---
id: TST-PFM-ELG-510
title: Responsibility rules checks
kind: unit
product_area: platform
module: eligibility
revision: 1
status: draft
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
repository: services-platform
files:
  - modules/responsibilities/tests/unit/rules.spec.js
implements:
  - ATS-PFM-ELG-013-07
  - ATS-PFM-ELG-014-02
environment: mock
implementation_state: implemented
latest_result: not-run
conformance: not-verified
estimated_minutes: 1
isolation: One process with suite-local inputs.
evidence:
  - provenance: test
    source: 'services-platform:modules/responsibilities/tests/unit/rules.spec.js'
    cases:
      - stores both bounds as UTC instants
      - leaves an absent bound open
      - 'refuses an end that is not after the start, naming valid_until'
      - 'refuses a bound without an offset, naming it'
      - includes its start and excludes its end
      - is read by nothing before it starts
      - starts now when no start is given
      - may start in the future
      - requires an end
      - refuses an end in the past
      - refuses a window shorter than one hour
      - accepts a window of exactly one hour
      - accepts a window of exactly 90 days
      - refuses a window longer than 90 days
      - refuses a window that outlives its assignment
      - allows the tenant always
      - allows a resource of one of its scope kinds
      - 'refuses a resource of another kind, naming resource_type'
      - 'refuses a resource scope without its id, naming resource_id'
      - refuses a tenant scope that names a resource
      - reads a chain most specific first and keeps the tenant last
      - appends the tenant to a chain that does not end in it
      - is the tenant alone when no chain is given
      - keeps an id that itself contains a colon
      - 'refuses an element that is neither tenant nor type:id'
      - refuses the tenant anywhere but last
      - refuses a scope named twice
      - refuses a chain longer than ten
      - 'gives each scope its position as specificity, 0 the most specific'
  - provenance: documented
    source: >-
      services-platform:modules/responsibilities/tests/unit/rules.spec.js:suite
      header
    note: >-
      The source header describes the verification boundary and declared
      substitutions.
proof_limit: >-
  Only the named scenario checkpoints have a verified source binding; execution
  has not been attempted.
---

# Responsibility rules checks

## Verification Boundary

This suite checks isolated decisions and validation using the imported inputs. It cannot establish a complete service or browser lifecycle.

## What This Suite Proves

The mapped scenarios identify the capability and feature checkpoints this file exercises. The source test titles preserve the assertion-level evidence.

## What It Does Not Prove

Registration supplies no execution result or conformance decision. Passing isolated checks does not establish deployed dependencies or cross-application delivery.

## Real Dependencies and Test Doubles

The suite runs isolated checks; its imported fixtures and injected collaborators define the substitutions. The source imports and suite header identify the exact dependencies.

## Must Not Be Doubled

The decision or validator being asserted remains real; returning the expected answer from a substitute defeats the check.