--- id: ATS-PFM-DJE-018 scope: CAP-PFM-DJE-018 product_area: platform module: data-job-engine revision: 2 status: proposed approved_by: null approved_at: null source_sha: macroservice-libraries: 54536a441935c6e09fdb7f96f0bec71c52ba4e03 services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 services-crm: a8d1364f1dd44b723bb5f9acba12f983e9ec8d69 services-membership: 5994c270e8a37a30f848e99ba5b5ee6b87c08893 scenarios: - id: ATS-PFM-DJE-018-01 title: Invalid operation declarations fail initialization level: unit proves: - BR-CAP-PFM-DJE-018-01 preconditions: Prepare declarations without versions and deletes declaring writable fields or rollback. steps: - do: Initialize each operation. expect: Every invalid declaration is refused. provenance: test source: >- macroservice-libraries:packages/data-jobs/src/validate-data-job-request.spec.ts#refuses a declaration with no contract version, which could accept no job at all expected: Every invalid declaration is refused. negative: true data_needs: No additional fixture is needed. bound_to: - TST-PFM-DJE-037 - TST-PFM-DJE-015 provenance: test source: >- macroservice-libraries:packages/data-jobs/src/validate-data-job-request.spec.ts#refuses a declaration with no contract version, which could accept no job at all category: validation binding_evidence: - >- macroservice-libraries:packages/data-jobs/src/validate-data-job-request.spec.ts#refuses a declaration with no contract version, which could accept no job at all - >- macroservice-libraries:packages/data-jobs/src/validate-data-job-request.spec.ts#refuses a delete that declares patchable fields, which a delete never sets - >- macroservice-libraries:packages/data-jobs/src/define-data-operation.spec.ts#refuses a delete that declares one, because a hard delete has no undo to promise - id: ATS-PFM-DJE-018-02 title: Workspace policies constrain consumer persistence level: api proves: - BR-CAP-PFM-DJE-018-02 preconditions: Create engine tables using the shared contracts. steps: - do: Attempt foreign-workspace writes and queue claims. expect: Writes are refused and claims contain only the current workspace’s rows. provenance: test source: >- macroservice-libraries:packages/data-jobs/src/tests/integration/tenant-isolation.integration.spec.ts#refuses a row written into another tenant, whatever the statement says expected: Writes are refused and claims contain only the current workspace’s rows. negative: true data_needs: A disposable database fixture. bound_to: - TST-PFM-DJE-035 provenance: test source: >- macroservice-libraries:packages/data-jobs/src/tests/integration/tenant-isolation.integration.spec.ts#refuses a row written into another tenant, whatever the statement says category: invariant binding_evidence: - >- macroservice-libraries:packages/data-jobs/src/tests/integration/tenant-isolation.integration.spec.ts#refuses a row written into another tenant, whatever the statement says - >- macroservice-libraries:packages/data-jobs/src/tests/integration/tenant-isolation.integration.spec.ts#claims only its own tenant's queue rows, which is why the queue table takes no exemption - id: ATS-PFM-DJE-018-03 title: Field definitions use metadata behavior level: api proves: - BR-CAP-PFM-DJE-018-03 preconditions: Prepare definition input including an existing definition. steps: - do: Submit insert and upsert operations. expect: >- Domain rules govern each write; insert refuses the existing definition and upsert updates it. provenance: test source: >- services-platform:modules/data-jobs/tests/integration/services/jobs/custom-field-data-jobs.integration.spec.js#writes the currency definition the metadata module’s own way, configuration and all expected: Domain rules govern each write; insert refuses the existing definition and upsert updates it. negative: true data_needs: A field-definition dataset. bound_to: - TST-PFM-DJE-168 provenance: test source: >- services-platform:modules/data-jobs/tests/integration/services/jobs/custom-field-data-jobs.integration.spec.js#writes the currency definition the metadata module’s own way, configuration and all category: rule binding_evidence: - >- services-platform:modules/data-jobs/tests/integration/services/jobs/custom-field-data-jobs.integration.spec.js#writes the currency definition the metadata module’s own way, configuration and all - >- services-platform:modules/data-jobs/tests/integration/services/jobs/custom-field-data-jobs.integration.spec.js#refuses the same change as an insert, naming the definition rather than writing a second one - >- services-platform:modules/data-jobs/tests/integration/services/jobs/custom-field-data-jobs.integration.spec.js#reports the item as updated rather than created, because the source key named a definition that exists - id: ATS-PFM-DJE-018-04 title: Supplied rule sets have explicit replacement behavior level: api proves: - BR-CAP-PFM-DJE-018-04 preconditions: 'Prepare lines with rules, omitted rules and a forward reference.' steps: - do: 'Load the definitions, reset and load again.' expect: >- Supplied rules replace existing rules, omissions preserve them and the forward reference is refused. provenance: proposed source: >- services-platform:docs/data-jobs/platform-data-operations.md#1.1 A definition's rules (the package format) expected: >- Supplied rules replace existing rules, omissions preserve them and the forward reference is refused. negative: true data_needs: A definition package. bound_to: [] provenance: proposed source: >- services-platform:docs/data-jobs/platform-data-operations.md#1.1 A definition's rules (the package format) category: rule binding_evidence: [] - id: ATS-PFM-DJE-018-05 title: Lasting transient errors pause in-request processing level: api proves: - BR-CAP-PFM-DJE-018-05 preconditions: Inject a repeated failure in one Platform batch. steps: - do: 'Submit, clear the error and retry.' expect: The job pauses with transient-failure detail and finishes after recovery. provenance: proposed source: >- services-platform:docs/data-jobs/platform-data-operations.md#3. The batches run in the submitting request expected: The job pauses with transient-failure detail and finishes after recovery. negative: true data_needs: Controllable failure injection. bound_to: [] provenance: proposed source: >- services-platform:docs/data-jobs/platform-data-operations.md#3. The batches run in the submitting request category: failure binding_evidence: [] - id: ATS-PFM-DJE-018-06 title: Oversized Platform datasets are refused level: api proves: - BR-CAP-PFM-DJE-018-06 preconditions: Prepare 501 field-definition lines. steps: - do: Submit the dataset. expect: The refusal identifies its record count and supported limit. provenance: proposed source: 'services-platform:modules/data-jobs/services/jobs/custom-field-data-jobs.ts' expected: The refusal identifies its record count and supported limit. negative: true data_needs: A field-definition dataset. bound_to: [] provenance: proposed source: 'services-platform:modules/data-jobs/services/jobs/custom-field-data-jobs.ts' category: boundary binding_evidence: [] - id: ATS-PFM-DJE-018-07 title: Platform submission requires domain and bulk authority level: api proves: - BR-CAP-PFM-DJE-018-07 preconditions: Prepare callers with create access alone and with create plus bulk access. steps: - do: Submit under both identities. expect: The first is refused and the fully authorized caller succeeds. provenance: test source: >- services-platform:modules/data-jobs/tests/integration/services/jobs/custom-field-data-jobs.integration.spec.js#refuses a caller who may create a definition but holds no bulk right expected: The first is refused and the fully authorized caller succeeds. negative: true data_needs: Permission personas. bound_to: - TST-PFM-DJE-168 provenance: test source: >- services-platform:modules/data-jobs/tests/integration/services/jobs/custom-field-data-jobs.integration.spec.js#refuses a caller who may create a definition but holds no bulk right category: permission binding_evidence: - >- services-platform:modules/data-jobs/tests/integration/services/jobs/custom-field-data-jobs.integration.spec.js#refuses a caller who may create a definition but holds no bulk right - >- services-platform:modules/data-jobs/tests/integration/services/jobs/custom-field-data-jobs.integration.spec.js#accepts a caller holding the bulk right and the per-record ones (the positive control) - id: ATS-PFM-DJE-018-08 title: Custom-record validation accounts for neighboring file rows level: api proves: - BR-CAP-PFM-DJE-018-08 preconditions: Prepare boats including a repeated hull number and invalid type. steps: - do: Load the dataset twice. expect: >- Invalid lines have numbered refusals, eligible input applies and repeated eligible records report unchanged. provenance: test source: >- services-platform:modules/data-jobs/tests/integration/services/jobs/custom-object-data-jobs.integration.spec.js#refuses a hull number an earlier line of the same file holds, naming that line expected: >- Invalid lines have numbered refusals, eligible input applies and repeated eligible records report unchanged. negative: true data_needs: A boat-record dataset. bound_to: - TST-PFM-DJE-169 provenance: test source: >- services-platform:modules/data-jobs/tests/integration/services/jobs/custom-object-data-jobs.integration.spec.js#refuses a hull number an earlier line of the same file holds, naming that line category: edge binding_evidence: - >- services-platform:modules/data-jobs/tests/integration/services/jobs/custom-object-data-jobs.integration.spec.js#refuses a hull number an earlier line of the same file holds, naming that line - >- services-platform:modules/data-jobs/tests/integration/services/jobs/custom-object-data-jobs.integration.spec.js#names the line of the dataset in each refusal’s message - >- services-platform:modules/data-jobs/tests/integration/services/jobs/custom-object-data-jobs.integration.spec.js#answers every record of the second load unchanged - id: ATS-PFM-DJE-018-09 title: Operation declarations constrain submitted work category: interaction level: api exercises: - CAP-PFM-DJE-001 - CAP-PFM-DJE-018 proves: - BR-CAP-PFM-DJE-001-06 - BR-CAP-PFM-DJE-018-01 - BR-CAP-PFM-DJE-018-07 preconditions: >- Prepare a supported Platform field-definition operation and authorized and unauthorized callers. steps: - do: >- Submit a supported definition, an unsupported operation, and the supported input without bulk authority. expect: >- Only the permitted declared operation creates work; the refused requests leave no definition or job. provenance: proposed source: >- services-crm:modules/data-jobs/tests/integration/services/jobs/contact-data-jobs.integration.spec.js#refuses an object type CRM performs no bulk operation on, naming what it does perform; macroservice-libraries:packages/data-jobs/src/validate-data-job-request.spec.ts#refuses a delete that declares patchable fields, which a delete never sets; services-platform:modules/data-jobs/tests/integration/services/jobs/custom-field-data-jobs.integration.spec.js#refuses a caller who may create a definition but holds no bulk right expected: >- Only the permitted declared operation creates work; the refused requests leave no definition or job. negative: true data_needs: >- Prepare a supported Platform field-definition operation and authorized and unauthorized callers. bound_to: [] provenance: proposed source: >- services-crm:modules/data-jobs/tests/integration/services/jobs/contact-data-jobs.integration.spec.js#refuses an object type CRM performs no bulk operation on, naming what it does perform; macroservice-libraries:packages/data-jobs/src/validate-data-job-request.spec.ts#refuses a delete that declares patchable fields, which a delete never sets; services-platform:modules/data-jobs/tests/integration/services/jobs/custom-field-data-jobs.integration.spec.js#refuses a caller who may create a definition but holds no bulk right - id: ATS-PFM-DJE-018-10 title: Platform datasets use the same domain authority as direct jobs category: interaction level: api exercises: - CAP-PFM-DJE-016 - CAP-PFM-DJE-018 proves: - BR-CAP-PFM-DJE-016-07 - BR-CAP-PFM-DJE-016-12 - BR-CAP-PFM-DJE-018-07 - BR-CAP-PFM-DJE-018-08 preconditions: >- Register a package with custom definitions, records and associations and prepare limited and authorized staff contexts. steps: - do: >- Start under insufficient domain authority, then under authorized authority and inspect each local job. expect: >- The refusal leaves the run unchanged; permitted local datasets use domain validation and preserve line-specific refusals. provenance: proposed source: >- services-platform:modules/data-jobs/tests/integration/services/runs/run-driver.integration.spec.js#forwards the staff caller’s own token with every call, and invents no identity of its own; services-platform:modules/data-jobs/services/runs/data-run-services.ts:DATA_RUN_SERVICES; services-platform:modules/data-jobs/tests/integration/services/jobs/custom-field-data-jobs.integration.spec.js#refuses a caller who may create a definition but holds no bulk right; services-platform:modules/data-jobs/tests/integration/services/jobs/custom-object-data-jobs.integration.spec.js#refuses a hull number an earlier line of the same file holds, naming that line expected: >- The refusal leaves the run unchanged; permitted local datasets use domain validation and preserve line-specific refusals. negative: true data_needs: >- Register a package with custom definitions, records and associations and prepare limited and authorized staff contexts. bound_to: [] provenance: proposed source: >- services-platform:modules/data-jobs/tests/integration/services/runs/run-driver.integration.spec.js#forwards the staff caller’s own token with every call, and invents no identity of its own; services-platform:modules/data-jobs/services/runs/data-run-services.ts:DATA_RUN_SERVICES; services-platform:modules/data-jobs/tests/integration/services/jobs/custom-field-data-jobs.integration.spec.js#refuses a caller who may create a definition but holds no bulk right; services-platform:modules/data-jobs/tests/integration/services/jobs/custom-object-data-jobs.integration.spec.js#refuses a hull number an earlier line of the same file holds, naming that line evidence: - >- Reviewed evidence: macroservice-libraries (54536a44): README.md (The operation contract; The tables; How a service adopts it); src/define-data-operation.ts, validate-data-job-request.ts, data-job-columns.ts, data-job-tables.ts, row-level-security.ts; tests validate-data-job-request.spec.ts, define-data-operation.spec.ts, tenant-isolation.integration.spec.ts. - >- Reviewed evidence: services-platform (ad3f6a65): docs/data-jobs/platform-data-operations.md; modules/data-jobs/services/operations/*, services/jobs/custom-field-data-jobs.ts, data-job-surfaces.ts; db/data-jobs.table.ts; tests custom-field-data-jobs.integration.spec.js, custom-object-data-jobs.integration.spec.js, custom-field-data-jobs.e2e.spec.js, custom-object-data-jobs.e2e.spec.js. - >- Reviewed evidence: services-crm (a8d1364f): services/operations/data-operations.ts; db/data-jobs.table.ts. - >- Reviewed evidence: services-membership (5994c270): modules/data-jobs/services/operations/structure-data-operations.ts; export/import-crosswalk.dataset.ts; tests structure-data-operations.integration.spec.ts. - >- Testing back-fill: related capability rules, domain invariants, state transitions and crossing workflows at the pinned source revisions. coverage: rule: covered transition: 'gap: FND-PFM-DJE-078' validation: covered permission: covered edge: covered failure: covered boundary: covered concurrency: 'gap: FND-PFM-DJE-078' invariant: covered interaction: covered coverage_notes: transition: >- Selected lifecycle examples do not cover every applicable object and batch transition. The linked finding retains the remaining matrix. execution: >- Covered means a specification scenario exists. Proposed scenarios and registered suites with no run result do not establish executed conformance. related: - CAP-PFM-DJE-001 - CAP-PFM-DJE-016 workflows: - WF-PFM-DJE-001 - WF-PFM-DJE-009 coverage_evidence: - rule: BR-CAP-PFM-DJE-018-01 scenarios: - ATS-PFM-DJE-018-01 - ATS-PFM-DJE-018-09 provenance: proposed source: >- macroservice-libraries:packages/data-jobs/src/validate-data-job-request.spec.ts#refuses a delete that declares patchable fields, which a delete never sets - rule: BR-CAP-PFM-DJE-018-02 scenarios: - ATS-PFM-DJE-018-02 provenance: proposed source: 'macroservice-libraries:packages/data-jobs/src/row-level-security.ts:PRIVILEGES' - rule: BR-CAP-PFM-DJE-018-03 scenarios: - ATS-PFM-DJE-018-03 provenance: proposed source: >- services-platform:modules/data-jobs/tests/integration/services/jobs/custom-field-data-jobs.integration.spec.js#refuses the same change as an insert, naming the definition rather than writing a second one - rule: BR-CAP-PFM-DJE-018-04 scenarios: - ATS-PFM-DJE-018-04 provenance: proposed source: >- services-platform:docs/data-jobs/platform-data-operations.md#1.1 A definition's rules (the package format) - rule: BR-CAP-PFM-DJE-018-05 scenarios: - ATS-PFM-DJE-018-05 provenance: proposed source: >- services-platform:docs/data-jobs/platform-data-operations.md#3. The batches run in the submitting request - rule: BR-CAP-PFM-DJE-018-06 scenarios: - ATS-PFM-DJE-018-06 provenance: proposed source: 'services-platform:modules/data-jobs/services/jobs/custom-field-data-jobs.ts:parseDatasetLines' - rule: BR-CAP-PFM-DJE-018-07 scenarios: - ATS-PFM-DJE-018-07 - ATS-PFM-DJE-018-09 - ATS-PFM-DJE-018-10 provenance: proposed source: >- services-platform:modules/data-jobs/tests/integration/services/jobs/custom-field-data-jobs.integration.spec.js#refuses a caller who may create a definition but holds no bulk right - rule: BR-CAP-PFM-DJE-018-08 scenarios: - ATS-PFM-DJE-018-08 - ATS-PFM-DJE-018-10 provenance: proposed source: >- services-platform:modules/data-jobs/tests/integration/services/jobs/custom-object-data-jobs.integration.spec.js#refuses a hull number an earlier line of the same file holds, naming that line --- # Enable product records to use the shared job engine: Capability Test Specification ## Coverage The structured coverage rows link required rules to their scenarios. A covered category has a defined check; executable coverage and successful execution require separate evidence. The category map keeps incomplete lifecycle matrices and other missing checks visible as findings. ## Interactions With Related Capabilities Operation declarations constrain submitted work. Platform datasets use the same domain authority as direct jobs. The interaction scenarios use the related capabilities' rule references and identify the shared fixture and observable outcome.