--- id: ATS-PFM-INT-008 scope: CAP-PFM-INT-008 product_area: platform module: integrations revision: 3 status: proposed source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 macroservice-libraries: 54536a441935c6e09fdb7f96f0bec71c52ba4e03 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f scenarios: - id: ATS-PFM-INT-008-01 title: Business context selects the narrowest choice level: api proves: - BR-CAP-PFM-INT-008-01 - AS-JNY-PFM-INT-003-01 preconditions: 'Merchant account A has a record choice, B has a business-unit choice and a third account has none.' steps: Explain payments for all three. expected: >- A selects its record connection, B its business-unit connection and the third reports missing configuration with every visited scope. negative: false data_needs: 'Fixtures establishing the stated accounts, declarations and history in an isolated workspace.' bound_to: - TST-PFM-INT-572 - TST-PFM-INT-514 - TST-PFM-INT-374 provenance: test source: >- services-platform:modules/integrations/tests/unit/services/binding-resolution.spec.ts#asks every scope the policy allows and the context names, most specific first category: rule binding_evidence: - >- services-platform:modules/integrations/tests/unit/services/binding-resolution.spec.ts#asks every scope the policy allows and the context names, most specific first - >- services-platform:modules/integrations/tests/unit/services/binding-resolution.spec.ts#skips a scope the context cannot name: a resource of another object, a missing business unit - >- services-platform:modules/integrations/tests/integration/services/bindings/resolve.integration.spec.js#walks a tender on B, which has no resource binding, to its business unit and Stripe - >- react-console:acceptance/integrations/playwright/journeys/library/INT-ACC-0033.spec.ts#INT-ACC-0033 binding_scope: >- contributions: the cited tests support their own asserted outcomes. Additional setup, branches and combined sequences remain proposed unless the cited assertions exercise them. - id: ATS-PFM-INT-008-02 title: Trace identifies the failed eligibility condition level: api proves: - BR-CAP-PFM-INT-008-02 preconditions: Prepare candidates each violating one check. steps: Resolve each candidate. expected: The trace identifies that failed check and the missing prerequisite. negative: true data_needs: 'Fixtures establishing the stated accounts, declarations and history in an isolated workspace.' bound_to: - TST-PFM-INT-569 - TST-PFM-INT-488 - TST-PFM-INT-539 provenance: test source: >- services-platform:modules/integrations/tests/unit/services/binding-eligibility.spec.ts#fails a published version with no active deployment here category: validation binding_evidence: - >- services-platform:modules/integrations/tests/unit/services/binding-eligibility.spec.ts#fails a published version with no active deployment here - >- services-platform:modules/integrations/tests/unit/services/binding-eligibility.spec.ts#fails a retired version - >- services-platform:modules/integrations/tests/e2e/integration-bindings.e2e.spec.js#shows every eligibility check of the chosen binding - >- services-platform:modules/integrations/tests/integration/services/executions/consent-narrowing.integration.spec.js#INT-ACC-0509 step 4: the trace authorization check failed naming payments.refund@1 binding_scope: >- contributions: the cited tests support their own asserted outcomes. Additional setup, branches and combined sequences remain proposed unless the cited assertions exercise them. - id: ATS-PFM-INT-008-03 title: Sensitivity controls broader-scope fallback level: api proves: - BR-CAP-PFM-INT-008-03 preconditions: An unusable record choice sits above a valid application choice for payments and webinars. steps: Explain each capability. expected: >- Payment refuses the record choice; webinar uses the application choice and reports that it skipped the narrower scope. negative: true data_needs: 'Fixtures establishing the stated accounts, declarations and history in an isolated workspace.' bound_to: - TST-PFM-INT-572 - TST-PFM-INT-514 provenance: test source: >- services-platform:modules/integrations/tests/unit/services/binding-resolution.spec.ts#stops at the first ineligible binding with binding_ineligible, never reaching the broader scope category: edge binding_evidence: - >- services-platform:modules/integrations/tests/unit/services/binding-resolution.spec.ts#stops at the first ineligible binding with binding_ineligible, never reaching the broader scope - >- services-platform:modules/integrations/tests/unit/services/binding-resolution.spec.ts#walks past an ineligible resource binding to the application’s - >- services-platform:modules/integrations/tests/integration/services/bindings/resolve.integration.spec.js#walks to the application’s account, which has webinars, warning that the resource binding was skipped binding_scope: >- contributions: the cited tests support their own asserted outcomes. Additional setup, branches and combined sequences remain proposed unless the cited assertions exercise them. - id: ATS-PFM-INT-008-04 title: Unbound work reports configuration gaps level: api proves: - BR-CAP-PFM-INT-008-04 preconditions: The business unit has no provider choice. steps: Explain a payment in that context. expected: Resolution reports no binding and lists the unbound scopes it examined. negative: true data_needs: 'Fixtures establishing the stated accounts, declarations and history in an isolated workspace.' bound_to: - TST-PFM-INT-572 - TST-PFM-INT-514 provenance: test source: >- services-platform:modules/integrations/tests/unit/services/binding-resolution.spec.ts#refuses no_binding with every visited scope recorded, each with no binding category: failure binding_evidence: - >- services-platform:modules/integrations/tests/unit/services/binding-resolution.spec.ts#refuses no_binding with every visited scope recorded, each with no binding - >- services-platform:modules/integrations/tests/integration/services/bindings/resolve.integration.spec.js#refuses a third merchant account, in a business unit with no binding, with no_binding after every scope binding_scope: >- contributions: the cited tests support their own asserted outcomes. Additional setup, branches and combined sequences remain proposed unless the cited assertions exercise them. - id: ATS-PFM-INT-008-05 title: Contract retirement precedes selection level: unit proves: - BR-CAP-PFM-INT-008-05 preconditions: 'Prepare a sunset major, a deprecated major before sunset and an undefined capability.' steps: Resolve each. expected: >- The sunset major refuses with no scope trace, the deprecated major resolves and the unknown capability reports invalid input. negative: true data_needs: 'Fixtures establishing the stated accounts, declarations and history in an isolated workspace.' bound_to: - TST-PFM-INT-572 provenance: test source: >- services-platform:modules/integrations/tests/unit/services/binding-resolution.spec.ts#refuses contract_retired after its sunset, reading no scope category: transition binding_evidence: - >- services-platform:modules/integrations/tests/unit/services/binding-resolution.spec.ts#refuses contract_retired after its sunset, reading no scope - >- services-platform:modules/integrations/tests/unit/services/binding-resolution.spec.ts#still resolves a deprecated major before its sunset - >- services-platform:modules/integrations/tests/unit/services/binding-resolution.spec.ts#is refused as an invalid request naming the capability binding_scope: >- contributions: the cited tests support their own asserted outcomes. Additional setup, branches and combined sequences remain proposed unless the cited assertions exercise them. - id: ATS-PFM-INT-008-06 title: Degraded accounts remain usable with a warning level: api proves: - BR-CAP-PFM-INT-008-06 preconditions: One explicitly named connection is degraded and another requires re-authorization. steps: Explain a call against each. expected: The degraded account resolves with a warning and the other refuses as unavailable. negative: false data_needs: 'Fixtures establishing the stated accounts, declarations and history in an isolated workspace.' bound_to: - TST-PFM-INT-514 - TST-PFM-INT-488 provenance: test source: >- services-platform:modules/integrations/tests/integration/services/bindings/resolve.integration.spec.js#resolves with the connection_degraded warning while the circuit is closed category: edge binding_evidence: - >- services-platform:modules/integrations/tests/integration/services/bindings/resolve.integration.spec.js#resolves with the connection_degraded warning while the circuit is closed - >- services-platform:modules/integrations/tests/integration/services/bindings/resolve.integration.spec.js#refuses a processor that needs re-authorization with connection_unavailable - >- services-platform:modules/integrations/tests/e2e/integration-bindings.e2e.spec.js#explains the payment resolving with the connection_degraded warning binding_scope: >- contributions: the cited tests support their own asserted outcomes. Additional setup, branches and combined sequences remain proposed unless the cited assertions exercise them. - id: ATS-PFM-INT-008-07 title: Circuit state never silently changes processors level: api proves: - BR-CAP-PFM-INT-008-07 preconditions: A payment choice has an open circuit above a broader application choice. steps: Explain immediately and after the probe becomes due. expected: 'Both use the original connection, with open then half-open circuit information in the trace.' negative: false data_needs: 'Fixtures establishing the stated accounts, declarations and history in an isolated workspace.' bound_to: - TST-PFM-INT-572 - TST-PFM-INT-514 provenance: test source: >- services-platform:modules/integrations/tests/unit/services/binding-resolution.spec.ts#resolves a payment whose processor’s circuit is open rather than refusing it binding_ineligible category: invariant binding_evidence: - >- services-platform:modules/integrations/tests/unit/services/binding-resolution.spec.ts#resolves a payment whose processor’s circuit is open rather than refusing it binding_ineligible - >- services-platform:modules/integrations/tests/integration/services/bindings/resolve.integration.spec.js#still resolves the payment to its processor, never touching the application’s (admission answers the circuit) - >- services-platform:modules/integrations/tests/integration/services/bindings/resolve.integration.spec.js#resolves again once the probe is due, the circuit then half-open binding_scope: >- contributions: the cited tests support their own asserted outcomes. Additional setup, branches and combined sequences remain proposed unless the cited assertions exercise them. - id: ATS-PFM-INT-008-08 title: Refund routing preserves the original processor level: api proves: - BR-CAP-PFM-INT-008-08 preconditions: 'A payment was taken by Payrix, with Stripe later selected by bindings.' steps: Explain a directly named Payrix refund before and after its disconnection. expected: >- The first bypasses bindings and resolves; the later request reports the original connection disconnected. negative: true data_needs: 'Fixtures establishing the stated accounts, declarations and history in an isolated workspace.' bound_to: - TST-PFM-INT-514 provenance: test source: >- services-platform:modules/integrations/tests/integration/services/bindings/resolve.integration.spec.js#reaches the processor that took the payment through its named connection category: interaction binding_evidence: - >- services-platform:modules/integrations/tests/integration/services/bindings/resolve.integration.spec.js#reaches the processor that took the payment through its named connection - >- services-platform:modules/integrations/tests/integration/services/bindings/resolve.integration.spec.js#refuses a disconnected processor with connection_disconnected - >- services-platform:modules/integrations/tests/integration/services/bindings/resolve.integration.spec.js#refuses another tenant’s connection as one that is not there - >- services-platform:modules/integrations/tests/integration/services/bindings/resolve.integration.spec.js#answers connection_unavailable for a mode the pin does not implement binding_scope: >- contributions: the cited tests support their own asserted outcomes. Additional setup, branches and combined sequences remain proposed unless the cited assertions exercise them. - id: ATS-PFM-INT-008-09 title: Read-only Explain exposes the actual selection level: browser proves: - BR-CAP-PFM-INT-008-09 preconditions: Record and business-unit bindings exist. steps: Explain in business-unit context as a reader. expected: 'The chosen connection, binding and checks are visible without mutation controls.' negative: false data_needs: 'Fixtures establishing the stated accounts, declarations and history in an isolated workspace.' bound_to: - TST-PFM-INT-488 - TST-PFM-INT-400 provenance: test source: 'services-platform:modules/integrations/tests/e2e/integration-bindings.e2e.spec.js#may explain' category: permission binding_evidence: - 'services-platform:modules/integrations/tests/e2e/integration-bindings.e2e.spec.js#may explain' - >- services-platform:modules/integrations/tests/e2e/integration-bindings.e2e.spec.js#answers connection_unavailable for a capability the connection’s pin does not implement - >- react-console:acceptance/integrations/playwright/journeys/library/INT-ACC-0059.spec.ts#INT-ACC-0059 binding_scope: >- contributions: the cited tests support their own asserted outcomes. Additional setup, branches and combined sequences remain proposed unless the cited assertions exercise them. - id: ATS-PFM-INT-008-10 level: api negative: false data_needs: Run-owned records and principals in an isolated workspace. bound_to: [] provenance: proposed title: Circuit refusal retains the selected processor category: interaction proves: - BR-CAP-PFM-INT-008-07 - BR-CAP-PFM-INT-009-07 exercises: - CAP-PFM-INT-008 - CAP-PFM-INT-009 preconditions: A sensitive binding selects an account with an open circuit and another usable account exists. steps: 'Resolve and invoke the capability, then inspect the trace and adapter calls.' expected: >- Resolution identifies the selected account and circuit condition; admission refuses without contacting either processor. source: - >- services-platform:modules/integrations/tests/unit/services/binding-resolution.spec.ts#resolves a payment whose processor’s circuit is open rather than refusing it binding_ineligible - >- services-platform:modules/integrations/tests/integration/services/executions/invoke-capability.integration.spec.js#refuses with 503 provider_unavailable while the circuit is open, and releases the key workflows: - WF-PFM-INT-011 - id: ATS-PFM-INT-008-11 level: api negative: false data_needs: Run-owned records and principals in an isolated workspace. bound_to: [] provenance: proposed title: A direct test uses its named account category: interaction proves: - BR-CAP-PFM-INT-008-08 - BR-CAP-PFM-INT-012-04 exercises: - CAP-PFM-INT-008 - CAP-PFM-INT-012 preconditions: A provider-reported test account supports the requested capability and has no binding. steps: Invoke through the Library and inspect resolution and execution identity. expected: The test uses that account directly and retains ordinary gateway history. source: - >- services-platform:modules/integrations/tests/integration/services/bindings/resolve.integration.spec.js#reaches the processor that took the payment through its named connection - >- services-platform:modules/integrations/tests/e2e/connection-try.e2e.spec.js#records an execution of that connection by the calling application library_try on behalf of the person, with no binding workflows: - WF-PFM-INT-011 evidence: - >- Each binding identifies an existing source test at the pinned revision; unbound scenarios remain proposed proof obligations. coverage: rule: covered transition: covered validation: covered permission: covered edge: covered failure: covered boundary: 'gap: FND-PFM-INT-066' concurrency: 'gap: FND-PFM-INT-066' invariant: covered interaction: covered coverage_notes: covered: A designed scenario exists; executable coverage and a passing run require separate evidence. gaps: >- The finding records categories without a designed scenario and remaining permission and rule audit obligations. --- # Explain and select the connection for a call: Capability Test Specification ## Coverage | Rule | Proved By | |---|---| | `BR-CAP-PFM-INT-008-01` | `ATS-PFM-INT-008-01` | | `BR-CAP-PFM-INT-008-02` | `ATS-PFM-INT-008-02` | | `BR-CAP-PFM-INT-008-03` | `ATS-PFM-INT-008-03` | | `BR-CAP-PFM-INT-008-04` | `ATS-PFM-INT-008-04` | | `BR-CAP-PFM-INT-008-05` | `ATS-PFM-INT-008-05` | | `BR-CAP-PFM-INT-008-06` | `ATS-PFM-INT-008-06` | | `BR-CAP-PFM-INT-008-07` | `ATS-PFM-INT-008-07`, `ATS-PFM-INT-008-10` | | `BR-CAP-PFM-INT-008-08` | `ATS-PFM-INT-008-08`, `ATS-PFM-INT-008-11` | | `BR-CAP-PFM-INT-008-09` | `ATS-PFM-INT-008-09` | | `BR-CAP-PFM-INT-008-10` | `FND-PFM-INT-066` | ## Interactions With Related Capabilities Resolution supplies the connection choice used by invocation and test calls. The interaction cases compare the selected route with the retained execution evidence and exercise the additional restrictions of the test-account path. The structured scenarios name the capabilities and rules involved. A bound test contributes only the outcomes it asserts; proposed transition matrices and composed interactions still require executable proof.