--- id: ATS-PFM-CSH-016 scope: CAP-PFM-CSH-016 product_area: platform module: console-shell revision: 3 status: proposed approved_by: null approved_at: null source_sha: react-console: baf6dae382d6f41dce976c7f848667ccc37e076f services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 rhythm-v2-docs: 25e253cb434aac6603ee294e3ca197ab6c4bfd0b scenarios: - id: ATS-PFM-CSH-016-01 title: A coded refusal refreshes offered applications level: browser proves: - BR-CAP-PFM-CSH-016-01 preconditions: CRM and Membership are offered before mock CRM requests begin failing. steps: Navigate to Tasks to trigger the application-refusal signal. expected: The refreshed sidebar removes CRM and keeps Membership visible. negative: false data_needs: >- An isolated browser context with the stated identity, workspace and response fixtures. bound_to: - TST-PFM-CSH-011 provenance: test source: >- react-console:e2e/mock/application-access.mock.spec.ts#brings the launcher up to date instead of leaving it offering what is gone category: interaction test_sources: - >- react-console:e2e/mock/application-access.mock.spec.ts#brings the launcher up to date instead of leaving it offering what is gone action_evidence: provenance: test source: >- react-console:e2e/mock/application-access.mock.spec.ts#brings the launcher up to date instead of leaving it offering what is gone assertion_evidence: provenance: test source: >- react-console:e2e/mock/application-access.mock.spec.ts#brings the launcher up to date instead of leaving it offering what is gone - id: ATS-PFM-CSH-016-02 title: Only recognized application refusals notify listeners level: unit proves: - BR-CAP-PFM-CSH-016-01 - BR-CAP-PFM-CSH-016-02 preconditions: Error fixtures cover both application codes and unrelated failures. steps: Classify the errors and publish them to subscribed listeners. expected: >- Recognized codes notify each active listener once; unrelated failures produce no application notification. negative: true data_needs: Independent fixture inputs for the variants listed in this case. bound_to: - TST-PFM-CSH-030 provenance: test source: >- react-console:lib/security-context/application-refusal.test.ts#reads the two application codes off a 403 category: validation test_sources: - >- react-console:lib/security-context/application-refusal.test.ts#reads the two application codes off a 403 - >- react-console:lib/security-context/application-refusal.test.ts#leaves every other refusal alone - >- react-console:lib/security-context/application-refusal.test.ts#calls every listener once, with the code action_evidence: provenance: test source: >- react-console:lib/security-context/application-refusal.test.ts#reads the two application codes off a 403 assertion_evidence: provenance: test source: >- react-console:lib/security-context/application-refusal.test.ts#reads the two application codes off a 403 - id: ATS-PFM-CSH-016-03 title: An aged returning tab requests new application data level: unit proves: - BR-CAP-PFM-CSH-016-03 preconditions: The tab’s recorded application timestamp is six minutes old. steps: Bring the visible tab back to the foreground. expected: The provider requests an application refresh. negative: false data_needs: Independent fixture inputs for the variants listed in this case. bound_to: [] provenance: proposed source: 'react-console:lib/security-context/provider.tsx:SecurityContextProvider' category: boundary test_sources: [] action_evidence: provenance: proposed source: 'react-console:lib/security-context/provider.tsx:SecurityContextProvider' assertion_evidence: provenance: proposed source: 'react-console:lib/security-context/provider.tsx:SecurityContextProvider' - id: ATS-PFM-CSH-016-04 title: A late refresh cannot install the previous workspace’s list level: unit proves: - BR-CAP-PFM-CSH-016-06 preconditions: An application read remains pending while another workspace is entered. steps: Complete the old read after the workspace change. expected: >- The new workspace’s held application list is not replaced by the superseded response. negative: true data_needs: Independent fixture inputs for the variants listed in this case. bound_to: [] provenance: proposed source: 'react-console:lib/security-context/provider.tsx:refreshApplications' category: concurrency test_sources: [] action_evidence: provenance: proposed source: 'react-console:lib/security-context/provider.tsx:refreshApplications' assertion_evidence: provenance: proposed source: 'react-console:lib/security-context/provider.tsx:refreshApplications' - id: ATS-PFM-CSH-016-05 title: A narrow refresh retains the other access snapshots category: invariant level: browser proves: - BR-CAP-PFM-CSH-016-04 - INV-DOM-PFM-CSH-004-04 preconditions: >- Roles, rules and reachable workspaces are distinctive; the next answer changes all fields. steps: Complete an application refresh and compare each held field. expected: >- Applications and features change while roles, rules and reachable workspaces remain the earlier snapshot. negative: false data_needs: >- A fresh browser context, isolated account fixtures and controlled responses for the listed transitions. bound_to: [] provenance: proposed source: >- rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-016-keep-the-menu-current-when-what-a-person-may-open-changes.md test_sources: [] action_evidence: provenance: proposed source: >- rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-016-keep-the-menu-current-when-what-a-person-may-open-changes.md assertion_evidence: provenance: proposed source: >- rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-016-keep-the-menu-current-when-what-a-person-may-open-changes.md - id: ATS-PFM-CSH-016-06 title: Failed refresh keeps the list and its old timestamp category: failure level: browser proves: - BR-CAP-PFM-CSH-016-05 preconditions: The held application list has an aged timestamp. steps: Reject a refresh and regain focus again. expected: >- The list remains usable without a dedicated error screen; the aged timestamp permits another focus refresh. negative: false data_needs: >- A fresh browser context, isolated account fixtures and controlled responses for the listed transitions. bound_to: [] provenance: proposed source: >- rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-016-keep-the-menu-current-when-what-a-person-may-open-changes.md test_sources: [] action_evidence: provenance: proposed source: >- rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-016-keep-the-menu-current-when-what-a-person-may-open-changes.md assertion_evidence: provenance: proposed source: >- rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-016-keep-the-menu-current-when-what-a-person-may-open-changes.md - id: ATS-PFM-CSH-016-07 title: Overlapping refresh triggers share the pending read category: concurrency level: browser proves: - BR-CAP-PFM-CSH-016-05 preconditions: A refresh remains unresolved in the current workspace. steps: >- Trigger application refusal, focus and an explicit refresh before answering. expected: >- Only one read is in flight and all callers await that request; its completion releases the next refresh. negative: false data_needs: >- A fresh browser context, isolated account fixtures and controlled responses for the listed transitions. bound_to: [] provenance: proposed source: >- rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-016-keep-the-menu-current-when-what-a-person-may-open-changes.md test_sources: [] action_evidence: provenance: proposed source: >- rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-016-keep-the-menu-current-when-what-a-person-may-open-changes.md assertion_evidence: provenance: proposed source: >- rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-016-keep-the-menu-current-when-what-a-person-may-open-changes.md - id: ATS-PFM-CSH-016-08 title: The five-minute refresh threshold includes its endpoint category: boundary level: browser proves: - BR-CAP-PFM-CSH-016-03 preconditions: The provider clock is controlled and the tab is visible. steps: >- Dispatch focus at just under five minutes and at exactly five minutes; repeat while hidden. expected: >- The recent and hidden cases make no read; the visible threshold case requests applications. negative: false data_needs: >- A fresh browser context, isolated account fixtures and controlled responses for the listed transitions. bound_to: [] provenance: proposed source: >- rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-016-keep-the-menu-current-when-what-a-person-may-open-changes.md test_sources: [] action_evidence: provenance: proposed source: >- rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-016-keep-the-menu-current-when-what-a-person-may-open-changes.md assertion_evidence: provenance: proposed source: >- rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-016-keep-the-menu-current-when-what-a-person-may-open-changes.md - id: ATS-PFM-CSH-016-09 title: A coded refusal changes the menu in the same session category: interaction level: browser proves: - BR-CAP-PFM-CSH-016-01 - BR-CAP-PFM-CSH-006-02 preconditions: CRM and Membership are visible before CRM authority is withdrawn. steps: Trigger a mocked application refusal through Tasks. expected: >- The refreshed sidebar removes CRM and retains Membership without a page reload. negative: false data_needs: >- A fresh browser context, isolated account fixtures and controlled responses for the listed transitions. bound_to: - TST-PFM-CSH-011 provenance: test source: >- react-console:e2e/mock/application-access.mock.spec.ts#brings the launcher up to date instead of leaving it offering what is gone test_sources: - >- react-console:e2e/mock/application-access.mock.spec.ts#brings the launcher up to date instead of leaving it offering what is gone action_evidence: provenance: test source: >- react-console:e2e/mock/application-access.mock.spec.ts#brings the launcher up to date instead of leaving it offering what is gone assertion_evidence: provenance: test source: >- react-console:e2e/mock/application-access.mock.spec.ts#brings the launcher up to date instead of leaving it offering what is gone evidence: - >- react-console at baf6dae: lib/security-context/{application-refusal,application-refusal.test,provider}.ts*, lib/auth/api.ts (reports refusals), e2e/mock/application-access.mock.spec.ts. - >- services-platform at ad3f6a6: modules/security/aws/api/access.routes.ts (getMySecurityContext, getMySecurityContextInTenant, getMyApplications), modules/security/services/access/security-context.ts (applications_of), docs/security/application-access.md, docs/licensing.md §2 and §9, docs/proposals/application-access-and-entitlements.md §6.4, §7.1, §10.1. - >- rhythm-v2-docs at 25e253cb434aac6603ee294e3ca197ab6c4bfd0b: capability, related capabilities, domain objects, client lifecycles, workflows and prior OpenAI examinations; continuation coverage limitations are recorded in FND-PFM-CSH-066. coverage: rule: 'gap: FND-PFM-CSH-066' transition: 'gap: FND-PFM-CSH-066' validation: covered permission: 'gap: FND-PFM-CSH-066' edge: 'gap: FND-PFM-CSH-066' failure: covered boundary: covered concurrency: 'gap: FND-PFM-CSH-066' invariant: 'gap: FND-PFM-CSH-066' interaction: covered coverage_notes: rule: provenance: unknown source: FND-PFM-CSH-066 reason: >- No dedicated scenario establishes this category; applicability and the required fixtures need review. transition: provenance: unknown source: FND-PFM-CSH-066 reason: >- The associated lifecycle has additional transitions beyond the specified cases. validation: provenance: proposed source: ATS-PFM-CSH-016-02 reason: >- The listed scenarios specify this category; their bindings separately identify existing executable evidence. permission: provenance: unknown source: FND-PFM-CSH-066 reason: >- The named permission keys still need a complete allowed, denied and scope matrix across their enforcement boundaries. edge: provenance: unknown source: FND-PFM-CSH-066 reason: >- No dedicated scenario establishes this category; applicability and the required fixtures need review. failure: provenance: proposed source: ATS-PFM-CSH-016-06 reason: >- The listed scenarios specify this category; their bindings separately identify existing executable evidence. boundary: provenance: proposed source: ATS-PFM-CSH-016-03; ATS-PFM-CSH-016-08 reason: >- The listed scenarios specify this category; their bindings separately identify existing executable evidence. concurrency: provenance: unknown source: FND-PFM-CSH-066 reason: >- No complete scenario matrix covers repeated events, overlapping reads or superseded answers for this capability. invariant: provenance: unknown source: FND-PFM-CSH-066 reason: Associated object invariants remain without explicit proving scenarios. interaction: provenance: proposed source: ATS-PFM-CSH-016-01; ATS-PFM-CSH-016-09 reason: >- The listed scenarios specify this category; their bindings separately identify existing executable evidence. design_obligations: - artifact: STATE-PFM-CSH-003 provenance: documented source: >- rhythm-v2-docs:specs/platform/console-shell/design/state-models/STATE-PFM-CSH-003-freshness-of-the-application-list.md transitions: - ordinal: 1 from: current to: refreshing provenance: test source: >- react-console:e2e/mock/application-access.mock.spec.ts#brings the launcher up to date instead of leaving it offering what is gone disposition: 'gap: FND-PFM-CSH-066' - ordinal: 2 from: current to: aging provenance: observed source: >- react-console:lib/security-context/provider.tsx:APPLICATIONS_STALE_AFTER_MS disposition: 'gap: FND-PFM-CSH-066' - ordinal: 3 from: aging to: refreshing provenance: observed source: >- react-console:lib/security-context/provider.tsx:SecurityContextProvider (focus and visibility listener) disposition: 'gap: FND-PFM-CSH-066' - ordinal: 4 from: refreshing to: current provenance: observed source: 'react-console:lib/security-context/provider.tsx:refreshApplications' disposition: 'gap: FND-PFM-CSH-066' - ordinal: 5 from: refreshing to: aging provenance: observed source: >- react-console:lib/security-context/provider.tsx:refreshApplications (catch) disposition: 'gap: FND-PFM-CSH-066' - ordinal: 6 from: refreshing to: current provenance: observed source: 'react-console:lib/security-context/provider.tsx:refreshApplications' disposition: 'gap: FND-PFM-CSH-066' note: >- The finding carries exhaustive transition execution coverage; overlapping scenario examples do not close the remaining lifecycle matrix. interactions: - capability: CAP-PFM-CSH-006 provenance: proposed source: ATS-PFM-CSH-016-09 workflow_obligations: - artifact: WF-PFM-CSH-005 provenance: documented source: >- rhythm-v2-docs:specs/platform/console-shell/design/workflows/WF-PFM-CSH-005-refresh-the-application-list.md disposition: 'gap: FND-PFM-CSH-066' note: >- Review every hop, branch, failure and race with the cited capability scenarios; unexecuted combinations remain in the coverage finding. --- # Refresh application choices when access changes: Capability Test Specification ## Coverage The coverage map describes specified proof, not a passing run. Each mandatory rule below has a scenario or an explicit finding; a proposed scenario remains an execution obligation even when its expected outcome follows the pinned implementation. | Mandatory Rule | Scenarios or Finding | |---|---| | `BR-CAP-PFM-CSH-016-01` | `ATS-PFM-CSH-016-01`, `ATS-PFM-CSH-016-02`, `ATS-PFM-CSH-016-09` | | `BR-CAP-PFM-CSH-016-02` | `ATS-PFM-CSH-016-02` | | `BR-CAP-PFM-CSH-016-03` | `ATS-PFM-CSH-016-03`, `ATS-PFM-CSH-016-08` | | `BR-CAP-PFM-CSH-016-04` | `ATS-PFM-CSH-016-05` | | `BR-CAP-PFM-CSH-016-05` | `ATS-PFM-CSH-016-06`, `ATS-PFM-CSH-016-07` | | `BR-CAP-PFM-CSH-016-06` | `ATS-PFM-CSH-016-04` | Refresh coverage needs the exact five-minute endpoint, hidden tabs, failures, shared requests, narrow replacement, HQ no-op and superseded successful timestamps. A second workspace can share the previous workspace’s pending read; that race remains unexecuted. ## Interactions With Related Capabilities The refreshed sidebar removes CRM and retains Membership without a page reload. The interaction rows cite the contracts they exercise. Related combinations without a complete case remain in the coverage finding, together with cross-capability workflows and permission boundaries. A helper assertion is bound only for its stated outcome; the full browser handoff remains proposed until a suite checks it. Pinned source and exact test anchors are recorded in frontmatter. Test bindings record static assertion review and use the executable-suite register; no product test result is inferred from that review. The prior planning and design examinations supply context, while this continuation records the remaining proof obligations explicitly.