--- id: ATS-PFM-OPS-001 scope: CAP-PFM-OPS-001 product_area: platform module: operations revision: 2 status: proposed approved_by: null approved_at: null source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 macroservice-libraries: 54536a441935c6e09fdb7f96f0bec71c52ba4e03 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f scenarios: - id: ATS-PFM-OPS-001-01 title: Reuse an existing submission level: unit proves: - BR-CAP-PFM-OPS-001-01 - INV-DOM-PFM-OPS-001-01 preconditions: >- A registered kind has a stable intention key; one competing submission runs in a caller transaction. steps: >- Repeat the intention, simulate a uniqueness collision outside a caller transaction, and repeat the collision inside one. expected: >- Ordinary repeats and a lost race outside the caller transaction resolve to the existing job; the same collision inside the caller transaction surfaces its uniqueness failure to the caller. negative: false data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - TST-PFM-OPS-005 provenance: test source: >- macroservice-libraries:packages/jobs/src/engine/job-engine.spec.ts#answers the job the identity already names when the submission is repeated evidence_candidates: - >- macroservice-libraries:packages/jobs/src/engine/job-engine.spec.ts#answers the job the identity already names when the submission is repeated category: concurrency binding_evidence: - >- macroservice-libraries:packages/jobs/src/engine/job-engine.spec.ts#answers the job the identity already names when the submission is repeated - id: ATS-PFM-OPS-001-02 title: Keep execution outside the transaction level: unit proves: - BR-CAP-PFM-OPS-001-02 preconditions: The submitting operation has an open transaction. steps: 'Attempt combined submission and start, then create inside and start after commit.' expected: The combined attempt is refused and the committed job has queued steps and submission history. negative: true data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: [] provenance: proposed source: >- macroservice-libraries:packages/jobs/src/engine/job-engine.spec.ts#refuses submitJob inside a transaction: the execution starts after the commit evidence_candidates: - >- macroservice-libraries:packages/jobs/src/engine/job-engine.spec.ts#refuses submitJob inside a transaction: the execution starts after the commit category: validation binding_evidence: - >- macroservice-libraries:packages/jobs/src/engine/job-engine.spec.ts#refuses submitJob inside a transaction: the execution starts after the commit binding_review: >- The cited refusal test does not execute the entire create-in-transaction and start-after-commit sequence. - id: ATS-PFM-OPS-001-03 title: Retain the committed request after start failure level: unit proves: - BR-CAP-PFM-OPS-001-03 preconditions: Execution startup is unavailable. steps: Call the API-facing start helper for a committed job. expected: Submission remains successful and the pending job is logged for reconciliation. negative: true data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: [] provenance: proposed source: 'macroservice-libraries:packages/jobs/src/engine/job-engine.ts:startJobOrLeaveToReconciler' category: failure - id: ATS-PFM-OPS-001-04 title: Reject movement after settlement level: unit proves: - BR-CAP-PFM-OPS-001-04 - INV-DOM-PFM-OPS-001-03 preconditions: A job has reached success. steps: Attempt another settlement and deliver a delayed step report. expected: Settlement is refused and the report adds no transition history. negative: true data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - TST-PFM-OPS-005 provenance: test source: >- macroservice-libraries:packages/jobs/src/engine/job-engine.spec.ts#refuses settling an already terminal job evidence_candidates: - >- macroservice-libraries:packages/jobs/src/engine/job-engine.spec.ts#refuses settling an already terminal job category: invariant binding_evidence: - >- macroservice-libraries:packages/jobs/src/engine/job-engine.spec.ts#refuses settling an already terminal job - id: ATS-PFM-OPS-001-05 title: Reject decreasing progress level: unit proves: - BR-CAP-PFM-OPS-001-05 - INV-DOM-PFM-OPS-001-04 preconditions: A run already reports sixty percent progress. steps: Report forty percent progress. expected: The transition is refused. negative: true data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - TST-PFM-OPS-005 provenance: test source: >- macroservice-libraries:packages/jobs/src/engine/job-engine.spec.ts#refuses progress that would move backwards evidence_candidates: - >- macroservice-libraries:packages/jobs/src/engine/job-engine.spec.ts#refuses progress that would move backwards category: boundary binding_evidence: - >- macroservice-libraries:packages/jobs/src/engine/job-engine.spec.ts#refuses progress that would move backwards - id: ATS-PFM-OPS-001-06 title: Keep transient errors out of persisted history level: unit proves: - BR-CAP-PFM-OPS-001-06 preconditions: One task refuses permanently and another raises an unexpected fault. steps: Execute both failure paths through the workflow. expected: >- The refusal ends immediately with safe wording and the retried fault reveals no technical payload in persisted history. negative: true data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - TST-PFM-OPS-019 provenance: test source: >- macroservice-libraries:packages/jobs/src/workflow/job-workflow.spec.ts#lets no detail of the transient error reach the job or the execution state evidence_candidates: - >- macroservice-libraries:packages/jobs/src/workflow/job-workflow.spec.ts#lets no detail of the transient error reach the job or the execution state category: failure binding_evidence: - >- macroservice-libraries:packages/jobs/src/workflow/job-workflow.spec.ts#lets no detail of the transient error reach the job or the execution state - id: ATS-PFM-OPS-001-07 title: Require a declared business consequence level: unit proves: - BR-CAP-PFM-OPS-001-09 - INV-DOM-PFM-OPS-001-08 preconditions: All Platform job kinds are registered. steps: Inspect their failure declarations. expected: Every kind names a consequence or an explicit no-change declaration. negative: true data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - TST-PFM-OPS-077 provenance: test source: >- services-platform:modules/jobs/tests/unit/job-failure-consequences.spec.js#declares a failure consequence, or states there is none, for every registered kind evidence_candidates: - >- services-platform:modules/jobs/tests/unit/job-failure-consequences.spec.js#declares a failure consequence, or states there is none, for every registered kind category: rule binding_evidence: - >- services-platform:modules/jobs/tests/unit/job-failure-consequences.spec.js#declares a failure consequence, or states there is none, for every registered kind - id: ATS-PFM-OPS-001-08 title: Retain deletion evidence during purge level: api proves: - BR-CAP-PFM-OPS-001-10 preconditions: A deleting workspace has ordinary jobs and requester notices. steps: Purge its job resources while naming the deletion’s own jobs to retain. expected: 'Ordinary roots, steps, history and notices disappear while the two retained jobs remain.' negative: false data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: [] provenance: proposed source: 'services-platform:modules/jobs/services/persistence/tenant-purges.ts:JOB_PURGE_RESOURCES' category: transition - id: ATS-PFM-OPS-001-09 title: Recover a committed run whose start fails category: interaction level: api proves: - BR-CAP-PFM-OPS-001-03 - BR-CAP-PFM-OPS-002-03 exercises: - CAP-PFM-OPS-001 - CAP-PFM-OPS-002 preconditions: Execution startup fails after a workspace change commits. steps: 'Submit the change, let the reconciliation threshold pass, and inspect the run.' expected: The change and pending run remain inspectable before reconciliation supplies the final failure. negative: false data_needs: Isolated workspace records and caller contexts for both sides of the interaction. bound_to: [] provenance: proposed source: >- macroservice-libraries:packages/jobs/src/engine/job-engine.ts:startJobOrLeaveToReconciler; services-platform:modules/jobs/tests/integration/lifecycle/job-reconciliation/job-reconciliation.integration.spec.js#settles it failed, saying the job never started; CAP-PFM-OPS-002; WF-PFM-OPS-001; WF-PFM-OPS-002; WF-PFM-OPS-009 - id: ATS-PFM-OPS-001-10 title: Retry without reopening the predecessor category: interaction level: api proves: - BR-CAP-PFM-OPS-001-04 - BR-CAP-PFM-OPS-004-01 - BR-CAP-PFM-OPS-004-02 exercises: - CAP-PFM-OPS-001 - CAP-PFM-OPS-004 preconditions: A retryable run fails after completing its first step. steps: Create a retry and compare both runs after later reports arrive for the predecessor. expected: The retry has separate history while the predecessor retains its final outcome. negative: false data_needs: Isolated workspace records and caller contexts for both sides of the interaction. bound_to: [] provenance: proposed source: >- macroservice-libraries:packages/jobs/src/engine/job-engine.spec.ts#refuses settling an already terminal job; macroservice-libraries:packages/jobs/src/engine/job-engine.spec.ts#refuses to create a retry of a kind that is not retryable; macroservice-libraries:packages/jobs/src/engine/job-engine.spec.ts#answers the steps the prior job completed, which the start carries into the new execution; CAP-PFM-OPS-004; WF-PFM-OPS-001; WF-PFM-OPS-002; WF-PFM-OPS-009 - id: ATS-PFM-OPS-001-11 title: Retain lifecycle failure evidence category: interaction level: api proves: - BR-CAP-PFM-OPS-001-10 exercises: - CAP-PFM-OPS-001 - CAP-PFM-SEC-003 preconditions: A workspace lifecycle run reaches an interrupted execution outcome. steps: Reconcile it and inspect the lifecycle record alongside the job record. expected: Both records identify the failed work without silently reopening its final history. negative: false data_needs: Isolated workspace records and caller contexts for both sides of the interaction. bound_to: [] provenance: proposed source: >- services-platform:modules/jobs/services/persistence/tenant-purges.ts:JOB_PURGE_RESOURCES; CAP-PFM-SEC-003; WF-PFM-OPS-001; WF-PFM-OPS-002; WF-PFM-OPS-009 - id: ATS-PFM-OPS-001-12 title: Preserve retirement scope category: interaction level: api proves: - BR-CAP-PFM-OPS-001-10 exercises: - CAP-PFM-OPS-001 - CAP-PFM-SEC-004 preconditions: A workspace is deleting and its deletion jobs must remain inspectable. steps: Purge operational resources and inspect the retained deletion runs. expected: Retirement removes owned resources while its retained work still explains the deletion. negative: false data_needs: Isolated workspace records and caller contexts for both sides of the interaction. bound_to: [] provenance: proposed source: >- services-platform:modules/jobs/services/persistence/tenant-purges.ts:JOB_PURGE_RESOURCES; CAP-PFM-SEC-004; WF-PFM-OPS-001; WF-PFM-OPS-002; WF-PFM-OPS-009 - id: ATS-PFM-OPS-001-13 title: Follow a first report into successful settlement category: transition level: unit proves: - BR-CAP-PFM-OPS-001-04 - INV-DOM-PFM-OPS-001-02 preconditions: A pending run and a running run have an unsettled declared step. steps: Report the pending run’s first step; separately settle the running run successfully. expected: >- The first run starts its recorded activity; the second has a final successful outcome with full progress and settlement time. negative: false data_needs: Run-owned records and controlled clocks or dependency responses named in the preconditions. bound_to: - TST-PFM-OPS-006 provenance: test source: >- macroservice-libraries:packages/jobs/src/engine/job-root-status-model.spec.ts#settles a running job succeeded, at full progress models: - STATE-PFM-OPS-001 transitions: - 1 - 2 - id: ATS-PFM-OPS-001-14 title: Exercise the declared step moves and retained attempts category: transition level: unit proves: - BR-CAP-PFM-OPS-001-04 - INV-DOM-PFM-OPS-001-03 preconditions: Separate runs contain steps in each starting state of the declared step lifecycle. steps: 'Apply each declared step move, replay final states, and attempt changed final outcomes.' expected: >- Each permitted move has the expected event and attempt history; final-state replays add no event and changed final outcomes are refused. negative: false data_needs: Run-owned records and controlled clocks or dependency responses named in the preconditions. bound_to: - TST-PFM-OPS-007 provenance: test source: >- macroservice-libraries:packages/jobs/src/engine/job-step-status-model.spec.ts#the job step status model models: - STATE-PFM-OPS-002 transitions: - 1 - 2 - 3 - 4 - 5 - 6 - 7 note: >- Retry creation supplies the eighth move; this writer matrix does not prove orchestration retry policy. - id: ATS-PFM-OPS-001-15 title: Retain the continuation successor through replay category: invariant level: unit proves: - BR-CAP-PFM-OPS-001-12 preconditions: A run has a current execution handle and a named continuation. steps: >- Record the successor, replay the same continuation, and submit a continuation for a different source handle. expected: Replay preserves the successor and its single continuation event; the different source is refused. negative: false data_needs: Run-owned records and controlled clocks or dependency responses named in the preconditions. bound_to: - TST-PFM-OPS-004 provenance: test source: 'macroservice-libraries:packages/jobs/src/engine/job-continuation.spec.ts#recording the continuation' - id: ATS-PFM-OPS-001-16 title: Keep success final when requester delivery fails category: interaction level: api proves: - BR-CAP-PFM-OPS-001-04 - BR-CAP-PFM-OPS-003-05 exercises: - CAP-PFM-OPS-001 - CAP-PFM-OPS-003 workflows: - WF-PFM-OPS-002 preconditions: A notifying run settles successfully before its message sender fails. steps: 'Complete the run, inject the send failure, and inspect both the run and notice outcome.' expected: The run retains success while notice evidence records the delivery failure. negative: true data_needs: >- Isolated workspace and run-owned lifecycle records, with a second linked workspace where shared company evidence is checked. bound_to: [] provenance: proposed source: >- services-platform:modules/jobs/tests/integration/services/job-snapshot/job-snapshot.integration.spec.js#takes that catalog from the published event rather than the declaration, which the event itself carries; macroservice-libraries:packages/jobs/src/workflow/job-workflow.spec.ts#lets no detail of the transient error reach the job or the execution state; macroservice-libraries:packages/jobs/src/engine/job-engine.ts:settleJob; macroservice-libraries:packages/jobs/src/reconciler/job-reconciler.spec.ts#applies it before the settlement, so a consequence that fails leaves the job for the next pass; services-platform:modules/jobs/services/notices/notify-job-requester.ts:notifyJobRequester - id: ATS-PFM-OPS-001-17 title: Keep the deletion run readable after operational purge category: interaction level: api proves: - BR-CAP-PFM-OPS-001-10 - BR-CAP-PFM-OPS-015-09 exercises: - CAP-PFM-OPS-001 - CAP-PFM-OPS-010 - CAP-PFM-OPS-012 - CAP-PFM-OPS-015 workflows: - WF-PFM-OPS-009 preconditions: >- A deleting workspace has ordinary runs and notices, activity entries, staff exceptions and operational application rows. steps: >- Run the operational lifecycle participants through bounded batches, retaining the deletion’s own run identities. expected: >- The retained deletion runs still explain the purge after the other workspace-owned operational records disappear. negative: false data_needs: >- Isolated workspace and run-owned lifecycle records, with a second linked workspace where shared company evidence is checked. bound_to: [] provenance: proposed source: >- services-platform:modules/jobs/services/persistence/tenant-purges.ts:JOB_PURGE_RESOURCES; services-platform:modules/audit/tests/integration/services/persistence/audit-events.integration.spec.js#is refused by the database, so the purger is never a delete-by-tenant tool; services-platform:modules/licensing/services/maintenance/tenant-participant.ts:licensingParticipant evidence: - >- Pinned capability rules, object invariants, state transitions and workflows are reviewed for testing obligations. - >- Executable bindings refer only to existing suites; no module executable suite runs during this documentation job. coverage: rule: covered transition: covered validation: covered permission: not-applicable edge: 'gap: FND-PFM-OPS-053' failure: covered boundary: covered concurrency: covered invariant: covered interaction: covered coverage_notes: permission: >- This internal operation defines no independent caller permission; its callers and audience checks have separate scenarios. edge: 'Empty, missing and unusual inputs need dedicated proof.' related_capabilities: - CAP-PFM-OPS-002 - CAP-PFM-OPS-004 - CAP-PFM-SEC-003 - CAP-PFM-SEC-004 workflow_interactions: - WF-PFM-OPS-001 - WF-PFM-OPS-002 - WF-PFM-OPS-009 coverage_obligations: finding: FND-PFM-OPS-053 uncovered_must_prove: - BR-CAP-PFM-OPS-001-11 object_invariants_requiring_explicit_trace: - INV-DOM-PFM-OPS-001-05 - INV-DOM-PFM-OPS-001-06 - INV-DOM-PFM-OPS-001-07 - INV-DOM-PFM-OPS-001-09 - INV-DOM-PFM-OPS-001-10 - INV-DOM-PFM-OPS-001-11 - INV-DOM-PFM-OPS-001-12 related_scenarios: - capabilities: - CAP-PFM-OPS-001 - CAP-PFM-OPS-002 scenario: ATS-PFM-OPS-001-09 - capabilities: - CAP-PFM-OPS-001 - CAP-PFM-OPS-004 scenario: ATS-PFM-OPS-001-10 - capabilities: - CAP-PFM-OPS-001 - CAP-PFM-SEC-003 scenario: ATS-PFM-OPS-001-11 - capabilities: - CAP-PFM-OPS-001 - CAP-PFM-SEC-004 scenario: ATS-PFM-OPS-001-12 unbound_scenarios: - ATS-PFM-OPS-001-02 - ATS-PFM-OPS-001-03 - ATS-PFM-OPS-001-08 - ATS-PFM-OPS-001-09 - ATS-PFM-OPS-001-10 - ATS-PFM-OPS-001-11 - ATS-PFM-OPS-001-12 - ATS-PFM-OPS-001-16 - ATS-PFM-OPS-001-17 transition_review: - model: STATE-PFM-OPS-001 transition: 3 from: running to: failed provenance: unknown source: FND-PFM-OPS-053 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-001 transition: 4 from: running to: failed provenance: unknown source: FND-PFM-OPS-053 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-001 transition: 5 from: running to: succeeded provenance: unknown source: FND-PFM-OPS-053 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-001 transition: 6 from: pending to: failed provenance: unknown source: FND-PFM-OPS-053 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-001 transition: 7 from: pending to: cancelled provenance: unknown source: FND-PFM-OPS-053 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-001 transition: 8 from: running to: cancelled provenance: unknown source: FND-PFM-OPS-053 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-002 transition: 8 from: queued to: completed provenance: unknown source: FND-PFM-OPS-053 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. permission_review: [] gap_detail: >- Empty declarations, unknown late step reports and the full progress-weight calculation lack complete scenario trace. workflow_scenarios: WF-PFM-OPS-002: - ATS-PFM-OPS-001-16 - ATS-PFM-OPS-003-13 WF-PFM-OPS-009: - ATS-PFM-OPS-001-17 - ATS-PFM-OPS-010-13 - ATS-PFM-OPS-012-19 - ATS-PFM-OPS-015-15 --- # Complete background work with a durable record: Capability Test Specification ## Coverage The category map distinguishes authored scenarios from unresolved proof obligations. A bound scenario names an existing executable suite; its recorded result remains unrun. | Rule | Proof status | |---|---| | `BR-CAP-PFM-OPS-001-01` | `ATS-PFM-OPS-001-01` | | `BR-CAP-PFM-OPS-001-02` | `ATS-PFM-OPS-001-02` | | `BR-CAP-PFM-OPS-001-03` | `ATS-PFM-OPS-001-03`, `ATS-PFM-OPS-001-09` | | `BR-CAP-PFM-OPS-001-04` | `ATS-PFM-OPS-001-04`, `ATS-PFM-OPS-001-10`, `ATS-PFM-OPS-001-13`, `ATS-PFM-OPS-001-14` | | `BR-CAP-PFM-OPS-001-05` | `ATS-PFM-OPS-001-05` | | `BR-CAP-PFM-OPS-001-06` | `ATS-PFM-OPS-001-06` | | `BR-CAP-PFM-OPS-001-09` | `ATS-PFM-OPS-001-07` | | `BR-CAP-PFM-OPS-001-10` | `ATS-PFM-OPS-001-08`, `ATS-PFM-OPS-001-11`, `ATS-PFM-OPS-001-12` | | `BR-CAP-PFM-OPS-001-11` | no scenario: `FND-PFM-OPS-053` | | `BR-CAP-PFM-OPS-001-12` | `ATS-PFM-OPS-001-15` | ## Interactions With Related Capabilities Recover a committed run whose start fails. The change and pending run remain inspectable before reconciliation supplies the final failure. Retry without reopening the predecessor. The retry has separate history while the predecessor retains its final outcome. Retain lifecycle failure evidence. Both records identify the failed work without silently reopening its final history. Preserve retirement scope. Retirement removes owned resources while its retained work still explains the deletion. Keep success final when requester delivery fails. The run retains success while notice evidence records the delivery failure. Keep the deletion run readable after operational purge. The retained deletion runs still explain the purge after the other workspace-owned operational records disappear. ## Evidence and Boundaries Pinned assertion sources support the listed executable bindings. Proposed cases retain the proof required beyond those boundaries. Structured obligations name incomplete object, transition and permission trace; row-level concurrency proof does not establish complete workflow serialization.