--- id: ATS-PFM-INT-009 scope: CAP-PFM-INT-009 product_area: platform module: integrations revision: 3 status: proposed source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 macroservice-libraries: 54536a441935c6e09fdb7f96f0bec71c52ba4e03 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f scenarios: - id: ATS-PFM-INT-009-01 title: Invalid calls leave no execution record level: unit proves: - BR-CAP-PFM-INT-009-01 preconditions: A payment capability has a defined request contract. steps: >- Send excessive size, invalid shape, unsupported mode, missing key, padded key and excessive timeout. expected: Each request reports invalid input with its cause and creates no execution. negative: true data_needs: 'Fixtures establishing the stated accounts, declarations and history in an isolated workspace.' bound_to: - TST-PFM-INT-580 provenance: test source: >- services-platform:modules/integrations/tests/unit/services/gateway-refusals.spec.ts#refuses a request the contract refuses, invalid_request with the failing path category: validation binding_evidence: - >- services-platform:modules/integrations/tests/unit/services/gateway-refusals.spec.ts#refuses a request the contract refuses, invalid_request with the failing path - >- services-platform:modules/integrations/tests/unit/services/gateway-refusals.spec.ts#refuses a request over 1 MB before anything else - >- services-platform:modules/integrations/tests/unit/services/gateway-refusals.spec.ts#refuses a key with surrounding whitespace as given, never trimming it into another key - >- services-platform:modules/integrations/tests/unit/services/gateway-refusals.spec.ts#refuses a timeout above the contract’s maximum - >- services-platform:modules/integrations/tests/unit/services/gateway-refusals.spec.ts#refuses a missing key where the contract requires one binding_scope: >- contributions: the cited tests support their own asserted outcomes. Additional setup, branches and combined sequences remain proposed unless the cited assertions exercise them. - id: ATS-PFM-INT-009-02 title: Invocation authority matches the business application level: api proves: - BR-CAP-PFM-INT-009-02 preconditions: Prepare Accounting and Events principals plus a console person. steps: Invoke for Events as Accounting and invoke as the person without the capability permission. expected: Both refuse before recording an operation. negative: true data_needs: 'Fixtures establishing the stated accounts, declarations and history in an isolated workspace.' bound_to: - TST-PFM-INT-580 - TST-PFM-INT-543 provenance: test source: >- services-platform:modules/integrations/tests/unit/services/gateway-refusals.spec.ts#refuses a service principal naming another application, access_denied category: permission binding_evidence: - >- services-platform:modules/integrations/tests/unit/services/gateway-refusals.spec.ts#refuses a service principal naming another application, access_denied - >- services-platform:modules/integrations/tests/unit/services/gateway-refusals.spec.ts#refuses a console caller without it - >- services-platform:modules/integrations/tests/integration/services/executions/invoke-capability.integration.spec.js#refuses a principal invoking for another application, 403, before recording anything binding_scope: >- contributions: the cited tests support their own asserted outcomes. Additional setup, branches and combined sequences remain proposed unless the cited assertions exercise them. - id: ATS-PFM-INT-009-03 title: Idempotent requests reuse the original operation level: api proves: - BR-CAP-PFM-INT-009-03 preconditions: >- One request has succeeded under a known key and another execution with its own key is awaiting reconciliation. steps: >- Replay a succeeded request unchanged, reuse its key with another amount and repeat a separate request while its execution is being reconciled. expected: >- Replay returns the stored result without another provider call, changed input is refused and the unresolved repeat identifies its pending execution. negative: true data_needs: 'Fixtures establishing the stated accounts, declarations and history in an isolated workspace.' bound_to: - TST-PFM-INT-543 provenance: test source: >- services-platform:modules/integrations/tests/integration/services/executions/invoke-capability.integration.spec.js#replays a settled execution’s stored answer for the same key and request, without calling the adapter again category: invariant binding_evidence: - >- services-platform:modules/integrations/tests/integration/services/executions/invoke-capability.integration.spec.js#replays a settled execution’s stored answer for the same key and request, without calling the adapter again - >- services-platform:modules/integrations/tests/integration/services/executions/invoke-capability.integration.spec.js#refuses the same key with another request, idempotency_key_reused - >- services-platform:modules/integrations/tests/integration/services/executions/invoke-capability.integration.spec.js#answers in_progress, with the execution id, while the key’s execution is being reconciled binding_scope: >- contributions: the cited tests support their own asserted outcomes. Additional setup, branches and combined sequences remain proposed unless the cited assertions exercise them. - id: ATS-PFM-INT-009-04 title: Execution history is useful without secret values level: api proves: - BR-CAP-PFM-INT-009-04 preconditions: A payment connection is bound. steps: Authorize and inspect execution and attempt records. expected: >- The record retains its attempt, request fingerprint, safe summaries and binding; the adapter uses the execution identity and no credential is persisted. negative: false data_needs: 'Fixtures establishing the stated accounts, declarations and history in an isolated workspace.' bound_to: - TST-PFM-INT-543 - TST-PFM-INT-579 provenance: test source: >- services-platform:modules/integrations/tests/integration/services/executions/invoke-capability.integration.spec.js#records the execution succeeded, with its digest, summaries, reference and one attempt category: invariant binding_evidence: - >- services-platform:modules/integrations/tests/integration/services/executions/invoke-capability.integration.spec.js#records the execution succeeded, with its digest, summaries, reference and one attempt - >- services-platform:modules/integrations/tests/integration/services/executions/invoke-capability.integration.spec.js#hands the adapter the execution id, the lease and the callback, and stores no credential - >- services-platform:modules/integrations/tests/unit/services/gateway-circuit-rows.spec.ts#never keeps a credential, a token, an instrument or a person - >- services-platform:modules/integrations/tests/unit/services/gateway-circuit-rows.spec.ts#stays within 4 KB binding_scope: >- contributions: the cited tests support their own asserted outcomes. Additional setup, branches and combined sequences remain proposed unless the cited assertions exercise them. - id: ATS-PFM-INT-009-05 title: Failure classification determines safe repetition level: api proves: - BR-CAP-PFM-INT-009-05 preconditions: The test adapter can return scripted outcomes. steps: 'Exercise pre-send timeout, retry-after, adapter error, decline and post-send timeout.' expected: >- Pre-send failure retries, retry-after waits, adapter error retries once, decline returns immediately and post-send uncertainty is investigated rather than repeated. negative: false data_needs: 'Fixtures establishing the stated accounts, declarations and history in an isolated workspace.' bound_to: - TST-PFM-INT-543 - TST-PFM-INT-481 provenance: test source: >- services-platform:modules/integrations/tests/integration/services/executions/invoke-capability.integration.spec.js#retries a timeout before send after the sync schedule’s first delay, with the same execution id, and succeeds category: failure binding_evidence: - >- services-platform:modules/integrations/tests/integration/services/executions/invoke-capability.integration.spec.js#retries a timeout before send after the sync schedule’s first delay, with the same execution id, and succeeds - >- services-platform:modules/integrations/tests/integration/services/executions/invoke-capability.integration.spec.js#answers a decline as failed, refused, and never retries it - >- services-platform:modules/integrations/tests/integration/services/executions/invoke-capability.integration.spec.js#retries an adapter_error once, then fails it - >- services-platform:modules/integrations/tests/integration/services/executions/invoke-capability.integration.spec.js#leaves a timeout after send unknown, for the reconciler in 30 seconds, and never retries it - >- services-platform:modules/integrations/tests/e2e-adapters/gateway-dummy.adapters.spec.js#retries a timeout before send and succeeds on the second attempt (02) binding_scope: >- contributions: the cited tests support their own asserted outcomes. Additional setup, branches and combined sequences remain proposed unless the cited assertions exercise them. - id: ATS-PFM-INT-009-06 title: Budget exhaustion stops delayed payment effects level: api proves: - BR-CAP-PFM-INT-009-06 preconditions: Rate limiting outlasts the caller’s payment budget. steps: 'Authorize, wait and repeat using the same key.' expected: >- The first fails with retry-later guidance, no background provider effect follows and key reuse can start a new execution. negative: false data_needs: 'Fixtures establishing the stated accounts, declarations and history in an isolated workspace.' bound_to: - TST-PFM-INT-543 - TST-PFM-INT-583 - TST-PFM-INT-481 provenance: test source: >- services-platform:modules/integrations/tests/integration/services/executions/invoke-capability.integration.spec.js#queues no continuation and nudges no dispatcher, so nothing runs in the background category: boundary binding_evidence: - >- services-platform:modules/integrations/tests/integration/services/executions/invoke-capability.integration.spec.js#queues no continuation and nudges no dispatcher, so nothing runs in the background - >- services-platform:modules/integrations/tests/integration/services/executions/invoke-capability.integration.spec.js#settles the execution failed with the last attempt’s class and retry_later.budget_exhausted - >- services-platform:modules/integrations/tests/integration/services/executions/invoke-capability.integration.spec.js#records a new execution when the caller sends the same key again - >- services-platform:modules/integrations/tests/unit/services/retry-later-stop.spec.ts#keeps every capability that is not sensitive continuing in the queue - >- services-platform:modules/integrations/tests/e2e-adapters/gateway-dummy.adapters.spec.js#queues nothing, so no attempt reaches the dummy after the answer and nothing succeeds in the background binding_scope: >- contributions: the cited tests support their own asserted outcomes. Additional setup, branches and combined sequences remain proposed unless the cited assertions exercise them. - id: ATS-PFM-INT-009-07 title: Admission refusal retains the selected provider level: api proves: - BR-CAP-PFM-INT-009-07 preconditions: 'Prepare an open circuit, an operator-limited connection and one with unavailable credentials.' steps: Authorize against each. expected: >- The first reports provider unavailability without another processor, the second rate limiting and the third re-authorization; all release unused keys. negative: true data_needs: 'Fixtures establishing the stated accounts, declarations and history in an isolated workspace.' bound_to: - TST-PFM-INT-543 - TST-PFM-INT-481 provenance: test source: >- services-platform:modules/integrations/tests/integration/services/executions/invoke-capability.integration.spec.js#refuses with 503 provider_unavailable while the circuit is open, and releases the key category: failure binding_evidence: - >- services-platform:modules/integrations/tests/integration/services/executions/invoke-capability.integration.spec.js#refuses with 503 provider_unavailable while the circuit is open, and releases the key - >- services-platform:modules/integrations/tests/integration/services/executions/invoke-capability.integration.spec.js#refuses with 429 rate_limited and retry_after over an operator’s limit, and releases the key - >- services-platform:modules/integrations/tests/integration/services/executions/invoke-capability.integration.spec.js#refuses with 409 connection_reauth_required when the credential cannot be leased - >- services-platform:modules/integrations/tests/e2e-adapters/gateway-dummy.adapters.spec.js#touches no processor: neither the open one nor another binding_scope: >- contributions: the cited tests support their own asserted outcomes. Additional setup, branches and combined sequences remain proposed unless the cited assertions exercise them. - id: ATS-PFM-INT-009-08 title: Circuit lifecycle is an unbound proof obligation level: api proves: - BR-CAP-PFM-INT-009-08 preconditions: The selected provider repeatedly fails. steps: 'Fail five calls, call while open, wait for the probe, fail it and pass a subsequent probe.' expected: >- The circuit opens, refuses before contact, permits one probe, doubles a failed-probe wait and closes after success. negative: false data_needs: 'Fixtures establishing the stated accounts, declarations and history in an isolated workspace.' bound_to: [] provenance: proposed source: 'services-platform:docs/integrations/README.md#Circuits (13 §10)' category: transition binding_evidence: [] - id: ATS-PFM-INT-009-09 title: Queued invocation resumes once per dispatch level: api proves: - BR-CAP-PFM-INT-009-09 preconditions: An asynchronous test contract is available. steps: 'Invoke, dispatch the work and redeliver the same message after state advancement.' expected: >- Acceptance precedes contact, the worker resumes through admission and the stale redelivery contacts no adapter. negative: false data_needs: 'Fixtures establishing the stated accounts, declarations and history in an isolated workspace.' bound_to: - TST-PFM-INT-543 - TST-PFM-INT-540 provenance: test source: >- services-platform:modules/integrations/tests/integration/services/executions/invoke-capability.integration.spec.js#answers 202 accepted and queues the first attempt with the execution, calling no adapter category: concurrency binding_evidence: - >- services-platform:modules/integrations/tests/integration/services/executions/invoke-capability.integration.spec.js#answers 202 accepted and queues the first attempt with the execution, calling no adapter - >- services-platform:modules/integrations/tests/integration/services/executions/invoke-capability.integration.spec.js#publishes the dispatch to the queue and deletes it, and the consumer resumes the execution at admission - >- services-platform:modules/integrations/tests/integration/services/executions/dispatcher.integration.spec.js#skips a redelivered message whose execution has moved on, calling no adapter binding_scope: >- contributions: the cited tests support their own asserted outcomes. Additional setup, branches and combined sequences remain proposed unless the cited assertions exercise them. - id: ATS-PFM-INT-009-10 title: Attempt limits include operator work level: api proves: - BR-CAP-PFM-INT-009-10 preconditions: Two executions have nine and ten attempts. steps: Request retries and deliver work that would exceed ten. expected: >- The ninth-attempt execution can retry, the tenth cannot and excess queued work settles failed with key release. negative: true data_needs: 'Fixtures establishing the stated accounts, declarations and history in an isolated workspace.' bound_to: - TST-PFM-INT-542 provenance: test source: >- services-platform:modules/integrations/tests/integration/services/executions/execution-settlement.integration.spec.js#settles an execution whose next attempt is the eleventh failed, with the last class and retry_exhausted.attempt_limit category: boundary binding_evidence: - >- services-platform:modules/integrations/tests/integration/services/executions/execution-settlement.integration.spec.js#settles an execution whose next attempt is the eleventh failed, with the last class and retry_exhausted.attempt_limit - >- services-platform:modules/integrations/tests/integration/services/executions/execution-settlement.integration.spec.js#refuses an operator’s retry at ten attempts, not_retryable with the reason attempt_limit and the count - >- services-platform:modules/integrations/tests/integration/services/executions/execution-settlement.integration.spec.js#still retries at nine attempts, the control for the refusal - >- services-platform:modules/integrations/tests/integration/services/executions/execution-settlement.integration.spec.js#releases the key of the execution it settled at the bound binding_scope: >- contributions: the cited tests support their own asserted outcomes. Additional setup, branches and combined sequences remain proposed unless the cited assertions exercise them. - id: ATS-PFM-INT-009-11 title: Payload diagnostics respect sensitivity level: api proves: - BR-CAP-PFM-INT-009-11 preconditions: Both a meeting and payment integration opt into capture. steps: Invoke each and simulate capture-storage failure. expected: >- The meeting retains redacted payload references, the payment retains none and capture failure leaves the call outcome unchanged. negative: false data_needs: 'Fixtures establishing the stated accounts, declarations and history in an isolated workspace.' bound_to: - TST-PFM-INT-544 - TST-PFM-INT-576 provenance: test source: >- services-platform:modules/integrations/tests/integration/services/executions/payload-recording.integration.spec.js#writes nothing for a sensitive capability, though the manifest records payloads category: edge binding_evidence: - >- services-platform:modules/integrations/tests/integration/services/executions/payload-recording.integration.spec.js#writes nothing for a sensitive capability, though the manifest records payloads - >- services-platform:modules/integrations/tests/integration/services/executions/payload-recording.integration.spec.js#writes the request and the result of a non-sensitive capability, and keeps the execution’s prefix on the attempt - >- services-platform:modules/integrations/tests/integration/services/executions/payload-recording.integration.spec.js#does not fail the attempt when the write fails, counting the failure and storing no reference - >- services-platform:modules/integrations/tests/unit/services/execution-payloads-archive.spec.ts#masks a credential key and a secret-shaped value whatever key carries it binding_scope: >- contributions: the cited tests support their own asserted outcomes. Additional setup, branches and combined sequences remain proposed unless the cited assertions exercise them. - id: ATS-PFM-INT-009-12 title: Reject an oversized gateway request key level: api proves: - BR-CAP-PFM-INT-009-13 preconditions: 'An execution request key has valid workspace, capability and digest fields.' steps: >- Persist a key of one hundred and twenty-eight characters, then attempt one with one hundred and twenty-nine. expected: The limit-sized key is accepted and the longer key is refused without saving a request-key row. negative: true data_needs: Valid direct-writer fixtures in an isolated workspace. bound_to: [] provenance: proposed source: >- services-platform:modules/integrations/db/integration-execution-keys.table.ts:integration_execution_keys_key_check category: boundary binding_evidence: [] - id: ATS-PFM-INT-009-13 level: api negative: true data_needs: Run-owned records and principals in an isolated workspace. bound_to: [] provenance: proposed title: Exercise the complete execution lifecycle category: transition proves: - BR-CAP-PFM-INT-009-05 - BR-CAP-PFM-INT-009-06 - BR-CAP-PFM-INT-009-09 - BR-CAP-PFM-INT-009-10 - BR-CAP-PFM-INT-010-01 - BR-CAP-PFM-INT-010-02 - BR-CAP-PFM-INT-010-04 - BR-CAP-PFM-INT-010-05 - BR-CAP-PFM-INT-011-05 - BR-CAP-PFM-INT-011-06 preconditions: >- Prepare one independent record in each starting state, including absent-record cases where the model defines creation. steps: >- Run each listed transition once with its guard satisfied, then repeat it with the guard denied. Inspect the resulting record and listed side effects after commit. expected: >- Each positive case reaches its listed destination and records its defined side effects. Each denied case preserves the starting record and creates no transition side effects. source: >- rhythm-v2-docs:specs/platform/integrations/design/state-models/STATE-PFM-INT-007-execution-lifecycle.md#transitions state_model: STATE-PFM-INT-007 transition_cases: - from: accepted to: running trigger: Begin provider delivery guard: 'Circuit, rate and credential admission succeeded' side_effects: - Create an attempt record before delivery. provenance: proposed source: 'services-platform:modules/integrations/services/executions/attempt-loop.ts' - from: accepted to: failed trigger: Refuse provider admission guard: 'Circuit, rate or authentication prevents delivery' side_effects: - Release the unused request key and return retry or authorization guidance. provenance: proposed source: >- services-platform:modules/integrations/tests/integration/services/executions/invoke-capability.integration.spec.js#refuses with 503 provider_unavailable while the circuit is open, and releases the key - from: running to: succeeded trigger: Receive a valid successful answer guard: The adapter result passes response validation side_effects: - Retain the replayable answer and eligible connector notices. provenance: proposed source: >- services-platform:modules/integrations/tests/integration/services/executions/invoke-capability.integration.spec.js#records the execution succeeded, with its digest, summaries, reference and one attempt - from: running to: failed trigger: End a failed attempt guard: The failure is terminal or further attempts are exhausted side_effects: - Retain the failure answer and release the key when appropriate for pre-send failure. provenance: proposed source: 'services-platform:modules/integrations/services/executions/attempt-loop.ts' - from: running to: retrying trigger: Prepare a safe retry guard: The request could not reach the provider and retry rules permit continuation side_effects: - Schedule another attempt within budget or on the asynchronous schedule. provenance: proposed source: >- services-platform:modules/integrations/tests/integration/services/executions/invoke-capability.integration.spec.js#retries a timeout before send after the sync schedule’s first delay, with the same execution id, and succeeds - from: retrying to: running trigger: Begin a scheduled retry guard: Admission succeeds for the next attempt side_effects: - Create the next attempt record. provenance: proposed source: 'services-platform:modules/integrations/services/executions/attempt-loop.ts' - from: retrying to: failed trigger: Stop retry continuation guard: Sensitive work exceeds its synchronous budget or the attempt ceiling prevents another try side_effects: - Release the request key and return failure without more queued work. provenance: proposed source: >- services-platform:modules/integrations/tests/integration/services/executions/invoke-capability.integration.spec.js#queues no continuation and nudges no dispatcher, so nothing runs in the background - from: running to: unknown trigger: Lose certainty after sending guard: The failure can occur after provider receipt side_effects: - Schedule investigation after thirty seconds and do not resend. provenance: proposed source: >- services-platform:modules/integrations/tests/integration/services/executions/reconciler.integration.spec.js#looks the execution up on the same connection with the contracts’ lookup shape, never repeating the authorize - from: retrying to: unknown trigger: Detect orphaned continuation guard: Retrying work has no dispatch and its last change is more than eight hours old side_effects: - Make provider investigation due immediately. provenance: proposed source: 'services-platform:modules/integrations/services/executions/reconciler.ts' - from: accepted to: unknown trigger: Detect an overdue accepted call guard: Its asynchronous completion budget is spent side_effects: - Make provider investigation due immediately. provenance: proposed source: 'services-platform:modules/integrations/services/executions/reconciler.ts' - from: running to: unknown trigger: Detect a lost running attempt guard: The last unfinished attempt exceeds its bound plus one minute side_effects: - Make provider investigation due immediately. provenance: proposed source: 'services-platform:modules/integrations/services/executions/reconciler.ts' - from: unknown to: succeeded trigger: Find a successful provider result guard: Lookup confirms success or an applicable late adapter completion wins settlement side_effects: - Save the answer and create its applicable completion event. provenance: proposed source: 'services-platform:modules/integrations/services/executions/reconciler.ts' - from: unknown to: failed trigger: Find a failed provider result guard: >- Lookup confirms failure, final non-sensitive investigation finds nothing, or a valid late asynchronous timeout completion reports failure side_effects: - Save failure and create its applicable completion event. provenance: proposed source: 'services-platform:modules/integrations/services/executions/reconciler.ts' - from: unknown to: needs_attention trigger: Exhaust inconclusive investigation guard: >- Five lookups remain inconclusive, final sensitive lookup is not found, or no usable lookup exists side_effects: - 'Save attention state, request administrator mail and record attention telemetry.' provenance: proposed source: 'services-platform:modules/integrations/services/executions/reconciler.ts' - from: needs_attention to: succeeded trigger: Record a person’s successful finding guard: The execution needs attention and a note accompanies the result side_effects: - Create completion and audit without calling the provider. provenance: proposed source: >- services-platform:modules/integrations/tests/integration/services/executions/reconciler.integration.spec.js#lets an operator resolve a needs_attention execution by hand, audited, with no call to the provider - from: needs_attention to: failed trigger: Record a person’s failed finding guard: The execution needs attention and a note accompanies the result side_effects: - Create completion and audit without calling the provider. provenance: proposed source: >- services-platform:modules/integrations/tests/integration/services/executions/reconciler.integration.spec.js#lets an operator resolve a needs_attention execution by hand, audited, with no call to the provider - from: accepted to: cancelled trigger: Cancel before the first attempt guard: Accepted work has no started attempt side_effects: - Remove queued work and release its key - Create applicable asynchronous cancellation completion. provenance: proposed source: >- services-platform:modules/integrations/tests/integration/services/executions/invoke-capability.integration.spec.js#cancels an accepted execution before its first attempt, releasing its key and its queued dispatch - from: running to: cancelled trigger: Accept adapter cancellation guard: A running asynchronous call has cancellation requested and receives the cancellation result side_effects: - Create the applicable cancellation completion. provenance: proposed source: >- services-platform:modules/integrations/services/adapter-callbacks/adapter-callbacks.ts:completeExecution - from: failed to: retrying trigger: Request an operator retry guard: 'Failure classification permits retry, the attempt limit remains and original input matches' side_effects: - Queue the next attempt under the same execution and record retry history. provenance: proposed source: >- services-platform:modules/integrations/tests/integration/services/executions/execution-operations.integration.spec.js#refuses a request handed back that is not the one recorded - from: accepted to: succeeded trigger: Receive asynchronous success before a running marker guard: A valid asynchronous completion wins settlement side_effects: - Save the response and applicable completion event. provenance: proposed source: >- services-platform:modules/integrations/services/adapter-callbacks/adapter-callbacks.ts:completeExecution - from: unknown to: cancelled trigger: Receive late acknowledged cancellation guard: The asynchronous timeout is still unresolved and the adapter reports the requested cancellation side_effects: - Settle cancellation through the shared writer. provenance: proposed source: >- services-platform:modules/integrations/services/adapter-callbacks/adapter-callbacks.ts:completeExecution proof_boundary: >- The parameterized cases prove the listed lifecycle outcomes. Separate assertions are needed for independent object invariants, numeric limits and simultaneous requests. - id: ATS-PFM-INT-009-14 level: api negative: true data_needs: Run-owned records and principals in an isolated workspace. bound_to: [] provenance: proposed title: Exercise the complete provider circuit category: transition proves: - BR-CAP-PFM-INT-009-08 - BR-CAP-PFM-INT-011-08 preconditions: >- Prepare one independent record in each starting state, including absent-record cases where the model defines creation. steps: >- Run each listed transition once with its guard satisfied, then repeat it with the guard denied. Inspect the resulting record and listed side effects after commit. expected: >- Each positive case reaches its listed destination and records its defined side effects. Each denied case preserves the starting record and creates no transition side effects. source: >- rhythm-v2-docs:specs/platform/integrations/design/state-models/STATE-PFM-INT-008-provider-circuit.md#transitions state_model: STATE-PFM-INT-008 transition_cases: - from: closed to: open trigger: Reach the unavailable threshold guard: The process-local consecutive-failure count reaches five in its breaker window side_effects: - Delay the next probe by sixty seconds. provenance: proposed source: 'services-platform:docs/integrations/README.md#Circuits (13 §10)' - from: open to: half_open trigger: Admit the recovery probe guard: The open wait elapsed and this admission claims the probe side_effects: - Allow the probing request. provenance: proposed source: 'services-platform:docs/integrations/README.md#Circuits (13 §10)' - from: half_open to: closed trigger: Observe a recovered probe guard: The probe does not report unavailable failure side_effects: - Clear the breaker’s failure count. provenance: proposed source: 'services-platform:docs/integrations/README.md#Circuits (13 §10)' - from: half_open to: open trigger: Observe another unavailable probe guard: Probe failure is unavailable or timeout side_effects: - Double the delay without exceeding fifteen minutes. provenance: proposed source: 'services-platform:docs/integrations/README.md#Circuits (13 §10)' - from: open to: closed trigger: Reset through staff operations guard: The staff caller has circuit-operation authority side_effects: - Record the reset in workspace history. provenance: proposed source: 'services-platform:modules/integrations/services/executions/execution-operations.ts' - from: half_open to: closed trigger: Reset while a probe is pending guard: The staff caller has circuit-operation authority side_effects: - Close and audit the circuit independent of its former status. provenance: proposed source: 'services-platform:modules/integrations/services/executions/execution-operations.ts:resetCircuit' proof_boundary: >- The parameterized cases prove the listed lifecycle outcomes. Separate assertions are needed for independent object invariants, numeric limits and simultaneous requests. - id: ATS-PFM-INT-009-15 level: api negative: false data_needs: Run-owned records and principals in an isolated workspace. bound_to: [] provenance: proposed title: A post-send timeout enters lookup without another send category: interaction proves: - BR-CAP-PFM-INT-009-05 - BR-CAP-PFM-INT-010-01 exercises: - CAP-PFM-INT-009 - CAP-PFM-INT-010 preconditions: A sensitive operation times out after possible provider receipt. steps: 'Invoke it, run the due lookup and inspect attempts and provider operations.' expected: Investigation uses the same execution and account; no second authorization is sent. source: - >- services-platform:modules/integrations/tests/integration/services/executions/invoke-capability.integration.spec.js#retries a timeout before send after the sync schedule’s first delay, with the same execution id, and succeeds - >- services-platform:modules/integrations/tests/integration/services/executions/reconciler.integration.spec.js#looks the execution up on the same connection with the contracts’ lookup shape, never repeating the authorize workflows: - WF-PFM-INT-012 - id: ATS-PFM-INT-009-16 level: api negative: false data_needs: Run-owned records and principals in an isolated workspace. bound_to: [] provenance: proposed title: Operator retry obeys the execution attempt ceiling category: interaction proves: - BR-CAP-PFM-INT-009-10 - BR-CAP-PFM-INT-011-03 exercises: - CAP-PFM-INT-009 - CAP-PFM-INT-011 preconditions: Retryable failures exist with nine and ten attempts and the original request is available. steps: Request an operator retry for each and dispatch accepted work. expected: Only the nine-attempt execution permits another attempt; the other remains unchanged. source: - >- services-platform:modules/integrations/tests/integration/services/executions/execution-settlement.integration.spec.js#settles an execution whose next attempt is the eleventh failed, with the last class and retry_exhausted.attempt_limit - >- services-platform:modules/integrations/tests/integration/services/executions/execution-operations.integration.spec.js#refuses a request handed back that is not the one recorded workflows: [] - id: ATS-PFM-INT-009-17 level: api negative: false data_needs: Run-owned records and principals in an isolated workspace. bound_to: [] provenance: proposed title: Circuit refusal retains the selected processor category: interaction proves: - BR-CAP-PFM-INT-008-07 - BR-CAP-PFM-INT-009-07 exercises: - CAP-PFM-INT-009 - CAP-PFM-INT-008 preconditions: A sensitive binding selects an account with an open circuit and another usable account exists. steps: 'Resolve and invoke the capability, then inspect the trace and adapter calls.' expected: >- Resolution identifies the selected account and circuit condition; admission refuses without contacting either processor. source: - >- services-platform:modules/integrations/tests/unit/services/binding-resolution.spec.ts#resolves a payment whose processor’s circuit is open rather than refusing it binding_ineligible - >- services-platform:modules/integrations/tests/integration/services/executions/invoke-capability.integration.spec.js#refuses with 503 provider_unavailable while the circuit is open, and releases the key workflows: - WF-PFM-INT-011 - id: ATS-PFM-INT-009-18 level: api negative: false data_needs: Run-owned records and principals in an isolated workspace. bound_to: [] provenance: proposed title: Library calls retain ordinary execution evidence category: interaction proves: - BR-CAP-PFM-INT-009-04 - BR-CAP-PFM-INT-012-04 exercises: - CAP-PFM-INT-009 - CAP-PFM-INT-012 preconditions: An active test account is usable from connection detail. steps: Invoke the same example twice through the Library and inspect Activity and account history. expected: Separate executions identify the person and selected account without requiring a binding. source: - >- services-platform:modules/integrations/tests/integration/services/executions/invoke-capability.integration.spec.js#records the execution succeeded, with its digest, summaries, reference and one attempt - >- services-platform:modules/integrations/tests/e2e/connection-try.e2e.spec.js#records an execution of that connection by the calling application library_try on behalf of the person, with no binding workflows: - WF-PFM-INT-011 - id: ATS-PFM-INT-009-19 title: Concurrent first claims create one provider operation category: concurrency level: api proves: - BR-CAP-PFM-INT-009-03 - INV-DOM-PFM-INT-003-03 preconditions: >- Two authorized callers prepare identical requests with the same unused key and one selected test account. steps: >- Release both initial invocations at the same barrier, then inspect keys, executions, attempts and adapter contact. expected: >- The key names one execution and the losing claimant identifies that execution or its retained result; only one initial provider operation occurs. negative: true data_needs: A delayed scripted adapter and a run-owned unused request key in an isolated workspace. bound_to: [] provenance: proposed source: >- rhythm-v2-docs:specs/platform/integrations/planning/capabilities/CAP-PFM-INT-009-call-a-capability-through-the-gateway-without-doing-it-twice.md#rules evidence: - >- Each binding identifies an existing source test at the pinned revision; unbound scenarios remain proposed proof obligations. coverage: rule: 'gap: FND-PFM-INT-068' transition: covered validation: covered permission: covered edge: covered failure: covered boundary: covered concurrency: covered invariant: covered interaction: covered coverage_notes: covered: A designed scenario exists; executable coverage and a passing run require separate evidence. gaps: >- The finding records categories without a designed scenario and remaining permission and rule audit obligations. --- # Run provider operations safely through the gateway: Capability Test Specification ## Coverage | Rule | Proved By | |---|---| | `BR-CAP-PFM-INT-009-01` | `ATS-PFM-INT-009-01` | | `BR-CAP-PFM-INT-009-02` | `ATS-PFM-INT-009-02` | | `BR-CAP-PFM-INT-009-03` | `ATS-PFM-INT-009-03`, `ATS-PFM-INT-009-19` | | `BR-CAP-PFM-INT-009-04` | `ATS-PFM-INT-009-04`, `ATS-PFM-INT-009-18` | | `BR-CAP-PFM-INT-009-05` | `ATS-PFM-INT-009-05`, `ATS-PFM-INT-009-13`, `ATS-PFM-INT-009-15` | | `BR-CAP-PFM-INT-009-06` | `ATS-PFM-INT-009-06`, `ATS-PFM-INT-009-13` | | `BR-CAP-PFM-INT-009-07` | `ATS-PFM-INT-009-07`, `ATS-PFM-INT-009-17` | | `BR-CAP-PFM-INT-009-08` | `ATS-PFM-INT-009-08`, `ATS-PFM-INT-009-14` | | `BR-CAP-PFM-INT-009-09` | `ATS-PFM-INT-009-09`, `ATS-PFM-INT-009-13` | | `BR-CAP-PFM-INT-009-10` | `ATS-PFM-INT-009-10`, `ATS-PFM-INT-009-13`, `ATS-PFM-INT-009-16` | | `BR-CAP-PFM-INT-009-11` | `ATS-PFM-INT-009-11` | | `BR-CAP-PFM-INT-009-13` | `ATS-PFM-INT-009-12` | ## Interactions With Related Capabilities Invocation relies on binding resolution, credential admission and later settlement. The interaction cases follow uncertain and asynchronous results through recovery, cancellation and event completion without assuming that a new account choice moves existing work. The structured scenarios name the capabilities and rules involved. A bound test contributes only the outcomes it asserts; proposed transition matrices and composed interactions still require executable proof.