--- id: ATS-PFM-OPS-002 scope: CAP-PFM-OPS-002 product_area: platform module: operations revision: 2 status: proposed approved_by: null approved_at: null source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 macroservice-libraries: 54536a441935c6e09fdb7f96f0bec71c52ba4e03 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f scenarios: - id: ATS-PFM-OPS-002-01 title: Resolve a timed-out execution level: api proves: - BR-CAP-PFM-OPS-002-01 preconditions: A running job has exceeded the inactivity threshold and its execution timed out. steps: Run reconciliation once. expected: The failed result retains progress and fails the running step with reconciliation history. negative: false data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - TST-PFM-OPS-069 provenance: test source: >- services-platform:modules/jobs/tests/integration/lifecycle/job-reconciliation/job-reconciliation.integration.spec.js#settles the job failed, with the reconciled summary and the progress its steps earned evidence_candidates: - >- services-platform:modules/jobs/tests/integration/lifecycle/job-reconciliation/job-reconciliation.integration.spec.js#settles the job failed, with the reconciled summary and the progress its steps earned category: transition binding_evidence: - >- services-platform:modules/jobs/tests/integration/lifecycle/job-reconciliation/job-reconciliation.integration.spec.js#settles the job failed, with the reconciled summary and the progress its steps earned - id: ATS-PFM-OPS-002-02 title: Reject incomplete reported success level: api proves: - BR-CAP-PFM-OPS-002-02 - INV-DOM-PFM-OPS-001-07 preconditions: Execution reports success while a recorded step still runs. steps: Reconcile the job. expected: The record settles failed rather than accepting unsupported success. negative: true data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - >- services-platform:modules/jobs/tests/integration/lifecycle/job-reconciliation/job-reconciliation.integration.spec.js#corrects the job to failed, never succeeded, keeping the progress its steps earned - TST-PFM-OPS-069 provenance: test source: >- services-platform:modules/jobs/tests/integration/lifecycle/job-reconciliation/job-reconciliation.integration.spec.js#corrects the job to failed, never succeeded, keeping the progress its steps earned category: invariant binding_evidence: - >- services-platform:modules/jobs/tests/integration/lifecycle/job-reconciliation/job-reconciliation.integration.spec.js#corrects the job to failed, never succeeded, keeping the progress its steps earned - id: ATS-PFM-OPS-002-03 title: Resolve an execution that never started level: api proves: - BR-CAP-PFM-OPS-002-03 preconditions: A pending job has no execution handle and is stale. steps: Run a reconciliation pass. expected: The failure identifies an unstarted job and its steps remain queued. negative: true data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - TST-PFM-OPS-069 provenance: test source: >- services-platform:modules/jobs/tests/integration/lifecycle/job-reconciliation/job-reconciliation.integration.spec.js#settles it failed, saying the job never started evidence_candidates: - >- services-platform:modules/jobs/tests/integration/lifecycle/job-reconciliation/job-reconciliation.integration.spec.js#settles it failed, saying the job never started category: transition binding_evidence: - >- services-platform:modules/jobs/tests/integration/lifecycle/job-reconciliation/job-reconciliation.integration.spec.js#settles it failed, saying the job never started - id: ATS-PFM-OPS-002-04 title: Require repeated missing-execution evidence level: api proves: - BR-CAP-PFM-OPS-002-04 preconditions: A running execution cannot be found. steps: Run three lookup passes. expected: The first two add misses and only the third fails the job. negative: false data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - TST-PFM-OPS-069 provenance: test source: >- services-platform:modules/jobs/tests/integration/lifecycle/job-reconciliation/job-reconciliation.integration.spec.js#halts the job only on the third pass evidence_candidates: - >- services-platform:modules/jobs/tests/integration/lifecycle/job-reconciliation/job-reconciliation.integration.spec.js#halts the job only on the third pass category: boundary binding_evidence: - >- services-platform:modules/jobs/tests/integration/lifecycle/job-reconciliation/job-reconciliation.integration.spec.js#halts the job only on the third pass - id: ATS-PFM-OPS-002-05 title: Preserve active work level: api proves: - BR-CAP-PFM-OPS-002-05 preconditions: One job has recent activity and another execution still runs. steps: Run reconciliation against both. expected: Their records and histories remain unchanged. negative: true data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - TST-PFM-OPS-069 provenance: test source: >- services-platform:modules/jobs/tests/integration/lifecycle/job-reconciliation/job-reconciliation.integration.spec.js#leaves the root exactly as it was, version and all evidence_candidates: - >- services-platform:modules/jobs/tests/integration/lifecycle/job-reconciliation/job-reconciliation.integration.spec.js#leaves the root exactly as it was, version and all category: edge binding_evidence: - >- services-platform:modules/jobs/tests/integration/lifecycle/job-reconciliation/job-reconciliation.integration.spec.js#leaves the root exactly as it was, version and all - id: ATS-PFM-OPS-002-06 title: Alert on execution after finality level: api proves: - BR-CAP-PFM-OPS-002-06 preconditions: A recently failed job’s execution is still running. steps: Run a pass. expected: An operational alert is emitted without reopening the job. negative: true data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - TST-PFM-OPS-069 provenance: test source: >- services-platform:modules/jobs/tests/integration/lifecycle/job-reconciliation/job-reconciliation.integration.spec.js#raises one alert and changes nothing evidence_candidates: - >- services-platform:modules/jobs/tests/integration/lifecycle/job-reconciliation/job-reconciliation.integration.spec.js#raises one alert and changes nothing category: invariant binding_evidence: - >- services-platform:modules/jobs/tests/integration/lifecycle/job-reconciliation/job-reconciliation.integration.spec.js#raises one alert and changes nothing - id: ATS-PFM-OPS-002-07 title: Apply the business consequence before failure level: unit proves: - BR-CAP-PFM-OPS-002-07 preconditions: A registered kind has a failure consequence that can fail before settlement. steps: 'Reconcile a failed execution, first refusing the consequence and then allowing it to finish.' expected: >- The refusal leaves the run open for another pass; successful consequence application precedes failed settlement. negative: false data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: [] provenance: proposed source: >- macroservice-libraries:packages/jobs/src/reconciler/job-reconciler.spec.ts#applies it before the settlement, so a consequence that fails leaves the job for the next pass evidence_candidates: - >- macroservice-libraries:packages/jobs/src/reconciler/job-reconciler.spec.ts#applies it before the settlement, so a consequence that fails leaves the job for the next pass category: failure - id: ATS-PFM-OPS-002-08 title: Repair summary drift level: api proves: - BR-CAP-PFM-OPS-002-08 preconditions: Recorded step progress and the root summary disagree. steps: Reconcile the stale run. expected: The root is repaired and the job remains unsettled. negative: false data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - TST-PFM-OPS-069 provenance: test source: >- services-platform:modules/jobs/tests/integration/lifecycle/job-reconciliation/job-reconciliation.integration.spec.js#repairs the summary instead of settling the job evidence_candidates: - >- services-platform:modules/jobs/tests/integration/lifecycle/job-reconciliation/job-reconciliation.integration.spec.js#repairs the summary instead of settling the job category: rule binding_evidence: - >- services-platform:modules/jobs/tests/integration/lifecycle/job-reconciliation/job-reconciliation.integration.spec.js#repairs the summary instead of settling the job - id: ATS-PFM-OPS-002-09 title: Explain a never-started run to its requester category: interaction level: api proves: - BR-CAP-PFM-OPS-002-03 - BR-CAP-PFM-OPS-003-06 exercises: - CAP-PFM-OPS-002 - CAP-PFM-OPS-003 preconditions: A notifying provisioning run has no execution handle. steps: Reconcile the stale run and inspect its requester notice. expected: The message refers to the same failed run and carries its reconciliation explanation. negative: false data_needs: Isolated workspace records and caller contexts for both sides of the interaction. bound_to: [] provenance: proposed source: >- services-platform:modules/jobs/tests/integration/lifecycle/job-reconciliation/job-reconciliation.integration.spec.js#settles it failed, saying the job never started; services-platform:modules/tenants/tests/integration/lifecycle/reconciled-job-failure.integration.spec.js#tells the staff member who asked for the tenant that it failed, though no task of the job ever ran; CAP-PFM-OPS-003; WF-PFM-OPS-003 - id: ATS-PFM-OPS-002-10 title: Retain lifecycle failure evidence category: interaction level: api proves: - BR-CAP-PFM-OPS-002-07 exercises: - CAP-PFM-OPS-002 - CAP-PFM-SEC-003 preconditions: A workspace lifecycle run reaches an interrupted execution outcome. steps: Reconcile it and inspect the lifecycle record alongside the job record. expected: Both records identify the failed work without silently reopening its final history. negative: false data_needs: Isolated workspace records and caller contexts for both sides of the interaction. bound_to: [] provenance: proposed source: >- macroservice-libraries:packages/jobs/src/reconciler/job-reconciler.spec.ts#applies it before the settlement, so a consequence that fails leaves the job for the next pass; CAP-PFM-SEC-003; WF-PFM-OPS-003 - id: ATS-PFM-OPS-002-11 title: Defer a transient candidate lookup category: failure level: unit proves: - BR-CAP-PFM-OPS-002-11 preconditions: A stalled candidate’s repository lookup raises a connection error. steps: Run one reconciliation pass with the transient lookup fault. expected: The candidate is deferred without a settlement or an unregistered-kind alert. negative: true data_needs: Run-owned records and controlled clocks or dependency responses named in the preconditions. bound_to: - TST-PFM-OPS-013 provenance: test source: >- macroservice-libraries:packages/jobs/src/reconciler/job-reconciler.spec.ts#defers the candidate to a later pass - id: ATS-PFM-OPS-002-12 title: Follow continuation before deciding the outcome category: interaction level: unit proves: - BR-CAP-PFM-OPS-002-12 - BR-CAP-PFM-OPS-001-12 preconditions: The previous execution succeeded by creating a recorded successor that remains running. steps: 'Reconcile first against the predecessor, then against the ended successor.' expected: The first pass preserves the active job; the later pass uses the successor’s outcome. negative: false data_needs: Run-owned records and controlled clocks or dependency responses named in the preconditions. bound_to: - TST-PFM-OPS-004 provenance: test source: 'macroservice-libraries:packages/jobs/src/engine/job-continuation.spec.ts#the reconciler' exercises: - CAP-PFM-OPS-001 - CAP-PFM-OPS-002 evidence: - >- Pinned capability rules, object invariants, state transitions and workflows are reviewed for testing obligations. - >- Executable bindings refer only to existing suites; no module executable suite runs during this documentation job. coverage: rule: covered transition: covered validation: 'gap: FND-PFM-OPS-054' permission: not-applicable edge: covered failure: covered boundary: covered concurrency: 'gap: FND-PFM-OPS-054' invariant: covered interaction: covered coverage_notes: validation: Invalid input and rejected configuration need dedicated proof. permission: >- This internal operation defines no independent caller permission; its callers and audience checks have separate scenarios. concurrency: >- No controlled overlapping execution proves the capability’s read or write behavior while related state changes. related_capabilities: - CAP-PFM-OPS-003 - CAP-PFM-SEC-003 workflow_interactions: - WF-PFM-OPS-003 coverage_obligations: finding: FND-PFM-OPS-054 uncovered_must_prove: - BR-CAP-PFM-OPS-002-09 object_invariants_requiring_explicit_trace: - INV-DOM-PFM-OPS-001-01 - INV-DOM-PFM-OPS-001-02 - INV-DOM-PFM-OPS-001-03 - INV-DOM-PFM-OPS-001-04 - INV-DOM-PFM-OPS-001-05 - INV-DOM-PFM-OPS-001-06 - INV-DOM-PFM-OPS-001-08 - INV-DOM-PFM-OPS-001-09 - INV-DOM-PFM-OPS-001-10 - INV-DOM-PFM-OPS-001-11 - INV-DOM-PFM-OPS-001-12 related_scenarios: - capabilities: - CAP-PFM-OPS-002 - CAP-PFM-OPS-003 scenario: ATS-PFM-OPS-002-09 - capabilities: - CAP-PFM-OPS-002 - CAP-PFM-SEC-003 scenario: ATS-PFM-OPS-002-10 unbound_scenarios: - ATS-PFM-OPS-002-07 - ATS-PFM-OPS-002-09 - ATS-PFM-OPS-002-10 transition_review: - model: STATE-PFM-OPS-001 transition: 1 from: pending to: running provenance: unknown source: FND-PFM-OPS-054 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-001 transition: 2 from: running to: succeeded provenance: unknown source: FND-PFM-OPS-054 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-001 transition: 3 from: running to: failed provenance: unknown source: FND-PFM-OPS-054 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-001 transition: 4 from: running to: failed provenance: unknown source: FND-PFM-OPS-054 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-001 transition: 5 from: running to: succeeded provenance: unknown source: FND-PFM-OPS-054 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-001 transition: 6 from: pending to: failed provenance: unknown source: FND-PFM-OPS-054 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-001 transition: 7 from: pending to: cancelled provenance: unknown source: FND-PFM-OPS-054 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. - model: STATE-PFM-OPS-001 transition: 8 from: running to: cancelled provenance: unknown source: FND-PFM-OPS-054 note: >- Existing cases may exercise this move, but exhaustive transition-to-scenario trace is not established. permission_review: [] gap_detail: >- Malformed scheduled invocations and competing task-versus-reconciler reports lack complete proof; successful-execution correction retains the previously recorded consequence-ordering defect. workflow_scenarios: WF-PFM-OPS-003: - ATS-PFM-OPS-004-11 --- # Resolve interrupted background work: Capability Test Specification ## Coverage The category map distinguishes authored scenarios from unresolved proof obligations. A bound scenario names an existing executable suite; its recorded result remains unrun. | Rule | Proof status | |---|---| | `BR-CAP-PFM-OPS-002-01` | `ATS-PFM-OPS-002-01` | | `BR-CAP-PFM-OPS-002-02` | `ATS-PFM-OPS-002-02` | | `BR-CAP-PFM-OPS-002-03` | `ATS-PFM-OPS-002-03`, `ATS-PFM-OPS-002-09` | | `BR-CAP-PFM-OPS-002-04` | `ATS-PFM-OPS-002-04` | | `BR-CAP-PFM-OPS-002-05` | `ATS-PFM-OPS-002-05` | | `BR-CAP-PFM-OPS-002-06` | `ATS-PFM-OPS-002-06` | | `BR-CAP-PFM-OPS-002-07` | `ATS-PFM-OPS-002-07`, `ATS-PFM-OPS-002-10` | | `BR-CAP-PFM-OPS-002-08` | `ATS-PFM-OPS-002-08` | | `BR-CAP-PFM-OPS-002-09` | no scenario: `FND-PFM-OPS-054` | | `BR-CAP-PFM-OPS-002-11` | `ATS-PFM-OPS-002-11` | | `BR-CAP-PFM-OPS-002-12` | `ATS-PFM-OPS-002-12` | ## Interactions With Related Capabilities Explain a never-started run to its requester. The message refers to the same failed run and carries its reconciliation explanation. Retain lifecycle failure evidence. Both records identify the failed work without silently reopening its final history. Follow continuation before deciding the outcome. The first pass preserves the active job; the later pass uses the successor’s outcome. ## Evidence and Boundaries Pinned assertion sources support the listed executable bindings. Proposed cases retain the proof required beyond those boundaries. Structured obligations name incomplete object, transition and permission trace; row-level concurrency proof does not establish complete workflow serialization.