--- id: TST-PFM-SEC-220 title: HQ workspace loading request checks kind: api-lifecycle product_area: platform module: security revision: 2 status: draft source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 repository: services-platform files: - modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js implements: - ATS-PFM-SEC-003-11 - ATS-PFM-SEC-003-12 - ATS-PFM-SEC-003-13 environment: local implementation_state: implemented latest_result: not-run latest_run_at: null latest_run_ref: null conformance: not-verified estimated_minutes: 5 isolation: Use the prepared test database and suite-owned fixture rows; retain shared seed records. assertion_evidence: - provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#the HQ tenant loading, reset and activation routes (end to end) - provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#opening a tenant’s load - provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#is served to a staff member holding hq.data-runs.manage, answering the loading state - provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#records who opened the load and why, which is what the row is evidence of - provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses a live tenant, an initial import going only into an implementation tenant - provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#names the status rule in that refusal, so an operator knows which half stopped it - provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#left the live tenant exactly as it was, so the refusal did not half-happen - provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses the staff member who may only activate a tenant, the two keys being separate - provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses an administrator of the tenant’s own customer, a customer never loading a tenant of its own - provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses an anonymous caller - provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#resetting a loading tenant - provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses a confirmation that is not the tenant’s own id, without saying what to type - provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses a tenant that is live, whatever the confirmation says - provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses a tenant that is in implementation mode and not loading - provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses a tenant it may otherwise reset, the services holding its records not being in the live plan - provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#names every participant it could not reach, so an operator knows what to deploy - provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#left the tenant loading after every one of those refusals, having emptied nothing - provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses the staff member who may only activate a tenant, resetting being part of running the import - provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses an administrator of the tenant’s own customer - provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses an anonymous caller - provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#answers 404 for the reset of a tenant that has never been reset - provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses the tenant activator the reset read, as it is refused the reset - provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#once the services holding its records declare the reset - provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#is accepted for a staff member holding hq.data-runs.manage: 202, naming the tenant and the job that empties it - provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#is followed by the reset read to the job it answered, succeeded - provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#answers the totals by resource the reset removed, the other macroservice’s among them - provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#empties what the other macroservice held for the tenant, by its reset and never its purge - provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#leaves the tenant loading and in implementation, so the package can be loaded again at once - provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#while a reset of the tenant is still running - provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#accepted the first request - provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses the second 409, naming the reset that is running - provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#says why in the refusal’s own words - provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#started nothing more: the tenant’s latest reset is the first one, still pending - provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#activating a loaded tenant - provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses the staff member who ran the import, activation being the other key - provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses an administrator of the tenant’s own customer - provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses an anonymous caller - provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#left the tenant loading after those three refusals, which is the premise of the case below - provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#is served to a staff member holding hq.tenants.activate, returning the tenant to active - provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#leaves the status where it was, going live being the separate decision - provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#keeps the record of the load, which is the evidence of what was done to the tenant dependency_evidence: >- The local request harness exercises the route dispatcher and the prepared database. The suite controls workflow execution, the signing key at the declared seams; those collaborators remain outside its live proof. evidence: - 'services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js' - >- Static review at the recorded source revision; executable results remain not-run and conformance remains not-verified. binding_note: >- Each binding names the scenario to which this file contributes assertions. A binding is not a recorded pass and does not extend the file’s dependency boundary. examiner: codex examined_at: '2026-10-23' final_text: OpenAI dependency_review: provenance: test source: 'services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js' explicit_no_doubles: false identified_double_boundaries: - workflow execution - the signing key --- # HQ workspace loading request checks ## Verification Boundary The file exercises public request handling through the local service harness. The assertion references identify the source checks for HQ workspace loading. ## What This Suite Proves The source assertions support the observations named in the bound scenarios. A scenario spanning multiple files must retain the other files’ contributions. ## What It Does Not Prove This examination does not run the suite. Passing behavior, deployed conformance and the behavior of substituted dependencies require separate execution evidence. ## Real Dependencies and Test Doubles The local request harness exercises the route dispatcher and the prepared database. The suite controls workflow execution, the signing key at the declared seams; those collaborators remain outside its live proof. ## Must Not Be Doubled Keep route dispatch, signed-context verification and the exercised service decisions real. A test key can supply signatures, but replacing the authorization decision cannot prove request enforcement.