--- id: CAP-PFM-OPS-005 title: Inspect background runs within customer reach feature: FEAT-PFM-OPS-01 product_area: platform module: operations revision: 1 status: draft product_intent: confirmed implementation_evidence: observed supersedes: [] source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f intent_sources: - 'services-platform:docs/jobs.md#A tenant''s job runs (2026-10-16) (Andrew, 2026-10-16)' - >- react-console:components/console/nav-config.ts:maintenanceArea (Andrew, 2026-10-16: Maintenance holds only Scheduled Jobs) purpose: Help customer administrators understand background activity within the records they may reach. outcomes: - The administrator can inspect runs within the permitted workspace and customer scope. - Job inspection leaves execution and persisted job state unchanged. concepts: - CON-PFM-OPS-001 actors: - ACT-PFM-001 - ACT-PFM-005 surfaces: - console - api preconditions: - 'The caller holds workspace jobs-read authority, including the console’s equivalent Scheduled Jobs key.' postconditions: - Job reads leave stored job records unchanged. permissions: - key: platform.jobs.read where_checked: api scope: tenant - key: maintenance.scheduled-jobs.view where_checked: console scope: tenant rules: - id: BR-CAP-PFM-OPS-005-01 proved_by: [ATS-PFM-OPS-005-01, TST-PFM-OPS-067] statement: >- Customer job reads require the customer jobs read permission, HQ reads require staff jobs read authority, and every job route performs a read. kind: permission enforced_at: - api must_prove: true provenance: test source: >- services-platform:modules/jobs/tests/e2e/jobs.e2e.spec.js#declares the customer monitor and the tenant runs console, with platform.jobs.read origin: none - id: BR-CAP-PFM-OPS-005-02 proved_by: [ATS-PFM-OPS-005-02, ATS-PFM-OPS-005-10, ATS-PFM-OPS-006-06, TST-PFM-OPS-067] statement: >- The customer monitor restricts jobs to the caller’s customer and workspace reach, returning an inaccessible customer’s job as not found. kind: permission enforced_at: - api - service must_prove: true provenance: test source: >- services-platform:modules/jobs/tests/e2e/jobs.e2e.spec.js#says of another customer's job exactly what it says of an unknown one origin: none - id: BR-CAP-PFM-OPS-005-03 proved_by: [ATS-PFM-OPS-005-03, ATS-PFM-OPS-007-07, TST-PFM-OPS-066] statement: >- The workspace monitor includes all services’ jobs for that workspace, including customer-less snapshot runs excluded from the customer-wide monitor. kind: policy enforced_at: - service must_prove: true provenance: test source: >- services-platform:modules/jobs/tests/e2e/jobs-tenant-runs.e2e.spec.js#answers exactly the tenant's jobs, of every macroservice origin: 'services-platform:docs/jobs.md#A tenant''s job runs (2026-10-16)' - id: BR-CAP-PFM-OPS-005-04 proved_by: [ATS-PFM-OPS-005-04, TST-PFM-OPS-066] statement: >- An unreached workspace is refused, and staff entry through a workspace grant permits that workspace’s runs without granting access to the customer-wide monitor. kind: permission enforced_at: - api must_prove: true provenance: test source: >- services-platform:modules/jobs/tests/e2e/jobs-tenant-runs.e2e.spec.js#is refused a tenant of the same customer the grant does not name origin: 'services-platform:docs/hq/rhythm-hq-plan.md#D1 (rule S1)' - id: BR-CAP-PFM-OPS-005-05 proved_by: [ATS-PFM-OPS-005-05, TST-PFM-OPS-066] statement: >- Portal callers are refused job reads as a context mismatch, and unauthenticated callers cannot read jobs. kind: permission enforced_at: - api must_prove: true provenance: test source: >- services-platform:modules/jobs/tests/e2e/jobs-tenant-runs.e2e.spec.js#refuses a portal caller as a context mismatch origin: none - id: BR-CAP-PFM-OPS-005-06 proved_by: [ATS-PFM-OPS-005-06, TST-PFM-OPS-067] statement: >- Job lists continue from a timestamp-and-identity cursor and reject malformed cursors, invalid statuses and malformed kinds; unknown correctly shaped kinds return an empty result. kind: validation enforced_at: - api must_prove: true provenance: test source: 'services-platform:modules/jobs/tests/e2e/jobs.e2e.spec.js#refuses a cursor it did not issue' origin: none - id: BR-CAP-PFM-OPS-005-07 proved_by: [] statement: >- The kind list reports labels and owning applications for kinds present in scope, and the console requests run counts separately. kind: calculation enforced_at: - service - console must_prove: false provenance: observed source: >- services-platform:modules/jobs/aws/api/jobs.routes.ts:toApiJobKinds; react-console:lib/maintenance/use-job-runs.ts origin: none - id: BR-CAP-PFM-OPS-005-08 proved_by: [ATS-PFM-OPS-005-07, TST-PFM-OPS-067] statement: >- Job snapshots expose summaries, steps, attempts, published definitions and events while omitting execution handles and row versions; event reads can resume after a sequence. kind: policy enforced_at: - api must_prove: true provenance: test source: >- services-platform:modules/jobs/tests/e2e/jobs.e2e.spec.js#never puts the execution handle or the row version on the wire origin: none - id: BR-CAP-PFM-OPS-005-09 proved_by: [ATS-PFM-OPS-005-08, TST-PFM-OPS-055] statement: >- Maintenance contains Scheduled Jobs alone, and missing jobs-read authority suppresses its link and shows Access Denied. kind: permission enforced_at: - console must_prove: true provenance: test source: >- react-console:e2e/mock/maintenance-job-runs.mock.spec.ts#is the console's Access Denied state, and its link is not offered origin: 'react-console:components/console/nav-config.ts:maintenanceArea (Andrew, 2026-10-16)' - id: BR-CAP-PFM-OPS-005-10 proved_by: [] statement: >- Scheduled Jobs presents run type, application, subject, status, timing and requester, labels automatic runs Scheduled, and opens a read-only panel that refreshes active work. kind: policy enforced_at: - console must_prove: false provenance: test source: >- react-console:e2e/mock/maintenance-job-runs.mock.spec.ts#lists the tenant's runs: what each was about, its status, and who started it origin: 'services-platform:docs/jobs.md#A tenant''s job runs (2026-10-16)' scenarios: - id: SC-CAP-PFM-OPS-005-01 given: 'A workspace has snapshot, merge and rebuild runs alongside jobs from another workspace.' when: The administrator requests that workspace’s Scheduled Jobs. then: The workspace’s runs are returned and the snapshot subject includes its month. provenance: inferred source: >- services-platform:modules/jobs/tests/e2e/jobs-tenant-runs.e2e.spec.js#names Platform's snapshot run by its snapshot and month note: >- This illustrative example combines behavior established by the cited test and the capability’s implementation evidence; it is not an independently bound end-to-end proof. - id: SC-CAP-PFM-OPS-005-02 given: A customer user supplies the identity of another customer’s job. when: The user opens that job through the customer monitor. then: The response treats it as an unknown job. provenance: inferred source: >- services-platform:modules/jobs/tests/e2e/jobs.e2e.spec.js#says of another customer's job exactly what it says of an unknown one note: >- This illustrative example combines behavior established by the cited test and the capability’s implementation evidence; it is not an independently bound end-to-end proof. edge_cases: [] constraints: - Workspace-scoped reads use that workspace context so published subjects can resolve its records. depends_on: - CAP-PFM-OPS-001 - CAP-PFM-OPS-007 related: - CAP-PFM-OPS-006 journeys: - JNY-PFM-OPS-001 open_questions: [] evidence: - >- services-platform at ad3f6a6: modules/jobs/aws/api/jobs.routes.ts (the /jobs and /tenant_jobs declarations), jobs.schemas.ts, services/scope/job-read-scope.ts, services/snapshots/job-snapshots.ts, services/persistence/jobs.ts; jobs and jobs-tenant-runs e2e suites; docs/jobs.md §5. - >- react-console at baf6dae: app/(console)/console/[tenantId]/maintenance/**, components/configuration/area-route.tsx (maintenanceAreaRoute), components/maintenance/job-runs-screen.tsx, lib/maintenance/*, components/console/nav-config.ts; e2e/mock/maintenance-job-runs.mock.spec.ts. - >- Operations this capability covers: listJobs, countJobs, listJobKinds, getJob, listJobEvents, listJobsOfTenant, countJobsOfTenant, listJobKindsOfTenant, getJobOfTenant, listJobEventsOfTenant. - >- Examination: proposed acceptance matrices retain candidate test references; incomplete proof is recorded by FND-PFM-OPS-028. controls: [TC-AVL-001, TC-AVL-004, TC-AVL-005, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-IAM-001, TC-IAM-002, TC-IAM-004, TC-IAM-005, TC-IAM-006, TC-LOG-001, TC-LOG-002, TC-LOG-003, TC-LOG-004, TC-LOG-005, TC-MON-001, TC-PI-001, TC-PI-002, TC-PI-003, TC-PI-004, TC-PI-005, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-VEN-001, TC-VEN-002, TC-VEN-003] exercised_by: [FAS-PFM-OPS-01-01, FAS-PFM-OPS-01-04] suites: [TST-PFM-OPS-055, TST-PFM-OPS-066, TST-PFM-OPS-067] --- # Inspect background runs within customer reach ## Purpose Help customer administrators understand background activity within the records they may reach. ## How It Works A customer administrator opens Scheduled Jobs from Maintenance. The page reads the active workspace’s runs, presents readable subjects and supports type and status filtering. Opening a row shows a read-only progress and history panel. Active work refreshes while the panel remains open. The separate customer-wide read follows customer and workspace reach and excludes jobs with no customer attribution. The workspace read includes those runs when their workspace matches. Missing authority produces a refusal rather than a misleading empty list. Staff working through an access grant use the granted workspace’s surface rather than gaining the broader customer monitor. ## Relationships The job record supports reconciliation, notices and both monitors; owning modules retain responsibility for the work itself.