--- id: ATS-PFM-OPS-005 scope: CAP-PFM-OPS-005 product_area: platform module: operations revision: 2 status: proposed approved_by: null approved_at: null source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f macroservice-libraries: 54536a441935c6e09fdb7f96f0bec71c52ba4e03 scenarios: - id: ATS-PFM-OPS-005-01 title: Declare authorized read routes level: api proves: - BR-CAP-PFM-OPS-005-01 preconditions: The customer and workspace job routes are registered. steps: 'Inspect access, methods and permissions.' expected: The routes require customer jobs-read authority and perform reads. negative: false data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - >- services-platform:modules/jobs/tests/e2e/jobs.e2e.spec.js#declares the customer monitor and the tenant runs console, with platform.jobs.read - TST-PFM-OPS-067 provenance: test source: >- services-platform:modules/jobs/tests/e2e/jobs.e2e.spec.js#declares the customer monitor and the tenant runs console, with platform.jobs.read category: permission binding_evidence: - >- services-platform:modules/jobs/tests/e2e/jobs.e2e.spec.js#declares the customer monitor and the tenant runs console, with platform.jobs.read - id: ATS-PFM-OPS-005-02 title: Hide a different customer’s job level: api proves: - BR-CAP-PFM-OPS-005-02 preconditions: Two customers have job records. steps: List and open the other customer’s job through the customer monitor. expected: The foreign job is absent and its direct read matches an unknown-job response. negative: true data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - TST-PFM-OPS-067 provenance: test source: >- services-platform:modules/jobs/tests/e2e/jobs.e2e.spec.js#says of another customer's job exactly what it says of an unknown one evidence_candidates: - >- services-platform:modules/jobs/tests/e2e/jobs.e2e.spec.js#says of another customer's job exactly what it says of an unknown one category: boundary binding_evidence: - >- services-platform:modules/jobs/tests/e2e/jobs.e2e.spec.js#says of another customer's job exactly what it says of an unknown one - id: ATS-PFM-OPS-005-03 title: Include workspace runs without customer attribution level: api proves: - BR-CAP-PFM-OPS-005-03 preconditions: The workspace has multiple services’ runs including a snapshot with no customer. steps: Read workspace runs and the customer-wide monitor. expected: The workspace read includes the snapshot while the customer-wide read excludes it. negative: false data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - TST-PFM-OPS-066 provenance: test source: >- services-platform:modules/jobs/tests/e2e/jobs-tenant-runs.e2e.spec.js#answers exactly the tenant's jobs, of every macroservice evidence_candidates: - >- services-platform:modules/jobs/tests/e2e/jobs-tenant-runs.e2e.spec.js#answers exactly the tenant's jobs, of every macroservice category: rule binding_evidence: - >- services-platform:modules/jobs/tests/e2e/jobs-tenant-runs.e2e.spec.js#answers exactly the tenant's jobs, of every macroservice - id: ATS-PFM-OPS-005-04 title: Keep staff entry within its grant level: api proves: - BR-CAP-PFM-OPS-005-04 preconditions: Staff hold a grant into only one workspace and another caller belongs elsewhere. steps: Read the granted and ungranted workspace runs and customer monitor. expected: The allowed workspace is readable and the other requested surfaces are refused. negative: true data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - TST-PFM-OPS-066 provenance: test source: >- services-platform:modules/jobs/tests/e2e/jobs-tenant-runs.e2e.spec.js#is refused a tenant of the same customer the grant does not name evidence_candidates: - >- services-platform:modules/jobs/tests/e2e/jobs-tenant-runs.e2e.spec.js#is refused a tenant of the same customer the grant does not name category: permission binding_evidence: - >- services-platform:modules/jobs/tests/e2e/jobs-tenant-runs.e2e.spec.js#is refused a tenant of the same customer the grant does not name - id: ATS-PFM-OPS-005-05 title: Refuse portal and anonymous inspection level: api proves: - BR-CAP-PFM-OPS-005-05 preconditions: A portal caller and an unauthenticated caller are available. steps: Request workspace runs. expected: Portal context is refused and anonymous access receives an authentication refusal. negative: true data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - TST-PFM-OPS-066 provenance: test source: >- services-platform:modules/jobs/tests/e2e/jobs-tenant-runs.e2e.spec.js#refuses a portal caller as a context mismatch evidence_candidates: - >- services-platform:modules/jobs/tests/e2e/jobs-tenant-runs.e2e.spec.js#refuses a portal caller as a context mismatch category: permission binding_evidence: - >- services-platform:modules/jobs/tests/e2e/jobs-tenant-runs.e2e.spec.js#refuses a portal caller as a context mismatch - id: ATS-PFM-OPS-005-06 title: Validate list continuation and filters level: api proves: - BR-CAP-PFM-OPS-005-06 preconditions: Several runs support a paged list. steps: 'Page once and supply malformed cursor, status and kind values plus a well-formed unknown kind.' expected: 'Valid continuation works, malformed values fail and the unknown kind returns no rows.' negative: true data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - TST-PFM-OPS-067 provenance: test source: 'services-platform:modules/jobs/tests/e2e/jobs.e2e.spec.js#refuses a cursor it did not issue' evidence_candidates: - 'services-platform:modules/jobs/tests/e2e/jobs.e2e.spec.js#refuses a cursor it did not issue' category: validation binding_evidence: - 'services-platform:modules/jobs/tests/e2e/jobs.e2e.spec.js#refuses a cursor it did not issue' - id: ATS-PFM-OPS-005-07 title: Omit private execution references level: api proves: - BR-CAP-PFM-OPS-005-08 - INV-DOM-PFM-OPS-001-12 preconditions: A settled job has a step catalog and events. steps: Read its snapshot and subsequent history. expected: >- Public detail omits execution handle and row version while later events follow the supplied sequence. negative: false data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - TST-PFM-OPS-067 provenance: test source: >- services-platform:modules/jobs/tests/e2e/jobs.e2e.spec.js#never puts the execution handle or the row version on the wire evidence_candidates: - >- services-platform:modules/jobs/tests/e2e/jobs.e2e.spec.js#never puts the execution handle or the row version on the wire category: invariant binding_evidence: - >- services-platform:modules/jobs/tests/e2e/jobs.e2e.spec.js#never puts the execution handle or the row version on the wire - id: ATS-PFM-OPS-005-08 title: Enforce the Maintenance entry permission level: browser proves: - BR-CAP-PFM-OPS-005-09 preconditions: A reader has jobs authority and another does not. steps: Open Maintenance with both accounts. expected: Only the authorized account reaches Scheduled Jobs; the other sees Access Denied without its link. negative: true data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - TST-PFM-OPS-055 provenance: test source: >- react-console:e2e/mock/maintenance-job-runs.mock.spec.ts#is the console's Access Denied state, and its link is not offered evidence_candidates: - >- react-console:e2e/mock/maintenance-job-runs.mock.spec.ts#is the console's Access Denied state, and its link is not offered category: permission binding_evidence: - >- react-console:e2e/mock/maintenance-job-runs.mock.spec.ts#is the console's Access Denied state, and its link is not offered - id: ATS-PFM-OPS-005-09 title: Inspect the active workspace without job controls level: browser proves: - AS-JNY-PFM-OPS-001-01 - AS-JNY-PFM-OPS-001-02 - AS-JNY-PFM-OPS-001-03 preconditions: The workspace has several services’ runs including a monthly snapshot. steps: Open Scheduled Jobs and inspect a row. expected: Workspace scope and month-specific subject are preserved and the panel has no start or stop action. negative: false data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - >- react-console:e2e/mock/maintenance-job-runs.mock.spec.ts#lists the tenant's runs: what each was about, its status, and who started it - >- services-platform:modules/jobs/tests/e2e/jobs-tenant-runs.e2e.spec.js#refuses another customer's tenant, as every tenant route does - 'services-platform:modules/jobs/tests/e2e/jobs.e2e.spec.js#declares every jobs route a GET' - >- services-platform:modules/jobs/tests/e2e/jobs-tenant-runs.e2e.spec.js#names Platform's snapshot run by its snapshot and month - >- react-console:e2e/mock/maintenance-job-runs.mock.spec.ts#a row opens the run, read-only, in a drawer on the right - TST-PFM-OPS-055 - TST-PFM-OPS-066 - TST-PFM-OPS-067 provenance: test source: >- react-console:e2e/mock/maintenance-job-runs.mock.spec.ts#lists the tenant's runs: what each was about, its status, and who started it category: interaction binding_evidence: - >- react-console:e2e/mock/maintenance-job-runs.mock.spec.ts#lists the tenant's runs: what each was about, its status, and who started it - >- services-platform:modules/jobs/tests/e2e/jobs-tenant-runs.e2e.spec.js#refuses another customer's tenant, as every tenant route does - 'services-platform:modules/jobs/tests/e2e/jobs.e2e.spec.js#declares every jobs route a GET' - >- services-platform:modules/jobs/tests/e2e/jobs-tenant-runs.e2e.spec.js#names Platform's snapshot run by its snapshot and month - >- react-console:e2e/mock/maintenance-job-runs.mock.spec.ts#a row opens the run, read-only, in a drawer on the right - id: ATS-PFM-OPS-005-10 title: Compare customer and staff views of one run category: interaction level: api proves: - BR-CAP-PFM-OPS-005-02 - BR-CAP-PFM-OPS-006-04 exercises: - CAP-PFM-OPS-005 - CAP-PFM-OPS-006 preconditions: A customer run has a requester and a workspace subject. steps: Read it through the authorized customer monitor and through HQ. expected: Both audiences see the same run outcome; only the staff view includes staff enrichment. negative: false data_needs: Isolated workspace records and caller contexts for both sides of the interaction. bound_to: [] provenance: proposed source: >- services-platform:modules/jobs/tests/e2e/jobs.e2e.spec.js#says of another customer's job exactly what it says of an unknown one; services-platform:modules/jobs/tests/e2e/jobs.e2e.spec.js#carries neither on the customer's own snapshot, which has nothing to say; CAP-PFM-OPS-006; WF-PFM-OPS-007 evidence: - >- Pinned capability rules, object invariants, state transitions and workflows are reviewed for testing obligations. - >- Executable bindings refer only to existing suites; no module executable suite runs during this documentation job. coverage: rule: covered transition: not-applicable validation: covered permission: covered edge: 'gap: FND-PFM-OPS-057' failure: 'gap: FND-PFM-OPS-057' boundary: covered concurrency: 'gap: FND-PFM-OPS-057' invariant: covered interaction: covered coverage_notes: transition: >- This capability reads records without changing their lifecycle; transitions belong to the writing capabilities. edge: 'Empty, missing and unusual inputs need dedicated proof.' failure: Injected dependency failures need dedicated proof. concurrency: >- No controlled overlapping execution proves the capability’s read or write behavior while related state changes. related_capabilities: - CAP-PFM-OPS-006 workflow_interactions: - WF-PFM-OPS-007 coverage_obligations: finding: FND-PFM-OPS-057 uncovered_must_prove: [] object_invariants_requiring_explicit_trace: - INV-DOM-PFM-OPS-001-01 - INV-DOM-PFM-OPS-001-02 - INV-DOM-PFM-OPS-001-03 - INV-DOM-PFM-OPS-001-04 - INV-DOM-PFM-OPS-001-05 - INV-DOM-PFM-OPS-001-06 - INV-DOM-PFM-OPS-001-07 - INV-DOM-PFM-OPS-001-08 - INV-DOM-PFM-OPS-001-09 - INV-DOM-PFM-OPS-001-10 - INV-DOM-PFM-OPS-001-11 related_scenarios: - capabilities: - CAP-PFM-OPS-005 - CAP-PFM-OPS-006 scenario: ATS-PFM-OPS-005-10 unbound_scenarios: - ATS-PFM-OPS-005-10 transition_review: [] permission_review: - key: platform.jobs.read where_checked: api provenance: unknown source: FND-PFM-OPS-057 note: >- Scenario-level audience checks do not establish every grant combination at each enforcement surface. - key: maintenance.scheduled-jobs.view where_checked: console provenance: unknown source: FND-PFM-OPS-057 note: >- Scenario-level audience checks do not establish every grant combination at each enforcement surface. gap_detail: >- Empty or removed run targets, failed monitor reads and paging while job activity changes need dedicated scenario proof. workflow_scenarios: WF-PFM-OPS-007: - ATS-PFM-OPS-005-10 - ATS-PFM-OPS-007-07 --- # Inspect background runs within customer reach: Capability Test Specification ## Coverage The category map distinguishes authored scenarios from unresolved proof obligations. A bound scenario names an existing executable suite; its recorded result remains unrun. | Rule | Proof status | |---|---| | `BR-CAP-PFM-OPS-005-01` | `ATS-PFM-OPS-005-01` | | `BR-CAP-PFM-OPS-005-02` | `ATS-PFM-OPS-005-02`, `ATS-PFM-OPS-005-10` | | `BR-CAP-PFM-OPS-005-03` | `ATS-PFM-OPS-005-03` | | `BR-CAP-PFM-OPS-005-04` | `ATS-PFM-OPS-005-04` | | `BR-CAP-PFM-OPS-005-05` | `ATS-PFM-OPS-005-05` | | `BR-CAP-PFM-OPS-005-06` | `ATS-PFM-OPS-005-06` | | `BR-CAP-PFM-OPS-005-08` | `ATS-PFM-OPS-005-07` | | `BR-CAP-PFM-OPS-005-09` | `ATS-PFM-OPS-005-08` | ## Interactions With Related Capabilities Inspect the active workspace without job controls. Workspace scope and month-specific subject are preserved and the panel has no start or stop action. Compare customer and staff views of one run. Both audiences see the same run outcome; only the staff view includes staff enrichment. ## Evidence and Boundaries Pinned assertion sources support the listed executable bindings. Proposed cases retain the proof required beyond those boundaries. Structured obligations name incomplete object, transition and permission trace; row-level concurrency proof does not establish complete workflow serialization.