--- id: TST-PFM-SEC-095 title: Reconcile catalog database and service checks kind: integration product_area: platform module: security revision: 2 status: draft source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 repository: services-platform files: - modules/security/tests/integration/services/catalog/reconcile-catalog.integration.spec.js implements: - ATS-PFM-SEC-013-01 - ATS-PFM-SEC-013-04 - ATS-PFM-SEC-013-05 - ATS-PFM-SEC-013-06 - ATS-PFM-SEC-013-10 environment: local implementation_state: implemented latest_result: not-run latest_run_at: null latest_run_ref: null conformance: not-verified estimated_minutes: 3 isolation: Use the prepared test database and suite-owned fixture rows; retain shared seed records. assertion_evidence: - provenance: test source: >- services-platform:modules/security/tests/integration/services/catalog/reconcile-catalog.integration.spec.js#security workflow: reconcileCatalog - provenance: test source: >- services-platform:modules/security/tests/integration/services/catalog/reconcile-catalog.integration.spec.js#reconciling what the running code declares - provenance: test source: >- services-platform:modules/security/tests/integration/services/catalog/reconcile-catalog.integration.spec.js#changes nothing when the catalog is the one already stored, and bumps no version - provenance: test source: >- services-platform:modules/security/tests/integration/services/catalog/reconcile-catalog.integration.spec.js#adds a declared key, puts it in the built-ins its tier belongs to, and records the release - provenance: test source: >- services-platform:modules/security/tests/integration/services/catalog/reconcile-catalog.integration.spec.js#run again with the same catalog changes nothing, which is what a redeploy is - provenance: test source: >- services-platform:modules/security/tests/integration/services/catalog/reconcile-catalog.integration.spec.js#retires a key of its own app the release no longer declares and takes it out of the built-ins - provenance: test source: >- services-platform:modules/security/tests/integration/services/catalog/reconcile-catalog.integration.spec.js#leaves another service's keys and built-ins alone: CRM going live does not undo Platform - provenance: test source: >- services-platform:modules/security/tests/integration/services/catalog/reconcile-catalog.integration.spec.js#changes the tier of a key and moves it between the built-ins accordingly - provenance: test source: >- services-platform:modules/security/tests/integration/services/catalog/reconcile-catalog.integration.spec.js#refuses a release with no identifier, a key defined twice and a malformed key, writing nothing - provenance: test source: >- services-platform:modules/security/tests/integration/services/catalog/reconcile-catalog.integration.spec.js#Portal Member and the Submissions engine's portal keys - provenance: test source: >- services-platform:modules/security/tests/integration/services/catalog/reconcile-catalog.integration.spec.js#carries only its own me keys while no Submissions release is in the catalog - provenance: test source: >- services-platform:modules/security/tests/integration/services/catalog/reconcile-catalog.integration.spec.js#gains the four portal keys when the Submissions release is reconciled, and none of the release's other keys - provenance: test source: >- services-platform:modules/security/tests/integration/services/catalog/reconcile-catalog.integration.spec.js#keeps the portal keys when Platform's own release is reconciled after the Submissions one - provenance: test source: >- services-platform:modules/security/tests/integration/services/catalog/reconcile-catalog.integration.spec.js#loses a portal key the Submissions release stops declaring, keeping the rest - provenance: test source: >- services-platform:modules/security/tests/integration/services/catalog/reconcile-catalog.integration.spec.js#the built-ins a release declares - provenance: test source: >- services-platform:modules/security/tests/integration/services/catalog/reconcile-catalog.integration.spec.js#creates one shared row at version 1 for a newly declared built-in - provenance: test source: >- services-platform:modules/security/tests/integration/services/catalog/reconcile-catalog.integration.spec.js#grants a newly shipped built-in to nobody: no role references it - provenance: test source: >- services-platform:modules/security/tests/integration/services/catalog/reconcile-catalog.integration.spec.js#is one row two customers share, and a rule change reaches both without copying anything - provenance: test source: >- services-platform:modules/security/tests/integration/services/catalog/reconcile-catalog.integration.spec.js#relabels a built-in in place, keeping its key and its rules - provenance: test source: >- services-platform:modules/security/tests/integration/services/catalog/reconcile-catalog.integration.spec.js#renames a key through formerKeys, keeping the row and every reference to it - provenance: test source: >- services-platform:modules/security/tests/integration/services/catalog/reconcile-catalog.integration.spec.js#archives a built-in the release no longer declares and audits the roles still holding it - provenance: test source: >- services-platform:modules/security/tests/integration/services/catalog/reconcile-catalog.integration.spec.js#makes a retired built-in grant nothing while its holder keeps every other grant - provenance: test source: >- services-platform:modules/security/tests/integration/services/catalog/reconcile-catalog.integration.spec.js#brings a built-in back on its own row when a later release ships it again - provenance: test source: >- services-platform:modules/security/tests/integration/services/catalog/reconcile-catalog.integration.spec.js#leaves another app's declared built-in alone when a release says nothing about it - provenance: test source: >- services-platform:modules/security/tests/integration/services/catalog/reconcile-catalog.integration.spec.js#refuses a declaration that allows a key the release does not define, writing nothing - provenance: test source: >- services-platform:modules/security/tests/integration/services/catalog/reconcile-catalog.integration.spec.js#refuses a declaration whose allow is a pattern, writing nothing - provenance: test source: >- services-platform:modules/security/tests/integration/services/catalog/reconcile-catalog.integration.spec.js#refuses a release that declares one key twice, writing nothing - provenance: test source: >- services-platform:modules/security/tests/integration/services/catalog/reconcile-catalog.integration.spec.js#changes nothing on a redeploy of the same declaration - provenance: test source: >- services-platform:modules/security/tests/integration/services/catalog/reconcile-catalog.integration.spec.js#the built-ins the reconciler generates - provenance: test source: >- services-platform:modules/security/tests/integration/services/catalog/reconcile-catalog.integration.spec.js#gives every app three policies by tier, and names them as a person would - provenance: test source: >- services-platform:modules/security/tests/integration/services/catalog/reconcile-catalog.integration.spec.js#never puts a staff-only key in a generated policy - provenance: test source: >- services-platform:modules/security/tests/integration/services/catalog/reconcile-catalog.integration.spec.js#keeps a security key that is a power out of the app tier policies, and lets a security read key in - provenance: test source: >- services-platform:modules/security/tests/integration/services/catalog/reconcile-catalog.integration.spec.js#leaves the self-read key out of every generated policy, because nobody grants it - provenance: test source: >- services-platform:modules/security/tests/integration/services/catalog/reconcile-catalog.integration.spec.js#generates no Security Administrator: it is declared, not derived from a tier - provenance: test source: >- services-platform:modules/security/tests/integration/services/catalog/reconcile-catalog.integration.spec.js#builds the eight roles, with the three staff ones reaching Rhythm HQ and nothing of a customer dependency_evidence: >- The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here. The suite’s own dependency setup determines which external collaborators are controlled; registration alone does not certify them as live. evidence: - >- services-platform:modules/security/tests/integration/services/catalog/reconcile-catalog.integration.spec.js - >- Static review at the recorded source revision; executable results remain not-run and conformance remains not-verified. binding_note: >- Each binding names the scenario to which this file contributes assertions. A binding is not a recorded pass and does not extend the file’s dependency boundary. examiner: codex examined_at: '2026-10-23' final_text: OpenAI dependency_review: provenance: test source: >- services-platform:modules/security/tests/integration/services/catalog/reconcile-catalog.integration.spec.js explicit_no_doubles: false identified_double_boundaries: [] --- # Reconcile catalog database and service checks ## Verification Boundary The file exercises database or service behavior through the local integration harness. The assertion references identify the source checks for reconcile catalog. ## What This Suite Proves The source assertions support the observations named in the bound scenarios. A scenario spanning multiple files must retain the other files’ contributions. ## What It Does Not Prove This examination does not run the suite. Passing behavior, deployed conformance and the behavior of substituted dependencies require separate execution evidence. ## Real Dependencies and Test Doubles The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here. The suite’s own dependency setup determines which external collaborators are controlled; registration alone does not certify them as live. ## Must Not Be Doubled Keep the queried database, applicable constraints and transaction boundaries real. Provider substitutes cannot establish delivery, cloud execution or cross-service recovery.