# TASK IMPLEMENTATION — WS-001B

## Workspace Provisioning Business Logic

You are implementing exactly one Sprint 3 task.

Current completed tasks:

* Sprint 0 ✅
* Sprint 1 ✅
* Sprint 2 ✅
* Database Foundation ✅
* S3-002 Security Hardening ✅
* S3-003 WorkspaceMiddleware ✅
* WS-001A Workspace Foundation ✅

This task implements ONLY the business logic for Workspace Provisioning.

Do not modify controllers, validators, routes, or views except where absolutely required for dependency injection.

---

# Mandatory Reading

Read:

* AI.md v1.1
* SPRINT3_PLANNING.md
* SPRINT3_EXECUTION_GUIDE.md
* WS-001A implementation memory

If documentation conflicts exist:

STOP.

Report.

Wait.

---

# Objective

Implement the Workspace Provisioning business workflow.

Business logic belongs exclusively inside the Service Layer.

Database access belongs exclusively inside the Model Layer.

---

# Files Allowed

## New Files

```
app/modules/Workspace/WorkspaceService.php

app/modules/Workspace/WorkspaceModel.php
```

## Modified Files

Only if dependency injection requires it:

```
app/modules/Workspace/WorkspaceController.php
```

No other files may be modified.

---

# Service Responsibilities

WorkspaceService owns the provisioning transaction.

The service shall:

* beginTransaction()
* provision workspace
* provision Couple user
* provision retention policy
* provision invitation
* provision invitation sections
* provision default message templates
* provision printer configuration
* commit
* rollback on any failure

The service owns ALL business rules.

No SQL outside WorkspaceModel.

No nested transactions.

---

# Model Responsibilities

WorkspaceModel executes ONLY parameterized PDO queries.

No business logic.

No presentation.

No transactions.

No session access.

Every workspace-scoped query must use parameterized SQL.

---

# Provisioning Order

Execute atomically:

1. Create workspace
2. Create Couple account
3. Create retention policy
4. Create invitation
5. Create default invitation sections
6. Create default message templates
7. Create printer configuration
8. Write audit log
9. Commit transaction

Any failure:

Rollback everything.

---

# Security

Verify:

* PDO prepared statements only.
* No SQL concatenation.
* Password generated securely.
* Temporary password never logged.
* Audit log contains no secrets.
* Slug uniqueness checked before insert.
* Transaction ownership remains inside WorkspaceService.

---

# Constraints

Do NOT:

* modify WorkspaceMiddleware
* modify Validator logic
* modify routes
* modify database schema
* modify authentication module
* modify app/core/*
* modify Router
* modify BaseController
* modify MiddlewarePipeline
* perform git operations

---

# Verification

Run:

* php -l on every modified PHP file.

Verify:

* rollback path
* commit path
* transaction ownership
* parameterized SQL
* audit logging
* password generation
* default data creation
* no nested transaction

---

# Acceptance Criteria

PASS only if:

* WorkspaceService created.
* WorkspaceModel created.
* Transaction implemented.
* Rollback implemented.
* Commit implemented.
* Workspace created atomically.
* Couple account created.
* Default configuration created.
* Audit log written.
* No SQL outside Model.
* No business logic outside Service.
* PHP syntax passes.
* Scope respected.

---

# Output

Provide:

1. Files created.
2. Files modified.
3. Transaction workflow.
4. Provisioning workflow.
5. Rollback strategy.
6. Audit strategy.
7. Acceptance checklist.
8. PHP syntax results.
9. Confirmation no other Sprint 3 task was started.

Stop after the implementation report.

Wait for Human Approval.