicetest
services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js#cuts off cached access before it removes anything
02must prove
Confirmed
Purge invokes participants in reverse build order, repeating one batch per call until done and removing the workspace record last.
origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§6.2 (approved)
proved by ATS-PFM-TNL-017-02
calculationservicetest
services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js#runs one step per participant, in the planned order, and completes every one of them
03must prove
Confirmed
Platform checks purge ownership and deleting lifecycle before each batch; CRM rejects non-deleting participant purges, while protected functions admit the defined loading-reset path.
origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.7, §5.9, §6.6 (approved)
proved by ATS-PFM-TNL-017-03
validationservice, databasetest
services-crm:modules/tenant-lifecycle/tests/integration/services/participants/purge.integration.spec.js#refuses a tenant that is not being deleted
04must prove
Confirmed
CRM’s protected histories are deleted through guarded functions while ordinary application delete protections remain in place.
origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§6.6 (approved)
proved by ATS-PFM-TNL-017-04
policydatabasetest
services-crm:modules/tenant-lifecycle/tests/integration/services/participants/purge.integration.spec.js#empties the record history after the contacts, through the definer function
05must prove
Confirmed
CRM purge disables change-event capture for its removal work.
origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.9 Late events (approved)
proved by ATS-PFM-TNL-017-05, TST-PFM-TNL-027
policyservicetest
services-crm:modules/tenant-lifecycle/tests/integration/services/participants/purge.integration.spec.js#records no change event at any point while it purges
06must prove
Confirmed
File purge deletes workspace-specific objects and versions using delimited prefixes, preserving similarly named neighboring folders.
origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§6.4 platform.assets (approved)
proved by ATS-PFM-TNL-017-06, TST-PFM-TNL-067
policyservicetest
services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js#leaves a folder whose name merely begins like the tenant’s, which is what the trailing slash is for
07must prove
Confirmed
Purge removes the workspace’s portal sign-in resources, sender identities and workspace security data after destruction is authorized.
origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§13 D5 (Andrew, 2026-10-09); §13 D6
no proof recorded yet
policyservicedocumented
services-platform:docs/tenants/tenant-lifecycle-plan.md#§6.4 security.portal-pool, communications.sender-identity
08must prove
Confirmed
A participant unable to remove or account for its resources blocks completion with an explanation and leaves the workspace deleting.
origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§6.1 not_applicable vs blocked (approved)
proved by ATS-PFM-TNL-017-07, TST-PFM-TNL-066
policyservicetest
services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge-recovery.integration.spec.js#fails the request with the participant’s own reason when a participant is blocked
09must prove
Confirmed
Inventory checks all planned participants apart from the workspace row; non-zero results repeat removal and the third non-zero verification refuses completion.
origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.9 Final sweep (approved)
proved by ATS-PFM-TNL-017-08
validationservicetest
services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge-recovery.integration.spec.js#refuses to finish, with the counts, when something keeps writing to the tenant
10must prove
Confirmed
Purge fixtures in Platform, CRM, Committees and Marketing preserve neighboring workspace records.
origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§10 Acceptance criterion 5 (approved)
proved by ATS-PFM-TNL-017-09, ATS-PFM-TNL-017-14, ATS-PFM-TNL-017-15, TST-PFM-TNL-003, TST-PFM-TNL-114
invariantservice, databasetest
services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge.integration.spec.js#leaves the other tenant of the same customer exactly as it was
11must prove
Confirmed
Finalization removes the workspace and lifecycle register entries, conditionally removes its final customer and preserves product catalog and deletion-job evidence.
origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§6.4 shared (approved)
proved by ATS-PFM-TNL-017-10
lifecycleservice, databasetest
services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge-recovery.integration.spec.js#deletes the customer with its last tenant when the request asked for it
12must prove
Confirmed
Authorized staff retry only failed purges, carrying completed work; late reports from the replaced attempt cannot change the current request.
origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.8 Retry a failed purge (approved)
proved by ATS-PFM-TNL-017-11
lifecycleapi, servicetest
services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge-recovery.integration.spec.js#completes the destruction when a purge that failed part way is retried
13must prove
Confirmed
Platform records removal totals after a participant returns its committed batch, across a separate transaction boundary.
no proof recorded yet
policyserviceobserved
services-platform:modules/tenants/services/deletion/tenant-purge-operations.ts:purgeParticipantOperation
14must prove
Confirmed
Committees removes parent, meeting and decision references before deleting the records those references target.
no proof recorded yet
policyserviceobserved
services-committees:modules/tenant-lifecycle/services/persistence/tenant-purges.ts:unlinkDecisionReferences

Scenarios

IdGivenWhenThenProvenance
01A service interruption stops participant removal.An administrator retries the failed purge after recovery.The retry completes outstanding participant work and the request retains its removal totals.test
services-platform:modules/tenants/tests/integration/services/deletion/tenant-purge-recovery.integration.spec.js#completes the destruction when a purge that failed part way is retried

The Markdown files under specs/ in rhythmsoftware/rhythm-v2-docs are the canonical source of truth. This reader is a generated, read-only projection of them.

Rhythm Software