---
id: TST-PFM-SEC-202
title: Reconcile catalog unit checks
kind: unit
product_area: platform
module: security
revision: 2
status: draft
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
repository: services-platform
files:
  - modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts
implements:
  - ATS-PFM-SEC-013-02
  - ATS-PFM-SEC-013-03
  - ATS-PFM-SEC-013-07
  - ATS-PFM-SEC-013-08
environment: mock
implementation_state: implemented
latest_result: not-run
latest_run_at: null
latest_run_ref: null
conformance: not-verified
estimated_minutes: 1
isolation: The suite owns its input fixtures and installed doubles.
assertion_evidence:
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#the
      built-ins a release generates
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#the
      name an app is shown under
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#capitalises
      a one-word app
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#reads
      each hyphenated part as a word of its own
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#the
      three tier policies of each app
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#produces
      the three tiers of every app of the release, the apps in order
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#names
      each tier policy in the words a customer reads, after the app rather than after its key
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#calls
      the lowest tier Read Only rather than the key’s own spelling
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#writes
      each tier policy as one allow of exact keys, and no deny
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#declares
      no former key for a generated policy, whose key is derived rather than chosen
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#files
      each tier policy under the app its keys belong to
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#which
      keys reach which tier
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#gives
      the read-only policy the app’s read keys and nothing above them
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#gives
      the user policy the read and user keys
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#gives
      the administrator policy every key of its app
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#sorts
      a tier’s keys, so a catalog declared in another order generates the same policy
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#gives
      an app’s policies none of another app’s keys
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#the
      keys no built-in may carry
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#keeps
      a staff-only key out of its app’s administrator policy
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#produces
      no policy at all for an app whose every key is staff-only
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#keeps
      the self-access key out of every tier, because the grant resolver answers it from the user’s
      own row
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#keeps
      a security power out of the Platform administrator policy, so a Power User cannot grant
      themselves more
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#keeps
      the READING of a security definition in, because a refusal nobody can be shown is a refusal
      nobody understands
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#keeps
      a security power of ANOTHER app in, because the rule is about Platform’s own security
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#produces
      no tier policy that would name no key
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#produces
      nothing for a release that declares no key
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#the
      built-in roles
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#publishes
      the eight roles the catalog ships, in the order it ships them
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#gives
      Administrator every app’s administrator policy and the declared security administrator
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#gives
      Administrator only the tier policies when no security administrator was produced
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#gives
      Power User the administrator policies without the security administrator
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#gives
      Standard User the user tier of every app
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#gives
      Read Only the read-only tier of every app
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#gives
      Support Representative the HQ reader and the deletion hold, at platform scope, and no customer
      app
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#gives
      Software Engineer the same HQ reader, the deletion request to read, and the custom query
      tables to author
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#gives
      Rhythm Administrator Rhythm HQ and the staff-only Platform keys, and no wildcard over a
      customer
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#gives
      hq.emergency-access.use to Rhythm Administrator alone: Support Representative and Software
      Engineer are refused it
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#reaches
      every published Rhythm HQ key with that pattern, under the matcher the grant slice resolves a
      rule by
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#gives
      no built-in role a pattern that reaches a customer’s own records, the staff roles included
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#reaches
      an assignable key from the wildcard spelled out in full, so the case above is not vacuous
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#gives
      every customer-scope role the customer’s own scope, so none of them reaches the platform
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#gives
      no role an inline permission but Portal Member and the three staff ones
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#publishes
      the eight roles with no policy at all when the release produced none
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#gives
      Portal Member, at tenant scope, only the keys of the portal tier’s own me routes while no
      peer’s portal key is active
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#gives
      Portal Member the Submissions engine’s four portal keys once its release is in the catalog
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#gives
      Portal Member only the Submissions portal keys the catalog holds, so it carries no dead key
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#keeps
      a Submissions portal key that is staff-only out of Portal Member
  - provenance: test
    source: >-
      services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts#gives
      Portal Member no other key of the Submissions release than its portal ones
dependency_evidence: >-
  The production function, schema or declaration runs over literal inputs. The source declares no
  substituted collaborator; this is an in-process decision or mapping check.
evidence:
  - 'services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts'
  - >-
    Static review at the recorded source revision; executable results remain not-run and conformance
    remains not-verified.
binding_note: >-
  Each binding names the scenario to which this file contributes assertions. A binding is not a
  recorded pass and does not extend the file’s dependency boundary.
examiner: codex
examined_at: '2026-10-23'
final_text: OpenAI
dependency_review:
  provenance: test
  source: 'services-platform:modules/security/tests/unit/services/catalog/reconcile-catalog.spec.ts'
  explicit_no_doubles: true
  identified_double_boundaries: []
---
# Reconcile catalog unit checks

## Verification Boundary

The file evaluates production helpers with controlled inputs in-process. The assertion references identify the source checks for reconcile catalog.

## What This Suite Proves

The source assertions support the observations named in the bound scenarios. A scenario spanning multiple files must retain the other files’ contributions.

## What It Does Not Prove

This examination does not run the suite. Passing behavior, deployed conformance and the behavior of substituted dependencies require separate execution evidence.

## Real Dependencies and Test Doubles

The production function, schema or declaration runs over literal inputs. The source declares no substituted collaborator; this is an in-process decision or mapping check.

## Must Not Be Doubled

Keep the production helper, schema, matcher or declaration under examination real. Substituting the decision itself would remove the behavior the assertions exercise.