Platform command, refusal and evidence contracts

Command envelope

Every state-changing intent supplies these coordinates before owner-specific fields:

Coordinate	Requirement
commandId	Required idempotency identity; reuse with different material payload is refused
workspaceId	Required trusted boundary
actingIdentity	Required union of Human Principal, System Principal or Connection Identity
initiatingHumanPrincipalId	Required when a system/connection executes an earlier human intent
authorityDecisionId	Required and exact for protected mutation
expectedRevision	Required when mutating an existing Aggregate
requestedAt	Caller assertion retained as input; never used as trusted record time
recordedAt	Required trusted system Instant assigned at decision recording
effectiveTime	Required when business effect differs from record time
correlationId	Required end-to-end trace identity
causationId	Required when another fact/decision caused the command
reason	Required by the command’s Evidence Profile
inputEvidence	Required where the invariant needs external support

A retry with the same commandId and same material payload returns the original outcome and emits no second business fact. Reuse with a different payload returns IDEMPOTENCY_KEY_REUSED.

Common refusal catalogue

Code	Exact meaning	Retry classification
NOT_AUTHORIZED	Principal lacks Product + Action + typed Scope authority	Stable until authority changes
RESOURCE_NOT_DISCLOSED	Identified read is observationally hidden	Stable until authority changes
WORKSPACE_MISMATCH	References cross customer boundary	Stable invalid request
REFERENCE_NOT_FOUND	Required canonical reference does not exist	Stable unless created
REFERENCE_UNAVAILABLE	Reference exists but cannot accept this new association	Stable until state changes
EXPECTED_REVISION_CONFLICT	Actual Aggregate revision differs from expected	Retry only after reread/redecision
IDEMPOTENCY_KEY_REUSED	Same command identity carries another material intent	Stable invalid request
UNIQUENESS_CONFLICT	Governed business uniqueness coordinate is reserved	Stable unless correction changes coordinate
EFFECTIVE_INTERVAL_CONFLICT	Effective-dated relationships overlap incompatibly	Stable until interval changes
CONTINUITY_VIOLATION	Change would remove required administration continuity	Stable until another grant exists
REASON_REQUIRED	Evidence profile requires a business reason	Correct request and retry
EVIDENCE_REQUIRED	Named invariant lacks required supporting evidence	Supply evidence and retry
UNSUPPORTED_CORRECTION	Requested change would reinterpret identity/history	Requires model decision, not ordinary retry
MODEL_DECISION_REQUIRED	Behavior is intentionally unsupported until the named product decision is resolved	Not retryable under current model
PRODUCT_NOT_ENTITLED	Applicable Product Entitlement is absent/withdrawn	Stable until entitlement changes
ENTITLEMENT_DECISION_UNAVAILABLE	Entitlement owner cannot provide a trusted decision	Retryable infrastructure boundary
STALE_OPERATION_ACKNOWLEDGEMENT	Acknowledgement is for an earlier enable/disable operation	Stable; reconcile
CONTRACT_REVISION_MISMATCH	Sender and target do not agree on exact connection contract	Stable until compatible redelivery
TARGET_COMMAND_REFUSED	Target product applied ordinary validation and refused	Stable or state-dependent per target receipt
DELIVERY_RETRYABLE_FAILURE	No authoritative target decision was obtained	Retry under same pinned intent
CONTENT_NOT_AVAILABLE	Exact Content Revision lacks current available verification	Stable until new decision
SIGNATURE_TARGET_STALE	Signed revision/digest is no longer the target	New ceremony required

Refusal of a command emits no false success fact. The attempt and refusal receipt may still be retained as authorization, validation, conflict or delivery evidence.

Context-specific refusal registry

Code	Owner	Exact meaning	Retry classification
PRINCIPAL_UNAVAILABLE	Identity & Access	Principal state cannot accept the requested identity/authority operation	After Principal state changes
AUTHENTICATION_BINDING_CONFLICT	Identity & Access	Issuer/subject is already bound incompatibly	Requires correction decision
ROLE_PRODUCT_MISMATCH	Identity & Access	Role home Product differs from Assignment Product	Stable invalid request
CROSS_PRODUCT_ACTION_NOT_ALLOWED	Identity & Access	Role revision contains another product’s Action without approved dependency	Publish compatible revision
ACTION_SCOPE_INCOMPATIBLE	Identity & Access	One or more Actions cannot be granted at requested Scope kind	Change Role or Scope
DELEGATION_SCOPE_EXCEEDED	Identity & Access	Grantor attempts product/scope authority beyond delegation	Requires broader authorized grantor
ORGANIZATION_UNAVAILABLE	Party Registry	Organization cannot accept the new relationship	After registry state changes
SPONSOR_UNAVAILABLE	Study Registry	Primary Sponsor is absent/inactive/cross-Workspace	After valid Sponsor supplied
DUPLICATE_DECISION_REQUIRED	Study Registry	Selected duplicate-admission policy requires explicit decision	Supply authorized decision
STUDY_MERGE_REQUIRES_MODEL_DECISION	Study Registry	Merge/supersession semantics are unsupported, especially after product roots	Not retryable; resolve PD-PLAT-002
STUDY_COUNTRY_CONFLICT	Study Registry	Retained Study/country coordinate already exists	Stable unless correcting existing identity
STUDY_COUNTRY_MISMATCH	Study Registry	Study Country does not belong to the supplied Study	Stable invalid request
SITE_COUNTRY_MISMATCH	Study Registry	Canonical Site country differs from Study Country	Model correction/replacement required
SITE_ALREADY_ASSOCIATED	Study Registry	Study/Site uniqueness coordinate is already retained	Depends on PD-PLAT-005
STUDY_SITE_NUMBER_CONFLICT	Study Registry	Normalized Study-local number is reserved	Depends on PD-PLAT-006
USED_SITE_COUNTRY_CORRECTION_REQUIRES_MODEL_DECISION	Party Registry	Country change would reinterpret used Study Site scope	Not retryable; resolve PD-PLAT-007
RESPONSIBILITY_PARTY_KIND_MISMATCH	Clinical Coordination	Responsibility does not permit Organization/Person kind	Stable invalid request
RESPONSIBILITY_SCOPE_MISMATCH	Clinical Coordination	Responsibility does not permit supplied Scope kind	Stable invalid request
PRIMARY_SPONSOR_NOT_A_PARTICIPATION	Clinical Coordination	Primary Sponsor belongs to Study in the initial model	Stable under current model
INVALID_ENABLEMENT_STATE	Suite Composition	Command is not allowed from absent/current coordination state	After state/reconciliation changes
ACKNOWLEDGEMENT_FROM_WRONG_PRODUCT	Suite Composition	Authenticated product differs from requested product	Stable invalid acknowledgement
PRODUCT_ROOT_ALREADY_BOUND	Suite Composition	Another root is already bound to retained enablement	Reconciliation/model decision
INTEGRITY_VERIFICATION_FAILED	Content	Verification inputs prove digest/scanning failure	New verification/revision per policy
VERIFICATION_DECISION_NOT_CURRENT	Content	Binding pins a superseded/non-current verification decision	Re-evaluate and submit exact current decision
CONTENT_BINDING_CONFLICT	Content	Active owner/object/purpose/revision binding already exists	Idempotent same intent or release/change purpose
MILESTONE_TYPE_NOT_SUPPORTED	Study Timeline	Type is outside the approved catalogue	Promote type through model review
MILESTONE_SCOPE_NOT_ALLOWED	Study Timeline	Type does not allow supplied Scope	Stable invalid request
ACHIEVEMENT_SOURCE_NOT_ALLOWED	Study Timeline	Source/attestation is not approved for the type	Supply accepted evidence/policy
SOURCE_REVISION_GAP	Integration	Consumer cannot safely advance across missing owner revisions	Reconcile under PD-PLAT-021

Normative command registry

Every row inherits the common Command Envelope and idempotency rule. “Revision” means expectedRevision is mandatory for an existing Aggregate.

Identity & Access

Command	Target / authority and gates	Preconditions	Success / fact	Refusals	Evidence profile
RegisterPrincipal	New Principal; Platform identity-admin Action, Workspace Scope	Kind/display identity valid; external identity not inferred	Retained Principal created / PrincipalRegistered	workspace, identity conflict	RegistryCreation
BindAuthenticationIdentity	Principal; identity-admin Action; revision	Principal available; issuer/subject unique and verified	New revocable binding / AuthenticationIdentityBound	principal unavailable, binding conflict, revision	ReasonedCorrection
DisablePrincipal	Principal; identity-admin Action; revision	Active; reason; administrator continuity preserved	Disabled, historical resolution retained / PrincipalDisabled	continuity, invalid state, revision	LifecycleChange
RestorePrincipal	Principal; identity-admin Action; revision	Disabled; accepted authentication binding; reason	Active / PrincipalRestored	binding missing/conflict, revision	LifecycleChange
DefineRole	New Role; product-bounded access-admin Action	Unique Role key; non-empty compatible published Actions	Active Role revision 1 / RoleDefined, RoleRevisionPublished	cross-product Action, scope incompatibility	AuthorityChange
ReviseRole	Role; product-bounded access-admin Action; revision	Active; Actions compatible; continuity preserved	Immutable next revision becomes current / RoleRevisionPublished	continuity, cross-product, scope, revision	AuthorityChange
RetireRole	Role; product-bounded access-admin Action; revision	Impact known; continuity preserved	Retired; historical revisions retained / RoleRetired	continuity, invalid state, revision	LifecycleChange + AuthorityChange
AssignRole	New Assignment; delegated product access-admin Action	Principal/Role available; same Product; complete valid Scope; half-open interval; grantor contains target; no prohibited overlap	Retained effective-dated Assignment / RoleAssigned	role/product, scope, delegation, overlap, continuity	AuthorityChange
RevokeAssignment	Assignment; delegated product access-admin Action; revision	End time valid; continuity preserved	Future authority ended / AssignmentRevoked	continuity, invalid interval/state, revision	AuthorityChange

Party Registry

Command	Target / authority and gates	Preconditions	Success / fact	Refusals	Evidence profile
RegisterOrganization	New Organization; registry-admin Action	Required identity valid; Workspace match; similarity is non-authoritative	Active Organization / OrganizationRegistered	workspace, duplicate decision only if policy	RegistryCreation
CorrectOrganizationIdentity	Organization; registry-admin Action; revision	Only accepted identity fields; reason; no implicit merge	New revision with lineage / OrganizationIdentityCorrected	unsupported correction, reason, revision	ReasonedCorrection
RegisterPersonProfile	New Person Profile; party-admin Action	Minimum lawful identity and privacy classification; name not identity	Profile created, no account/access / PersonProfileRegistered	workspace, privacy/input refusal	RegistryCreation
CorrectPersonProfileIdentity	Person Profile; party-admin Action; revision	Correctable fields only; reason; no inferred account merge	New revision with lineage / PersonProfileIdentityCorrected	unsupported correction, reason, revision	ReasonedCorrection
RegisterSite	New Site; registry-admin Action	Operating Organization available/same Workspace; governed country	Active Site / SiteRegistered	organization unavailable, country reference, workspace	RegistryCreation
CorrectSiteDetails	Site; registry-admin Action; revision	Correctable fields; reason; country unchanged after Study use	New revision / SiteDetailsCorrected	used-country decision, reason, revision	ReasonedCorrection

Study Registry

Command	Target / authority and gates	Preconditions	Success / fact	Refusals	Evidence profile
RegisterStudy	New Study; Study-registration Action at Workspace	Sponsor available; protocol identity valid; selected duplicate policy satisfied	Registered Study / StudyRegistered	Sponsor, duplicate decision, workspace	RegistryCreation + duplicate result
UpdateStudyRegistryDetails	Study; Study-correction Action; revision	Presentation-only delta; reason; no Sponsor/protocol/product-root mutation	Revision and before/after lineage / StudyRegistryDetailsUpdated	unsupported correction, reason, revision	ReasonedCorrection
ArchiveStudy	Study; Study-lifecycle Action; revision	Registered; reason/impact acknowledgement	Registry availability archived / StudyArchived	invalid state, evidence, revision	LifecycleChange
RestoreStudy	Study; Study-lifecycle Action; revision	Archived; reason; canonical identity still valid	Registered availability / StudyRestored	superseded/unavailable, revision	LifecycleChange
MergeDuplicateStudy	Study pair; high-risk registry Action	Unsupported until PD-PLAT-002	No Core state change	merge requires model decision	Refusal receipt
PlanStudyCountry	New Study Country; country-admin Action at Study	Study available; governed country; retained coordinate absent	Planned Study Country / StudyCountryPlanned	country conflict/reference/study unavailable	RegistryCreation
ActivateStudyCountry (Candidate)	Study Country; transition authority unresolved; revision	PD-PLAT-004 not resolved for transition policy	No Core state change	MODEL_DECISION_REQUIRED	Refusal receipt
CloseStudyCountry (Candidate)	Study Country; transition authority unresolved; revision	PD-PLAT-004 not resolved for transition policy	No Core state change	MODEL_DECISION_REQUIRED	Refusal receipt
ReopenStudyCountry (Candidate)	Study Country; transition authority unresolved; revision	PD-PLAT-004 not resolved for transition policy	No Core state change	MODEL_DECISION_REQUIRED	Refusal receipt
CorrectLocalStudyIdentifier	Study Country; correction Action; revision	Identifier-only delta; reason	Revision with lineage / LocalStudyIdentifierCorrected	uniqueness, reason, revision	ReasonedCorrection
AssociateSiteWithStudy	New Study Site; site-association Action at Study	Study/Country/Site available and same Workspace; hierarchy/country match; uniqueness/number available	Open Study Site / SiteAssociatedWithStudy	mismatch, already associated, number conflict	RegistryCreation
CorrectStudySiteNumber	Study Site; site-number-correction Action; revision	Number valid/available under reuse policy; reason	Same identity, new number/revision / StudySiteNumberCorrected	number conflict, reason, revision	ReasonedCorrection
CloseStudySite	Study Site; registry-lifecycle Action; revision	Open; reason/impact acknowledgement	Closed registry availability only / StudySiteClosed	invalid state, evidence, revision	LifecycleChange
ReopenStudySite	Study Site; registry-lifecycle Action; revision	Closed; Study/Country/Site available; reason	Open registry availability / StudySiteReopened	reference unavailable, invalid state, revision	LifecycleChange

Clinical Coordination

Command	Target / authority and gates	Preconditions	Success / fact	Refusals	Evidence profile
AddStudyPartyParticipation	New Participation; coordination Action at exact Scope	Party/scope available; Responsibility allows kind/scope; interval valid/non-overlapping	Participation created / StudyPartyParticipationAdded	party/scope mismatch, primary Sponsor, interval conflict	RegistryCreation + source evidence
ReplaceStudyPartyParticipation	Predecessor + new successor intent; coordination Action; predecessor revision	Deterministic boundary; successor valid; no overlap; reason	Predecessor ended and successor created atomically / ended + added facts with lineage	interval, kind/scope, reason, revision	ReasonedCorrection + source evidence
EndStudyPartyParticipation	Participation; coordination Action; revision	Current/planned; end time valid; reason	Ended responsibility only / StudyPartyParticipationEnded	invalid interval/state, reason, revision	LifecycleChange
CorrectStudyPartyParticipation	Participation; high-risk correction Action; revision	Proven registration error; correction does not disguise genuine replacement; reason/evidence	Revision with exact correction lineage / StudyPartyParticipationCorrected	unsupported correction, overlap, reason, revision	ReasonedCorrection

Entitlement and Suite Composition

Command	Target / authority and gates	Preconditions	Success / fact	Refusals	Evidence profile
GrantProductEntitlement	New Entitlement; entitlement-admin Action	Workspace/product valid; retained coordinate absent	Entitled / ProductEntitlementGranted	uniqueness conflict when retained coordinate exists	RegistryCreation
WithdrawProductEntitlement	Entitlement; entitlement-admin Action; revision	Entitled; reason; in-flight cutoff recorded	Withdrawn; no product mutation / ProductEntitlementWithdrawn	invalid state, reason, revision	LifecycleChange
RestoreProductEntitlement	Entitlement; entitlement-admin Action; revision	Withdrawn; reason	Entitled using same identity / ProductEntitlementRestored	invalid state, revision	LifecycleChange
RequestStudyProductEnablement	New/disabled Enablement; product-admin Action; entitlement receipt	Study available; entitled; absent or disabled; exact active contract	Enable-requested, retained identity/operation / requested fact	entitlement, invalid state, contract	OwnerConnectionExecution
AcknowledgeStudyProductEnabled	Enablement; authenticated owning-product connection; revision	Exact Workspace/enablement/Study/Product/operation/contract; unique root	Enabled and root bound / ProductStudyRootAcknowledged	wrong product, stale operation, root conflict, contract, revision	OwnerConnectionExecution
RequestStudyProductDisablement	Enablement; product-admin Action; revision	Enabled; reason; exact contract	Disable-requested / StudyProductDisablementRequested	invalid state, contract, revision	LifecycleChange + OwnerConnectionExecution
AcknowledgeStudyProductDisabled	Enablement; authenticated owning-product connection; revision	Exact current disable operation and contract	Disabled; root reference retained / ProductStudyRootDisabled	wrong product, stale operation, contract, revision	OwnerConnectionExecution

Content

Command	Target / authority and gates	Preconditions	Success / fact	Refusals	Evidence profile
CreateContentItem	New Content Item; content-create Action	Workspace/purpose/privacy inputs valid	Stable Item / ContentItemCreated	workspace/input classification	RegistryCreation
RegisterContentRevision	Content Item; content-upload Action; revision	Provenance/media/size/digest valid; bytes are new intent	Immutable Revision appended / ContentRevisionRegistered	revision, payload/idempotency conflict	ContentProvenance
DecideContentVerification	Content Item decision stream; verifier Action; revision	Exact Revision/digest; verifier policy identified; next sequence	Immutable current Decision / available, quarantined or rejected fact	digest mismatch as decision; stale sequence/revision	ContentVerification
BindContentRevision	Content Item/Binding; product-purpose binding Action; revision	Exact current available Decision; owner object/purpose valid; classification compatible; uniqueness	Active binding pins Revision + Verification Decision / ContentRevisionBound	not available, decision not current, owner/purpose, binding conflict	ContentVerification + owner request evidence
ReleaseContentBinding	Content Binding; owner-authorized release; Content Item revision	Active; owner identity/purpose match; retention impact accepted	Released, history retained / ContentBindingReleased	owner mismatch, retention protected, revision	LifecycleChange

Study Timeline

Command	Target / authority and gates	Preconditions	Success / fact	Refusals	Evidence profile
PlanStudyMilestone	New Milestone; timeline Action	Supported type; exact allowed Scope; uniqueness; Civil Date semantics	Open Milestone with plan / StudyMilestonePlanned	type/scope/uniqueness	RegistryCreation
UpdateStudyMilestoneForecast	Milestone; timeline Action; revision	Open; forecast allowed; reason policy satisfied	Forecast assertion changes; lifecycle remains open / StudyMilestoneForecastUpdated	invalid state/date type/revision	ReasonedCorrection when replacing forecast
AchieveStudyMilestone	Milestone; achievement Action; revision	Open; accepted source/human assertion; actual Civil Date; evidence	Achieved / StudyMilestoneAchieved	source not allowed, invalid state, evidence, revision	HumanAssertion or OwnerConnectionExecution
CorrectStudyMilestoneAchievement	Achieved Milestone; correction Action; revision	Prior assertion identified; replacement and reason/evidence valid	New current assertion; prior retained / StudyMilestoneAchievementCorrected	reason/evidence/revision	ReasonedCorrection
ReverseStudyMilestoneAchievement	Achieved Milestone; reversal Action; revision	Reversal authority; reason; prior assertion exact	Open; current actual cleared, history retained / StudyMilestoneAchievementReversed	invalid state, evidence, revision	LifecycleChange + ReasonedCorrection
CancelStudyMilestone	Open Milestone; timeline Action; revision	Cancellation allowed; reason	Cancelled / StudyMilestoneCancelled	invalid state/type policy/revision	LifecycleChange

Integration delivery

Command	Target / authority and gates	Preconditions	Success / fact	Refusals	Evidence profile
ScheduleProductFactDelivery	New Delivery; authorized connection route	Exact source Fact and active Contract Revision; deterministic idempotency	Pending pinned delivery / ProductFactDeliveryScheduled	contract mismatch, idempotency conflict	OwnerConnectionExecution
RecordTargetAcceptance	Delivery; executing connection; revision	In flight; authenticated exact target receipt; no accepted outcome	Accepted / ProductFactDeliveryAccepted	duplicate idempotent, wrong target/contract, revision	OwnerConnectionExecution
RecordTargetRefusal	Delivery; executing connection; revision	In flight; authoritative target refusal receipt	Target-refused / ProductFactDeliveryRefused	wrong target/contract, revision	OwnerConnectionExecution
RecordRetryableFailure	Delivery; delivery mechanism; revision	No authoritative target outcome; failure classified retryable	Retry scheduled or exhausted / failure fact	outcome already authoritative, retry policy exhausted	OwnerConnectionExecution
RequestReconciliation	Delivery/connection checkpoint; reconciliation Action; revision	Gap/divergence proven; source/target checkpoints supplied	Reconciliation state/evidence / ProductReconciliationRequested	no divergence, insufficient evidence, revision	ReconciliationEvidence

Evidence profiles

Profile	Mandatory evidence
RegistryCreationEvidence	Actor, authority, time, source, command/correlation and created identity
ReasonedCorrectionEvidence	Creation evidence plus expected/prior revision, exact before/after values and reason
LifecycleChangeEvidence	Prior/resulting state, effective time, reason and impact acknowledgement where required
AuthorityChangeEvidence	Grantor authority/delegation, Principal, Role revision, Product, Scope and effective interval
HumanAssertionEvidence	Authenticated first-person actor, exact statement, subject revision, asserted time and authority; no electronic-signature ceremony implied
ElectronicSignatureEvidence	Signer, exact product-supplied meaning, target revision/digest, execution time and accepted ceremony policy; Candidate
OwnerConnectionExecutionEvidence	Initiating actor, executing connection, source fact, contract revision, operation and mapping
ContentProvenanceEvidence	Supplier/source, received time, media metadata and content digest
ContentVerificationEvidence	Exact revision/digest, verifier/rule revision, decision, findings and time
ReconciliationEvidence	Source/target checkpoints, attempts, divergence, reviewer/automated policy and resolution

Identity & Access commands

ReviseRole

Contract element	Specification
Owner / target	Identity & Access / RoleDefinition
Authority	Product-bounded access administration at Workspace scope
Preconditions	Role active; expected revision current; every Action published by home product or approved Platform dependency; scope kinds compatible; administrator continuity preserved
Success	New immutable Role Revision becomes current under the accepted assignment policy; Role revision increments
Facts	RoleRevisionPublished with Role, revision, exact Action keys and compatibility version
Refusals	NOT_AUTHORIZED, EXPECTED_REVISION_CONFLICT, CROSS_PRODUCT_ACTION_NOT_ALLOWED, ACTION_SCOPE_INCOMPATIBLE, CONTINUITY_VIOLATION
Evidence	AuthorityChangeEvidence; exact prior and resulting Action sets

AssignRole

Contract element	Specification
Owner / target	Identity & Access / new AccessAssignment
Authority	Explicit product access-administration Action at equal-or-broader typed scope
Preconditions	Principal available; Role active and same product; scope exists; every Action permits scope kind; interval valid; delegation boundary not exceeded; no prohibited overlap/separation-of-duty conflict
Success	New retained Assignment with Product, typed Scope and half-open interval
Facts	AccessAssigned with assignment identity and effective interval
Refusals	NOT_AUTHORIZED, PRINCIPAL_UNAVAILABLE, ROLE_PRODUCT_MISMATCH, UNSUPPORTED_SCOPE, DELEGATION_SCOPE_EXCEEDED, EFFECTIVE_INTERVAL_CONFLICT, CONTINUITY_VIOLATION
Evidence	AuthorityChangeEvidence

RevokeAssignment

Preconditions: expected revision current, proposed end is not before start, grantor is delegated for the product/scope, and required administrator continuity remains. Success closes future authority; prior Access Decisions remain reconstructable. It never ends Study responsibility.

DecideAccess

Policy operation over current Principal, product Action catalogue, current Role revision policy, effective Assignments, full typed Scope containment and evaluation time. Result is an immutable AccessDecision. It does not inspect EDC/eTMF Aggregate state.

Party Registry commands

RegisterOrganization

Requires Workspace-scoped registry authority and normalized legal/display identity. Similar names may create duplicate-candidate evidence but never establish identity. Success creates an active Organization and OrganizationRegistered. Automatic merge is forbidden.

RegisterPersonProfile

Requires minimum lawful shared identity fields and privacy classification. Duplicate names are valid. Success grants no account, responsibility or Action.

RegisterSite

Contract element	Specification
Preconditions	Operating Organization active and same Workspace; governed country; caller authorized
Success	New active Site with independent identity
Fact	SiteRegistered
Refusals	ORGANIZATION_UNAVAILABLE, WORKSPACE_MISMATCH, invalid country reference
Evidence	RegistryCreationEvidence

CorrectSiteDetails

Name and other accepted presentation corrections use ReasonedCorrectionEvidence. Country change after any Study Site reference returns USED_SITE_COUNTRY_CORRECTION_REQUIRES_MODEL_DECISION; no replacement workflow is implied until the decision ledger resolves it.

Study Registry commands

RegisterStudy

Contract element	Specification
Authority	Platform Study registration at Workspace scope
Preconditions	Sponsor Organization active/same Workspace; sponsor-aware protocol identifier and title valid
Duplicate policy	Similarity produces a non-authoritative candidate; the open decision determines warn/override/refuse behavior
Success	New canonical Study identity in registered availability
Fact	StudyRegistered
Refusals	SPONSOR_UNAVAILABLE, WORKSPACE_MISMATCH, DUPLICATE_DECISION_REQUIRED only if selected policy demands it
Evidence	RegistryCreationEvidence plus duplicate rule revision/result

UpdateStudyRegistryDetails

Corrects only approved registry presentation fields with expected revision and reason. It cannot change studyId, move product roots, change protocol meaning or silently transfer Sponsor. Success emits StudyRegistryDetailsUpdated with exact before/after values.

MergeDuplicateStudy

Unsupported pending decision. Until product-root and reversal semantics are accepted, requests after any EDC/eTMF root exists return STUDY_MERGE_REQUIRES_MODEL_DECISION. The documentation must not imply that a safe merge workflow exists.

PlanStudyCountry

Requires available Study, governed Country, uniqueness of retained Study/country coordinate, and Platform authority. Success creates an independently addressable StudyCountry and StudyCountryPlanned; it does not enable either product or assert regulatory approval.

AssociateSiteWithStudy

Contract element	Specification
Preconditions	Study, Study Country and Site available; all same Workspace; Study Country belongs to Study; Site country matches; Site not already associated under Core rule; site number available
Concurrency	Site association and site-number reservation are one accepted intent; one competing command wins
Success	New open Study Site with immutable Study/Country/Site references
Fact	SiteAssociatedWithStudy
Refusals	REFERENCE_UNAVAILABLE, STUDY_COUNTRY_MISMATCH, SITE_COUNTRY_MISMATCH, SITE_ALREADY_ASSOCIATED, STUDY_SITE_NUMBER_CONFLICT
Evidence	RegistryCreationEvidence plus uniqueness coordinates

CorrectStudySiteNumber

Requires expected revision, non-empty reason and a number not reserved under the approved reuse policy. Success changes the presentation/business identifier while retaining studySiteId, prior value and correction lineage. EDC/eTMF consume a versioned correction fact and never rematch by number.

CloseStudySite / ReopenStudySite

Change only shared registry availability. Neither command activates, disables, closes, reopens or deletes EDC/eTMF state. Impact acknowledgements may be required but cannot manufacture product decisions.

Clinical Coordination commands

AddStudyPartyParticipation

Requires one available Party, one valid exact Scope, a governed Responsibility permitting that Party kind and Scope kind, and a non-conflicting half-open interval. Success creates responsibility only; it grants no Action. Primary Sponsor is refused as Participation in the initial catalogue.

ReplaceStudyPartyParticipation

One intent atomically ends the predecessor and creates the successor at a deterministic boundary. It requires expected predecessor revision, reason/source evidence and no resulting overlap. Facts retain predecessor/successor lineage. Access is unchanged; an explicit policy may propose an access review.

EndStudyPartyParticipation

Ends business responsibility at an exact effective time. It cannot be submitted as authority to end an Access Assignment.

Account & Environment commands

GrantProductEntitlement

Creates/restores one retained entitlement per Workspace × Software Product. It grants no Actions and creates no product root.

WithdrawProductEntitlement

Requires expected revision and reason. It blocks new ordinary requests and new enablement after its decision point. It does not disable an existing product, delete records or rewrite in-flight operations. Treatment of an already-accepted enablement is an unresolved decision.

Suite Composition commands

RequestStudyProductEnablement

Contract element	Specification
Preconditions	Study available; applicable entitlement decision is entitled; enablement is absent for first enable or disabled for re-enable; exact product connection revision active; caller authorized
Success	First enable creates the retained Workspace × Study × Product enablement identity in enable-requested state; re-enable changes disabled → enable-requested; both use a new Operation ID
Fact	StudyProductEnablementRequested
Refusals	PRODUCT_NOT_ENTITLED, ENTITLEMENT_DECISION_UNAVAILABLE, INVALID_ENABLEMENT_STATE, CONTRACT_REVISION_MISMATCH
Evidence	Entitlement receipt, actor authority, Study/product/operation and contract revision

AcknowledgeStudyProductEnabled

Only the target product connection can acknowledge. Product, Study, Operation ID, contract revision and expected enablement state must all match. Success records the opaque product-root reference and enabled state. Old-cycle acknowledgement returns STALE_OPERATION_ACKNOWLEDGEMENT.

RequestStudyProductDisablement / acknowledgement

Disable coordinates the owner request and acknowledgement. It never states that product data was deleted. Re-enable creates a new Operation ID. Lost acknowledgements, root reuse and inspection-mode access remain explicit decision-ledger items.

Content commands

RegisterContentRevision

Creates immutable byte/provenance metadata under one Content Item using ContentProvenanceEvidence. New bytes always create a new revision. Equal digest may permit physical deduplication later, but never collapses business provenance.

DecideContentVerification

Pins the exact Content Revision/digest and verifier policy revision. Success records an append-only available, quarantined or rejected Decision. It does not mutate the registered bytes or imply EDC semantic validation/eTMF quality acceptance.

BindContentRevision

Requires a current available verification decision, authorized owner/purpose, exact product object reference and compatible privacy/blind handling. Success records binding evidence. It does not create a TMF Document or adopt an EDC Design.

Study Timeline commands

PlanStudyMilestone

Initial scope permits only the governed site_activated type at Study Site scope, one retained identity and Civil Date semantics. Wider types/scopes require promotion.

AchieveStudyMilestone

Requires open Milestone, source/attestation allowed by the type, actual Civil Date and evidence. Success changes open → achieved. Forecast never changes lifecycle.

CorrectStudyMilestoneAchievement

Retains the earlier actual/source assertion and supplies a superseding assertion with reason. It does not rewrite the originating product fact.

ReverseStudyMilestoneAchievement

Changes achieved → open, clears only the current assertion, retains all achievement/reversal evidence and does not reopen a closed Study Site or mutate products.

Integration delivery commands

ScheduleProductFactDelivery

Pins one exact source Fact, one Contract Revision, target intent and deterministic idempotency key.

RecordTargetAcceptance

Requires authenticated target receipt for the pinned intent. At most one accepted outcome exists per idempotency key.

RecordTargetRefusal

Records an ordinary target-domain refusal distinctly from transport failure. It cannot change the source fact.

RecordRetryableFailure

Permits retry only when no authoritative target acceptance/refusal exists. Retry cannot change source fact, mapping or target intent.

RequestReconciliation

Records detected gap/divergence and proposed recovery. Reconciliation invokes ordinary owner commands; it never edits another context directly.