--- id: ATS-PFM-ELG-015 scope: CAP-PFM-ELG-015 product_area: platform module: eligibility revision: 3 status: proposed approved_by: null approved_at: null source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f scenarios: - id: ATS-PFM-ELG-015-01 title: Validate all area declarations level: api proves: - BR-CAP-PFM-ELG-015-01 preconditions: Declaration sets contain each invalid shape. steps: Register every set. expected: Problems are identified and no partial data is written. negative: true data_needs: No fixtures beyond the described setup. bound_to: - >- services-platform:modules/responsibilities/tests/integration/services/registration/register-service-responsibilities.integration.spec.js#refuses a malformed manifest whole, as ObjectInvalid, writing nothing - TST-PFM-ELG-503 - >- services-platform:modules/responsibilities/tests/integration/services/registration/register-service-responsibilities.integration.spec.js#refuses a scope kind that is not a registered object of the application, na - >- services-platform:modules/responsibilities/tests/integration/services/registration/register-service-responsibilities.integration.spec.js#refuses a role product key the security catalog does not know - >- services-platform:modules/responsibilities/tests/integration/services/registration/register-service-responsibilities.integration.spec.js#refuses a fallback that is neither in the manifest nor registered - >- services-platform:modules/responsibilities/tests/unit/registration-manifest.spec.js#refuses a key whose first word is not its application - TST-PFM-ELG-506 provenance: test source: >- services-platform:modules/responsibilities/tests/integration/services/registration/register-service-responsibilities.integration.spec.js#refuses a malformed manifest whole, as ObjectInvalid, writing nothing category: validation action_evidence: provenance: test source: >- services-platform:modules/responsibilities/tests/integration/services/registration/register-service-responsibilities.integration.spec.js#refuses a malformed manifest whole, as ObjectInvalid, writing nothing assertion_evidence: provenance: test source: >- services-platform:modules/responsibilities/tests/integration/services/registration/register-service-responsibilities.integration.spec.js#refuses a malformed manifest whole, as ObjectInvalid, writing nothing binding_scope: >- The cited tests contribute their reachable assertions; the binding does not establish execution or every step of this scenario. binding_limitations: - FND-PFM-ELG-074 - id: ATS-PFM-ELG-015-02 title: Retain omitted area history level: api proves: - BR-CAP-PFM-ELG-015-02 preconditions: An application has registered areas. steps: 'Resubmit unchanged, changed and with an omission.' expected: 'Unchanged areas remain unwritten, changed areas update and omitted areas remain retired.' negative: false data_needs: No fixtures beyond the described setup. bound_to: - >- services-platform:modules/responsibilities/tests/integration/services/registration/register-service-responsibilities.integration.spec.js#leaves an unchanged definition unwritten the second time: its version and re - TST-PFM-ELG-503 - >- services-platform:modules/responsibilities/tests/integration/services/registration/register-service-responsibilities.integration.spec.js#takes a changed definition’s new values and bumps its version - >- services-platform:modules/responsibilities/tests/integration/services/registration/register-service-responsibilities.integration.spec.js#retires a definition the manifest no longer declares, and keeps its row provenance: test source: >- services-platform:modules/responsibilities/tests/integration/services/registration/register-service-responsibilities.integration.spec.js#leaves an unchanged definition unwritten the second time: its version and re category: transition action_evidence: provenance: test source: >- services-platform:modules/responsibilities/tests/integration/services/registration/register-service-responsibilities.integration.spec.js#leaves an unchanged definition unwritten the second time: its version and re assertion_evidence: provenance: test source: >- services-platform:modules/responsibilities/tests/integration/services/registration/register-service-responsibilities.integration.spec.js#leaves an unchanged definition unwritten the second time: its version and re binding_scope: >- The cited tests contribute their reachable assertions; the binding does not establish execution or every step of this scenario. binding_limitations: - FND-PFM-ELG-074 - id: ATS-PFM-ELG-015-03 title: Reconcile deployment changes promptly level: api proves: - BR-CAP-PFM-ELG-015-03 preconditions: New always-held areas include one with a default. steps: 'Register, repeat unchanged and exhaust the immediate budget.' expected: >- Defaults and gaps update promptly, unchanged registration does nothing and budget exhaustion defers remaining work to night. negative: false data_needs: No fixtures beyond the described setup. bound_to: - >- services-platform:modules/responsibilities/tests/integration/services/reconcile/reconcile-after-registration.integration.spec.js#gives the tenant the role default of a newly registered definition - TST-PFM-ELG-501 - >- services-platform:modules/responsibilities/tests/integration/services/reconcile/reconcile-after-registration.integration.spec.js#says an identical registration changed nothing - >- services-platform:modules/responsibilities/tests/integration/services/reconcile/reconcile-after-registration.integration.spec.js#leaves every tenant to the nightly reconcile when the budget is spent, writing nothing provenance: test source: >- services-platform:modules/responsibilities/tests/integration/services/reconcile/reconcile-after-registration.integration.spec.js#gives the tenant the role default of a newly registered definition category: boundary action_evidence: provenance: test source: >- services-platform:modules/responsibilities/tests/integration/services/reconcile/reconcile-after-registration.integration.spec.js#gives the tenant the role default of a newly registered definition assertion_evidence: provenance: test source: >- services-platform:modules/responsibilities/tests/integration/services/reconcile/reconcile-after-registration.integration.spec.js#gives the tenant the role default of a newly registered definition binding_scope: >- The cited tests contribute their reachable assertions; the binding does not establish execution or every step of this scenario. binding_limitations: - FND-PFM-ELG-074 - id: ATS-PFM-ELG-015-04 title: Make default reconciliation repeatable level: api proves: - BR-CAP-PFM-ELG-015-04 preconditions: 'Declared, removed and withdrawn defaults exist.' steps: Reconcile twice. expected: >- The declared holding exists once, removed defaults remain absent, withdrawn defaults end and repetition changes nothing. negative: false data_needs: No fixtures beyond the described setup. bound_to: - >- services-platform:modules/responsibilities/tests/integration/services/reconcile/reconcile-tenant.integration.spec.js#(a) writes one active role-default assignment of the declared role at the tenant - TST-PFM-ELG-502 - >- services-platform:modules/responsibilities/tests/integration/services/reconcile/reconcile-tenant.integration.spec.js#(a) never recreates a default the tenant removed - >- services-platform:modules/responsibilities/tests/integration/services/reconcile/reconcile-tenant.integration.spec.js#(b) ends a role-default row whose definition no longer declares the default - >- services-platform:modules/responsibilities/tests/integration/services/reconcile/reconcile-tenant.integration.spec.js#changes nothing on a second run the same night provenance: test source: >- services-platform:modules/responsibilities/tests/integration/services/reconcile/reconcile-tenant.integration.spec.js#(a) writes one active role-default assignment of the declared role at the tenant category: invariant action_evidence: provenance: test source: >- services-platform:modules/responsibilities/tests/integration/services/reconcile/reconcile-tenant.integration.spec.js#(a) writes one active role-default assignment of the declared role at the tenant assertion_evidence: provenance: test source: >- services-platform:modules/responsibilities/tests/integration/services/reconcile/reconcile-tenant.integration.spec.js#(a) writes one active role-default assignment of the declared role at the tenant binding_scope: >- The cited tests contribute their reachable assertions; the binding does not establish execution or every step of this scenario. binding_limitations: - FND-PFM-ELG-074 - id: ATS-PFM-ELG-015-05 title: Update gaps with assignment writes level: api proves: - BR-CAP-PFM-ELG-015-05 preconditions: One always-held area has a primary and another expects no holder. steps: 'End, recreate and remove the last default holding.' expected: >- The gap opens or clears immediately, while unrelated and no-holder-required areas stay unchanged. negative: false data_needs: No fixtures beyond the described setup. bound_to: - >- services-platform:modules/responsibilities/tests/integration/services/persistence/unassigned-responsibilities.integration.spec.js#opens a row for an unheld always-held area and none for an area that expects nobody - TST-PFM-ELG-499 - >- services-platform:modules/responsibilities/tests/integration/services/persistence/unassigned-responsibilities.integration.spec.js#opens the row at once when the only assignment of an area is ended - >- services-platform:modules/responsibilities/tests/integration/services/persistence/unassigned-responsibilities.integration.spec.js#leaves the other areas’ rows alone when one area changes - >- services-platform:modules/responsibilities/tests/integration/services/persistence/unassigned-responsibilities.integration.spec.js#opens the row at once when the tenant removes the only role default - >- services-platform:modules/responsibilities/tests/integration/services/reconcile/reconcile-tenant.integration.spec.js#(c) has the report clear once a holder appears, before any reconcile (DEF-RA-0003), and the reconcile leave it clear - TST-PFM-ELG-502 provenance: test source: >- services-platform:modules/responsibilities/tests/integration/services/persistence/unassigned-responsibilities.integration.spec.js#opens a row for an unheld always-held area and none for an area that expects nobody category: interaction action_evidence: provenance: test source: >- services-platform:modules/responsibilities/tests/integration/services/persistence/unassigned-responsibilities.integration.spec.js#opens a row for an unheld always-held area and none for an area that expects nobody assertion_evidence: provenance: test source: >- services-platform:modules/responsibilities/tests/integration/services/persistence/unassigned-responsibilities.integration.spec.js#opens a row for an unheld always-held area and none for an area that expects nobody binding_scope: >- The cited tests contribute their reachable assertions; the binding does not establish execution or every step of this scenario. binding_limitations: - FND-PFM-ELG-074 - id: ATS-PFM-ELG-015-06 title: Clear administrator attention with coverage level: browser proves: - BR-CAP-PFM-ELG-015-06 - AS-JNY-PFM-ELG-006-01 preconditions: An always-held area has no primary. steps: Inspect administrator Home and assign a holder. expected: >- The uncovered-area advisory reaches administrators and resolves as cleared after successful refresh. negative: false data_needs: No fixtures beyond the described setup. bound_to: - >- services-platform:modules/attention/tests/integration/services/evaluate/refresh-unassigned-attention.integration.spec.js#has one open report row and one open item for an always-held area nobody holds - TST-PFM-ELG-391 - >- services-platform:modules/attention/tests/integration/services/evaluate/refresh-unassigned-attention.integration.spec.js#resolves the item as cleared when the refresh runs after the assignment - >- services-platform:modules/attention/tests/integration/services/evaluate/evaluate-definition.integration.spec.js#publishes one item per open row, addressed to the administrators, about the responsibility - TST-PFM-ELG-390 - >- react-console:acceptance/platform-attention/playwright/journeys/responsibilities/RA-ACC-0003.spec.ts#RA-ACC-0003 - TST-PFM-ELG-378 provenance: test source: >- services-platform:modules/attention/tests/integration/services/evaluate/refresh-unassigned-attention.integration.spec.js#has one open report row and one open item for an always-held area nobody holds category: interaction action_evidence: provenance: test source: >- services-platform:modules/attention/tests/integration/services/evaluate/refresh-unassigned-attention.integration.spec.js#has one open report row and one open item for an always-held area nobody holds assertion_evidence: provenance: test source: >- services-platform:modules/attention/tests/integration/services/evaluate/refresh-unassigned-attention.integration.spec.js#has one open report row and one open item for an always-held area nobody holds binding_scope: >- The cited tests contribute their reachable assertions; the binding does not establish execution or every step of this scenario. binding_limitations: - FND-PFM-ELG-074 - id: ATS-PFM-ELG-015-07 title: Repair a reported gap by assignment category: interaction level: api proves: - BR-CAP-PFM-ELG-013-08 - BR-CAP-PFM-ELG-015-05 exercises: - CAP-PFM-ELG-015 - CAP-PFM-ELG-013 preconditions: An always-held area has no primary holding. steps: 'Read uncovered areas, create a valid primary holding, then end it and read again.' expected: >- The area leaves the report when assigned and returns after ending, with each gap change committed with the holding. negative: false data_needs: Run-owned records and a controlled clock where timing changes the result. bound_to: [] provenance: proposed source: >- services-platform:modules/responsibilities/tests/integration/services/persistence/assignments.integration.spec.js#ends the assignment’s open delegations in the same transaction; services-platform:modules/responsibilities/tests/integration/services/persistence/unassigned-responsibilities.integration.spec.js#opens the row at once when the only assignment of an area is ended action_evidence: provenance: proposed source: >- services-platform:modules/responsibilities/tests/integration/services/persistence/assignments.integration.spec.js#ends the assignment’s open delegations in the same transaction; services-platform:modules/responsibilities/tests/integration/services/persistence/unassigned-responsibilities.integration.spec.js#opens the row at once when the only assignment of an area is ended assertion_evidence: provenance: proposed source: >- services-platform:modules/responsibilities/tests/integration/services/persistence/assignments.integration.spec.js#ends the assignment’s open delegations in the same transaction; services-platform:modules/responsibilities/tests/integration/services/persistence/unassigned-responsibilities.integration.spec.js#opens the row at once when the only assignment of an area is ended binding_scope: This sequence is proposed and has no executable proof binding. - id: ATS-PFM-ELG-015-08 title: Report inactive cover without silently ending it category: interaction level: api proves: - BR-CAP-PFM-ELG-014-08 - BR-CAP-PFM-ELG-015-04 exercises: - CAP-PFM-ELG-015 - CAP-PFM-ELG-014 preconditions: A cover arrangement exists before the delegate becomes inactive. steps: >- Run nightly reconciliation, inspect its report and the cover row, then read effective attention. expected: >- The report names the inactive colleague while the arrangement is retained; ineffective coverage supplies no attention match. negative: false data_needs: Run-owned records and a controlled clock where timing changes the result. bound_to: [] provenance: proposed source: >- services-platform:modules/responsibilities/tests/integration/services/reconcile/reconcile-tenant.integration.spec.js#(d) reports a delegation to a user who is no longer active, and leaves it active; services-platform:modules/responsibilities/tests/integration/services/reconcile/reconcile-tenant.integration.spec.js#(a) writes one active role-default assignment of the declared role at the tenant action_evidence: provenance: proposed source: >- services-platform:modules/responsibilities/tests/integration/services/reconcile/reconcile-tenant.integration.spec.js#(d) reports a delegation to a user who is no longer active, and leaves it active; services-platform:modules/responsibilities/tests/integration/services/reconcile/reconcile-tenant.integration.spec.js#(a) writes one active role-default assignment of the declared role at the tenant assertion_evidence: provenance: proposed source: >- services-platform:modules/responsibilities/tests/integration/services/reconcile/reconcile-tenant.integration.spec.js#(d) reports a delegation to a user who is no longer active, and leaves it active; services-platform:modules/responsibilities/tests/integration/services/reconcile/reconcile-tenant.integration.spec.js#(a) writes one active role-default assignment of the declared role at the tenant binding_scope: This sequence is proposed and has no executable proof binding. - id: ATS-PFM-ELG-015-09 title: Clear gap attention after coverage repair category: interaction level: api proves: - BR-CAP-PFM-ELG-015-06 - BR-CAP-PFM-ELG-016-07 exercises: - CAP-PFM-ELG-015 - CAP-PFM-ELG-016 preconditions: An uncovered always-held area has advisory administrator attention. steps: >- Assign a primary holder, refresh uncovered-area attention and inspect the advisory and gap report. expected: >- Coverage clears the report and resolves its advisory; repeating the refresh creates no new occurrence. negative: false data_needs: Run-owned records and a controlled clock where timing changes the result. bound_to: [] provenance: proposed source: >- services-platform:modules/attention/tests/integration/services/evaluate/refresh-unassigned-attention.integration.spec.js#resolves the item as cleared when the refresh runs after the assignment; services-platform:modules/attention/tests/integration/services/persistence/items.integration.spec.js#resolves the open items not confirmed since the instant, in the scope given, and leaves the confirmed action_evidence: provenance: proposed source: >- services-platform:modules/attention/tests/integration/services/evaluate/refresh-unassigned-attention.integration.spec.js#resolves the item as cleared when the refresh runs after the assignment; services-platform:modules/attention/tests/integration/services/persistence/items.integration.spec.js#resolves the open items not confirmed since the instant, in the scope given, and leaves the confirmed assertion_evidence: provenance: proposed source: >- services-platform:modules/attention/tests/integration/services/evaluate/refresh-unassigned-attention.integration.spec.js#resolves the item as cleared when the refresh runs after the assignment; services-platform:modules/attention/tests/integration/services/persistence/items.integration.spec.js#resolves the open items not confirmed since the instant, in the scope given, and leaves the confirmed binding_scope: This sequence is proposed and has no executable proof binding. - title: Keep the coverage write when attention refresh fails category: failure level: api proves: - BR-CAP-PFM-ELG-015-05 - BR-CAP-PFM-ELG-015-06 preconditions: An uncovered area has an outstanding advisory and an accepted assignment repair is ready. steps: >- Fail the post-commit advisory refresh, create the holder, inspect coverage and run the later repair refresh. expected: >- The holder and cleared gap remain committed while the advisory may lag; a successful later refresh clears the advisory. negative: true data_needs: 'Run-owned fixtures, separate caller contexts and a controlled clock where required.' bound_to: [] provenance: proposed source: >- services-platform:modules/responsibilities/services/persistence/assignments.ts:refreshUnassignedFor id: ATS-PFM-ELG-015-10 action_evidence: provenance: proposed source: >- services-platform:modules/responsibilities/services/persistence/assignments.ts:refreshUnassignedFor assertion_evidence: provenance: proposed source: >- services-platform:modules/responsibilities/services/persistence/assignments.ts:refreshUnassignedFor binding_scope: This sequence is proposed and has no executable proof binding. evidence: - >- services-platform: docs/responsibilities.md; docs/milestones/PLAT-M15-home-attention-and-responsibilities.md and plans/PLAT-M15-plan.md; docs/proposals/responsibilities-and-attention/16-decisions.md; aws/platform.service.ts (RESPONSIBILITIES_PERMISSIONS); modules/responsibilities/services/registration/**, services/reconcile/** (reconcile-workspace.ts, reconcile-after-registration.ts, nightly-reconcile-workflow.ts), services/persistence/unassigned-responsibilities.ts, aws/logic/responsibilities-reconcile.step-function.ts, aws/lambda/RECONCILE_SCHEDULER.handler.ts, REGISTRATION.handler.ts, db/unassigned-responsibilities.table.ts, responsibility-reconcile-jobs.table.ts, _job_steps, _job_events; modules/attention/services/evaluate/refresh-unassigned-attention.ts, platform-attention.ts; rule-level source and test references - >- react-console: components/responsibilities/responsibilities-settings.tsx (the Nobody looks after this panel); acceptance/platform-attention/journeys/responsibilities/RA-ACC-0003. related_coverage: - capability: CAP-PFM-ELG-013 scenario: ATS-PFM-ELG-015-07 - capability: CAP-PFM-ELG-014 scenario: ATS-PFM-ELG-015-08 - capability: CAP-PFM-ELG-016 scenario: ATS-PFM-ELG-015-09 coverage: rule: 'gap: FND-PFM-ELG-067' transition: 'gap: FND-PFM-ELG-067' validation: covered permission: 'gap: FND-PFM-ELG-067' edge: 'gap: FND-PFM-ELG-067' failure: 'gap: FND-PFM-ELG-067' boundary: covered concurrency: 'gap: FND-PFM-ELG-067' invariant: 'gap: FND-PFM-ELG-067' interaction: covered invariant_gaps: - invariant: INV-DOM-PFM-ELG-004-07 finding: FND-PFM-ELG-067 source: 'services-platform:modules/responsibilities/rules.ts:checkDelegationWindow' - invariant: INV-DOM-PFM-ELG-004-08 finding: FND-PFM-ELG-067 source: >- services-platform:modules/responsibilities/services/persistence/assignments.ts:refreshUnassignedFor - invariant: INV-DOM-PFM-ELG-004-09 finding: FND-PFM-ELG-067 source: >- services-platform:db/migrations/20261019011302_responsibilities.sql:platform.sync_derived_responsibilities transition_coverage: - model: STATE-PFM-ELG-005 from: scheduled to: active trigger: Current instant reaches validity start finding: FND-PFM-ELG-067 source: 'services-platform:modules/responsibilities/rules.ts:windowIncludes' - model: STATE-PFM-ELG-005 from: active to: lapsed trigger: Current instant reaches validity end finding: FND-PFM-ELG-067 source: 'services-platform:modules/responsibilities/rules.ts:windowIncludes' - model: STATE-PFM-ELG-005 from: active to: ended trigger: endResponsibilityAssignment source: 'services-platform:modules/responsibilities/services/persistence/assignments.ts:endAssignment' scenario: ATS-PFM-ELG-013-08 - model: STATE-PFM-ELG-005 from: scheduled to: ended trigger: endResponsibilityAssignment finding: FND-PFM-ELG-067 source: 'services-platform:modules/responsibilities/services/persistence/assignments.ts:endAssignment' - model: STATE-PFM-ELG-005 from: active to: removed trigger: removeResponsibilityRoleDefault source: >- services-platform:modules/responsibilities/services/persistence/assignments.ts:removeRoleDefaultAssignment scenario: ATS-PFM-ELG-013-09 - model: STATE-PFM-ELG-005 from: active to: ended trigger: Registration or reconcile retires a default declaration finding: FND-PFM-ELG-067 source: >- services-platform:modules/responsibilities/services/persistence/assignments.ts:endRetiredRoleDefaultAssignments - model: STATE-PFM-ELG-005 from: active to: ended trigger: sync_derived_responsibilities omits an existing holding finding: FND-PFM-ELG-067 source: >- services-platform:db/migrations/20261019011302_responsibilities.sql:platform.sync_derived_responsibilities permission_coverage: - key: platform.responsibilities.read finding: FND-PFM-ELG-067 reason: A capability-level authority scenario does not prove every operation protected by this key. coverage_notes: meaning: >- Covered means a detailed scenario exists; it does not mean the scenario ran or every executable assertion conforms. gaps: >- Derived synchronization needs complete validation, transactional audit and serialization scenarios. Uncovered-area attention failure, reader refusal and a repeated reconciliation spanning inactive cover need proof. --- # Identify and repair gaps in responsibility coverage: Capability Test Specification ## Coverage The scenarios check observable outcomes against the cited contracts. The coverage map retains partial proof and unresolved design boundaries as findings. | Required Rule | Scenarios | |---|---| | `BR-CAP-PFM-ELG-015-01` | `ATS-PFM-ELG-015-01` | | `BR-CAP-PFM-ELG-015-02` | `ATS-PFM-ELG-015-02` | | `BR-CAP-PFM-ELG-015-03` | `ATS-PFM-ELG-015-03` | | `BR-CAP-PFM-ELG-015-04` | `ATS-PFM-ELG-015-04`, `ATS-PFM-ELG-015-08` | | `BR-CAP-PFM-ELG-015-05` | `ATS-PFM-ELG-015-05`, `ATS-PFM-ELG-015-07`, `ATS-PFM-ELG-015-10` | | `BR-CAP-PFM-ELG-015-06` | `ATS-PFM-ELG-015-06`, `ATS-PFM-ELG-015-09`, `ATS-PFM-ELG-015-10` | | `BR-CAP-PFM-ELG-015-08` | Gap: `FND-PFM-ELG-067` | | `BR-CAP-PFM-ELG-015-09` | Gap: `FND-PFM-ELG-067` | ## Interactions With Related Capabilities Repair a reported gap by assignment. Read uncovered areas, create a valid primary holding, then end it and read again. Report inactive cover without silently ending it. Run nightly reconciliation, inspect its report and the cover row, then read effective attention. Clear gap attention after coverage repair. Assign a primary holder, refresh uncovered-area attention and inspect the advisory and gap report.