---
id: ATS-MBR-STR-014
scope: CAP-MBR-STR-014
product_area: membership
module: structure
revision: 2
status: proposed
approved_by: null
approved_at: null
source_sha:
  services-membership: 5994c270e8a37a30f848e99ba5b5ee6b87c08893
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
scenarios:
  - id: ATS-MBR-STR-014-01
    title: Policy list size and replacement identity are explicit
    level: api
    proves:
      - BR-CAP-MBR-STR-014-01
    preconditions: >-
      An isolated Membership-licensed workspace contains the relevant records, with caller permissions
      selected for the case.
    steps: 'Compare lists of 200 and 201 cases, then resubmit the allowed list.'
    expected: The oversized list fails and replacement allocates new case identities.
    negative: true
    data_needs: The FAA example records or equivalent records prepared within the isolated workspace.
    bound_to:
      - >-
        services-membership:tests/acceptance/configuration/MBR-ACC-0106.acceptance.ts#MBR-ACC-0106:
        Change policy sets are kept exactly as written: every policy field round-trips with its defaults,
        the list is rewritten whole with new ids, two hundred policies fit and the two-hundred-and-first
        does not, a policy naming both a type and a package on one side is refused raw, and ids nobody
        checks are accepted
      - TST-MBR-STR-046
    provenance: test
    source: >-
      services-membership:tests/acceptance/configuration/MBR-ACC-0106.acceptance.ts#MBR-ACC-0106: Change
      policy sets are kept exactly as written: every policy field round-trips with its defaults, the list
      is rewritten whole with new ids, two hundred policies fit and the two-hundred-and-first does not, a
      policy naming both a type and a package on one side is refused raw, and ids nobody checks are
      accepted
    category: boundary
  - id: ATS-MBR-STR-014-02
    title: A change side cannot specify two selectors
    level: api
    proves:
      - BR-CAP-MBR-STR-014-02
    preconditions: >-
      An isolated Membership-licensed workspace contains the relevant records, with caller permissions
      selected for the case.
    steps: Submit both a source type and source package in one policy.
    expected: The write fails and identifies the source package selector.
    negative: true
    data_needs: The FAA example records or equivalent records prepared within the isolated workspace.
    bound_to:
      - >-
        services-membership:tests/acceptance/configuration/MBR-ACC-0106.acceptance.ts#MBR-ACC-0106:
        Change policy sets are kept exactly as written: every policy field round-trips with its defaults,
        the list is rewritten whole with new ids, two hundred policies fit and the two-hundred-and-first
        does not, a policy naming both a type and a package on one side is refused raw, and ids nobody
        checks are accepted
      - TST-MBR-STR-046
    provenance: test
    source: >-
      services-membership:tests/acceptance/configuration/MBR-ACC-0106.acceptance.ts#MBR-ACC-0106: Change
      policy sets are kept exactly as written: every policy field round-trips with its defaults, the list
      is rewritten whole with new ids, two hundred policies fit and the two-hundred-and-first does not, a
      policy naming both a type and a package on one side is refused raw, and ids nobody checks are
      accepted
    category: validation
  - id: ATS-MBR-STR-014-03
    title: Package references protect stored change policies
    category: interaction
    level: api
    proves:
      - BR-CAP-MBR-STR-012-08
      - BR-CAP-MBR-STR-014-01
    preconditions: An isolated workspace contains the records and current versions needed for the case.
    steps: >-
      Save a policy set, reference it from a package and try deleting the policy set at its current
      version.
    expected: The package remains readable and the referenced policy set cannot be removed.
    negative: false
    data_needs: Separate fixture records for the accepted and refused operations.
    bound_to: []
    provenance: proposed
    source:
      - >-
        services-membership:tests/e2e/database-refusals.e2e.spec.ts#mistakes only the database catches,
        through the API › DEF-MBR-0086: a configuration write a check, a foreign key or an integer column
        refuses › refuses a change policy set that does not exist 400 naming change_policy_set_id
      - >-
        services-membership:modules/configuration/services/configuration/configuration-records.ts:policySetResource
    exercises:
      - CAP-MBR-STR-014
      - CAP-MBR-STR-012
  - id: ATS-MBR-STR-014-04
    title: Workspace authority gates this capability
    category: permission
    level: api
    proves:
      - BR-CAP-MBR-STR-019-02
    preconditions: An isolated workspace contains the records and current versions needed for the case.
    steps: >-
      Exercise the capability’s exposed operations with its read-only and management callers, then repeat
      with application access removed, an unlicensed workspace and an unavailable workspace.
    expected: >-
      Each named operation requires its declared authority; admission failures occur before any record or
      calculated result is exposed.
    negative: true
    data_needs: Separate fixture records for the accepted and refused operations.
    bound_to: []
    provenance: proposed
    source:
      - >-
        services-membership:tests/unit/route-authorization.spec.ts#route authorization: every Membership
        operation names its permission › requires membership.structure.read of every structure read and
        membership.structure.manage of every change
      - >-
        services-membership:modules/configuration/aws/api/configuration.routes.ts:configurationModuleRoutes
      - >-
        services-membership:tests/e2e/terms-api.e2e.spec.ts#the terms API, end to end in process ›
        refuses a caller who holds no key in the tenant
    exercises:
      - CAP-MBR-STR-014
      - CAP-MBR-STR-019
evidence:
  - 'services-membership:tests/acceptance/configuration/MBR-ACC-0106.acceptance.ts'
  - >-
    services-membership:modules/configuration/services/configuration/configuration-records.ts:policySetResource
  - 'services-membership:modules/configuration/db/change-policies.table.ts:changePolicies'
  - >-
    services-membership:modules/configuration/services/configuration/configuration-records.ts:policyContent
  - 'services-membership:docs/migrations/membership-core/README.md#Tables and migrations'
  - >-
    services-membership:tests/acceptance/configuration/MBR-ACC-0106.acceptance.ts#MBR-ACC-0106: Change
    policy sets are kept exactly as written: every policy field round-trips with its defaults, the list
    is rewritten whole with new ids, two hundred policies fit and the two-hundred-and-first does not, a
    policy naming both a type and a package on one side is refused raw, and ids nobody checks are
    accepted
  - >-
    services-membership:tests/e2e/database-refusals.e2e.spec.ts#mistakes only the database catches,
    through the API › DEF-MBR-0086: a configuration write a check, a foreign key or an integer column
    refuses › refuses a change policy set that does not exist 400 naming change_policy_set_id
  - membership.configuration.read
  - membership.configuration.manage
  - membership.application.access
  - >-
    services-membership:tests/unit/route-authorization.spec.ts#route authorization: every Membership
    operation names its permission › requires membership.structure.read of every structure read and
    membership.structure.manage of every change
  - 'services-membership:modules/configuration/aws/api/configuration.routes.ts:configurationModuleRoutes'
  - >-
    services-membership:tests/e2e/terms-api.e2e.spec.ts#the terms API, end to end in process › refuses a
    caller who holds no key in the tenant
coverage:
  rule: 'gap: FND-MBR-STR-067'
  transition: 'gap: FND-MBR-STR-067'
  validation: covered
  permission: covered
  edge: 'gap: FND-MBR-STR-067'
  failure: 'gap: FND-MBR-STR-067'
  boundary: covered
  concurrency: 'gap: FND-MBR-STR-067'
  invariant: 'gap: FND-MBR-STR-067'
  interaction: covered
coverage_notes:
  rule: >-
    No dedicated scenario establishes this category across the capability’s declared operations and
    design obligations.
  transition: >-
    No dedicated scenario establishes this category across the capability’s declared operations and
    design obligations.
  edge: >-
    No dedicated scenario establishes this category across the capability’s declared operations and
    design obligations.
  failure: >-
    No dedicated scenario establishes this category across the capability’s declared operations and
    design obligations.
  concurrency: >-
    No dedicated scenario establishes this category across the capability’s declared operations and
    design obligations.
  invariant: >-
    No dedicated scenario establishes this category across the capability’s declared operations and
    design obligations.
unproved_rules: []
coverage_obligations:
  permissions:
    - key: membership.configuration.read
      scenario_ids:
        - ATS-MBR-STR-019-02
      local_scenario_ids:
        - ATS-MBR-STR-014-04
      coverage: partial
      gap: FND-MBR-STR-067
      provenance: unknown
      source: FND-MBR-STR-067
      note: >-
        These cases establish declared authority or representative admission; exhaustive operation and
        caller combinations remain open.
    - key: membership.configuration.manage
      scenario_ids:
        - ATS-MBR-STR-019-02
      local_scenario_ids:
        - ATS-MBR-STR-014-04
      coverage: partial
      gap: FND-MBR-STR-067
      provenance: unknown
      source: FND-MBR-STR-067
      note: >-
        These cases establish declared authority or representative admission; exhaustive operation and
        caller combinations remain open.
    - key: membership.application.access
      scenario_ids:
        - ATS-MBR-STR-019-04
      local_scenario_ids:
        - ATS-MBR-STR-014-04
      coverage: partial
      gap: FND-MBR-STR-067
      provenance: unknown
      source: FND-MBR-STR-067
      note: >-
        These cases establish declared authority or representative admission; exhaustive operation and
        caller combinations remain open.
  state_models:
    - id: STATE-MBR-STR-006
      transitions:
        - from: active
          to: inactive
          trigger: Staff save activity false.
          provenance: unknown
          source: FND-MBR-STR-067
          scenario_ids: []
          coverage: gap
          gap: FND-MBR-STR-067
        - from: inactive
          to: active
          trigger: Staff save activity true.
          provenance: unknown
          source: FND-MBR-STR-067
          scenario_ids: []
          coverage: gap
          gap: FND-MBR-STR-067
        - from: active
          to: deleted
          trigger: Staff delete an active record.
          provenance: unknown
          source: FND-MBR-STR-067
          scenario_ids: []
          coverage: gap
          gap: FND-MBR-STR-067
        - from: inactive
          to: deleted
          trigger: Staff delete an inactive record.
          provenance: unknown
          source: FND-MBR-STR-067
          scenario_ids: []
          coverage: gap
          gap: FND-MBR-STR-067
      gap: FND-MBR-STR-067
  related:
    - capability: CAP-MBR-STR-012
      scenario: ATS-MBR-STR-014-03
      provenance: proposed
  invariants:
    - id: INV-DOM-MBR-STR-004-01
      scenario_ids: []
      coverage: gap
      gap: FND-MBR-STR-067
      provenance: unknown
      source: FND-MBR-STR-067
    - id: INV-DOM-MBR-STR-004-02
      scenario_ids: []
      coverage: gap
      gap: FND-MBR-STR-067
      provenance: unknown
      source: FND-MBR-STR-067
    - id: INV-DOM-MBR-STR-004-03
      scenario_ids: []
      coverage: gap
      gap: FND-MBR-STR-067
      provenance: unknown
      source: FND-MBR-STR-067
    - id: INV-DOM-MBR-STR-004-04
      scenario_ids: []
      coverage: gap
      gap: FND-MBR-STR-067
      provenance: unknown
      source: FND-MBR-STR-067
    - id: INV-DOM-MBR-STR-004-05
      scenario_ids: []
      coverage: gap
      gap: FND-MBR-STR-067
      provenance: unknown
      source: FND-MBR-STR-067
    - id: INV-DOM-MBR-STR-004-06
      scenario_ids: []
      coverage: gap
      gap: FND-MBR-STR-067
      provenance: unknown
      source: FND-MBR-STR-067
    - id: INV-DOM-MBR-STR-004-07
      scenario_ids: []
      coverage: gap
      gap: FND-MBR-STR-067
      provenance: unknown
      source: FND-MBR-STR-067
  workflows:
    - id: WF-MBR-STR-005
      scenarios:
        - ATS-MBR-STR-014-03
      unproved_failure_and_concurrency: FND-MBR-STR-067
      provenance: unknown
      source: FND-MBR-STR-067
  workflow_interactions:
    - workflow: WF-MBR-STR-005
      capability: CAP-MBR-STR-018
      scenario_ids:
        - ATS-MBR-STR-018-13
      coverage: specified
      gap: null
      provenance: documented
      source:
        - ATS-MBR-STR-018-13
      note: Cross-capability examples are cited from their owning specifications.
    - workflow: WF-MBR-STR-005
      capability: CAP-MBR-STR-009
      scenario_ids: []
      coverage: gap
      gap: FND-MBR-STR-067
      provenance: unknown
      source: FND-MBR-STR-067
      note: >-
        The shared workflow names both capabilities, but a concrete interaction oracle is not established
        for this pairing.
    - workflow: WF-MBR-STR-005
      capability: CAP-MBR-STR-010
      scenario_ids: []
      coverage: gap
      gap: FND-MBR-STR-067
      provenance: unknown
      source: FND-MBR-STR-067
      note: >-
        The shared workflow names both capabilities, but a concrete interaction oracle is not established
        for this pairing.
    - workflow: WF-MBR-STR-005
      capability: CAP-MBR-STR-011
      scenario_ids: []
      coverage: gap
      gap: FND-MBR-STR-067
      provenance: unknown
      source: FND-MBR-STR-067
      note: >-
        The shared workflow names both capabilities, but a concrete interaction oracle is not established
        for this pairing.
    - workflow: WF-MBR-STR-005
      capability: CAP-MBR-STR-017
      scenario_ids: []
      coverage: gap
      gap: FND-MBR-STR-067
      provenance: unknown
      source: FND-MBR-STR-067
      note: >-
        The shared workflow names both capabilities, but a concrete interaction oracle is not established
        for this pairing.
rule_coverage:
  - rule: BR-CAP-MBR-STR-014-01
    scenarios:
      - ATS-MBR-STR-014-01
      - ATS-MBR-STR-014-03
    gap: null
    provenance: documented
    source:
      - >-
        services-membership:tests/acceptance/configuration/MBR-ACC-0106.acceptance.ts#MBR-ACC-0106:
        Change policy sets are kept exactly as written: every policy field round-trips with its defaults,
        the list is rewritten whole with new ids, two hundred policies fit and the two-hundred-and-first
        does not, a policy naming both a type and a package on one side is refused raw, and ids nobody
        checks are accepted
      - >-
        services-membership:tests/e2e/database-refusals.e2e.spec.ts#mistakes only the database catches,
        through the API › DEF-MBR-0086: a configuration write a check, a foreign key or an integer column
        refuses › refuses a change policy set that does not exist 400 naming change_policy_set_id
      - >-
        services-membership:modules/configuration/services/configuration/configuration-records.ts:policySetResource
  - rule: BR-CAP-MBR-STR-014-02
    scenarios:
      - ATS-MBR-STR-014-02
    gap: null
    provenance: documented
    source:
      - >-
        services-membership:tests/acceptance/configuration/MBR-ACC-0106.acceptance.ts#MBR-ACC-0106:
        Change policy sets are kept exactly as written: every policy field round-trips with its defaults,
        the list is rewritten whole with new ids, two hundred policies fit and the two-hundred-and-first
        does not, a policy naming both a type and a package on one side is refused raw, and ids nobody
        checks are accepted
narrative_sources:
  - section: Coverage
    provenance: documented
    source:
      - CAP-MBR-STR-014
      - FND-MBR-STR-067
  - section: Interactions With Related Capabilities
    provenance: proposed
    source:
      - ATS-MBR-STR-014-03
---

# Record policies for future package changes: Capability Test Specification

## Coverage

The coverage map distinguishes specified examples from missing proof. A covered category means an expected case is specified; executable bindings and their run results remain separate evidence. Each required rule has a proof link or an explicit coverage finding in the structured rule ledger.

| Required Rule | Scenario or Finding |
|---|---|
| `BR-CAP-MBR-STR-014-01` | `ATS-MBR-STR-014-01`, `ATS-MBR-STR-014-03` |
| `BR-CAP-MBR-STR-014-02` | `ATS-MBR-STR-014-02` |

## Interactions With Related Capabilities

Package references protect stored change policies. Save a policy set, reference it from a package and try deleting the policy set at its current version.