---
id: TST-PFM-SEC-023
title: HQ ops console checks
kind: browser-lifecycle
product_area: platform
module: security
revision: 2
status: draft
source_sha:
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
repository: react-console
files:
  - e2e/mock/hq-ops.mock.spec.ts
implements:
  - ATS-PFM-SEC-002-14
  - ATS-PFM-SEC-003-14
  - ATS-PFM-SEC-016-04
environment: mock
implementation_state: implemented
latest_result: not-run
latest_run_at: null
latest_run_ref: null
conformance: not-verified
estimated_minutes: 10
isolation: The browser context and intercepted responses belong to this run.
assertion_evidence:
  - provenance: test
    source: 'react-console:e2e/mock/hq-ops.mock.spec.ts#a tenant''s page'
  - provenance: test
    source: >-
      react-console:e2e/mock/hq-ops.mock.spec.ts#shows the overview, its sandboxes and the sender's
      DNS records
  - provenance: test
    source: >-
      react-console:e2e/mock/hq-ops.mock.spec.ts#says so when the tenant sends from the shared
      Rhythm sender
  - provenance: test
    source: >-
      react-console:e2e/mock/hq-ops.mock.spec.ts#says sender identities are coming, without an
      error, where Platform does not serve the route yet
  - provenance: test
    source: >-
      react-console:e2e/mock/hq-ops.mock.spec.ts#the edit sheet saves, has no identifier to change,
      and confirms before disabling the tenant
  - provenance: test
    source: 'react-console:e2e/mock/hq-ops.mock.spec.ts#says so when the tenant doesn''t exist'
  - provenance: test
    source: 'react-console:e2e/mock/hq-ops.mock.spec.ts#is opened from the tenants list''s row menu'
  - provenance: test
    source: 'react-console:e2e/mock/hq-ops.mock.spec.ts#provisioning a tenant'
  - provenance: test
    source: 'react-console:e2e/mock/hq-ops.mock.spec.ts#walks every step and lands on the job it started'
  - provenance: test
    source: >-
      react-console:e2e/mock/hq-ops.mock.spec.ts#creates a new customer with a customer ID that
      follows the tenant ID until it is edited
  - provenance: test
    source: >-
      react-console:e2e/mock/hq-ops.mock.spec.ts#puts Platform's refusal of a taken tenant ID on the
      Tenant ID
  - provenance: test
    source: >-
      react-console:e2e/mock/hq-ops.mock.spec.ts#proposes no tenant ID for a sandbox: staff must
      type one
  - provenance: test
    source: >-
      react-console:e2e/mock/hq-ops.mock.spec.ts#opens with the customer already chosen when it
      starts from that customer
  - provenance: test
    source: >-
      react-console:e2e/mock/hq-ops.mock.spec.ts#asks before leaving with answers that were never
      submitted
  - provenance: test
    source: 'react-console:e2e/mock/hq-ops.mock.spec.ts#a job''s page'
  - provenance: test
    source: >-
      react-console:e2e/mock/hq-ops.mock.spec.ts#shows a running job's step, its timeline and its
      event log
  - provenance: test
    source: >-
      react-console:e2e/mock/hq-ops.mock.spec.ts#shows a failed job's reason and retries its
      provisioning
  - provenance: test
    source: >-
      react-console:e2e/mock/hq-ops.mock.spec.ts#says a job that has stopped reporting may be stuck,
      and checks again
  - provenance: test
    source: >-
      react-console:e2e/mock/hq-ops.mock.spec.ts#calls a job that has not started Queued, never
      Cancelled
  - provenance: test
    source: 'react-console:e2e/mock/hq-ops.mock.spec.ts#says so when the job doesn''t exist'
  - provenance: test
    source: 'react-console:e2e/mock/hq-ops.mock.spec.ts#is opened from a row of the jobs list'
  - provenance: test
    source: 'react-console:e2e/mock/hq-ops.mock.spec.ts#Rhythm staff'
  - provenance: test
    source: >-
      react-console:e2e/mock/hq-ops.mock.spec.ts#lists everyone with their role, status and last
      sign-in, and filters by role
  - provenance: test
    source: >-
      react-console:e2e/mock/hq-ops.mock.spec.ts#resends an invitation, suspends and reinstates, and
      names the last administrator
  - provenance: test
    source: >-
      react-console:e2e/mock/hq-ops.mock.spec.ts#revokes access behind a confirmation that names the
      person
  - provenance: test
    source: >-
      react-console:e2e/mock/hq-ops.mock.spec.ts#the invite dialog takes a Rhythm address, a role,
      and offers to resend an invitation already sent
  - provenance: test
    source: >-
      react-console:e2e/mock/hq-ops.mock.spec.ts#a person's page shows V0's details and grants card,
      customer-level grants included, ends an emergency one behind a confirmation, and keeps a
      standing one's End Access disabled
  - provenance: test
    source: >-
      react-console:e2e/mock/hq-ops.mock.spec.ts#staff who can view but not manage staff see the
      grants and no End Access or actions
  - provenance: test
    source: >-
      react-console:e2e/mock/hq-ops.mock.spec.ts#a staff member who does not exist reads as not
      found
  - provenance: test
    source: >-
      react-console:e2e/mock/hq-ops.mock.spec.ts#the roles page lists the HQ roles and their
      permission keys by area
  - provenance: test
    source: >-
      react-console:e2e/mock/hq-ops.mock.spec.ts#the roles page says so and shows the built-in roles
      when GET /hq/roles fails
  - provenance: test
    source: 'react-console:e2e/mock/hq-ops.mock.spec.ts#customers'
  - provenance: test
    source: >-
      react-console:e2e/mock/hq-ops.mock.spec.ts#New Customer creates one with Platform's types and
      opens it
  - provenance: test
    source: 'react-console:e2e/mock/hq-ops.mock.spec.ts#Edit renames a customer from its own page'
  - provenance: test
    source: 'react-console:e2e/mock/hq-ops.mock.spec.ts#refuses a name another customer already uses'
  - provenance: test
    source: >-
      react-console:e2e/mock/hq-ops.mock.spec.ts#entering a tenant covered by a grant over its
      customer
  - provenance: test
    source: >-
      react-console:e2e/mock/hq-ops.mock.spec.ts#switches straight in, with no emergency access
      dialog
dependency_evidence: >-
  The console runs in a browser with fixture data or intercepted responses. Assertions cover the
  displayed refusal, navigation or editing outcome; the substituted response does not establish
  server enforcement.
evidence:
  - 'react-console:e2e/mock/hq-ops.mock.spec.ts'
  - >-
    Static review at the recorded source revision; executable results remain not-run and conformance
    remains not-verified.
binding_note: >-
  Each binding names the scenario to which this file contributes assertions. A binding is not a
  recorded pass and does not extend the file’s dependency boundary.
examiner: codex
examined_at: '2026-10-23'
final_text: OpenAI
---
# HQ ops console checks

## Verification Boundary

The file drives console behavior with controlled data or responses. The assertion references identify the source checks for HQ ops.

## What This Suite Proves

The source assertions support the observations named in the bound scenarios. A scenario spanning multiple files must retain the other files’ contributions.

## What It Does Not Prove

This examination does not run the suite. Passing behavior, deployed conformance and the behavior of substituted dependencies require separate execution evidence.

## Real Dependencies and Test Doubles

The console runs in a browser with fixture data or intercepted responses. Assertions cover the displayed refusal, navigation or editing outcome; the substituted response does not establish server enforcement.

## Must Not Be Doubled

Keep the console code and browser navigation real. A controlled success or refusal must remain distinguishable from enforcement by the actual service.