--- id: ATS-PFM-OPS-009 scope: CAP-PFM-OPS-009 product_area: platform module: operations revision: 2 status: proposed approved_by: null approved_at: null source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 macroservice-libraries: 54536a441935c6e09fdb7f96f0bec71c52ba4e03 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f scenarios: - id: ATS-PFM-OPS-009-01 title: Separate history permission tiers level: unit proves: - BR-CAP-PFM-OPS-009-01 preconditions: Own and colleague-history permission declarations are available. steps: Inspect their tier and sensitivity metadata. expected: Own history is reading authority and colleague history is sensitive administrator authority. negative: true data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - TST-PFM-OPS-064 provenance: test source: >- services-platform:modules/audit/tests/unit/aws/api/audit-permissions.spec.ts#declares reading another user’s audit events at the admin tier, which is what keeps it out of Read Only evidence_candidates: - >- services-platform:modules/audit/tests/unit/aws/api/audit-permissions.spec.ts#declares reading another user’s audit events at the admin tier, which is what keeps it out of Read Only category: permission binding_evidence: - >- services-platform:modules/audit/tests/unit/aws/api/audit-permissions.spec.ts#declares reading another user’s audit events at the admin tier, which is what keeps it out of Read Only - id: ATS-PFM-OPS-009-02 title: Retain visits after record removal level: api proves: - BR-CAP-PFM-OPS-009-02 preconditions: A viewed contact has since been deleted. steps: Read the actor’s raw history. expected: The retained visit does not depend on current record resolution. negative: false data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - TST-PFM-OPS-061 provenance: test source: >- services-platform:modules/audit/tests/integration/services/record-views/view-history.integration.spec.js#still holds the view after the contact is gone, because a trail is not a list of records evidence_candidates: - >- services-platform:modules/audit/tests/integration/services/record-views/view-history.integration.spec.js#still holds the view after the contact is gone, because a trail is not a list of records category: edge binding_evidence: - >- services-platform:modules/audit/tests/integration/services/record-views/view-history.integration.spec.js#still holds the view after the contact is gone, because a trail is not a list of records - id: ATS-PFM-OPS-009-03 title: Bound requested history sizes level: api proves: - BR-CAP-PFM-OPS-009-03 preconditions: The actor has enough visits to fill pages. steps: 'Request default, maximum, excessive and zero page sizes.' expected: Default and maximum work while invalid sizes are refused. negative: true data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - TST-PFM-OPS-061 provenance: test source: >- services-platform:modules/audit/tests/integration/services/record-views/view-history.integration.spec.js#refuses a page larger than the maximum, naming it evidence_candidates: - >- services-platform:modules/audit/tests/integration/services/record-views/view-history.integration.spec.js#refuses a page larger than the maximum, naming it category: boundary binding_evidence: - >- services-platform:modules/audit/tests/integration/services/record-views/view-history.integration.spec.js#refuses a page larger than the maximum, naming it - id: ATS-PFM-OPS-009-04 title: Traverse equal-time events level: api proves: - BR-CAP-PFM-OPS-009-04 - INV-DOM-PFM-OPS-002-07 preconditions: Several visits share a timestamp across a page boundary. steps: Read small successive pages and try malformed continuation. expected: Each visit appears once and malformed continuation fails. negative: true data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - TST-PFM-OPS-059 provenance: test source: >- services-platform:modules/audit/tests/integration/services/persistence/audit-events.queries.integration.spec.js#steps over the tie correctly when a page boundary falls inside it evidence_candidates: - >- services-platform:modules/audit/tests/integration/services/persistence/audit-events.queries.integration.spec.js#steps over the tie correctly when a page boundary falls inside it category: boundary binding_evidence: - >- services-platform:modules/audit/tests/integration/services/persistence/audit-events.queries.integration.spec.js#steps over the tie correctly when a page boundary falls inside it - id: ATS-PFM-OPS-009-05 title: Validate the record-type filter level: api proves: - BR-CAP-PFM-OPS-009-05 preconditions: History contains contact and organization visits. steps: Filter for contacts and then an unsupported type. expected: The supported filter narrows results and the unsupported type is refused. negative: true data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - TST-PFM-OPS-061 provenance: test source: >- services-platform:modules/audit/tests/integration/services/record-views/view-history.integration.spec.js#refuses a record type the registry does not hold, rather than answering an empty page evidence_candidates: - >- services-platform:modules/audit/tests/integration/services/record-views/view-history.integration.spec.js#refuses a record type the registry does not hold, rather than answering an empty page category: validation binding_evidence: - >- services-platform:modules/audit/tests/integration/services/record-views/view-history.integration.spec.js#refuses a record type the registry does not hold, rather than answering an empty page - id: ATS-PFM-OPS-009-06 title: Keep actor and workspace isolation level: api proves: - BR-CAP-PFM-OPS-009-06 preconditions: Two actors have visits in two workspaces. steps: Read one actor within one workspace. expected: Only that actor’s local visits are returned. negative: false data_needs: Controlled records and caller contexts matching this scenario’s preconditions. bound_to: - TST-PFM-OPS-061 provenance: test source: >- services-platform:modules/audit/tests/integration/services/record-views/view-history.integration.spec.js#answers nothing of another tenant’s history evidence_candidates: - >- services-platform:modules/audit/tests/integration/services/record-views/view-history.integration.spec.js#answers nothing of another tenant’s history category: permission binding_evidence: - >- services-platform:modules/audit/tests/integration/services/record-views/view-history.integration.spec.js#answers nothing of another tenant’s history - id: ATS-PFM-OPS-009-07 title: Retain history after its target disappears category: interaction level: api proves: - BR-CAP-PFM-OPS-009-02 - BR-CAP-PFM-OPS-010-03 exercises: - CAP-PFM-OPS-009 - CAP-PFM-OPS-010 preconditions: A person has a stored visit and the target record is subsequently removed. steps: Read that person’s raw history and compare it with currently resolvable recent records. expected: The visit remains in raw history even when the target cannot appear in a current record list. negative: false data_needs: Isolated workspace records and caller contexts for both sides of the interaction. bound_to: [] provenance: proposed source: >- services-platform:modules/audit/tests/integration/services/record-views/view-history.integration.spec.js#still holds the view after the contact is gone, because a trail is not a list of records; services-platform:modules/audit/tests/integration/db/audit-events.table.integration.spec.js#refuses an UPDATE of the event by the application role, so a trail cannot be rewritten; CAP-PFM-OPS-010; evidence: - >- Pinned capability rules, object invariants, state transitions and workflows are reviewed for testing obligations. - >- Executable bindings refer only to existing suites; no module executable suite runs during this documentation job. coverage: rule: 'gap: FND-PFM-OPS-061' transition: not-applicable validation: covered permission: covered edge: covered failure: 'gap: FND-PFM-OPS-061' boundary: covered concurrency: 'gap: FND-PFM-OPS-061' invariant: 'gap: FND-PFM-OPS-061' interaction: covered coverage_notes: rule: No distinct general rule case is categorized here. transition: >- This capability reads records without changing their lifecycle; transitions belong to the writing capabilities. failure: Injected dependency failures need dedicated proof. concurrency: >- No controlled overlapping execution proves the capability’s read or write behavior while related state changes. invariant: The object invariants need explicit proof bindings. related_capabilities: - CAP-PFM-OPS-010 workflow_interactions: [] coverage_obligations: finding: FND-PFM-OPS-061 uncovered_must_prove: [] object_invariants_requiring_explicit_trace: - INV-DOM-PFM-OPS-002-01 - INV-DOM-PFM-OPS-002-02 - INV-DOM-PFM-OPS-002-03 - INV-DOM-PFM-OPS-002-04 - INV-DOM-PFM-OPS-002-05 - INV-DOM-PFM-OPS-002-06 - INV-DOM-PFM-OPS-002-08 - INV-DOM-PFM-OPS-002-09 related_scenarios: - capabilities: - CAP-PFM-OPS-009 - CAP-PFM-OPS-010 scenario: ATS-PFM-OPS-009-07 unbound_scenarios: - ATS-PFM-OPS-009-07 transition_review: [] permission_review: - key: platform.record-views.read where_checked: api provenance: unknown source: FND-PFM-OPS-061 note: >- Scenario-level audience checks do not establish every grant combination at each enforcement surface. - key: platform.audit-events.read where_checked: api provenance: unknown source: FND-PFM-OPS-061 note: >- Scenario-level audience checks do not establish every grant combination at each enforcement surface. gap_detail: >- Excluding non-visit event types, failed history reads and pagination during new visits need complete category proof. workflow_scenarios: {} --- # Review a person’s record-view history: Capability Test Specification ## Coverage The category map distinguishes authored scenarios from unresolved proof obligations. A bound scenario names an existing executable suite; its recorded result remains unrun. | Rule | Proof status | |---|---| | `BR-CAP-PFM-OPS-009-01` | `ATS-PFM-OPS-009-01` | | `BR-CAP-PFM-OPS-009-02` | `ATS-PFM-OPS-009-02`, `ATS-PFM-OPS-009-07` | | `BR-CAP-PFM-OPS-009-03` | `ATS-PFM-OPS-009-03` | | `BR-CAP-PFM-OPS-009-04` | `ATS-PFM-OPS-009-04` | | `BR-CAP-PFM-OPS-009-05` | `ATS-PFM-OPS-009-05` | | `BR-CAP-PFM-OPS-009-06` | `ATS-PFM-OPS-009-06` | ## Interactions With Related Capabilities Retain history after its target disappears. The visit remains in raw history even when the target cannot appear in a current record list. ## Evidence and Boundaries Pinned assertion sources support the listed executable bindings. Proposed cases retain the proof required beyond those boundaries. Structured obligations name incomplete object, transition and permission trace; row-level concurrency proof does not establish complete workflow serialization.