---
id: ATS-PFM-LLM-003
scope: CAP-PFM-LLM-003
product_area: platform
module: llm
revision: 2
status: proposed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
scenarios:
  - id: ATS-PFM-LLM-003-01
    title: Task completion and failure retain timing
    level: api
    proves:
      - BR-CAP-PFM-LLM-003-01
    preconditions: One task returns and another throws after two requests.
    steps: Execute both through the task wrapper.
    expected: >-
      The records close completed or failed with end times and durations, retaining settled requests on the
      failed task.
    negative: false
    data_needs: Fixtures representing one task returns and another throws after two requests.
    bound_to:
      - TST-PFM-LLM-018
    provenance: test
    source: >-
      services-platform:modules/llm/tests/integration/lifecycle/executions.integration.spec.js#completes, and
      says it was not a replay
    category: transition
    test_sources:
      - >-
        services-platform:modules/llm/tests/integration/lifecycle/executions.integration.spec.js#completes,
        and says it was not a replay
      - >-
        services-platform:modules/llm/tests/integration/lifecycle/executions.integration.spec.js#closes the
        execution failed
      - >-
        services-platform:modules/llm/tests/integration/lifecycle/executions.integration.spec.js#stamps how
        long it ran before it failed
  - id: ATS-PFM-LLM-003-02
    title: Only scoped context associates requests
    level: api
    proves:
      - BR-CAP-PFM-LLM-003-02
      - INV-DOM-PFM-LLM-001-07
    preconditions: Requests are made inside and outside an execution.
    steps: Execute and inspect both requests.
    expected: The wrapped request names its task and the outside request has no task association.
    negative: false
    data_needs: Fixtures representing requests are made inside and outside an execution.
    bound_to:
      - TST-PFM-LLM-018
    provenance: test
    source: >-
      services-platform:modules/llm/tests/integration/lifecycle/executions.integration.spec.js#gives a call
      outside a wrapper no execution
    category: invariant
    test_sources:
      - >-
        services-platform:modules/llm/tests/integration/lifecycle/executions.integration.spec.js#gives a call
        outside a wrapper no execution
      - >-
        services-platform:modules/llm/tests/integration/lifecycle/executions.integration.spec.js#names every
        call’s invocation as belonging to it
  - id: ATS-PFM-LLM-003-03
    title: Nested task execution is rejected
    level: api
    proves:
      - BR-CAP-PFM-LLM-003-03
    preconditions: A task attempts to open another execution.
    steps: Run the outer task.
    expected: The inner open fails and the outer execution closes failed.
    negative: true
    data_needs: Fixtures representing a task attempts to open another execution.
    bound_to:
      - TST-PFM-LLM-018
    provenance: test
    source: >-
      services-platform:modules/llm/tests/integration/lifecycle/executions.integration.spec.js#refuses an
      execution inside an execution
    category: validation
    test_sources:
      - >-
        services-platform:modules/llm/tests/integration/lifecycle/executions.integration.spec.js#refuses an
        execution inside an execution
      - >-
        services-platform:modules/llm/tests/integration/lifecycle/executions.integration.spec.js#closes the
        outer execution failed when the inner one was refused
  - id: ATS-PFM-LLM-003-04
    title: Unknown task definitions create no record
    level: api
    proves:
      - BR-CAP-PFM-LLM-003-04
    preconditions: The supplied execution key is undeclared.
    steps: Attempt to open an execution.
    expected: Validation rejects it before insertion.
    negative: true
    data_needs: Fixtures representing the supplied execution key is undeclared.
    bound_to:
      - TST-PFM-LLM-018
      - TST-PFM-LLM-057
    provenance: test
    source: >-
      services-platform:modules/llm/tests/integration/lifecycle/executions.integration.spec.js#refuses a key
      nobody declared, before any row is written
    category: validation
    test_sources:
      - >-
        services-platform:modules/llm/tests/integration/lifecycle/executions.integration.spec.js#refuses a key
        nobody declared, before any row is written
      - >-
        services-platform:modules/llm/tests/unit/catalog/llm-executions.spec.ts#refuses an undeclared key,
        naming it
  - id: ATS-PFM-LLM-003-05
    title: Task totals follow settlements
    level: api
    proves:
      - BR-CAP-PFM-LLM-003-05
      - INV-DOM-PFM-LLM-001-10
    preconditions: A task includes three settlements and one refused request.
    steps: Execute and inspect the task and allowance period.
    expected: >-
      The three settlements contribute their costs, the refused request stays linked without increasing
      settlement count, and the charged totals agree.
    negative: false
    data_needs: Fixtures representing a task includes three settlements and one refused request.
    bound_to:
      - TST-PFM-LLM-018
    provenance: test
    source: >-
      services-platform:modules/llm/tests/integration/lifecycle/executions.integration.spec.js#totals the
      credits the three settlements charged
    category: rule
    test_sources:
      - >-
        services-platform:modules/llm/tests/integration/lifecycle/executions.integration.spec.js#totals the
        credits the three settlements charged
      - >-
        services-platform:modules/llm/tests/integration/lifecycle/executions.integration.spec.js#charges the
        period exactly what the execution totalled
      - >-
        services-platform:modules/llm/tests/integration/lifecycle/executions.integration.spec.js#links the
        refused call to its execution without counting it, since only settlements count
  - id: ATS-PFM-LLM-003-06
    title: Replayed task keys do not rerun work
    level: api
    proves:
      - BR-CAP-PFM-LLM-003-06
    preconditions: Two opens share one idempotency key and another uses a different key.
    steps: Open all three tasks.
    expected: 'The repeated key returns the first task as a replay, and only two executions run.'
    negative: false
    data_needs: Fixtures representing two opens share one idempotency key and another uses a different key.
    bound_to:
      - TST-PFM-LLM-018
    provenance: test
    source: >-
      services-platform:modules/llm/tests/integration/lifecycle/executions.integration.spec.js#says the second
      was a replay
    category: concurrency
    test_sources:
      - >-
        services-platform:modules/llm/tests/integration/lifecycle/executions.integration.spec.js#says the
        second was a replay
      - >-
        services-platform:modules/llm/tests/integration/lifecycle/executions.integration.spec.js#runs the
        function once for a key, and again for another
      - >-
        services-platform:modules/llm/tests/integration/lifecycle/executions.integration.spec.js#holds two
        executions, not three
  - id: ATS-PFM-LLM-003-07
    title: Execution closing keeps task errors intelligible
    level: api
    proves:
      - BR-CAP-PFM-LLM-003-09
    preconditions: Task completion storage can fail.
    steps: Run a failing task and a successful task with injected close errors.
    expected: A task error remains the returned failure; a close error after successful work reaches the caller.
    negative: true
    data_needs: Fault-injection fixtures for the described failure boundary.
    bound_to: []
    provenance: proposed
    source: 'services-platform:modules/llm/services/execution/with-llm-execution.ts:withLlmExecution'
    category: failure
    test_sources: []
  - id: ATS-PFM-LLM-003-08
    title: Recovery closes stale tasks without rewriting totals
    category: interaction
    level: api
    proves:
      - BR-CAP-PFM-LLM-003-01
      - BR-CAP-PFM-LLM-009-05
    exercises:
      - CAP-PFM-LLM-003
      - CAP-PFM-LLM-009
    preconditions: A stale running task contains settled requests and a recent task remains running.
    steps: Run task recovery twice and compare statuses and totals.
    expected: >-
      Only the stale task becomes abandoned, retaining its totals and no measured duration; repetition does
      not alter it.
    negative: false
    data_needs: 'An isolated workspace with the records, clock instants and caller authority stated in the preconditions.'
    bound_to:
      - TST-PFM-LLM-045
    provenance: test
    source:
      - >-
        services-platform:modules/llm/tests/integration/services/reconciliation/llm-execution-sweep.integration.spec.js#abandons
        the stale running execution
      - >-
        services-platform:modules/llm/tests/integration/services/reconciliation/llm-execution-sweep.integration.spec.js#abandons
        nothing the second time
      - >-
        services-platform:modules/llm/tests/integration/services/reconciliation/llm-execution-sweep.integration.spec.js#leaves
        the totals as the settlements put them
    test_sources:
      - >-
        services-platform:modules/llm/tests/integration/services/reconciliation/llm-execution-sweep.integration.spec.js#abandons
        the stale running execution
      - >-
        services-platform:modules/llm/tests/integration/services/reconciliation/llm-execution-sweep.integration.spec.js#abandons
        nothing the second time
      - >-
        services-platform:modules/llm/tests/integration/services/reconciliation/llm-execution-sweep.integration.spec.js#leaves
        the totals as the settlements put them
  - id: ATS-PFM-LLM-003-09
    title: Inspection links tasks to their requests
    category: interaction
    level: api
    proves:
      - BR-CAP-PFM-LLM-003-05
      - BR-CAP-PFM-LLM-011-08
    exercises:
      - CAP-PFM-LLM-003
      - CAP-PFM-LLM-011
    preconditions: A task contains three associated settled requests and another organization has a task.
    steps: List the first organization’s tasks and open its task detail.
    expected: Detail pairs the stored task totals with its requests and never includes the other organization’s task.
    negative: false
    data_needs: 'An isolated workspace with the records, clock instants and caller authority stated in the preconditions.'
    bound_to: []
    provenance: proposed
    source:
      - 'services-platform:modules/llm/services/persistence/invocations.ts'
      - 'services-platform:modules/llm/aws/api/llm-usage-api-mapper.ts'
  - id: ATS-PFM-LLM-003-10
    title: Task replay identity stays workspace-scoped
    category: boundary
    level: api
    proves:
      - BR-CAP-PFM-LLM-003-06
    preconditions: >-
      The suite owns isolated fixtures representing the valid control and the contrasting case described by
      its steps.
    steps: Open tasks with an identical replay key in two workspaces.
    expected: >-
      Each workspace retains its own execution while a repeated key within one workspace is refused by
      persistence.
    negative: false
    data_needs: 'Suite-owned fixtures, with a fixed clock where dates or grant windows matter.'
    bound_to:
      - TST-PFM-LLM-012
    provenance: test
    source: >-
      services-platform:modules/llm/tests/integration/db/llm-executions.table.integration.spec.js#accepts the
      same idempotency key in another tenant
    test_sources:
      - >-
        services-platform:modules/llm/tests/integration/db/llm-executions.table.integration.spec.js#accepts
        the same idempotency key in another tenant
  - id: ATS-PFM-LLM-003-11
    title: Failed settlement transaction retains task totals
    category: invariant
    level: api
    proves:
      - BR-CAP-PFM-LLM-003-05
    preconditions: >-
      The suite owns isolated fixtures representing the valid control and the contrasting case described by
      its steps.
    steps: Apply request settlement inside a transaction that subsequently fails.
    expected: The request remains unsettled and task counters stay at their prior zero values.
    negative: false
    data_needs: 'Suite-owned fixtures, with a fixed clock where dates or grant windows matter.'
    bound_to:
      - TST-PFM-LLM-032
    provenance: test
    source: >-
      services-platform:modules/llm/tests/integration/services/persistence/executions.integration.spec.js#leaves
      the counters at zero
    test_sources:
      - >-
        services-platform:modules/llm/tests/integration/services/persistence/executions.integration.spec.js#leaves
        the counters at zero
evidence:
  - >-
    services-platform at ad3f6a6582843008ed0f5a17b131878d15829af1: bound or cited
    modules/llm/tests/integration/lifecycle/executions.integration.spec.js;
    modules/llm/tests/unit/catalog/llm-executions.spec.ts.
coverage:
  rule: 'gap: FND-PFM-LLM-062'
  transition: 'gap: FND-PFM-LLM-062'
  validation: covered
  permission: not-applicable
  edge: 'gap: FND-PFM-LLM-062'
  failure: covered
  boundary: covered
  concurrency: covered
  invariant: 'gap: FND-PFM-LLM-062'
  interaction: covered
coverage_notes:
  transition: >-
    Existing transition scenarios are retained; the model transition register below records the remaining
    exhaustive mapping obligation.
  permission: >-
    This capability declares no permission key; caller authorization belongs to its consuming operation or a
    related capability.
  interaction: >-
    The related interaction register cites a concrete experiment for every dependency and related capability,
    including cross-capability workflow seams.
  invariant: >-
    The domain-invariant register maps each relevant invariant to a scenario or to the capability coverage
    finding; an example does not establish every invariant.
  rule: >-
    All must-prove rules have scenario references, but the coverage finding retains untested clauses and
    combined outcomes; scenario presence alone is not exhaustive rule proof.
related_interactions:
  - with: CAP-PFM-LLM-001
    scenarios:
      - ATS-PFM-LLM-001-12
    source: 'services-platform:modules/llm/services/catalog/catalog-authority.ts:resolveLlmOperation'
  - with: CAP-PFM-LLM-009
    scenarios:
      - ATS-PFM-LLM-003-08
    source: 'services-platform:modules/llm/aws/lambda/RECONCILIATION.handler.ts'
  - with: CAP-PFM-LLM-011
    scenarios:
      - ATS-PFM-LLM-003-09
    source: >-
      services-platform:modules/llm/tests/e2e/llm-usage.e2e.spec.js#refuses a customer’s administrator a
      tenant’s usage even in their own tenant
state_models:
  - STATE-PFM-LLM-002
coverage_obligations:
  must_prove:
    - rule: BR-CAP-PFM-LLM-003-01
      scenarios:
        - ATS-PFM-LLM-003-01
        - ATS-PFM-LLM-003-08
      source: 'services-platform:modules/llm/services/execution/with-llm-execution.ts'
      coverage: specified
    - rule: BR-CAP-PFM-LLM-003-02
      scenarios:
        - ATS-PFM-LLM-003-02
      source: 'services-platform:modules/llm/services/execution/execution-scope.ts'
      coverage: partial
      gap: FND-PFM-LLM-062
    - rule: BR-CAP-PFM-LLM-003-03
      scenarios:
        - ATS-PFM-LLM-003-03
      source: 'services-platform:modules/llm/services/execution/with-llm-execution.ts'
      coverage: specified
    - rule: BR-CAP-PFM-LLM-003-04
      scenarios:
        - ATS-PFM-LLM-003-04
      source: 'services-platform:modules/llm/catalog/llm-executions.ts'
      coverage: partial
      gap: FND-PFM-LLM-062
    - rule: BR-CAP-PFM-LLM-003-05
      scenarios:
        - ATS-PFM-LLM-003-05
        - ATS-PFM-LLM-003-09
        - ATS-PFM-LLM-003-11
      source: 'services-platform:modules/llm/services/persistence/invocations.ts'
      coverage: partial
      gap: FND-PFM-LLM-062
    - rule: BR-CAP-PFM-LLM-003-06
      scenarios:
        - ATS-PFM-LLM-003-06
        - ATS-PFM-LLM-003-10
      source: 'services-platform:modules/llm/services/execution/with-llm-execution.ts'
      coverage: partial
      gap: FND-PFM-LLM-062
    - rule: BR-CAP-PFM-LLM-003-09
      scenarios:
        - ATS-PFM-LLM-003-07
      source: 'services-platform:modules/llm/services/execution/with-llm-execution.ts:withLlmExecution'
      coverage: partial
      gap: FND-PFM-LLM-062
  state_transitions:
    - model: STATE-PFM-LLM-002
      transition: 1
      from: absent
      to: running
      trigger: A consumer opens a declared task.
      gap: FND-PFM-LLM-062
      provenance: proposed
      source: 'services-platform:modules/llm/services/execution/with-llm-execution.ts:withLlmExecution'
    - model: STATE-PFM-LLM-002
      transition: 2
      from: running
      to: completed
      trigger: The task body returns successfully.
      gap: FND-PFM-LLM-062
      provenance: proposed
      source: 'services-platform:modules/llm/services/persistence/executions.ts:closeExecution'
    - model: STATE-PFM-LLM-002
      transition: 3
      from: running
      to: failed
      trigger: The task body throws an error.
      gap: FND-PFM-LLM-062
      provenance: proposed
      source: 'services-platform:modules/llm/services/execution/with-llm-execution.ts:withLlmExecution'
    - model: STATE-PFM-LLM-002
      transition: 4
      from: running
      to: abandoned
      trigger: Recovery selects a task still running after a day.
      gap: FND-PFM-LLM-062
      provenance: proposed
      source: 'services-platform:modules/llm/services/persistence/executions.ts:markExecutionAbandoned'
    - model: STATE-PFM-LLM-002
      transition: 5
      from: completed
      to: completed
      trigger: A request settles after its enclosing task completed.
      gap: FND-PFM-LLM-062
      provenance: proposed
      source: 'services-platform:modules/llm/services/persistence/executions.ts:addInvocationToExecution'
  domain_invariants:
    - invariant: INV-DOM-PFM-LLM-001-07
      scenarios:
        - ATS-PFM-LLM-003-02
      provenance: documented
      source: 'services-platform:modules/llm/services/execution/execution-scope.ts:llmExecutionIdOf'
    - invariant: INV-DOM-PFM-LLM-001-10
      scenarios:
        - ATS-PFM-LLM-003-05
      provenance: documented
      source: 'services-platform:modules/llm/services/persistence/invocations.ts:markInvocationSettled'
    - invariant: INV-DOM-PFM-LLM-002-07
      scenarios: []
      gap: FND-PFM-LLM-062
      provenance: proposed
      source: 'services-platform:modules/llm/catalog/llm-executions.ts:requireLlmExecution'
coverage_limits:
  finding: FND-PFM-LLM-062
  statement: >-
    Running and closed replay races, late settlements and simultaneous close versus abandonment need complete
    task-state coverage. Failed close persistence needs a caller-error preservation case.
  provenance: proposed
  source:
    - 'services-platform:modules/llm/services/execution/with-llm-execution.ts'
    - 'services-platform:modules/llm/services/execution/execution-scope.ts'
    - 'services-platform:modules/llm/services/execution/with-llm-execution.ts'
    - 'services-platform:modules/llm/catalog/llm-executions.ts'
    - 'services-platform:modules/llm/services/persistence/invocations.ts'
    - 'services-platform:modules/llm/services/execution/with-llm-execution.ts'
    - 'services-platform:modules/llm/services/execution/with-llm-execution.ts:withLlmExecution'
    - 'services-platform:modules/llm/catalog/llm-executions.ts:requireLlmExecution'
  invariants_without_scenarios:
    - INV-DOM-PFM-LLM-002-07
---

# undefined

## Coverage

The scenarios identify the rules or journey assertions they are intended to prove. A test binding names existing evidence; an unbound proposal remains work to verify.

| Scenario | Title | Level | Provenance |
|---|---|---|---|
| `ATS-PFM-LLM-003-01` | Task completion and failure retain timing | api | test |
| `ATS-PFM-LLM-003-02` | Only scoped context associates requests | api | test |
| `ATS-PFM-LLM-003-03` | Nested task execution is rejected | api | test |
| `ATS-PFM-LLM-003-04` | Unknown task definitions create no record | api | test |
| `ATS-PFM-LLM-003-05` | Task totals follow settlements | api | test |
| `ATS-PFM-LLM-003-06` | Replayed task keys do not rerun work | api | test |
| `ATS-PFM-LLM-003-07` | Execution closing keeps task errors intelligible | api | proposed |

## Interactions With Related Capabilities

The interaction register links concrete experiments with run ai requests with consistent attribution and accounting; recover interrupted requests and identify accounting drift; inspect an organization’s ai account and request history. Each experiment checks the outcome at the shared boundary; an unbound experiment remains proposed.

Running and closed replay races, late settlements and simultaneous close versus abandonment need complete task-state coverage. Failed close persistence needs a caller-error preservation case.