Remove Verified-Stale Ownership Mappings

Use this task for stale saved ownership mappings across policies. Cleanup removes Policy’s mapping, not a native Policy Integration Manager (PIM) object. For a current policy incident, start with policy ownership reconciliation. A binding maps a Policy reference key to a native object’s identifier. Stale means current, complete evidence proves the saved mapping no longer applies. Age alone does not establish that.

Prerequisites

Prepare the following:

• Obtain policy:system-configure for all operations in this task.
• Confirm complete live PIM inventory access with the integration owner.
• Use the application programming interface (API) request setup.
• Retain an approved incident reason and the exact selected evidence.

Do not use this task to bypass active publication or withdrawal. Do not delete native objects to make a cleanup decision succeed.

Enumerate One Saved Registry Version

Complete the following steps:

1. Request the first page:

   curl --silent --show-error --include --cacert "$PPC_CA_FILE" \
     -H "@${POLICY_AUTH_HEADER:?Complete authentication setup}" \
     "${POLICY_API}/pim-reconciliations/bindings?limit=100&offset=0"
   

   Retain the strong ETag, target, ownership version, total, bindings, and nextOffset.

2. Set REGISTRY_ETAG to the exact first-page header value, including its quotes. Do not reconstruct it from another resource’s version.

3. Request each later page with that same token. Set OFFSET to the previous response’s non-null nextOffset:

   curl --silent --show-error --include --cacert "$PPC_CA_FILE" \
     -H "@${POLICY_AUTH_HEADER:?Complete authentication setup}" \
     -H "If-Match: ${REGISTRY_ETAG}" \
     "${POLICY_API}/pim-reconciliations/bindings?limit=100&offset=${OFFSET}"
   

4. Continue until nextOffset becomes null. Confirm that the collected unique mappings match the reported total.

5. Restart from offset zero if any page returns 412. Discard the mixed-version listing rather than adding a new token midway.

A later-page 428 means the request omitted its required precondition. A 404 can mean the ownership registry does not exist. Enumeration lists saved reference keys and native unique identifiers (UIDs). It does not read native inventory or establish cleanup safety.

Inspect Selected Mappings

Inspect the selected mappings against live evidence:

1. Select only the saved keys relevant to the incident. Use up to 100 keys per inspection, not guessed native names.

2. Inspect the selected key. Set REF_KEY to an enumerated key:

   curl --silent --show-error --include --cacert "$PPC_CA_FILE" --get \
     -H "@${POLICY_AUTH_HEADER:?Complete authentication setup}" \
     --data-urlencode "refKey=${REF_KEY}" \
     "${POLICY_API}/pim-reconciliations"
   

   For multiple keys, repeat the refKey query parameter.

3. Confirm that each selected mapping reports missing. Compare its persistedUid with your selected saved mapping.

4. Confirm that every selected blockingPolicyIds list is empty. Do not bypass active or unfinished policy work.

5. Confirm that writerPending is false. Retain the target, governedSetGeneration, ownership version, and this inspection’s registry ETag.

Stop on 503: unavailable inventory cannot prove native absence. Restore complete dependency access, then inspect again. Also stop for live identities, blocking policies, or a pending writer. Do not manually clear those blockers.

Forget Only the Verified Mappings

Complete the following steps:

1. Prepare forget_stale_bindings using the global decision contract. Include the inspected target, selected reference-to-UID mappings, reason, and governed-set generation.
2. Put the inspection’s strong registry ETag in If-Match. A draft or governed-policy validator cannot substitute for it.
3. Assign an Idempotency-Key to the exact decision. Retain the original request and key for uncertain-result recovery.
4. Submit POST /pim-reconciliations. A successful 200 response identifies the reconciliation, new ownership version, and forgotten mappings.
5. Enumerate the current registry again. Confirm that the selected mappings no longer appear.

For 409 or 412, inspect the changed registry and policy context again. Reconsider the decision before sending new evidence with a new key. After a lost response, replay only the identical original decision with its original key. Never reuse that key for different mappings, evidence, or intent.

Verification and Escalation

Match the returned forgotten mappings against the approved selection. Confirm their absence from a consistent current registry listing. Do not report native resource deletion: this operation does not perform it.

Stop when inventory, blockers, or current decision evidence remain uncertain. Use the diagnostic handoff instead of broadening the cleanup scope.