---
id: TST-ACC-CLS-016
title: 'Calendar, readiness and authorization API boundary'
kind: api-lifecycle
product_area: accounting
module: close
revision: 1
status: draft
source_sha:
  services-accounting: f47cb263875bbc0c5640fba7dae6785ec32695f8
repository: services-accounting
files:
  - modules/fiscal-close/tests/e2e/fiscal-close-readiness.e2e.spec.js
implements:
  - ATS-ACC-CLS-001-01
  - ATS-ACC-CLS-001-04
  - ATS-ACC-CLS-002-03
  - ATS-ACC-CLS-004-03
  - ATS-ACC-CLS-004-06
  - ATS-ACC-CLS-004-07
  - ATS-ACC-CLS-004-09
environment: local
implementation_state: implemented
latest_result: not-run
latest_run_at: null
latest_run_ref: null
conformance: not-verified
estimated_minutes: 3
isolation: >-
  The suite owns test-identifier workspaces and fixture records, removed by its
  teardown.
binding_policy: >-
  Each binding identifies the assertions this suite executes; combined scenarios
  may require other bound suites. Existence is not a recorded execution result.
evidence:
  - >-
    services-accounting:modules/fiscal-close/tests/e2e/fiscal-close-readiness.e2e.spec.js
  - provenance: test
    source: >-
      services-accounting:modules/fiscal-close/tests/e2e/fiscal-close-readiness.e2e.spec.js
    assertion_titles:
      - fiscal close read routes (end to end)
      - the periods
      - answers 200 with the unit and its years
      - marks September 2026 current
      - refuses a request without business_unit_id with 400
      - answers 404 for a unit the tenant does not have
      - refuses a principal without accounting.fiscal-periods.read with 403
      - the readiness
      - >-
        answers 200, ready, to a closer: the slice carries the close key the
        route evaluates
      - 'answers a reader not ready, blocked by close_authorization alone'
      - adds the year checks for the fiscal_year scope
      - refuses a period number out of range with 400
      - refuses an unknown scope with 400
      - answers 404 for a year of another tenant
      - 'answers B its own September, never A’s (B’s open batch blocks it)'
      - refuses a principal without accounting.fiscal-periods.read with 403
      - the authorization
      - lets a closer close September
      - tells a reader they may not close
      - refuses a principal without accounting.fiscal-periods.read with 403
real_dependencies: >-
  The local dispatcher, access and permission enforcement, domain services and
  database are exercised. Signing keys and workspace registration use local
  fixtures, and durable jobs use the in-process runner. This is a local API
  test, not a deployed authentication or workflow test.
product_intent: proposed
implementation_evidence: observed
---
# Calendar, readiness and authorization API boundary

## Verification Boundary

The suite exercises the local public API dispatcher with signed request contexts and PostgreSQL. Durable work uses the in-process runner. AWS workflow delivery and a deployed console are outside this verification boundary.

## What This Suite Proves

The local API suite reads calendars, readiness scopes and action authorization for readers and closers. It checks malformed requests, missing read authority and foreign workspace subjects.

## What It Does Not Prove

This register records assertion scope without claiming a passing run or complete coverage of every rule and scenario variant.

## Real Dependencies and Test Doubles

The local dispatcher, access and permission enforcement, domain services and database are exercised. Signing keys and workspace registration use local fixtures, and durable jobs use the in-process runner. This is a local API test, not a deployed authentication or workflow test.

## Must Not Be Doubled

Keep the dispatcher’s enforced grants, request validation, production persistence and database constraints real. A local runner cannot substitute for deployed workflow qualification.