--- id: ATS-PFM-ELG-006 scope: CAP-PFM-ELG-006 product_area: platform module: eligibility revision: 3 status: proposed approved_by: null approved_at: null source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f scenarios: - id: ATS-PFM-ELG-006-01 title: Reject invalid registration atomically level: api proves: - BR-CAP-PFM-ELG-006-01 preconditions: A declaration set has several mistakes. steps: Submit the set. expected: Registration reports failure and all problems while retaining the previous catalogue. negative: true data_needs: No fixtures beyond the described setup. bound_to: - >- services-platform:modules/eligibility/tests/integration/services/registry/register-eligibility-registration.integration.spec.js#answers a refused manifest with ok false and the refusal, rather than throwing - TST-PFM-ELG-465 - >- services-platform:modules/eligibility/tests/integration/services/registry/register-eligibility-registration.integration.spec.js#refuses a manifest whose envelope is wrong before reading anything - >- react-console:acceptance/eligibility/playwright/journeys/registry/ELIG-ACC-0014.spec.ts#ELIG-ACC-0014 - TST-PFM-ELG-326 provenance: test source: >- services-platform:modules/eligibility/tests/integration/services/registry/register-eligibility-registration.integration.spec.js#answers a refused manifest with ok false and the refusal, rather than throwing category: validation action_evidence: provenance: test source: >- services-platform:modules/eligibility/tests/integration/services/registry/register-eligibility-registration.integration.spec.js#answers a refused manifest with ok false and the refusal, rather than throwing assertion_evidence: provenance: test source: >- services-platform:modules/eligibility/tests/integration/services/registry/register-eligibility-registration.integration.spec.js#answers a refused manifest with ok false and the refusal, rather than throwing binding_scope: >- The cited tests contribute their reachable assertions; the binding does not establish execution or every step of this scenario. binding_limitations: - FND-PFM-ELG-074 - id: ATS-PFM-ELG-006-02 title: Validate application-owned dependencies level: api proves: - BR-CAP-PFM-ELG-006-02 preconditions: >- Declarations use incompatible operators, missing datasets or subject fields and foreign datasets or functions. steps: Submit each declaration. expected: Each rejection identifies its incompatible dependency. negative: true data_needs: No fixtures beyond the described setup. bound_to: - >- services-platform:modules/eligibility/tests/integration/services/registry/register-eligibility-registration.integration.spec.js#names an operator the value type cannot take - TST-PFM-ELG-465 - >- services-platform:modules/eligibility/tests/integration/services/registry/register-eligibility-registration.integration.spec.js#names a dataset that is not registered - >- services-platform:modules/eligibility/tests/integration/services/registry/register-eligibility-registration.integration.spec.js#names a subject field the dataset has not got - >- services-platform:modules/eligibility/tests/integration/services/registry/register-eligibility-registration.integration.spec.js#names a dataset of another application - >- services-platform:modules/eligibility/tests/integration/services/registry/register-eligibility-registration.integration.spec.js#names a function that is not the application’s provenance: test source: >- services-platform:modules/eligibility/tests/integration/services/registry/register-eligibility-registration.integration.spec.js#names an operator the value type cannot take category: validation action_evidence: provenance: test source: >- services-platform:modules/eligibility/tests/integration/services/registry/register-eligibility-registration.integration.spec.js#names an operator the value type cannot take assertion_evidence: provenance: test source: >- services-platform:modules/eligibility/tests/integration/services/registry/register-eligibility-registration.integration.spec.js#names an operator the value type cannot take binding_scope: >- The cited tests contribute their reachable assertions; the binding does not establish execution or every step of this scenario. binding_limitations: - FND-PFM-ELG-074 - id: ATS-PFM-ELG-006-03 title: Require declaration version advances level: api proves: - BR-CAP-PFM-ELG-006-03 preconditions: An application already has a registered declaration. steps: 'Resubmit unchanged and changed at equal, lower and higher versions.' expected: Unchanged input writes nothing; only the higher-version change registers. negative: false data_needs: No fixtures beyond the described setup. bound_to: - >- services-platform:modules/eligibility/tests/integration/services/registry/register-eligibility-registration.integration.spec.js#writes nothing on a redeploy of the same declarations, answering every entry unchanged - TST-PFM-ELG-465 - >- services-platform:modules/eligibility/tests/integration/services/registry/register-eligibility-registration.integration.spec.js#refuses a declaration changed at the same version, saying to bump it, and writes nothing - >- services-platform:modules/eligibility/tests/integration/services/registry/register-eligibility-registration.integration.spec.js#refuses a version lower than the registered one, and writes nothing - >- react-console:acceptance/eligibility/playwright/journeys/registry/ELIG-ACC-0012.spec.ts#ELIG-ACC-0012 - TST-PFM-ELG-324 - >- react-console:acceptance/eligibility/playwright/journeys/registry/ELIG-ACC-0013.spec.ts#ELIG-ACC-0013 - TST-PFM-ELG-325 provenance: test source: >- services-platform:modules/eligibility/tests/integration/services/registry/register-eligibility-registration.integration.spec.js#writes nothing on a redeploy of the same declarations, answering every entry unchanged category: concurrency action_evidence: provenance: test source: >- services-platform:modules/eligibility/tests/integration/services/registry/register-eligibility-registration.integration.spec.js#writes nothing on a redeploy of the same declarations, answering every entry unchanged assertion_evidence: provenance: test source: >- services-platform:modules/eligibility/tests/integration/services/registry/register-eligibility-registration.integration.spec.js#writes nothing on a redeploy of the same declarations, answering every entry unchanged binding_scope: >- The cited tests contribute their reachable assertions; the binding does not establish execution or every step of this scenario. binding_limitations: - FND-PFM-ELG-074 - id: ATS-PFM-ELG-006-04 title: Protect declarations used by publications level: api proves: - BR-CAP-PFM-ELG-006-04 preconditions: 'Conditions are used by a publication or only a draft, and a binding names a purpose.' steps: Omit each from a replacement set. expected: >- Publication and binding dependencies prevent withdrawal with context named; a draft-only condition is withdrawn. negative: true data_needs: No fixtures beyond the described setup. bound_to: - >- services-platform:modules/eligibility/tests/integration/services/registry/register-eligibility-registration.integration.spec.js#refuses to withdraw a type a published version of a tenant uses, naming the tenant and the definition, and writes nothing - TST-PFM-ELG-465 - >- services-platform:modules/eligibility/tests/integration/services/registry/register-eligibility-registration.integration.spec.js#withdraws a type only a draft uses: a draft is not published - >- services-platform:modules/eligibility/tests/integration/services/registry/register-eligibility-registration.integration.spec.js#refuses to withdraw a consumer kind a binding of a tenant names, and writes nothing - >- react-console:acceptance/eligibility/playwright/journeys/registry/ELIG-ACC-0010.spec.ts#ELIG-ACC-0010 - TST-PFM-ELG-322 provenance: test source: >- services-platform:modules/eligibility/tests/integration/services/registry/register-eligibility-registration.integration.spec.js#refuses to withdraw a type a published version of a tenant uses, naming the tenant and the definition, and writes nothing category: rule action_evidence: provenance: test source: >- services-platform:modules/eligibility/tests/integration/services/registry/register-eligibility-registration.integration.spec.js#refuses to withdraw a type a published version of a tenant uses, naming the tenant and the definition, and writes nothing assertion_evidence: provenance: test source: >- services-platform:modules/eligibility/tests/integration/services/registry/register-eligibility-registration.integration.spec.js#refuses to withdraw a type a published version of a tenant uses, naming the tenant and the definition, and writes nothing binding_scope: >- The cited tests contribute their reachable assertions; the binding does not establish execution or every step of this scenario. binding_limitations: - FND-PFM-ELG-074 - id: ATS-PFM-ELG-006-05 title: Control deprecated vocabulary visibility level: api proves: - BR-CAP-PFM-ELG-006-05 preconditions: 'Active, deprecated and withdrawn declarations exist.' steps: Read the catalogue normally and including deprecated declarations. expected: >- Deprecated entries appear only on request with their status, and withdrawn entries never appear. negative: false data_needs: No fixtures beyond the described setup. bound_to: - >- services-platform:modules/eligibility/tests/e2e/eligibility-registry.e2e.spec.js#lists a deprecated type, with its status, when asked to include deprecated ones - TST-PFM-ELG-415 - >- services-platform:modules/eligibility/tests/e2e/eligibility-registry.e2e.spec.js#never lists a withdrawn type, even with deprecated ones included - >- react-console:acceptance/eligibility/playwright/journeys/registry/ELIG-ACC-0009.spec.ts#ELIG-ACC-0009 - TST-PFM-ELG-321 provenance: test source: >- services-platform:modules/eligibility/tests/e2e/eligibility-registry.e2e.spec.js#lists a deprecated type, with its status, when asked to include deprecated ones category: transition action_evidence: provenance: test source: >- services-platform:modules/eligibility/tests/e2e/eligibility-registry.e2e.spec.js#lists a deprecated type, with its status, when asked to include deprecated ones assertion_evidence: provenance: test source: >- services-platform:modules/eligibility/tests/e2e/eligibility-registry.e2e.spec.js#lists a deprecated type, with its status, when asked to include deprecated ones binding_scope: >- The cited tests contribute their reachable assertions; the binding does not establish execution or every step of this scenario. binding_limitations: - FND-PFM-ELG-074 - id: ATS-PFM-ELG-006-06 title: Preserve aliases after renaming level: api proves: - BR-CAP-PFM-ELG-006-06 preconditions: A publication uses an existing condition key. steps: 'Register a successor with the former key, then evaluate.' expected: The unchanged publication continues to work through the alias. negative: false data_needs: No fixtures beyond the described setup. bound_to: - >- services-platform:modules/eligibility/tests/integration/services/registry/register-eligibility-registration.integration.spec.js#folds a renamed type into its successor rather than withdrawing it, so the old key keeps resolving - TST-PFM-ELG-465 - >- react-console:acceptance/eligibility/playwright/journeys/registry/ELIG-ACC-0011.spec.ts#ELIG-ACC-0011 - TST-PFM-ELG-323 provenance: test source: >- services-platform:modules/eligibility/tests/integration/services/registry/register-eligibility-registration.integration.spec.js#folds a renamed type into its successor rather than withdrawing it, so the old key keeps resolving category: invariant action_evidence: provenance: test source: >- services-platform:modules/eligibility/tests/integration/services/registry/register-eligibility-registration.integration.spec.js#folds a renamed type into its successor rather than withdrawing it, so the old key keeps resolving assertion_evidence: provenance: test source: >- services-platform:modules/eligibility/tests/integration/services/registry/register-eligibility-registration.integration.spec.js#folds a renamed type into its successor rather than withdrawing it, so the old key keeps resolving binding_scope: >- The cited tests contribute their reachable assertions; the binding does not establish execution or every step of this scenario. binding_limitations: - FND-PFM-ELG-074 - id: ATS-PFM-ELG-006-07 title: Apply licensing and subject filters level: api proves: - BR-CAP-PFM-ELG-006-07 preconditions: 'A workspace first licenses CRM and later Membership, with a separate workspace lacking CRM.' steps: 'Read conditions and purposes before and after changes, including subject filtering.' expected: Only licensed entries appear and no internal query details are exposed. negative: false data_needs: No fixtures beyond the described setup. bound_to: - >- services-platform:modules/eligibility/tests/e2e/eligibility-registry.e2e.spec.js#lists the active types of the tenant’s applications in key order, without a deprecated or withdrawn one or an unlicensed application’s - TST-PFM-ELG-415 - >- services-platform:modules/eligibility/tests/e2e/eligibility-registry.e2e.spec.js#lists only the types a subject of the asked kind can be judged by - >- services-platform:modules/eligibility/tests/e2e/eligibility-registry.e2e.spec.js#lists Membership’s condition types beside CRM’s - >- react-console:acceptance/eligibility/playwright/journeys/registry/ELIG-ACC-0008.spec.ts#ELIG-ACC-0008 - TST-PFM-ELG-320 provenance: test source: >- services-platform:modules/eligibility/tests/e2e/eligibility-registry.e2e.spec.js#lists the active types of the tenant’s applications in key order, without a deprecated or withdrawn one or an unlicensed application’s category: permission action_evidence: provenance: test source: >- services-platform:modules/eligibility/tests/e2e/eligibility-registry.e2e.spec.js#lists the active types of the tenant’s applications in key order, without a deprecated or withdrawn one or an unlicensed application’s assertion_evidence: provenance: test source: >- services-platform:modules/eligibility/tests/e2e/eligibility-registry.e2e.spec.js#lists the active types of the tenant’s applications in key order, without a deprecated or withdrawn one or an unlicensed application’s binding_scope: >- The cited tests contribute their reachable assertions; the binding does not establish execution or every step of this scenario. binding_limitations: - FND-PFM-ELG-074 - id: ATS-PFM-ELG-006-08 title: Refresh a process catalogue after its registration level: api proves: - BR-CAP-PFM-ELG-006-08 preconditions: The process has read the condition catalogue. steps: >- Write a declaration externally, advance past the cache lifetime, then commit a registration in the reading process. expected: >- An external write remains unseen during the cache lifetime; expiry and a committed local registration each cause a fresh read. negative: false data_needs: Existing evidence fixtures provide the described setup. bound_to: - >- services-platform:modules/eligibility/tests/integration/services/registry/registry-snapshot.integration.spec.js#keeps answering what it read for 60 seconds, though a type was written since - TST-PFM-ELG-466 - >- services-platform:modules/eligibility/tests/integration/services/registry/registry-snapshot.integration.spec.js#reads the tables again once the 60 seconds are over - >- services-platform:modules/eligibility/tests/integration/services/registry/registry-snapshot.integration.spec.js#reads the tables again after a registration commits in this process provenance: test source: >- services-platform:modules/eligibility/tests/integration/services/registry/registry-snapshot.integration.spec.js#keeps answering what it read for 60 seconds, though a type was written since category: boundary action_evidence: provenance: test source: >- services-platform:modules/eligibility/tests/integration/services/registry/registry-snapshot.integration.spec.js#keeps answering what it read for 60 seconds, though a type was written since assertion_evidence: provenance: test source: >- services-platform:modules/eligibility/tests/integration/services/registry/registry-snapshot.integration.spec.js#keeps answering what it read for 60 seconds, though a type was written since binding_scope: >- The cited tests contribute their reachable assertions; the binding does not establish execution or every step of this scenario. binding_limitations: - FND-PFM-ELG-074 - id: ATS-PFM-ELG-006-09 title: Use a renamed condition in existing work category: interaction level: api proves: - BR-CAP-PFM-ELG-001-07 - BR-CAP-PFM-ELG-006-06 exercises: - CAP-PFM-ELG-006 - CAP-PFM-ELG-001 preconditions: A released rule uses a condition whose application declares a new key with an alias. steps: 'Register the rename, inspect authoring choices and validate the retained expression.' expected: The author sees the new vocabulary while the expression using the former key remains valid. negative: false data_needs: Run-owned records and a controlled clock where timing changes the result. bound_to: [] provenance: proposed source: >- services-platform:modules/eligibility/tests/integration/services/model/validate-definition.integration.spec.js#answers a reference to an archived definition as missing; services-platform:modules/eligibility/tests/integration/services/registry/register-eligibility-registration.integration.spec.js#folds a renamed type into its successor rather than withdrawing it, so the old key keeps resolving action_evidence: provenance: proposed source: >- services-platform:modules/eligibility/tests/integration/services/model/validate-definition.integration.spec.js#answers a reference to an archived definition as missing; services-platform:modules/eligibility/tests/integration/services/registry/register-eligibility-registration.integration.spec.js#folds a renamed type into its successor rather than withdrawing it, so the old key keeps resolving assertion_evidence: provenance: proposed source: >- services-platform:modules/eligibility/tests/integration/services/model/validate-definition.integration.spec.js#answers a reference to an archived definition as missing; services-platform:modules/eligibility/tests/integration/services/registry/register-eligibility-registration.integration.spec.js#folds a renamed type into its successor rather than withdrawing it, so the old key keeps resolving binding_scope: This sequence is proposed and has no executable proof binding. - id: ATS-PFM-ELG-006-10 title: Protect a purpose while a consumer uses it category: interaction level: api proves: - BR-CAP-PFM-ELG-006-04 - BR-CAP-PFM-ELG-007-02 exercises: - CAP-PFM-ELG-006 - CAP-PFM-ELG-007 preconditions: An application purpose has an active consumer connection. steps: >- Deploy a manifest omitting that purpose, inspect the registry, remove the connection and deploy the manifest again. expected: >- The first deployment fails without partial registry writes; the second can withdraw the unused purpose. negative: false data_needs: Run-owned records and a controlled clock where timing changes the result. bound_to: [] provenance: proposed source: >- services-platform:modules/eligibility/tests/integration/services/registry/register-eligibility-registration.integration.spec.js#refuses to withdraw a type a published version of a tenant uses, naming the tenant and the definition, and writes nothing; services-platform:modules/eligibility/tests/integration/services/bindings/consumer-bindings.integration.spec.js#refuses a rule that needs a subject the kind does not supply action_evidence: provenance: proposed source: >- services-platform:modules/eligibility/tests/integration/services/registry/register-eligibility-registration.integration.spec.js#refuses to withdraw a type a published version of a tenant uses, naming the tenant and the definition, and writes nothing; services-platform:modules/eligibility/tests/integration/services/bindings/consumer-bindings.integration.spec.js#refuses a rule that needs a subject the kind does not supply assertion_evidence: provenance: proposed source: >- services-platform:modules/eligibility/tests/integration/services/registry/register-eligibility-registration.integration.spec.js#refuses to withdraw a type a published version of a tenant uses, naming the tenant and the definition, and writes nothing; services-platform:modules/eligibility/tests/integration/services/bindings/consumer-bindings.integration.spec.js#refuses a rule that needs a subject the kind does not supply binding_scope: This sequence is proposed and has no executable proof binding. - title: Leave the registry unchanged after a rejected manifest category: failure level: api proves: - BR-CAP-PFM-ELG-006-01 - BR-CAP-PFM-ELG-006-03 preconditions: A registered declaration has an established version and stored body. steps: >- Change its body without raising the version and submit the complete manifest; inspect both changed and untouched declarations. expected: The deployment is refused and neither declaration changes. negative: true data_needs: 'Run-owned fixtures, separate caller contexts and a controlled clock where required.' bound_to: - >- services-platform:modules/eligibility/tests/integration/services/registry/register-eligibility-registration.integration.spec.js - TST-PFM-ELG-465 provenance: test source: >- services-platform:modules/eligibility/tests/integration/services/registry/register-eligibility-registration.integration.spec.js#refuses a declaration changed at the same version, saying to bump it, and writes nothing id: ATS-PFM-ELG-006-11 action_evidence: provenance: test source: >- services-platform:modules/eligibility/tests/integration/services/registry/register-eligibility-registration.integration.spec.js#refuses a declaration changed at the same version, saying to bump it, and writes nothing assertion_evidence: provenance: test source: >- services-platform:modules/eligibility/tests/integration/services/registry/register-eligibility-registration.integration.spec.js#refuses a declaration changed at the same version, saying to bump it, and writes nothing binding_scope: >- The cited tests contribute their reachable assertions; the binding does not establish execution or every step of this scenario. binding_limitations: - FND-PFM-ELG-074 evidence: - >- services-platform: docs/eligibility.md; docs/milestones/PLAT-M11-eligibility-rules.md and plans/PLAT-M11-plan.md; docs/proposals/eligibility/17-decision-register.md; aws/platform.service.ts (ELIGIBILITY_PERMISSIONS); modules/eligibility/aws/api/eligibility.routes.ts (condition_types, consumer_kinds), services/registry/** (registration-manifest.ts, register-eligibility-registration.ts, registry-snapshot.ts, registry-catalog.ts), eligibility-registration.ts, aws/lambda/REGISTRATION.handler.ts, db/eligibility-condition-types.table.ts, eligibility-consumer-kinds.table.ts; rule-level source and test references - >- react-console: components/eligibility/builder/condition-picker.tsx, lib/eligibility/registry-provider.tsx; acceptance/eligibility/journeys/registry/*.json. related_coverage: - capability: CAP-PFM-ELG-001 scenario: ATS-PFM-ELG-006-09 - capability: CAP-PFM-ELG-007 scenario: ATS-PFM-ELG-006-10 coverage: rule: covered transition: covered validation: covered permission: 'gap: FND-PFM-ELG-058' edge: 'gap: FND-PFM-ELG-058' failure: 'gap: FND-PFM-ELG-058' boundary: covered concurrency: covered invariant: 'gap: FND-PFM-ELG-058' interaction: covered invariant_gaps: - invariant: INV-DOM-PFM-ELG-001-03 finding: FND-PFM-ELG-058 source: 'services-platform:modules/eligibility/lifecycle.ts:VERSION_TRANSITIONS' - invariant: INV-DOM-PFM-ELG-001-08 finding: FND-PFM-ELG-058 source: >- services-platform:modules/eligibility/db/eligibility-definitions.table.ts:eligibility_definitions_replaced_by_check transition_coverage: [] permission_coverage: - key: platform.eligibility.read finding: FND-PFM-ELG-058 reason: A capability-level authority scenario does not prove every operation protected by this key. coverage_notes: meaning: >- Covered means a detailed scenario exists; it does not mean the scenario ran or every executable assertion conforms. gaps: >- Registration needs transport failure, simultaneous changed manifests and whole-manifest rollback at every declaration seam. No staff mutation route exists, so route absence needs proof rather than a positive permission case. --- # Maintain the application-declared rule vocabulary: Capability Test Specification ## Coverage The scenarios check observable outcomes against the cited contracts. The coverage map retains partial proof and unresolved design boundaries as findings. | Required Rule | Scenarios | |---|---| | `BR-CAP-PFM-ELG-006-01` | `ATS-PFM-ELG-006-01`, `ATS-PFM-ELG-006-11` | | `BR-CAP-PFM-ELG-006-02` | `ATS-PFM-ELG-006-02` | | `BR-CAP-PFM-ELG-006-03` | `ATS-PFM-ELG-006-03`, `ATS-PFM-ELG-006-11` | | `BR-CAP-PFM-ELG-006-04` | `ATS-PFM-ELG-006-04`, `ATS-PFM-ELG-006-10` | | `BR-CAP-PFM-ELG-006-05` | `ATS-PFM-ELG-006-05` | | `BR-CAP-PFM-ELG-006-06` | `ATS-PFM-ELG-006-06`, `ATS-PFM-ELG-006-09` | | `BR-CAP-PFM-ELG-006-07` | `ATS-PFM-ELG-006-07` | | `BR-CAP-PFM-ELG-006-08` | `ATS-PFM-ELG-006-08` | ## Interactions With Related Capabilities Use a renamed condition in existing work. Register the rename, inspect authoring choices and validate the retained expression. Protect a purpose while a consumer uses it. Deploy a manifest omitting that purpose, inspect the registry, remove the connection and deploy the manifest again.