--- id: TST-PFM-SEC-157 title: Policies database and service checks kind: integration product_area: platform module: security revision: 2 status: draft source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 repository: services-platform files: - modules/security/tests/integration/services/persistence/policies.integration.spec.js implements: [] environment: local implementation_state: implemented latest_result: not-run latest_run_at: null latest_run_ref: null conformance: not-verified estimated_minutes: 3 isolation: Use the prepared test database and suite-owned fixture rows; retain shared seed records. assertion_evidence: - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/policies.integration.spec.js#security persistence: security_policies - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/policies.integration.spec.js#createPolicy - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/policies.integration.spec.js#records a customer's own policy with its owner, its app and its description - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/policies.integration.spec.js#records Rhythm's own product policy under the reconciler's stable key, owned by nobody - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/policies.integration.spec.js#trims the name and refuses an empty one, writing nothing - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/policies.integration.spec.js#refuses a product policy that names a customer and a custom policy that names none - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/policies.integration.spec.js#refuses a name the same owner already uses, in any case, and allows another owner the same name - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/policies.integration.spec.js#refuses a customer's policy under a built-in's name, in any case, writing nothing - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/policies.integration.spec.js#refuses a second policy under the same product key and a customer that does not exist - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/policies.integration.spec.js#the reads - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/policies.integration.spec.js#reads a policy by id and a built-in by its product key, and nothing for either when absent - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/policies.integration.spec.js#lists a customer its own policies and Rhythm's, and never another customer's - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/policies.integration.spec.js#leaves archived policies out unless they are asked for, and answers in name order - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/policies.integration.spec.js#updatePolicy and bumpPolicyVersion - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/policies.integration.spec.js#renames and re-describes a policy, bumping its version, and trims the new name - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/policies.integration.spec.js#refuses a rename onto a name the owner already uses, and a policy that is not there - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/policies.integration.spec.js#refuses renaming a customer's policy onto a built-in's name, leaving it unchanged - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/policies.integration.spec.js#bumps the version when the rules changed, which is what makes a version number mean something - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/policies.integration.spec.js#archivePolicy - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/policies.integration.spec.js#archives an active policy and keeps the row, because assignments and explanations refer to it - provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/policies.integration.spec.js#answers nothing for a policy already archived and one that is not there dependency_evidence: >- The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here. The suite’s own dependency setup determines which external collaborators are controlled; registration alone does not certify them as live. evidence: - >- services-platform:modules/security/tests/integration/services/persistence/policies.integration.spec.js - >- Static review at the recorded source revision; executable results remain not-run and conformance remains not-verified. binding_note: >- The file has no scenario binding established by this examination. Its executable checks remain registered without assigning them broader acceptance coverage. examiner: codex examined_at: '2026-10-23' final_text: OpenAI dependency_review: provenance: test source: >- services-platform:modules/security/tests/integration/services/persistence/policies.integration.spec.js explicit_no_doubles: false identified_double_boundaries: [] --- # Policies database and service checks ## Verification Boundary The file exercises database or service behavior through the local integration harness. The assertion references identify the source checks for policies. ## What This Suite Proves The file supplies executable engineering checks for the named subject. No complete acceptance scenario is inferred from the file’s existence. ## What It Does Not Prove This examination does not run the suite. Passing behavior, deployed conformance and the behavior of substituted dependencies require separate execution evidence. ## Real Dependencies and Test Doubles The prepared PostgreSQL database supplies the persisted fixtures and constraints exercised here. The suite’s own dependency setup determines which external collaborators are controlled; registration alone does not certify them as live. ## Must Not Be Doubled Keep the queried database, applicable constraints and transaction boundaries real. Provider substitutes cannot establish delivery, cloud execution or cross-service recovery.