--- id: ATS-PFM-LLM-007 scope: CAP-PFM-LLM-007 product_area: platform module: llm revision: 2 status: proposed source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 scenarios: - id: ATS-PFM-LLM-007-01 title: Concurrent first admission creates one period level: api proves: - BR-CAP-PFM-LLM-007-01 - INV-DOM-PFM-LLM-003-01 preconditions: The organization has neither custom limits nor a current period. steps: Race its first allowance-period initialization. expected: 'One default 100,000-credit period exists with no initial charge or hold.' negative: false data_needs: 'Authorized and unauthorized fixtures for the scenario, with controlled request and usage records.' bound_to: - TST-PFM-LLM-030 provenance: test source: >- services-platform:modules/llm/tests/integration/services/persistence/allowance-periods.integration.spec.js#answers a period at the default monthly allowance category: concurrency test_sources: - >- services-platform:modules/llm/tests/integration/services/persistence/allowance-periods.integration.spec.js#answers a period at the default monthly allowance - >- services-platform:modules/llm/tests/integration/services/persistence/allowance-periods.integration.spec.js#answers them all the same row, because the second insert conflicts and reads what the first wrote - id: ATS-PFM-LLM-007-02 title: Concurrent requests share capacity atomically level: api proves: - BR-CAP-PFM-LLM-007-02 - INV-DOM-PFM-LLM-003-02 preconditions: Base and active grant capacity cover fifteen reservations. steps: Race twenty admission requests. expected: Fifteen obtain holds and five receive allowance refusals; held credits equal admitted reservations. negative: false data_needs: Fixtures representing base and active grant capacity cover fifteen reservations. bound_to: - TST-PFM-LLM-019 - TST-PFM-LLM-030 provenance: test source: >- services-platform:modules/llm/tests/integration/lifecycle/llm-ledger-concurrency.integration.spec.js#admits exactly the fifteen the base and the override cover together category: concurrency test_sources: - >- services-platform:modules/llm/tests/integration/lifecycle/llm-ledger-concurrency.integration.spec.js#admits exactly the fifteen the base and the override cover together - >- services-platform:modules/llm/tests/integration/lifecycle/llm-ledger-concurrency.integration.spec.js#holds exactly the admitted credits and counts exactly the admitted calls in flight - >- services-platform:modules/llm/tests/integration/services/persistence/allowance-periods.integration.spec.js#authorizes exactly the ten the allowance covers, and no more - id: ATS-PFM-LLM-007-03 title: Exhausted allowance prevents another provider call level: api proves: - BR-CAP-PFM-LLM-007-03 preconditions: An earlier request consumes available allowance. steps: Submit the next model request. expected: The rate-limit refusal reports needed and remaining capacity without calling the model or taking a hold. negative: true data_needs: Fixtures representing an earlier request consumes available allowance. bound_to: - TST-PFM-LLM-020 provenance: test source: >- services-platform:modules/llm/tests/integration/lifecycle/run-operation.integration.spec.js#refuses it as a rate limit, which is the status a caller can act on category: failure test_sources: - >- services-platform:modules/llm/tests/integration/lifecycle/run-operation.integration.spec.js#refuses it as a rate limit, which is the status a caller can act on - >- services-platform:modules/llm/tests/integration/lifecycle/run-operation.integration.spec.js#never asked the provider, so a tenant out of credit costs nothing to refuse - >- services-platform:modules/llm/tests/integration/lifecycle/run-operation.integration.spec.js#holds nothing for the refused call - id: ATS-PFM-LLM-007-04 title: Concurrency slots return on settlement level: api proves: - BR-CAP-PFM-LLM-007-04 - BR-CAP-PFM-LLM-007-05 preconditions: The cap is eight and enough allowance covers initial requests. steps: 'Race twenty requests, settle one and repeat admission with both restrictions exceeded.' expected: >- Eight run, excess calls receive concurrency refusals, settlement releases a slot, and allowance takes priority when both checks fail. negative: true data_needs: Fixtures representing the cap is eight and enough allowance covers initial requests. bound_to: - TST-PFM-LLM-019 provenance: test source: >- services-platform:modules/llm/tests/integration/lifecycle/llm-ledger-concurrency.integration.spec.js#admits exactly eight category: concurrency test_sources: - >- services-platform:modules/llm/tests/integration/lifecycle/llm-ledger-concurrency.integration.spec.js#admits exactly eight - >- services-platform:modules/llm/tests/integration/lifecycle/llm-ledger-concurrency.integration.spec.js#refuses the other twelve as too many in flight - >- services-platform:modules/llm/tests/integration/lifecycle/llm-ledger-concurrency.integration.spec.js#admits a ninth only once a call has settled, which gives its place back - >- services-platform:modules/llm/tests/integration/lifecycle/llm-ledger-concurrency.integration.spec.js#says allowance_exceeded when both refuse, because that is the one that lasts - id: ATS-PFM-LLM-007-05 title: Grant windows and revocation apply at request time level: api proves: - BR-CAP-PFM-LLM-007-06 - INV-DOM-PFM-LLM-003-05 preconditions: 'Grants are future, ending or concurrently revoked.' steps: Submit admission requests around each boundary. expected: >- Future capacity is absent, ending capacity stops at its end instant and revoked capacity no longer counts. negative: false data_needs: 'Fixtures representing grants are future, ending or concurrently revoked.' bound_to: - TST-PFM-LLM-019 provenance: test source: >- services-platform:modules/llm/tests/integration/lifecycle/llm-ledger-concurrency.integration.spec.js#counts from its first instant category: boundary test_sources: - >- services-platform:modules/llm/tests/integration/lifecycle/llm-ledger-concurrency.integration.spec.js#counts from its first instant - >- services-platform:modules/llm/tests/integration/lifecycle/llm-ledger-concurrency.integration.spec.js#refuses the same call from the instant the window ends - >- services-platform:modules/llm/tests/integration/lifecycle/llm-ledger-concurrency.integration.spec.js#counts the override no longer once it is revoked: whatever the race admitted, the next call fits only inside the base - id: ATS-PFM-LLM-007-06 title: Admitted work can exceed allowance on settlement level: api proves: - BR-CAP-PFM-LLM-007-07 preconditions: A request fits its hold but its charge crosses the remaining allowance. steps: Complete that request and submit another. expected: 'The full charge remains, usage exceeds 100% and later admission fails.' negative: false data_needs: Fixtures representing a request fits its hold but its charge crosses the remaining allowance. bound_to: - TST-PFM-LLM-005 provenance: test source: >- services-platform:modules/llm/tests/e2e/allowance-warning.e2e.spec.js#tells both again, once, when the third call passes 100 % category: edge test_sources: - >- services-platform:modules/llm/tests/e2e/allowance-warning.e2e.spec.js#tells both again, once, when the third call passes 100 % - >- services-platform:modules/llm/tests/e2e/allowance-warning.e2e.spec.js#refuses the next call, because the allowance is used - id: ATS-PFM-LLM-007-07 title: Lower limits preserve running reservations level: api proves: - BR-CAP-PFM-LLM-007-08 - INV-DOM-PFM-LLM-003-03 preconditions: Requests hold credits when the allowance is reduced below committed usage. steps: Settle existing work and attempt new admission. expected: >- The requests finish normally, reservations fall no lower than zero and later work is refused while over allowance. negative: false data_needs: Fixtures representing requests hold credits when the allowance is reduced below committed usage. bound_to: - TST-PFM-LLM-019 provenance: test source: >- services-platform:modules/llm/tests/integration/lifecycle/llm-ledger-concurrency.integration.spec.js#keeps what was reserved: a lowered allowance never cuts a call off category: invariant test_sources: - >- services-platform:modules/llm/tests/integration/lifecycle/llm-ledger-concurrency.integration.spec.js#keeps what was reserved: a lowered allowance never cuts a call off - >- services-platform:modules/llm/tests/integration/lifecycle/llm-ledger-concurrency.integration.spec.js#refuses the next call while the period is over its lowered allowance - >- services-platform:modules/llm/tests/integration/lifecycle/llm-ledger-concurrency.integration.spec.js#takes held credits down to zero as each reservation settles, never below - id: ATS-PFM-LLM-007-08 title: Available balance accounts for charge and holds level: api proves: - BR-CAP-PFM-LLM-007-09 preconditions: A period contains settled and running work and any corrections. steps: Read its accounting position. expected: >- Charged usage includes settlements and corrections, and available capacity subtracts both charges and holds. negative: false data_needs: Fixtures representing a period contains settled and running work and any corrections. bound_to: [] provenance: proposed source: 'services-platform:modules/llm/services/persistence/allowance-periods.ts' category: rule test_sources: [] - id: ATS-PFM-LLM-007-09 title: Refusal retains the original decision figures level: api proves: - BR-CAP-PFM-LLM-007-10 - INV-DOM-PFM-LLM-001-05 preconditions: An allowance refusal occurs while a grant is active. steps: Inspect the refusal snapshot and period. expected: >- The stored figures and grant identity reflect that decision, with limits and ceiling present and no refusal charge. negative: false data_needs: Fixtures representing an allowance refusal occurs while a grant is active. bound_to: - TST-PFM-LLM-018 - TST-PFM-LLM-078 provenance: test source: >- services-platform:modules/llm/tests/integration/lifecycle/executions.integration.spec.js#keeps a snapshot whose numbers are the period row’s at that instant category: invariant test_sources: - >- services-platform:modules/llm/tests/integration/lifecycle/executions.integration.spec.js#keeps a snapshot whose numbers are the period row’s at that instant - >- services-platform:modules/llm/tests/integration/lifecycle/executions.integration.spec.js#names the overrides that were in force - >- services-platform:modules/llm/tests/unit/services/refusal-snapshot.spec.ts#serialises a worst case in under a kilobyte - id: ATS-PFM-LLM-007-10 title: Customer pause journey reaches its reported result level: api proves: - AS-JNY-PFM-LLM-001-01 - AS-JNY-PFM-LLM-001-02 - AS-JNY-PFM-LLM-001-03 preconditions: A small-allowance organization has administrators and other staff. steps: 'Exercise repeated AI use, threshold delivery, refusal and HQ inspection.' expected: >- Only administrators receive each threshold notice, refused work costs nothing and the customer explanation agrees with the HQ refusal record. negative: false data_needs: Fixtures representing a small-allowance organization has administrators and other staff. bound_to: [] provenance: proposed source: FND-PFM-LLM-027 category: interaction test_sources: [] - id: ATS-PFM-LLM-007-11 title: Charged usage drives notices after admission category: interaction level: api proves: - BR-CAP-PFM-LLM-007-09 - BR-CAP-PFM-LLM-008-01 exercises: - CAP-PFM-LLM-007 - CAP-PFM-LLM-008 preconditions: Holds reach warning range but charged usage remains below it and eligible administrators exist. steps: 'Read notice history before settlement, then settle across each threshold and retry delivery.' expected: >- Holds alone create no crossing; charged crossings retain their figures and notice completion tracks eligible recipients. negative: false data_needs: 'An isolated workspace with the records, clock instants and caller authority stated in the preconditions.' bound_to: [] provenance: proposed source: - 'services-platform:modules/llm/services/persistence/allowance-periods.ts' - 'services-platform:modules/llm/services/persistence/allowance-periods.ts' - id: ATS-PFM-LLM-007-12 title: Recovery releases an eligible recorded hold category: interaction level: api proves: - BR-CAP-PFM-LLM-007-09 - BR-CAP-PFM-LLM-009-01 exercises: - CAP-PFM-LLM-007 - CAP-PFM-LLM-009 preconditions: A stale request retains a recorded reservation while a recent request remains in flight. steps: Run request recovery twice and inspect monthly accounting. expected: >- The stale request receives estimated credits without cents and releases its recorded hold once; recent work remains unchanged. negative: false data_needs: 'An isolated workspace with the records, clock instants and caller authority stated in the preconditions.' bound_to: - TST-PFM-LLM-046 provenance: test source: - >- services-platform:modules/llm/tests/integration/services/reconciliation/llm-settlement-sweep.integration.spec.js#releases the hold, which is the whole point of the sweep - >- services-platform:modules/llm/tests/integration/services/reconciliation/llm-settlement-sweep.integration.spec.js#charges the period once - >- services-platform:modules/llm/tests/integration/services/reconciliation/llm-settlement-sweep.integration.spec.js#leaves the hold in place, so a live call keeps the credits it reserved test_sources: - >- services-platform:modules/llm/tests/integration/services/reconciliation/llm-settlement-sweep.integration.spec.js#releases the hold, which is the whole point of the sweep - >- services-platform:modules/llm/tests/integration/services/reconciliation/llm-settlement-sweep.integration.spec.js#charges the period once - >- services-platform:modules/llm/tests/integration/services/reconciliation/llm-settlement-sweep.integration.spec.js#leaves the hold in place, so a live call keeps the credits it reserved - id: ATS-PFM-LLM-007-13 title: Live utilisation counts running commitments category: interaction level: api proves: - BR-CAP-PFM-LLM-007-09 - BR-CAP-PFM-LLM-010-03 exercises: - CAP-PFM-LLM-007 - CAP-PFM-LLM-010 preconditions: The organization has settled charges and enough held credits to reach warning range. steps: 'Read live HQ status, release the held work and read again.' expected: The live status and percentage fall with commitments even when no charged-usage crossing exists. negative: false data_needs: 'An isolated workspace with the records, clock instants and caller authority stated in the preconditions.' bound_to: [] provenance: proposed source: - 'services-platform:modules/llm/services/persistence/allowance-periods.ts' - 'services-platform:modules/llm/services/usage-reports/usage-status.ts' - id: ATS-PFM-LLM-007-14 title: Inspection separates charged and held usage category: interaction level: api proves: - BR-CAP-PFM-LLM-007-09 - BR-CAP-PFM-LLM-011-03 exercises: - CAP-PFM-LLM-007 - CAP-PFM-LLM-011 preconditions: An organization has both a settled request and a running reservation. steps: Read its overview before and after settlement. expected: >- The overview preserves the live charged and held position while request history identifies the corresponding outcome. negative: false data_needs: 'An isolated workspace with the records, clock instants and caller authority stated in the preconditions.' bound_to: [] provenance: proposed source: - 'services-platform:modules/llm/services/persistence/allowance-periods.ts' - 'services-platform:modules/llm/services/usage-reports/tenant-usage.ts' - id: ATS-PFM-LLM-007-15 title: Explanation never reserves the retried estimate category: interaction level: api proves: - BR-CAP-PFM-LLM-007-02 - BR-CAP-PFM-LLM-012-04 exercises: - CAP-PFM-LLM-007 - CAP-PFM-LLM-012 preconditions: A stored allowance refusal becomes affordable after capacity is added. steps: Explain the original refusal twice and compare the period before and after. expected: >- Original decision figures remain stable and the current check changes to affordable without taking a hold. negative: false data_needs: 'An isolated workspace with the records, clock instants and caller authority stated in the preconditions.' bound_to: - TST-PFM-LLM-025 provenance: test source: - >- services-platform:modules/llm/tests/integration/services/explain/explain-invocation.integration.spec.js#says the same request would be admitted now, after an override granted since is in force - >- services-platform:modules/llm/tests/integration/services/explain/explain-invocation.integration.spec.js#leaves blocks 1 and 2 as the snapshot had them, whatever has changed since - >- services-platform:modules/llm/tests/integration/services/explain/explain-invocation.integration.spec.js#holds no credits by explaining test_sources: - >- services-platform:modules/llm/tests/integration/services/explain/explain-invocation.integration.spec.js#says the same request would be admitted now, after an override granted since is in force - >- services-platform:modules/llm/tests/integration/services/explain/explain-invocation.integration.spec.js#leaves blocks 1 and 2 as the snapshot had them, whatever has changed since - >- services-platform:modules/llm/tests/integration/services/explain/explain-invocation.integration.spec.js#holds no credits by explaining - id: ATS-PFM-LLM-007-16 title: Lowering limits preserves admitted work category: interaction level: api proves: - BR-CAP-PFM-LLM-007-08 - BR-CAP-PFM-LLM-013-06 exercises: - CAP-PFM-LLM-007 - CAP-PFM-LLM-013 preconditions: Requests hold capacity when a manager lowers recurring allowance below commitments. steps: 'Save the lower limit, settle the admitted requests and request new admission.' expected: >- Running holds survive the save and settle normally; new work is refused while commitments exceed capacity. negative: true data_needs: 'An isolated workspace with the records, clock instants and caller authority stated in the preconditions.' bound_to: - TST-PFM-LLM-019 provenance: test source: - >- services-platform:modules/llm/tests/integration/lifecycle/llm-ledger-concurrency.integration.spec.js#keeps what was reserved: a lowered allowance never cuts a call off - >- services-platform:modules/llm/tests/integration/lifecycle/llm-ledger-concurrency.integration.spec.js#refuses the next call while the period is over its lowered allowance - >- services-platform:modules/llm/tests/integration/lifecycle/llm-ledger-concurrency.integration.spec.js#takes held credits down to zero as each reservation settles, never below test_sources: - >- services-platform:modules/llm/tests/integration/lifecycle/llm-ledger-concurrency.integration.spec.js#keeps what was reserved: a lowered allowance never cuts a call off - >- services-platform:modules/llm/tests/integration/lifecycle/llm-ledger-concurrency.integration.spec.js#refuses the next call while the period is over its lowered allowance - >- services-platform:modules/llm/tests/integration/lifecycle/llm-ledger-concurrency.integration.spec.js#takes held credits down to zero as each reservation settles, never below - id: ATS-PFM-LLM-007-17 title: Grant boundaries change the next admission category: interaction level: api proves: - BR-CAP-PFM-LLM-007-06 - BR-CAP-PFM-LLM-014-07 exercises: - CAP-PFM-LLM-007 - CAP-PFM-LLM-014 preconditions: Base capacity cannot afford an estimate and a scheduled grant supplies the difference. steps: 'Attempt admission just before start, at start and at end; repeat after revocation.' expected: >- Only the unrevoked half-open window contributes capacity; the next request after expiry or revocation uses base alone. negative: false data_needs: 'An isolated workspace with the records, clock instants and caller authority stated in the preconditions.' bound_to: - TST-PFM-LLM-019 provenance: test source: - >- services-platform:modules/llm/tests/integration/lifecycle/llm-ledger-concurrency.integration.spec.js#counts from its first instant - >- services-platform:modules/llm/tests/integration/lifecycle/llm-ledger-concurrency.integration.spec.js#refuses the same call from the instant the window ends - >- services-platform:modules/llm/tests/integration/lifecycle/llm-ledger-concurrency.integration.spec.js#counts the override no longer once it is revoked: whatever the race admitted, the next call fits only inside the base test_sources: - >- services-platform:modules/llm/tests/integration/lifecycle/llm-ledger-concurrency.integration.spec.js#counts from its first instant - >- services-platform:modules/llm/tests/integration/lifecycle/llm-ledger-concurrency.integration.spec.js#refuses the same call from the instant the window ends - >- services-platform:modules/llm/tests/integration/lifecycle/llm-ledger-concurrency.integration.spec.js#counts the override no longer once it is revoked: whatever the race admitted, the next call fits only inside the base - id: ATS-PFM-LLM-007-18 title: Correction changes capacity without rewriting requests category: interaction level: api proves: - BR-CAP-PFM-LLM-007-09 - BR-CAP-PFM-LLM-015-06 exercises: - CAP-PFM-LLM-007 - CAP-PFM-LLM-015 preconditions: A current period has a settled charge sufficient for a refund. steps: 'Apply a valid refund, read admission position and re-read the original request.' expected: >- Remaining credits rise with the signed correction while the request’s original settlement stays unchanged. negative: false data_needs: 'An isolated workspace with the records, clock instants and caller authority stated in the preconditions.' bound_to: [] provenance: proposed source: - 'services-platform:modules/llm/services/persistence/allowance-periods.ts' - 'services-platform:modules/llm/services/adjustments/adjust-allowance.ts' - id: ATS-PFM-LLM-007-19 title: Customer position includes running holds category: interaction level: api proves: - BR-CAP-PFM-LLM-007-09 - BR-CAP-PFM-LLM-017-02 exercises: - CAP-PFM-LLM-007 - CAP-PFM-LLM-017 preconditions: A current month has charged credits and a running reservation. steps: 'Read the customer summary, release the reservation and read again.' expected: Used and remaining figures follow committed credits and remain local without exposing internal prices. negative: false data_needs: 'An isolated workspace with the records, clock instants and caller authority stated in the preconditions.' bound_to: [] provenance: proposed source: - 'services-platform:modules/llm/services/persistence/allowance-periods.ts' - 'services-platform:modules/llm/services/usage/organization-usage.ts' - id: ATS-PFM-LLM-007-20 title: Read-only affordability includes its exact boundary category: boundary level: api proves: - BR-CAP-PFM-LLM-007-02 preconditions: >- The suite owns isolated fixtures representing the valid control and the contrasting case described by its steps. steps: Check exact remaining credits and one more credit through the read-only admission query. expected: 'Exact capacity is affordable, one more is not, and the query holds no credits.' negative: false data_needs: 'Suite-owned fixtures, with a fixed clock where dates or grant windows matter.' bound_to: - TST-PFM-LLM-031 provenance: test source: >- services-platform:modules/llm/tests/integration/services/persistence/allowance-periods.queries.integration.spec.js#says yes for credits that fill the allowance exactly, as the ledger’s own comparison does test_sources: - >- services-platform:modules/llm/tests/integration/services/persistence/allowance-periods.queries.integration.spec.js#says yes for credits that fill the allowance exactly, as the ledger’s own comparison does - id: ATS-PFM-LLM-007-21 title: Default allowance uses the declared monthly amount category: rule level: unit proves: - BR-CAP-PFM-LLM-007-01 preconditions: >- The suite owns isolated fixtures representing the valid control and the contrasting case described by its steps. steps: Read default monthly allowance and default concurrency configuration. expected: The monthly amount is one hundred thousand credits and the default running cap is eight. negative: false data_needs: 'Suite-owned fixtures, with a fixed clock where dates or grant windows matter.' bound_to: - TST-PFM-LLM-062 provenance: test source: 'services-platform:modules/llm/tests/unit/llm-settings.spec.ts#gives a tenant 100,000 credits a month' test_sources: - 'services-platform:modules/llm/tests/unit/llm-settings.spec.ts#gives a tenant 100,000 credits a month' evidence: - >- services-platform at ad3f6a6582843008ed0f5a17b131878d15829af1: bound or cited modules/llm/tests/e2e/allowance-warning.e2e.spec.js; modules/llm/tests/integration/lifecycle/executions.integration.spec.js; modules/llm/tests/integration/lifecycle/llm-ledger-concurrency.integration.spec.js; modules/llm/tests/integration/lifecycle/run-operation.integration.spec.js; modules/llm/tests/integration/services/persistence/allowance-periods.integration.spec.js; modules/llm/tests/unit/services/refusal-snapshot.spec.ts. coverage: rule: 'gap: FND-PFM-LLM-066' transition: 'gap: FND-PFM-LLM-066' validation: 'gap: FND-PFM-LLM-066' permission: not-applicable edge: covered failure: covered boundary: covered concurrency: covered invariant: 'gap: FND-PFM-LLM-066' interaction: covered coverage_notes: transition: >- Existing transition scenarios are retained; the model transition register below records the remaining exhaustive mapping obligation. permission: >- This capability declares no permission key; caller authorization belongs to its consuming operation or a related capability. interaction: >- The related interaction register cites a concrete experiment for every dependency and related capability, including cross-capability workflow seams. invariant: >- The domain-invariant register maps each relevant invariant to a scenario or to the capability coverage finding; an example does not establish every invariant. rule: >- All must-prove rules have scenario references, but the coverage finding retains untested clauses and combined outcomes; scenario presence alone is not exhaustive rule proof. related_interactions: - with: CAP-PFM-LLM-001 scenarios: - ATS-PFM-LLM-001-16 source: 'services-platform:modules/llm/services/catalog/catalog-authority.ts:resolveLlmOperation' - with: CAP-PFM-LLM-005 scenarios: - ATS-PFM-LLM-005-10 source: 'services-platform:modules/llm/catalog/pricing.ts' - with: CAP-PFM-LLM-008 scenarios: - ATS-PFM-LLM-007-11 source: 'services-platform:modules/llm/services/persistence/allowance-periods.ts' - with: CAP-PFM-LLM-009 scenarios: - ATS-PFM-LLM-007-12 source: 'services-platform:modules/llm/aws/lambda/RECONCILIATION.handler.ts' - with: CAP-PFM-LLM-010 scenarios: - ATS-PFM-LLM-007-13 source: >- services-platform:modules/llm/tests/e2e/llm-usage.e2e.spec.js#refuses a customer’s administrator, whatever they hold at their customer’s scope - with: CAP-PFM-LLM-011 scenarios: - ATS-PFM-LLM-007-14 source: >- services-platform:modules/llm/tests/e2e/llm-usage.e2e.spec.js#refuses a customer’s administrator a tenant’s usage even in their own tenant - with: CAP-PFM-LLM-012 scenarios: - ATS-PFM-LLM-007-15 source: >- services-platform:modules/llm/tests/e2e/llm-adjustments-and-organization.e2e.spec.js#is refused 403 for a customer’s administrator, because the route is system - with: CAP-PFM-LLM-013 scenarios: - ATS-PFM-LLM-007-16 source: >- services-platform:modules/llm/tests/e2e/llm-limits.e2e.spec.js#is refused the write before a handler runs, whatever the customer’s scope grants - with: CAP-PFM-LLM-014 scenarios: - ATS-PFM-LLM-007-17 source: >- services-platform:modules/llm/tests/e2e/llm-overrides.e2e.spec.js#is refused the grant before a handler runs, whatever the customer’s scope grants - with: CAP-PFM-LLM-015 scenarios: - ATS-PFM-LLM-007-18 source: >- services-platform:modules/llm/tests/e2e/llm-adjustments-and-organization.e2e.spec.js#is refused 403 for a Support Representative, who holds the read key and not the manage key - with: CAP-PFM-LLM-017 scenarios: - ATS-PFM-LLM-007-19 source: >- services-platform:modules/llm/tests/e2e/llm-adjustments-and-organization.e2e.spec.js#is refused to Rhythm staff holding every HQ key, because the routes are console state_models: - STATE-PFM-LLM-005 - STATE-PFM-LLM-007 coverage_obligations: must_prove: - rule: BR-CAP-PFM-LLM-007-01 scenarios: - ATS-PFM-LLM-007-01 - ATS-PFM-LLM-007-21 source: 'services-platform:modules/llm/services/persistence/allowance-periods.ts' coverage: specified - rule: BR-CAP-PFM-LLM-007-02 scenarios: - ATS-PFM-LLM-007-02 - ATS-PFM-LLM-007-15 - ATS-PFM-LLM-007-20 source: 'services-platform:modules/llm/services/persistence/allowance-periods.ts' coverage: specified - rule: BR-CAP-PFM-LLM-007-03 scenarios: - ATS-PFM-LLM-007-03 source: 'services-platform:modules/llm/services/execution/run-operation.ts' coverage: specified - rule: BR-CAP-PFM-LLM-007-04 scenarios: - ATS-PFM-LLM-007-04 source: >- services-platform:modules/llm/tests/integration/lifecycle/llm-ledger-concurrency.integration.spec.js#admits a ninth only once a call has settled, which gives its place back coverage: specified - rule: BR-CAP-PFM-LLM-007-05 scenarios: - ATS-PFM-LLM-007-04 source: >- services-platform:modules/llm/tests/integration/lifecycle/llm-ledger-concurrency.integration.spec.js#says allowance_exceeded when both refuse, because that is the one that lasts coverage: specified - rule: BR-CAP-PFM-LLM-007-06 scenarios: - ATS-PFM-LLM-007-05 - ATS-PFM-LLM-007-17 source: 'services-platform:modules/llm/services/persistence/allowance-periods.ts' coverage: partial gap: FND-PFM-LLM-066 - rule: BR-CAP-PFM-LLM-007-07 scenarios: - ATS-PFM-LLM-007-06 source: 'services-platform:modules/llm/services/execution/run-operation.ts' coverage: specified - rule: BR-CAP-PFM-LLM-007-08 scenarios: - ATS-PFM-LLM-007-07 - ATS-PFM-LLM-007-16 source: 'services-platform:modules/llm/services/persistence/allowance-periods.ts' coverage: partial gap: FND-PFM-LLM-066 - rule: BR-CAP-PFM-LLM-007-09 scenarios: - ATS-PFM-LLM-007-08 - ATS-PFM-LLM-007-11 - ATS-PFM-LLM-007-12 - ATS-PFM-LLM-007-13 - ATS-PFM-LLM-007-14 - ATS-PFM-LLM-007-18 - ATS-PFM-LLM-007-19 source: 'services-platform:modules/llm/services/persistence/allowance-periods.ts' coverage: specified - rule: BR-CAP-PFM-LLM-007-10 scenarios: - ATS-PFM-LLM-007-09 source: 'services-platform:modules/llm/services/metering/refusal-snapshot.ts' coverage: partial gap: FND-PFM-LLM-066 state_transitions: - model: STATE-PFM-LLM-005 transition: 1 from: within to: warned trigger: Commitments increase or effective capacity decreases into warning range. gap: FND-PFM-LLM-066 provenance: proposed source: 'services-platform:modules/llm/services/usage-reports/usage-status.ts:deriveUsageStatus' - model: STATE-PFM-LLM-005 transition: 2 from: warned to: hard_stopped trigger: Committed usage reaches full effective capacity. gap: FND-PFM-LLM-066 provenance: proposed source: 'services-platform:modules/llm/services/usage-reports/usage-status.ts:deriveUsageStatus' - model: STATE-PFM-LLM-005 transition: 3 from: within to: hard_stopped trigger: A large movement skips directly from below warning to full usage. gap: FND-PFM-LLM-066 provenance: proposed source: 'services-platform:modules/llm/services/usage-reports/usage-status.ts:deriveUsageStatus' - model: STATE-PFM-LLM-005 transition: 4 from: hard_stopped to: within trigger: 'Capacity rises, commitments fall or the month changes.' gap: FND-PFM-LLM-066 provenance: proposed source: 'services-platform:modules/llm/services/overrides/allowance-overrides.ts:grantOverride' - model: STATE-PFM-LLM-005 transition: 5 from: hard_stopped to: warned trigger: Capacity returns without removing the warning. gap: FND-PFM-LLM-066 provenance: proposed source: 'services-platform:modules/llm/services/usage-reports/usage-status.ts:deriveUsageStatus' - model: STATE-PFM-LLM-005 transition: 6 from: warned to: within trigger: Capacity increases or commitments decrease below warning. gap: FND-PFM-LLM-066 provenance: proposed source: 'services-platform:modules/llm/services/usage-reports/usage-status.ts:deriveUsageStatus' - model: STATE-PFM-LLM-005 transition: 7 from: within to: disabled trigger: The AI switch is disabled or organization availability changes. gap: FND-PFM-LLM-066 provenance: proposed source: 'services-platform:modules/llm/services/limits/tenant-limits.ts:checkOperationAccess' - model: STATE-PFM-LLM-005 transition: 8 from: disabled to: within trigger: AI and organization availability return. gap: FND-PFM-LLM-066 provenance: proposed source: 'services-platform:modules/llm/services/limits/tenant-limits.ts:upsertTenantLimits' - model: STATE-PFM-LLM-007 transition: 1 from: absent to: active trigger: A manager creates capacity starting immediately. gap: FND-PFM-LLM-066 provenance: proposed source: 'services-platform:modules/llm/services/overrides/allowance-overrides.ts:grantOverride' - model: STATE-PFM-LLM-007 transition: 2 from: absent to: scheduled trigger: A manager creates capacity with a future start. gap: FND-PFM-LLM-066 provenance: proposed source: 'services-platform:modules/llm/services/overrides/allowance-overrides.ts:grantOverride' - model: STATE-PFM-LLM-007 transition: 3 from: scheduled to: active trigger: Time reaches the grant’s start. gap: FND-PFM-LLM-066 provenance: proposed source: 'services-platform:modules/llm/services/persistence/allowance-periods.ts:authorizeCredits' - model: STATE-PFM-LLM-007 transition: 4 from: active to: expired trigger: Time reaches the grant’s end. gap: FND-PFM-LLM-066 provenance: proposed source: 'services-platform:modules/llm/services/persistence/allowance-periods.ts:authorizeCredits' - model: STATE-PFM-LLM-007 transition: 5 from: active to: revoked trigger: A manager revokes currently active capacity. gap: FND-PFM-LLM-066 provenance: proposed source: 'services-platform:modules/llm/services/overrides/allowance-overrides.ts:revokeOverride' - model: STATE-PFM-LLM-007 transition: 6 from: scheduled to: revoked trigger: A manager revokes scheduled capacity. gap: FND-PFM-LLM-066 provenance: proposed source: 'services-platform:modules/llm/services/overrides/allowance-overrides.ts:revokeOverride' domain_invariants: - invariant: INV-DOM-PFM-LLM-003-01 scenarios: - ATS-PFM-LLM-007-01 provenance: documented source: 'services-platform:modules/llm/services/persistence/allowance-periods.ts:getOrCreateAllowancePeriod' - invariant: INV-DOM-PFM-LLM-003-02 scenarios: - ATS-PFM-LLM-007-02 provenance: documented source: 'services-platform:modules/llm/services/persistence/allowance-periods.ts:authorizeCredits' - invariant: INV-DOM-PFM-LLM-003-03 scenarios: - ATS-PFM-LLM-007-07 provenance: documented source: 'services-platform:modules/llm/services/persistence/allowance-periods.ts:settleCredits' - invariant: INV-DOM-PFM-LLM-003-04 scenarios: [] gap: FND-PFM-LLM-066 provenance: proposed source: >- services-platform:modules/llm/db/llm-allowance-periods.table.ts:llm_allowance_periods_reserved_credits_check - invariant: INV-DOM-PFM-LLM-003-05 scenarios: - ATS-PFM-LLM-007-05 provenance: documented source: 'services-platform:modules/llm/services/persistence/allowance-periods.ts:authorizeCredits' - invariant: INV-DOM-PFM-LLM-001-05 scenarios: - ATS-PFM-LLM-007-09 provenance: documented source: 'services-platform:modules/llm/services/persistence/invocations.ts:markInvocationRefused' coverage_limits: finding: FND-PFM-LLM-066 statement: >- Complete displayed-position transitions, month-boundary races, changes during admission and interrupted period movement need additional proof beyond the atomic reservation race. provenance: proposed source: - 'services-platform:modules/llm/services/persistence/allowance-periods.ts' - 'services-platform:modules/llm/services/persistence/allowance-periods.ts' - 'services-platform:modules/llm/services/execution/run-operation.ts' - >- services-platform:modules/llm/tests/integration/lifecycle/llm-ledger-concurrency.integration.spec.js#admits a ninth only once a call has settled, which gives its place back - >- services-platform:modules/llm/tests/integration/lifecycle/llm-ledger-concurrency.integration.spec.js#says allowance_exceeded when both refuse, because that is the one that lasts - 'services-platform:modules/llm/services/persistence/allowance-periods.ts' - 'services-platform:modules/llm/services/execution/run-operation.ts' - 'services-platform:modules/llm/services/persistence/allowance-periods.ts' - 'services-platform:modules/llm/services/persistence/allowance-periods.ts' - 'services-platform:modules/llm/services/metering/refusal-snapshot.ts' - >- services-platform:modules/llm/db/llm-allowance-periods.table.ts:llm_allowance_periods_reserved_credits_check invariants_without_scenarios: - INV-DOM-PFM-LLM-003-04 --- # undefined ## Coverage The scenarios identify the rules or journey assertions they are intended to prove. A test binding names existing evidence; an unbound proposal remains work to verify. | Scenario | Title | Level | Provenance | |---|---|---|---| | `ATS-PFM-LLM-007-01` | Concurrent first admission creates one period | api | test | | `ATS-PFM-LLM-007-02` | Concurrent requests share capacity atomically | api | test | | `ATS-PFM-LLM-007-03` | Exhausted allowance prevents another provider call | api | test | | `ATS-PFM-LLM-007-04` | Concurrency slots return on settlement | api | test | | `ATS-PFM-LLM-007-05` | Grant windows and revocation apply at request time | api | test | | `ATS-PFM-LLM-007-06` | Admitted work can exceed allowance on settlement | api | test | | `ATS-PFM-LLM-007-07` | Lower limits preserve running reservations | api | test | | `ATS-PFM-LLM-007-08` | Available balance accounts for charge and holds | api | proposed | | `ATS-PFM-LLM-007-09` | Refusal retains the original decision figures | api | test | | `ATS-PFM-LLM-007-10` | Customer pause journey reaches its reported result | api | proposed | ## Interactions With Related Capabilities The interaction register links concrete experiments with run ai requests with consistent attribution and accounting; publish ai operation definitions and historical prices; notify administrators at allowance thresholds; recover interrupted requests and identify accounting drift; monitor ai usage across organizations; inspect an organization’s ai account and request history; explain an ai refusal or unsuccessful conversation; set an organization’s ai access and recurring limits; provide temporary ai capacity and revoke it; correct an organization’s ai charges; show administrators their organization’s ai allowance. Each experiment checks the outcome at the shared boundary; an unbound experiment remains proposed. Complete displayed-position transitions, month-boundary races, changes during admission and interrupted period movement need additional proof beyond the atomic reservation race.