---
id: ATS-PFM-OPS-006
scope: CAP-PFM-OPS-006
product_area: platform
module: operations
revision: 2
status: proposed
approved_by: null
approved_at: null
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
  macroservice-libraries: 54536a441935c6e09fdb7f96f0bec71c52ba4e03
scenarios:
  - id: ATS-PFM-OPS-006-01
    title: Keep the HQ monitor staff-only
    level: api
    proves:
      - BR-CAP-PFM-OPS-006-01
    preconditions: HQ staff and a customer administrator know customer job identities.
    steps: Request HQ snapshots through both contexts.
    expected: Authorized staff can read across customers while customer context is refused.
    negative: true
    data_needs: Controlled records and caller contexts matching this scenario’s preconditions.
    bound_to:
      - TST-PFM-OPS-067
    provenance: test
    source: >-
      services-platform:modules/jobs/tests/e2e/jobs.e2e.spec.js#refuses a console caller of the job’s own
      customer the HQ route as 403
    evidence_candidates:
      - >-
        services-platform:modules/jobs/tests/e2e/jobs.e2e.spec.js#refuses a console caller of the job’s
        own customer the HQ route as 403
    category: permission
    binding_evidence:
      - >-
        services-platform:modules/jobs/tests/e2e/jobs.e2e.spec.js#refuses a console caller of the job’s
        own customer the HQ route as 403
  - id: ATS-PFM-OPS-006-02
    title: Resolve subjects without requiring related records
    level: api
    proves:
      - BR-CAP-PFM-OPS-006-03
    preconditions: 'Jobs name workspace, customer, no subject and a deleted workspace.'
    steps: Resolve their subjects and requesters.
    expected: Workspace takes precedence over customer and unavailable names remain null without losing the job.
    negative: false
    data_needs: Controlled records and caller contexts matching this scenario’s preconditions.
    bound_to:
      - TST-PFM-OPS-075
    provenance: test
    source: >-
      services-platform:modules/jobs/tests/integration/services/subjects/job-subject.integration.spec.js#names
      the subject null, and still answers it, for a tenant that no longer reads
    evidence_candidates:
      - >-
        services-platform:modules/jobs/tests/integration/services/subjects/job-subject.integration.spec.js#names
        the subject null, and still answers it, for a tenant that no longer reads
    category: edge
    binding_evidence:
      - >-
        services-platform:modules/jobs/tests/integration/services/subjects/job-subject.integration.spec.js#names
        the subject null, and still answers it, for a tenant that no longer reads
  - id: ATS-PFM-OPS-006-03
    title: Present queued and missing jobs correctly
    level: browser
    proves:
      - BR-CAP-PFM-OPS-006-07
    preconditions: One job has not started and another identity is unknown.
    steps: Open their HQ detail pages.
    expected: The first is Queued and the second displays Job Not Found.
    negative: false
    data_needs: Controlled records and caller contexts matching this scenario’s preconditions.
    bound_to:
      - TST-PFM-OPS-054
    provenance: test
    source: 'react-console:e2e/mock/hq-ops.mock.spec.ts#calls a job that has not started Queued, never Cancelled'
    evidence_candidates:
      - >-
        react-console:e2e/mock/hq-ops.mock.spec.ts#calls a job that has not started Queued, never
        Cancelled
    category: rule
    binding_evidence:
      - >-
        react-console:e2e/mock/hq-ops.mock.spec.ts#calls a job that has not started Queued, never
        Cancelled
  - id: ATS-PFM-OPS-006-04
    title: Warn about silent work
    level: browser
    proves:
      - BR-CAP-PFM-OPS-006-08
    preconditions: A running job exceeds the inactivity threshold.
    steps: Open its HQ detail page.
    expected: The intended warning provides a Check Again action.
    negative: false
    data_needs: Controlled records and caller contexts matching this scenario’s preconditions.
    bound_to: []
    provenance: proposed
    source: FND-PFM-OPS-003
    category: failure
  - id: ATS-PFM-OPS-006-05
    title: Confirm recovery from the inspected failure
    category: interaction
    level: api
    proves:
      - BR-CAP-PFM-OPS-004-08
      - BR-CAP-PFM-OPS-006-06
    exercises:
      - CAP-PFM-OPS-006
      - CAP-PFM-OPS-004
    preconditions: Staff can inspect a failed provisioning run and hold both required action permissions.
    steps: 'Open the failure, confirm retry, and inspect the successor.'
    expected: The page follows the newly started attempt while the earlier failure remains inspectable.
    negative: false
    data_needs: Isolated workspace records and caller contexts for both sides of the interaction.
    bound_to: []
    provenance: proposed
    source: >-
      react-console:e2e/mock/hq-ops.mock.spec.ts#shows a failed job's reason and retries its
      provisioning; react-console:e2e/mock/hq-ops.mock.spec.ts#shows a running job's step, its timeline
      and its event log; CAP-PFM-OPS-004; WF-PFM-OPS-005; WF-PFM-OPS-007
  - id: ATS-PFM-OPS-006-06
    title: Compare customer and staff views of one run
    category: interaction
    level: api
    proves:
      - BR-CAP-PFM-OPS-005-02
      - BR-CAP-PFM-OPS-006-04
    exercises:
      - CAP-PFM-OPS-006
      - CAP-PFM-OPS-005
    preconditions: A customer run has a requester and a workspace subject.
    steps: Read it through the authorized customer monitor and through HQ.
    expected: Both audiences see the same run outcome; only the staff view includes staff enrichment.
    negative: false
    data_needs: Isolated workspace records and caller contexts for both sides of the interaction.
    bound_to: []
    provenance: proposed
    source: >-
      services-platform:modules/jobs/tests/e2e/jobs.e2e.spec.js#says of another customer's job exactly
      what it says of an unknown one; services-platform:modules/jobs/tests/e2e/jobs.e2e.spec.js#carries
      neither on the customer's own snapshot, which has nothing to say; CAP-PFM-OPS-005; WF-PFM-OPS-005;
      WF-PFM-OPS-007
evidence:
  - >-
    Pinned capability rules, object invariants, state transitions and workflows are reviewed for testing
    obligations.
  - >-
    Executable bindings refer only to existing suites; no module executable suite runs during this
    documentation job.
coverage:
  rule: covered
  transition: not-applicable
  validation: 'gap: FND-PFM-OPS-058'
  permission: covered
  edge: covered
  failure: 'gap: FND-PFM-OPS-003'
  boundary: 'gap: FND-PFM-OPS-058'
  concurrency: 'gap: FND-PFM-OPS-058'
  invariant: 'gap: FND-PFM-OPS-058'
  interaction: covered
coverage_notes:
  transition: >-
    This capability reads records without changing their lifecycle; transitions belong to the writing
    capabilities.
  validation: Invalid input and rejected configuration need dedicated proof.
  boundary: Exact limits and cross-scope boundaries need dedicated proof.
  concurrency: >-
    No controlled overlapping execution proves the capability’s read or write behavior while related
    state changes.
  invariant: The object invariants need explicit proof bindings.
related_capabilities:
  - CAP-PFM-OPS-004
  - CAP-PFM-OPS-005
workflow_interactions:
  - WF-PFM-OPS-005
  - WF-PFM-OPS-007
coverage_obligations:
  finding: FND-PFM-OPS-058
  uncovered_must_prove: []
  object_invariants_requiring_explicit_trace:
    - INV-DOM-PFM-OPS-001-01
    - INV-DOM-PFM-OPS-001-02
    - INV-DOM-PFM-OPS-001-03
    - INV-DOM-PFM-OPS-001-04
    - INV-DOM-PFM-OPS-001-05
    - INV-DOM-PFM-OPS-001-06
    - INV-DOM-PFM-OPS-001-07
    - INV-DOM-PFM-OPS-001-08
    - INV-DOM-PFM-OPS-001-09
    - INV-DOM-PFM-OPS-001-10
    - INV-DOM-PFM-OPS-001-11
    - INV-DOM-PFM-OPS-001-12
  related_scenarios:
    - capabilities:
        - CAP-PFM-OPS-006
        - CAP-PFM-OPS-004
      scenario: ATS-PFM-OPS-006-05
    - capabilities:
        - CAP-PFM-OPS-006
        - CAP-PFM-OPS-005
      scenario: ATS-PFM-OPS-006-06
  unbound_scenarios:
    - ATS-PFM-OPS-006-04
    - ATS-PFM-OPS-006-05
    - ATS-PFM-OPS-006-06
  transition_review: []
  permission_review:
    - key: hq.jobs.read
      where_checked: api
      provenance: unknown
      source: FND-PFM-OPS-058
      note: >-
        Scenario-level audience checks do not establish every grant combination at each enforcement
        surface.
  gap_detail: >-
    Invalid staff list filters, polling boundaries, response privacy and overlapping refresh need
    complete proof; the real stalled-work flag remains absent.
workflow_scenarios:
  WF-PFM-OPS-005:
    - ATS-PFM-OPS-004-06
  WF-PFM-OPS-007:
    - ATS-PFM-OPS-005-10
    - ATS-PFM-OPS-007-07
---

# Investigate platform jobs in Rhythm HQ: Capability Test Specification

## Coverage

The category map distinguishes authored scenarios from unresolved proof obligations. A bound scenario names an existing executable suite; its recorded result remains unrun.

| Rule | Proof status |
|---|---|
| `BR-CAP-PFM-OPS-006-01` | `ATS-PFM-OPS-006-01` |
| `BR-CAP-PFM-OPS-006-03` | `ATS-PFM-OPS-006-02` |
| `BR-CAP-PFM-OPS-006-07` | `ATS-PFM-OPS-006-03` |
| `BR-CAP-PFM-OPS-006-08` | `ATS-PFM-OPS-006-04` |

## Interactions With Related Capabilities

Confirm recovery from the inspected failure. The page follows the newly started attempt while the earlier failure remains inspectable.

Compare customer and staff views of one run. Both audiences see the same run outcome; only the staff view includes staff enrichment.

## Evidence and Boundaries

Pinned assertion sources support the listed executable bindings. Proposed cases retain the proof required beyond those boundaries. Structured obligations name incomplete object, transition and permission trace; row-level concurrency proof does not establish complete workflow serialization.