--- id: ATS-PFM-INT-014 scope: CAP-PFM-INT-014 product_area: platform module: integrations revision: 3 status: proposed source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 macroservice-libraries: 54536a441935c6e09fdb7f96f0bec71c52ba4e03 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f scenarios: - id: ATS-PFM-INT-014-01 title: Subscription creation respects accepted events level: api proves: - BR-CAP-PFM-INT-014-01 preconditions: An installation accepts contacts but not organization updates. steps: 'Subscribe to each type, repeat the accepted subscription and supply an invalid filter.' expected: Only one valid accepted subscription is saved; other requests identify the invalid condition. negative: true data_needs: 'Fixtures establishing the stated accounts, declarations and history in an isolated workspace.' bound_to: - TST-PFM-INT-566 - TST-PFM-INT-565 provenance: test source: >- services-platform:modules/integrations/tests/integration/services/subscriptions/subscriptions.integration.spec.js#refuses a subscription to a type the installation has not accepted, naming the type, and writes nothing category: validation binding_evidence: - >- services-platform:modules/integrations/tests/integration/services/subscriptions/subscriptions.integration.spec.js#refuses a subscription to a type the installation has not accepted, naming the type, and writes nothing - >- services-platform:modules/integrations/tests/integration/services/subscriptions/subscriptions.integration.spec.js#refuses a subscription to a type the manifest does not subscribe, naming the field - >- services-platform:modules/integrations/tests/integration/services/subscriptions/subscriptions.integration.spec.js#refuses a second subscription of the same installation, connection and type - >- services-platform:modules/integrations/tests/integration/services/subscriptions/subscriptions.integration.spec.js#refuses a filter the shared conditions grammar refuses, naming the field - >- services-platform:modules/integrations/tests/integration/services/subscriptions/subscription-consent.integration.spec.js#is refused although the manifest declares it, naming the field and the type binding_scope: >- contributions: the cited tests support their own asserted outcomes. Additional setup, branches and combined sequences remain proposed unless the cited assertions exercise them. - id: ATS-PFM-INT-014-02 title: Change projection is safe and deduplicated level: api proves: - BR-CAP-PFM-INT-014-02 preconditions: An integration subscribes to contact updates. steps: Change a contact and route the same change twice. expected: >- One delivery contains declared fields and applicable changed-field information without system columns. negative: false data_needs: 'Fixtures establishing the stated accounts, declarations and history in an isolated workspace.' bound_to: - TST-PFM-INT-566 - TST-PFM-INT-575 - TST-PFM-INT-480 provenance: test source: >- services-platform:modules/integrations/tests/integration/services/subscriptions/subscriptions.integration.spec.js#turns a CRM change event into a queued delivery of the catalog projection, never the row category: invariant binding_evidence: - >- services-platform:modules/integrations/tests/integration/services/subscriptions/subscriptions.integration.spec.js#turns a CRM change event into a queued delivery of the catalog projection, never the row - >- services-platform:modules/integrations/tests/integration/services/subscriptions/subscriptions.integration.spec.js#writes one delivery for a change event delivered twice - >- services-platform:modules/integrations/tests/unit/services/domain-event-projection.spec.ts#declares no system column among the projection’s fields - >- services-platform:modules/integrations/tests/e2e-adapters/events-dummy.adapters.spec.js#is received by the dummy, with the projection’s changed fields and never a system column binding_scope: >- contributions: the cited tests support their own asserted outcomes. Additional setup, branches and combined sequences remain proposed unless the cited assertions exercise them. - id: ATS-PFM-INT-014-03 title: Filter uncertainty is not permission to deliver level: unit proves: - BR-CAP-PFM-INT-014-03 preconditions: A subscription condition limits changes to business hours. steps: 'Evaluate in-hours, out-of-hours and unknown cases.' expected: Only the in-hours case matches; false and unknown cases are skipped. negative: false data_needs: 'Fixtures establishing the stated accounts, declarations and history in an isolated workspace.' bound_to: - TST-PFM-INT-566 - TST-PFM-INT-575 provenance: test source: >- services-platform:modules/integrations/tests/integration/services/subscriptions/subscriptions.integration.spec.js#records a delivery its filter refused as skipped_filter, and queues nothing for it category: edge binding_evidence: - >- services-platform:modules/integrations/tests/integration/services/subscriptions/subscriptions.integration.spec.js#records a delivery its filter refused as skipped_filter, and queues nothing for it - >- services-platform:modules/integrations/tests/unit/services/domain-event-projection.spec.ts#refuses an event a condition cannot decide, an allow needing TRUE binding_scope: >- contributions: the cited tests support their own asserted outcomes. Additional setup, branches and combined sequences remain proposed unless the cited assertions exercise them. - id: ATS-PFM-INT-014-04 title: Delivery failure reaches a finite endpoint level: api proves: - BR-CAP-PFM-INT-014-04 preconditions: The receiving integration repeatedly fails. steps: Send a subscribed change through all delivery attempts. expected: Six scheduled attempts end in dead status. negative: false data_needs: 'Fixtures establishing the stated accounts, declarations and history in an isolated workspace.' bound_to: - TST-PFM-INT-566 - TST-PFM-INT-585 provenance: test source: >- services-platform:modules/integrations/tests/integration/services/subscriptions/subscriptions.integration.spec.js#retries a classified failure with the async backoff and records the delivery dead after six attempts category: failure binding_evidence: - >- services-platform:modules/integrations/tests/integration/services/subscriptions/subscriptions.integration.spec.js#retries a classified failure with the async backoff and records the delivery dead after six attempts - >- services-platform:modules/integrations/tests/integration/services/subscriptions/subscriptions.integration.spec.js#delivers through the adapter’s EVENTS entry with the delivery, its attempt and a lease, and records the acknowledgement - >- services-platform:modules/integrations/tests/unit/services/work-backoff.spec.ts#waits 1 minute, 5, 30, 2 hours and 6 hours between the six attempts binding_scope: >- contributions: the cited tests support their own asserted outcomes. Additional setup, branches and combined sequences remain proposed unless the cited assertions exercise them. - id: ATS-PFM-INT-014-05 title: Repeated dead deliveries pause the subscription level: api proves: - BR-CAP-PFM-INT-014-05 preconditions: A subscription already has forty-nine consecutive dead deliveries. steps: 'Fail one more, raise a change while paused and resume.' expected: 'It pauses and notifies once, takes no paused delivery and resets its count on resume.' negative: false data_needs: 'Fixtures establishing the stated accounts, declarations and history in an isolated workspace.' bound_to: - TST-PFM-INT-566 provenance: test source: >- services-platform:modules/integrations/tests/integration/services/subscriptions/subscriptions.integration.spec.js#pauses a subscription after fifty dead deliveries in a row and tells its administrators once category: transition binding_evidence: - >- services-platform:modules/integrations/tests/integration/services/subscriptions/subscriptions.integration.spec.js#pauses a subscription after fifty dead deliveries in a row and tells its administrators once - >- services-platform:modules/integrations/tests/integration/services/subscriptions/subscriptions.integration.spec.js#delivers nothing more to a paused subscription, and resumes it with its count reset binding_scope: >- contributions: the cited tests support their own asserted outcomes. Additional setup, branches and combined sequences remain proposed unless the cited assertions exercise them. - id: ATS-PFM-INT-014-06 title: Consent restoration does not silently resume delivery level: api proves: - BR-CAP-PFM-INT-014-06 preconditions: An installation has two active event subscriptions. steps: 'Withdraw one event, accept it again and resume its subscription explicitly.' expected: The withdrawal pauses that subscription in both trails and it stays paused until explicit resume. negative: false data_needs: 'Fixtures establishing the stated accounts, declarations and history in an isolated workspace.' bound_to: - TST-PFM-INT-565 - TST-PFM-INT-566 provenance: test source: >- services-platform:modules/integrations/tests/integration/services/subscriptions/subscription-consent.integration.spec.js#pauses the active subscription of the type left out category: interaction binding_evidence: - >- services-platform:modules/integrations/tests/integration/services/subscriptions/subscription-consent.integration.spec.js#pauses the active subscription of the type left out - >- services-platform:modules/integrations/tests/integration/services/subscriptions/subscription-consent.integration.spec.js#audits the pause as subscription.paused_by_acceptance - >- services-platform:modules/integrations/tests/integration/services/subscriptions/subscription-consent.integration.spec.js#does not resume the subscription when the type is accepted again - >- services-platform:modules/integrations/tests/integration/services/subscriptions/subscriptions.integration.spec.js#fails a delivery of a type the installation withdrew after the subscription was made, without calling the adapter binding_scope: >- contributions: the cited tests support their own asserted outcomes. Additional setup, branches and combined sequences remain proposed unless the cited assertions exercise them. - id: ATS-PFM-INT-014-07 title: Installation suspension preserves subscription configuration level: api proves: - BR-CAP-PFM-INT-014-07 preconditions: An active subscription belongs to an enabled installation. steps: 'Pause the installation, change a record, resume and change again.' expected: The paused installation sends nothing and later changes are delivered after resume. negative: false data_needs: 'Fixtures establishing the stated accounts, declarations and history in an isolated workspace.' bound_to: - TST-PFM-INT-565 provenance: test source: >- services-platform:modules/integrations/tests/integration/services/subscriptions/subscription-consent.integration.spec.js#skips a subscription whose installation is suspended, and delivers again once it is resumed category: interaction binding_evidence: - >- services-platform:modules/integrations/tests/integration/services/subscriptions/subscription-consent.integration.spec.js#skips a subscription whose installation is suspended, and delivers again once it is resumed binding_scope: >- contributions: the cited tests support their own asserted outcomes. Additional setup, branches and combined sequences remain proposed unless the cited assertions exercise them. - id: ATS-PFM-INT-014-08 level: api negative: true data_needs: Run-owned records and principals in an isolated workspace. bound_to: [] provenance: proposed title: Exercise the complete subscription standing category: transition proves: - BR-CAP-PFM-INT-014-01 - BR-CAP-PFM-INT-014-05 - BR-CAP-PFM-INT-014-06 - BR-CAP-PFM-INT-003-08 preconditions: >- Prepare one independent record in each starting state, including absent-record cases where the model defines creation. steps: >- Run each listed transition once with its guard satisfied, then repeat it with the guard denied. Inspect the resulting record and listed side effects after commit. expected: >- Each positive case reaches its listed destination and records its defined side effects. Each denied case preserves the starting record and creates no transition side effects. source: >- rhythm-v2-docs:specs/platform/integrations/design/state-models/STATE-PFM-INT-011-subscription-standing.md#transitions state_model: STATE-PFM-INT-011 transition_cases: - from: absent to: active trigger: Create an event interest guard: 'Installation, declared and accepted event, filter and uniqueness checks pass' side_effects: - Commit both audit entries without filter contents. provenance: proposed source: >- services-platform:modules/integrations/tests/integration/services/subscriptions/subscriptions.integration.spec.js#refuses a subscription to a type the installation has not accepted, naming the type, and writes nothing - from: active to: paused trigger: Pause event fan-out guard: An authorized versioned edit pauses it or installation acceptance withdraws its event side_effects: - Commit pause history in both trails. provenance: proposed source: >- services-platform:modules/integrations/tests/integration/services/subscriptions/subscription-consent.integration.spec.js#pauses the active subscription of the type left out - from: paused to: active trigger: Resume event fan-out guard: The installation is enabled and still accepts this event type side_effects: - Audit resumed authority as widening. provenance: proposed source: 'services-platform:modules/integrations/services/persistence/integration-subscriptions.ts' - from: active to: paused_by_failures trigger: Reach repeated-dead threshold guard: An active subscription reaches fifty consecutive dead deliveries side_effects: - Request its administrator notice once. provenance: proposed source: >- services-platform:modules/integrations/tests/integration/services/subscriptions/subscriptions.integration.spec.js#pauses a subscription after fifty dead deliveries in a row and tells its administrators once - from: paused_by_failures to: active trigger: Resume after dead deliveries guard: Ordinary resume validation succeeds side_effects: - Clear the consecutive dead count. provenance: proposed source: >- services-platform:modules/integrations/tests/integration/services/subscriptions/subscriptions.integration.spec.js#pauses a subscription after fifty dead deliveries in a row and tells its administrators once - from: active to: absent trigger: Remove the interest guard: An administrator removes it or its installation is uninstalled side_effects: - Delete the subscription while retaining delivery records. provenance: proposed source: >- services-platform:modules/integrations/tests/integration/services/connections/disconnect-discard-uninstall.integration.spec.js#removes every subscription of the installation with the uninstallation, and no other installation’s - from: paused to: absent trigger: Remove a paused interest guard: The same administrative or uninstallation removal applies side_effects: - Delete the subscription while retaining delivery records. provenance: proposed source: >- services-platform:modules/integrations/services/persistence/integration-subscriptions.ts:removeSubscriptionsOfInstallation - from: paused_by_failures to: absent trigger: Remove a failure-paused interest guard: The same administrative or uninstallation removal applies side_effects: - Delete the subscription while retaining delivery records. provenance: proposed source: >- services-platform:modules/integrations/services/persistence/integration-subscriptions.ts:removeSubscriptionsOfInstallation proof_boundary: >- The parameterized cases prove the listed lifecycle outcomes. Separate assertions are needed for independent object invariants, numeric limits and simultaneous requests. - id: ATS-PFM-INT-014-09 level: api negative: true data_needs: Run-owned records and principals in an isolated workspace. bound_to: [] provenance: proposed title: Exercise the complete delivery progress category: transition proves: - BR-CAP-PFM-INT-014-04 - BR-CAP-PFM-INT-014-08 - BR-CAP-PFM-INT-014-09 preconditions: >- Prepare one independent record in each starting state, including absent-record cases where the model defines creation. steps: >- Run each listed transition once with its guard satisfied, then repeat it with the guard denied. Inspect the resulting record and listed side effects after commit. expected: >- Each positive case reaches its listed destination and records its defined side effects. Each denied case preserves the starting record and creates no transition side effects. source: >- rhythm-v2-docs:specs/platform/integrations/design/state-models/STATE-PFM-INT-012-delivery-progress.md#transitions state_model: STATE-PFM-INT-012 transition_cases: - from: pending to: delivered trigger: Acknowledge initial push guard: The adapter returns a successful handled response side_effects: - Save the acknowledgement. provenance: proposed source: 'services-platform:modules/integrations/services/subscriptions/delivery-worker.ts' - from: pending to: retrying trigger: Defer unsuccessful push guard: The classified error allows another attempt side_effects: - Write next delivery dispatch work. provenance: proposed source: 'services-platform:modules/integrations/services/subscriptions/delivery-worker.ts' - from: retrying to: delivered trigger: Acknowledge a later push guard: The adapter returns a successful handled response side_effects: - Reset the subscription’s consecutive dead count. provenance: proposed source: >- services-platform:modules/integrations/services/subscriptions/delivery-worker.ts:processDelivery - from: retrying to: dead trigger: End delivery retries guard: The sixth attempt fails or failure is permanently non-retryable side_effects: - Record a dead outcome for the subscription threshold. provenance: proposed source: 'services-platform:modules/integrations/services/subscriptions/delivery-worker.ts' - from: pending to: delivered trigger: Advance a pull cursor guard: The authorized adapter advances beyond pending deliveries side_effects: - Mark covered pending records delivered. provenance: proposed source: 'services-platform:modules/integrations/aws/api/gateway.routes.ts:writePullCursor' - from: dead to: pending trigger: Restart dead delivery guard: An authorized operator requests retry side_effects: - Reset attempt progression and queue work with history. provenance: proposed source: 'services-platform:modules/integrations/services/events/event-operations.ts:retryDelivery' - from: failed to: pending trigger: Restart failed delivery guard: An authorized operator requests retry side_effects: - Reset attempt progression and queue work. provenance: proposed source: 'services-platform:modules/integrations/services/events/event-operations.ts:retryDelivery' - from: retrying to: retrying trigger: Schedule a further delivery attempt guard: Another retryable failure occurs before the attempt ceiling side_effects: - Save the outcome and any permitted next dispatch. provenance: proposed source: >- services-platform:modules/integrations/services/subscriptions/delivery-worker.ts:processDelivery - from: pending to: dead trigger: Fail permanently on the first attempt guard: The classified failure permits no retry side_effects: - Save the outcome and any permitted next dispatch. provenance: proposed source: >- services-platform:modules/integrations/services/subscriptions/delivery-worker.ts:processDelivery - from: pending to: failed trigger: Refuse initial delivery after configuration loss guard: 'The subscription or account is gone, or accepted event access is absent' side_effects: - Save the outcome and any permitted next dispatch. provenance: proposed source: >- services-platform:modules/integrations/services/subscriptions/delivery-worker.ts:processDelivery - from: retrying to: failed trigger: Refuse later delivery after configuration loss guard: 'The subscription or account is gone, or accepted event access is absent' side_effects: - Save the outcome and any permitted next dispatch. provenance: proposed source: >- services-platform:modules/integrations/services/subscriptions/delivery-worker.ts:processDelivery - from: delivered to: pending trigger: Restart eligible delivery work guard: An authorized operator requests retry or bounded window replay side_effects: - 'Reset attempts and errors, audit the request and nudge dispatch.' provenance: proposed source: 'services-platform:modules/integrations/services/events/event-operations.ts:retryDelivery' - from: retrying to: pending trigger: Restart eligible delivery work guard: An authorized operator requests retry or bounded window replay side_effects: - 'Reset attempts and errors, audit the request and nudge dispatch.' provenance: proposed source: 'services-platform:modules/integrations/services/events/event-operations.ts:retryDelivery' proof_boundary: >- The parameterized cases prove the listed lifecycle outcomes. Separate assertions are needed for independent object invariants, numeric limits and simultaneous requests. - id: ATS-PFM-INT-014-10 level: api negative: false data_needs: Run-owned records and principals in an isolated workspace. bound_to: [] provenance: proposed title: Redelivered change work preserves delivery identity category: interaction proves: - BR-CAP-PFM-INT-014-02 - BR-CAP-PFM-INT-015-05 exercises: - CAP-PFM-INT-014 - CAP-PFM-INT-015 preconditions: A subscription accepts a change event and the routed change has a stable identity. steps: Fan out the same change twice and redeliver already claimed routing work. expected: One projected delivery exists and stale routing work makes no further attempt. source: - >- services-platform:modules/integrations/tests/integration/services/subscriptions/subscriptions.integration.spec.js#turns a CRM change event into a queued delivery of the catalog projection, never the row - >- services-platform:modules/integrations/tests/integration/services/events/event-router.integration.spec.js#does nothing for a message of an attempt already made workflows: [] - id: ATS-PFM-INT-014-11 level: api negative: false data_needs: Run-owned records and principals in an isolated workspace. bound_to: [] provenance: proposed title: Repeated delivery failure becomes visible attention category: interaction proves: - BR-CAP-PFM-INT-006-10 - BR-CAP-PFM-INT-014-05 exercises: - CAP-PFM-INT-014 - CAP-PFM-INT-006 preconditions: A subscription has forty-nine consecutive dead deliveries. steps: 'Fail its next delivery, read operational attention and resume the subscription.' expected: The subscription pauses with one notice and the dead delivery is available for investigation. source: - >- react-console:lib/integrations/needs-attention.test.ts#leaves a settling (unknown) execution out however long it has been unknown - >- services-platform:modules/integrations/tests/integration/services/subscriptions/subscriptions.integration.spec.js#pauses a subscription after fifty dead deliveries in a row and tells its administrators once workflows: [] - id: ATS-PFM-INT-014-12 level: api negative: false data_needs: Run-owned records and principals in an isolated workspace. bound_to: [] provenance: proposed title: Uninstall removes only its own delivery interests category: interaction proves: - BR-CAP-PFM-INT-003-08 - BR-CAP-PFM-INT-014-07 exercises: - CAP-PFM-INT-014 - CAP-PFM-INT-003 preconditions: Two installations subscribe to one business change and all accounts of the first are disconnected. steps: Uninstall the first installation and generate the subscribed change. expected: Only the surviving installation receives a delivery record. source: - >- services-platform:modules/integrations/tests/integration/services/connections/disconnect-discard-uninstall.integration.spec.js#removes every subscription of the installation with the uninstallation, and no other installation’s - >- services-platform:modules/integrations/tests/integration/services/subscriptions/subscription-consent.integration.spec.js#skips a subscription whose installation is suspended, and delivers again once it is resumed workflows: - WF-PFM-INT-002 evidence: - >- Each binding identifies an existing source test at the pinned revision; unbound scenarios remain proposed proof obligations. coverage: rule: 'gap: FND-PFM-INT-078' transition: covered validation: covered permission: 'gap: FND-PFM-INT-078' edge: covered failure: covered boundary: 'gap: FND-PFM-INT-078' concurrency: 'gap: FND-PFM-INT-078' invariant: covered interaction: covered coverage_notes: covered: A designed scenario exists; executable coverage and a passing run require separate evidence. gaps: >- The finding records categories without a designed scenario and remaining permission and rule audit obligations. --- # Deliver subscribed Rhythm changes to integrations: Capability Test Specification ## Coverage | Rule | Proved By | |---|---| | `BR-CAP-PFM-INT-014-01` | `ATS-PFM-INT-014-01`, `ATS-PFM-INT-014-08` | | `BR-CAP-PFM-INT-014-02` | `ATS-PFM-INT-014-02`, `ATS-PFM-INT-014-10` | | `BR-CAP-PFM-INT-014-03` | `ATS-PFM-INT-014-03` | | `BR-CAP-PFM-INT-014-04` | `ATS-PFM-INT-014-04`, `ATS-PFM-INT-014-09` | | `BR-CAP-PFM-INT-014-05` | `ATS-PFM-INT-014-05`, `ATS-PFM-INT-014-08`, `ATS-PFM-INT-014-11` | | `BR-CAP-PFM-INT-014-06` | `ATS-PFM-INT-014-06`, `ATS-PFM-INT-014-08` | | `BR-CAP-PFM-INT-014-07` | `ATS-PFM-INT-014-07`, `ATS-PFM-INT-014-12` | ## Interactions With Related Capabilities Subscription access and connection state affect which customer changes become deliveries. The interaction cases follow consent changes, failure recovery and repeated work through projection and dispatch. The structured scenarios name the capabilities and rules involved. A bound test contributes only the outcomes it asserts; proposed transition matrices and composed interactions still require executable proof.