---
id: TST-PFM-SEC-200
title: Catalog plan unit checks
kind: unit
product_area: platform
module: security
revision: 2
status: draft
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
repository: services-platform
files:
  - modules/security/tests/unit/services/catalog/catalog-plan.spec.ts
implements:
  - ATS-PFM-SEC-013-04
  - ATS-PFM-SEC-013-10
environment: mock
implementation_state: implemented
latest_result: not-run
latest_run_at: null
latest_run_ref: null
conformance: not-verified
estimated_minutes: 1
isolation: The suite owns its input fixtures and installed doubles.
assertion_evidence:
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#the
      catalog reconciler’s decisions
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#the apps a
      release speaks for
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#names each
      app of the release once, so a release of many keys asks about few apps
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#names no
      app for a release that declares no key, so such a release retires nothing
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#reconciles
      the declarations of the apps the release speaks for
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#leaves
      another service’s declarations alone, so one deploy never retires another’s built-ins
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#reconciles
      no declaration at all for a release that speaks for no app
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#checking a
      release’s keys before any of them are written
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#accepts a
      catalog of distinct, well-formed keys
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#accepts a
      release that declares no key, which has nothing wrong with it to find
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#refuses a
      key defined twice, naming the key so the release is fixed rather than hunted for
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#refuses a
      key that is not <app>.<resource>.<action>, before a row carries it
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#refuses by
      the error class the API answers a bad request with
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#checking a
      release’s declared built-ins against its own catalog
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#accepts a
      declaration whose allows are keys this release defines
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#accepts a
      release that declares no built-in
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#refuses an
      allow on a key this release does not define, which would grant nothing and be found by nobody
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#refuses
      the same key declared twice, because two entries would produce one row
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#refuses a
      declaration taking a key the tier generator owns
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#answers
      every problem of the release at once, rather than the first one it met
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#what one
      built-in policy needs: a built-in nobody has stored yet
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#creates
      the row and writes the rules it is created with
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#publishes
      it at version 1, because what a policy is created with is not a change to it
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#renames
      nothing, even when the declaration carries former keys that found no row
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#what one
      built-in policy needs: a row that already says exactly this
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#does
      nothing at all, which is what every deploy that changed nothing must do
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#reads a
      rule’s keys as a set, so a catalog written in another order is not a new version
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#reads a
      missing stored description as an empty one, so a built-in that declares none is not relabelled
      forever
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#compares
      the conditions as written, so a rule carrying the same condition is unchanged
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#what one
      built-in policy needs: a row whose rules have moved
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#rewrites
      the rules and bumps the version when the release adds a key to the tier
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#records a
      rewrite that only drops a key as narrowing, so the audit does not read as a widening
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#reads rule
      ORDER as part of what a policy says, because a deny read before an allow is a different policy
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#rewrites a
      rule that gained a condition, though it names the same keys
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#rewrites a
      row that lost a rule the code still ships
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#what one
      built-in policy needs: a row stored under a former key
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#rewrites
      product_key on the row every role already references, naming what it was
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#reports a
      rename alone as a change, so the release says the built-in moved
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#creates
      nothing for a renamed row: the policy keeps the one row and all its references
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#what one
      built-in policy needs: a row the release brings back or renames in words
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#restores
      an archived row rather than writing a second one under the same key
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#relabels a
      row whose display name changed, leaving its rules and its key alone
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#relabels a
      row whose description changed, because the version is what an explanation cites
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#relabels a
      row stored with no description when the code now ships one
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#plans
      every move at once for a row renamed, restored, relabelled and regenerated by one release
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#retiring
      the built-ins a release no longer produces
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#retires a
      built-in of this release’s apps that no current entry produces
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#retires
      nothing when the release still produces every built-in it finds
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#never
      touches a policy with no product key, which is a customer’s own and not a built-in
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#retires
      every built-in of the apps considered when the release produces none of them
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#keeping
      another service’s declared built-ins visible
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#keeps a
      declared built-in of an app this release does not speak for
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#keeps
      nothing this release already produced, which is in the map under its own key
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#keeps no
      generated tier policy, which is regenerated from every app’s active keys above
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#keeps
      nothing of this release’s own apps, so a built-in just retired does not come back
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#keeps no
      policy without a product key, which belongs to a customer rather than to a release
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#what one
      built-in role needs
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#creates a
      role nothing answers to, with the policies and inline keys it is published with
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#does
      nothing to a role already carrying exactly these policies and these inline keys
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#reads the
      policy list as a set, so a list returned in another order is not a new version
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#reads a
      role declaring no inline permission as naming none, rather than as a change every deploy
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#rewrites a
      role that gained a policy, and records it as widening
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#rewrites a
      role that lost a policy without recording it as widening
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#rewrites
      the Rhythm Administrator role when its one inline allow is not the one stored
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#records an
      inline key the role did not hold as widening
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#a
      declaration in the shape reconciliation works in
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#sorts each
      rule’s permissions, so a declaration rewritten in another order is not a new version
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#carries
      the declaration’s conditions through unchanged
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#leaves the
      conditions key off a rule that has none, so a condition-less rule compares equal to a stored
      one
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#reads a
      declaration with no former keys as having none, so the row is only ever looked up by its own
      key
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#carries a
      declaration’s former keys, which is what the reconciler finds a renamed row by
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts#takes the
      product key from the declaration’s key, never from its display name
dependency_evidence: >-
  The production function, schema or declaration runs over literal inputs. The source declares no
  substituted collaborator; this is an in-process decision or mapping check.
evidence:
  - 'services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts'
  - >-
    Static review at the recorded source revision; executable results remain not-run and conformance
    remains not-verified.
binding_note: >-
  Each binding names the scenario to which this file contributes assertions. A binding is not a
  recorded pass and does not extend the file’s dependency boundary.
examiner: codex
examined_at: '2026-10-23'
final_text: OpenAI
dependency_review:
  provenance: test
  source: 'services-platform:modules/security/tests/unit/services/catalog/catalog-plan.spec.ts'
  explicit_no_doubles: true
  identified_double_boundaries: []
---
# Catalog plan unit checks

## Verification Boundary

The file evaluates production helpers with controlled inputs in-process. The assertion references identify the source checks for catalog plan.

## What This Suite Proves

The source assertions support the observations named in the bound scenarios. A scenario spanning multiple files must retain the other files’ contributions.

## What It Does Not Prove

This examination does not run the suite. Passing behavior, deployed conformance and the behavior of substituted dependencies require separate execution evidence.

## Real Dependencies and Test Doubles

The production function, schema or declaration runs over literal inputs. The source declares no substituted collaborator; this is an in-process decision or mapping check.

## Must Not Be Doubled

Keep the production helper, schema, matcher or declaration under examination real. Substituting the decision itself would remove the behavior the assertions exercise.