--- id: ATS-PFM-ELG-012 scope: CAP-PFM-ELG-012 product_area: platform module: eligibility revision: 3 status: proposed approved_by: null approved_at: null source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f scenarios: - id: ATS-PFM-ELG-012-01 title: Match uncertainty alarm series level: unit proves: - BR-CAP-PFM-ELG-012-01 preconditions: Alarm resources have been synthesized. steps: Inspect the closed-policy inputs. expected: Counts use the service dimensions emitted by interactive evaluation. negative: false data_needs: No fixtures beyond the described setup. bound_to: - >- services-platform:modules/eligibility/tests/unit/alarm-inputs.spec.ts#reads the evaluation counts under the API function’s service - TST-PFM-ELG-467 - >- react-console:acceptance/eligibility/playwright/journeys/observability/ELIG-ACC-0661.spec.ts#ELIG-ACC-0661 - TST-PFM-ELG-248 provenance: test source: >- services-platform:modules/eligibility/tests/unit/alarm-inputs.spec.ts#reads the evaluation counts under the API function’s service category: boundary action_evidence: provenance: test source: >- services-platform:modules/eligibility/tests/unit/alarm-inputs.spec.ts#reads the evaluation counts under the API function’s service assertion_evidence: provenance: test source: >- services-platform:modules/eligibility/tests/unit/alarm-inputs.spec.ts#reads the evaluation counts under the API function’s service binding_scope: >- The cited tests contribute their reachable assertions; the binding does not establish execution or every step of this scenario. binding_limitations: - FND-PFM-ELG-074 - id: ATS-PFM-ELG-012-02 title: Include both circuit sources level: unit proves: - BR-CAP-PFM-ELG-012-02 preconditions: Synthesized circuit alarms are available. steps: Inspect their metric inputs. expected: Interactive and population refusals contribute to the sum. negative: false data_needs: No fixtures beyond the described setup. bound_to: - >- services-platform:modules/eligibility/tests/unit/alarm-inputs.spec.ts#reads the circuit refusals under both services that evaluate: the API function’s and the population task’s - TST-PFM-ELG-467 - >- react-console:acceptance/eligibility/playwright/journeys/observability/ELIG-ACC-0662.spec.ts#ELIG-ACC-0662 - TST-PFM-ELG-249 provenance: test source: >- services-platform:modules/eligibility/tests/unit/alarm-inputs.spec.ts#reads the circuit refusals under both services that evaluate: the API function’s and the population task’s category: failure action_evidence: provenance: test source: >- services-platform:modules/eligibility/tests/unit/alarm-inputs.spec.ts#reads the circuit refusals under both services that evaluate: the API function’s and the population task’s assertion_evidence: provenance: test source: >- services-platform:modules/eligibility/tests/unit/alarm-inputs.spec.ts#reads the circuit refusals under both services that evaluate: the API function’s and the population task’s binding_scope: >- The cited tests contribute their reachable assertions; the binding does not establish execution or every step of this scenario. binding_limitations: - FND-PFM-ELG-074 - id: ATS-PFM-ELG-012-03 title: Locate queue and job alarm sources level: unit proves: - BR-CAP-PFM-ELG-012-03 preconditions: Synthesized delay and failure alarms are available. steps: Inspect queue identity and failure metric dimensions. expected: The queue exists in the service and the failure series uses population dimensions. negative: false data_needs: No fixtures beyond the described setup. bound_to: - >- services-platform:modules/eligibility/tests/unit/alarm-inputs.spec.ts#watches the age of a queue the macroservice creates - TST-PFM-ELG-467 - >- services-platform:modules/eligibility/tests/unit/alarm-inputs.spec.ts#reads the population run’s failure under the service its task function records it as (DEF-ELIG-0675) - >- react-console:acceptance/eligibility/playwright/journeys/observability/ELIG-ACC-0663.spec.ts#ELIG-ACC-0663 - TST-PFM-ELG-250 - >- react-console:acceptance/eligibility/playwright/journeys/observability/ELIG-ACC-0664.spec.ts#ELIG-ACC-0664 - TST-PFM-ELG-251 provenance: test source: >- services-platform:modules/eligibility/tests/unit/alarm-inputs.spec.ts#watches the age of a queue the macroservice creates category: failure action_evidence: provenance: test source: >- services-platform:modules/eligibility/tests/unit/alarm-inputs.spec.ts#watches the age of a queue the macroservice creates assertion_evidence: provenance: test source: >- services-platform:modules/eligibility/tests/unit/alarm-inputs.spec.ts#watches the age of a queue the macroservice creates binding_scope: >- The cited tests contribute their reachable assertions; the binding does not establish execution or every step of this scenario. binding_limitations: - FND-PFM-ELG-074 - id: ATS-PFM-ELG-012-04 title: Reject nonexistent alarm inputs level: unit proves: - BR-CAP-PFM-ELG-012-04 preconditions: Published emitter metric lists are available. steps: Compare all alarm inputs and introduce negative controls. expected: Every real input matches an emitter and its dimensions; controls fail the comparison. negative: false data_needs: No fixtures beyond the described setup. bound_to: - >- services-platform:modules/eligibility/tests/unit/alarm-inputs.spec.ts#reads only metrics some code path emits, under the emitter’s dimensions - TST-PFM-ELG-467 - >- services-platform:modules/eligibility/tests/unit/alarm-inputs.spec.ts#finds a metric no emitter names, so the check below is not vacuous - >- react-console:acceptance/eligibility/playwright/journeys/observability/ELIG-ACC-0660.spec.ts#ELIG-ACC-0660 - TST-PFM-ELG-247 provenance: test source: >- services-platform:modules/eligibility/tests/unit/alarm-inputs.spec.ts#reads only metrics some code path emits, under the emitter’s dimensions category: invariant action_evidence: provenance: test source: >- services-platform:modules/eligibility/tests/unit/alarm-inputs.spec.ts#reads only metrics some code path emits, under the emitter’s dimensions assertion_evidence: provenance: test source: >- services-platform:modules/eligibility/tests/unit/alarm-inputs.spec.ts#reads only metrics some code path emits, under the emitter’s dimensions binding_scope: >- The cited tests contribute their reachable assertions; the binding does not establish execution or every step of this scenario. binding_limitations: - FND-PFM-ELG-074 - id: ATS-PFM-ELG-012-05 title: Trace without personal payloads level: api proves: - BR-CAP-PFM-ELG-012-05 preconditions: A batch and publication produce diagnostics. steps: Inspect the resulting log entries. expected: >- Evaluation lines identify plan and state and publication lines identify workspace and rule without personal or fact values. negative: false data_needs: No fixtures beyond the described setup. bound_to: - >- services-platform:modules/eligibility/tests/integration/services/evaluate/hosted-evaluate.integration.spec.js#logs one eligibility.evaluate event per evaluation with the plan and the state - TST-PFM-ELG-430 - >- react-console:acceptance/eligibility/playwright/journeys/observability/ELIG-ACC-0666.spec.ts#ELIG-ACC-0666 - TST-PFM-ELG-253 - >- react-console:acceptance/eligibility/playwright/journeys/observability/ELIG-ACC-0672.spec.ts#ELIG-ACC-0672 - TST-PFM-ELG-259 provenance: test source: >- services-platform:modules/eligibility/tests/integration/services/evaluate/hosted-evaluate.integration.spec.js#logs one eligibility.evaluate event per evaluation with the plan and the state category: rule action_evidence: provenance: test source: >- services-platform:modules/eligibility/tests/integration/services/evaluate/hosted-evaluate.integration.spec.js#logs one eligibility.evaluate event per evaluation with the plan and the state assertion_evidence: provenance: test source: >- services-platform:modules/eligibility/tests/integration/services/evaluate/hosted-evaluate.integration.spec.js#logs one eligibility.evaluate event per evaluation with the plan and the state binding_scope: >- The cited tests contribute their reachable assertions; the binding does not establish execution or every step of this scenario. binding_limitations: - FND-PFM-ELG-074 - id: ATS-PFM-ELG-012-06 title: Observe read failure and circuit refusal category: interaction level: api proves: - BR-CAP-PFM-ELG-008-04 - BR-CAP-PFM-ELG-012-02 exercises: - CAP-PFM-ELG-012 - CAP-PFM-ELG-008 preconditions: A batch has a failing provider entry and a healthy entry. steps: >- Evaluate the batch repeatedly through the circuit threshold and inspect results and diagnostics. expected: >- The failing entry is uncertain, the healthy entry remains answered and circuit diagnostics contain no fact payload. negative: true data_needs: Run-owned records and a controlled clock where timing changes the result. bound_to: [] provenance: proposed source: >- services-platform:modules/eligibility/tests/integration/services/evaluate/crm-conditions.integration.spec.js#answers every evaluation indeterminate with the one reason read_failed; services-platform:modules/eligibility/tests/unit/alarm-inputs.spec.ts#reads the circuit refusals under both services that evaluate: the API function’s and the population task’s action_evidence: provenance: proposed source: >- services-platform:modules/eligibility/tests/integration/services/evaluate/crm-conditions.integration.spec.js#answers every evaluation indeterminate with the one reason read_failed; services-platform:modules/eligibility/tests/unit/alarm-inputs.spec.ts#reads the circuit refusals under both services that evaluate: the API function’s and the population task’s assertion_evidence: provenance: proposed source: >- services-platform:modules/eligibility/tests/integration/services/evaluate/crm-conditions.integration.spec.js#answers every evaluation indeterminate with the one reason read_failed; services-platform:modules/eligibility/tests/unit/alarm-inputs.spec.ts#reads the circuit refusals under both services that evaluate: the API function’s and the population task’s binding_scope: This sequence is proposed and has no executable proof binding. - id: ATS-PFM-ELG-012-07 title: Observe a failed history write category: interaction level: api proves: - BR-CAP-PFM-ELG-009-07 - BR-CAP-PFM-ELG-012-05 exercises: - CAP-PFM-ELG-012 - CAP-PFM-ELG-009 preconditions: A bound authorization evaluation can be forced to fail its decision insertion. steps: 'Inject the insertion failure, evaluate and inspect diagnostic output and history.' expected: >- The authorization request does not report a successful retained decision; diagnostics omit subject facts. negative: true data_needs: Run-owned records and a controlled clock where timing changes the result. bound_to: [] provenance: proposed source: >- services-platform:modules/eligibility/tests/integration/services/evaluate/hosted-evaluate.integration.spec.js#records a display decision after answering it, at a sample rate of one; services-platform:modules/eligibility/tests/integration/services/evaluate/hosted-evaluate.integration.spec.js#logs one eligibility.evaluate event per evaluation with the plan and the state action_evidence: provenance: proposed source: >- services-platform:modules/eligibility/tests/integration/services/evaluate/hosted-evaluate.integration.spec.js#records a display decision after answering it, at a sample rate of one; services-platform:modules/eligibility/tests/integration/services/evaluate/hosted-evaluate.integration.spec.js#logs one eligibility.evaluate event per evaluation with the plan and the state assertion_evidence: provenance: proposed source: >- services-platform:modules/eligibility/tests/integration/services/evaluate/hosted-evaluate.integration.spec.js#records a display decision after answering it, at a sample rate of one; services-platform:modules/eligibility/tests/integration/services/evaluate/hosted-evaluate.integration.spec.js#logs one eligibility.evaluate event per evaluation with the plan and the state binding_scope: This sequence is proposed and has no executable proof binding. - id: ATS-PFM-ELG-012-08 title: Observe aging role rechecks category: interaction level: api proves: - BR-CAP-PFM-ELG-010-03 - BR-CAP-PFM-ELG-012-03 exercises: - CAP-PFM-ELG-012 - CAP-PFM-ELG-010 preconditions: Publication has enqueued role rechecks. steps: Keep one request pending beyond the alarm threshold and inspect queue-age metrics. expected: The queue-age series used by the alarm reflects the overdue request. negative: false data_needs: Run-owned records and a controlled clock where timing changes the result. bound_to: [] provenance: proposed source: >- services-platform:modules/eligibility/tests/integration/services/population/population-run.integration.spec.js#queues a reconcile for every subject the simulation found newly eligible when the version is published; services-platform:modules/eligibility/tests/unit/alarm-inputs.spec.ts#reads the population run’s failure under the service its task function records it as (DEF-ELIG-0675) action_evidence: provenance: proposed source: >- services-platform:modules/eligibility/tests/integration/services/population/population-run.integration.spec.js#queues a reconcile for every subject the simulation found newly eligible when the version is published; services-platform:modules/eligibility/tests/unit/alarm-inputs.spec.ts#reads the population run’s failure under the service its task function records it as (DEF-ELIG-0675) assertion_evidence: provenance: proposed source: >- services-platform:modules/eligibility/tests/integration/services/population/population-run.integration.spec.js#queues a reconcile for every subject the simulation found newly eligible when the version is published; services-platform:modules/eligibility/tests/unit/alarm-inputs.spec.ts#reads the population run’s failure under the service its task function records it as (DEF-ELIG-0675) binding_scope: This sequence is proposed and has no executable proof binding. - id: ATS-PFM-ELG-012-09 title: Observe a stopped population job category: interaction level: api proves: - BR-CAP-PFM-ELG-011-04 - BR-CAP-PFM-ELG-012-03 exercises: - CAP-PFM-ELG-012 - CAP-PFM-ELG-011 preconditions: A population run exceeds its permitted size or has a failing page. steps: >- Execute the run through failure settlement and inspect the run, dependent simulation and failure metric. expected: >- The run and dependent simulation fail and the population alarm receives the emitted failure series. negative: true data_needs: Run-owned records and a controlled clock where timing changes the result. bound_to: [] provenance: proposed source: >- services-platform:modules/eligibility/tests/integration/services/population/population-run.integration.spec.js#records a retried page once: the second attempt from the old cursor changes nothing; services-platform:modules/eligibility/tests/unit/alarm-inputs.spec.ts#reads the population run’s failure under the service its task function records it as (DEF-ELIG-0675) action_evidence: provenance: proposed source: >- services-platform:modules/eligibility/tests/integration/services/population/population-run.integration.spec.js#records a retried page once: the second attempt from the old cursor changes nothing; services-platform:modules/eligibility/tests/unit/alarm-inputs.spec.ts#reads the population run’s failure under the service its task function records it as (DEF-ELIG-0675) assertion_evidence: provenance: proposed source: >- services-platform:modules/eligibility/tests/integration/services/population/population-run.integration.spec.js#records a retried page once: the second attempt from the old cursor changes nothing; services-platform:modules/eligibility/tests/unit/alarm-inputs.spec.ts#reads the population run’s failure under the service its task function records it as (DEF-ELIG-0675) binding_scope: This sequence is proposed and has no executable proof binding. - title: Read health without reading business records category: permission level: api proves: - BR-CAP-PFM-ELG-012-06 preconditions: >- An authorized workspace caller, a caller without health authority and an anonymous caller are available. steps: Request workspace health with each signed caller and public health anonymously. expected: >- Only the authorized workspace request succeeds locally; public health identifies the build without returning workspace records. negative: true data_needs: 'Run-owned fixtures, separate caller contexts and a controlled clock where required.' bound_to: [] provenance: proposed source: >- react-console:acceptance/eligibility/playwright/journeys/registry/ELIG-ACC-0005.spec.ts#ELIG-ACC-0005 id: ATS-PFM-ELG-012-10 action_evidence: provenance: proposed source: >- react-console:acceptance/eligibility/playwright/journeys/registry/ELIG-ACC-0005.spec.ts#ELIG-ACC-0005 assertion_evidence: provenance: proposed source: >- react-console:acceptance/eligibility/playwright/journeys/registry/ELIG-ACC-0005.spec.ts#ELIG-ACC-0005 binding_scope: This sequence is proposed and has no executable proof binding. evidence: - >- services-platform: docs/eligibility.md; docs/milestones/PLAT-M11-eligibility-rules.md, PLAT-M12-eligibility-who-qualifies.md, PLAT-M13-eligibility-roles-and-permissions.md, plans/PLAT-M11-plan.md; docs/proposals/eligibility/17-decision-register.md; modules/eligibility/aws/logic/eligibility-alarms.cloudwatch.ts, services/observability/names.ts, aws/resources/*.logs.ts, aws/api/eligibility.routes.ts (health); tests/aws/platform.synth.ts named by docs; rule-level source and test references - >- react-console: acceptance/eligibility/journeys/observability/*.json and matching browser specifications. related_coverage: - capability: CAP-PFM-ELG-008 scenario: ATS-PFM-ELG-012-06 - capability: CAP-PFM-ELG-009 scenario: ATS-PFM-ELG-012-07 - capability: CAP-PFM-ELG-010 scenario: ATS-PFM-ELG-012-08 - capability: CAP-PFM-ELG-011 scenario: ATS-PFM-ELG-012-09 coverage: rule: covered transition: 'gap: FND-PFM-ELG-064' validation: 'gap: FND-PFM-ELG-064' permission: 'gap: FND-PFM-ELG-064' edge: 'gap: FND-PFM-ELG-064' failure: covered boundary: covered concurrency: 'gap: FND-PFM-ELG-064' invariant: 'gap: FND-PFM-ELG-064' interaction: covered invariant_gaps: [] transition_coverage: [] permission_coverage: - key: platform.eligibility.read finding: FND-PFM-ELG-064 reason: A capability-level authority scenario does not prove every operation protected by this key. coverage_notes: meaning: >- Covered means a detailed scenario exists; it does not mean the scenario ran or every executable assertion conforms. gaps: >- Health-request authority and public build presentation have no detailed cases. Alarm thresholds need below, equal and above controls; delayed or missing diagnostic delivery and concurrent dimensions need proof. --- # Monitor eligibility failures and delays: Capability Test Specification ## Coverage The scenarios check observable outcomes against the cited contracts. The coverage map retains partial proof and unresolved design boundaries as findings. | Required Rule | Scenarios | |---|---| | `BR-CAP-PFM-ELG-012-01` | `ATS-PFM-ELG-012-01` | | `BR-CAP-PFM-ELG-012-02` | `ATS-PFM-ELG-012-02`, `ATS-PFM-ELG-012-06` | | `BR-CAP-PFM-ELG-012-03` | `ATS-PFM-ELG-012-03`, `ATS-PFM-ELG-012-08`, `ATS-PFM-ELG-012-09` | | `BR-CAP-PFM-ELG-012-04` | `ATS-PFM-ELG-012-04` | | `BR-CAP-PFM-ELG-012-05` | `ATS-PFM-ELG-012-05`, `ATS-PFM-ELG-012-07` | ## Interactions With Related Capabilities Observe read failure and circuit refusal. Evaluate the batch repeatedly through the circuit threshold and inspect results and diagnostics. Observe a failed history write. Inject the insertion failure, evaluate and inspect diagnostic output and history. Observe aging role rechecks. Keep one request pending beyond the alarm threshold and inspect queue-age metrics. Observe a stopped population job. Execute the run through failure settlement and inspect the run, dependent simulation and failure metric.