--- id: TST-PFM-SEC-229 title: Workspace provisioning request checks kind: api-lifecycle product_area: platform module: security revision: 2 status: draft source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 repository: services-platform files: - modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js implements: - ATS-PFM-SEC-003-01 - ATS-PFM-SEC-003-04 - ATS-PFM-SEC-003-05 - ATS-PFM-SEC-003-10 environment: local implementation_state: implemented latest_result: not-run latest_run_at: null latest_run_ref: null conformance: not-verified estimated_minutes: 5 isolation: Use the prepared test database and suite-owned fixture rows; retain shared seed records. assertion_evidence: - provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js#tenant provisioning API (end to end) - provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js#asking for a tenant - provenance: test source: 'services-platform:modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js#answers 200' - provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js#answers the provisioning job that is making the tenant usable - provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js#answers a tenant that is not usable yet, because the work has only been asked for - provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js#leaves the tenant usable once the job has run - provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js#records when the tenant became usable - provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js#refuses an anonymous call as 401 - provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js#watching a provisioning - provenance: test source: 'services-platform:modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js#answers 200' - provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js#answers the job the submission named, against the tenant it was for - provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js#says the provisioning succeeded - provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js#shows one step per participant, then the readiness check and the activation - provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js#shows every step completed, and names each one for the person reading it - provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js#answers 404 for a tenant that was never provisioned by a request - provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js#answers 404 for a tenant that does not exist - provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js#refuses an anonymous call as 401 - provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js#provisioning a tenant again - provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js#leaves the tenant saying its provisioning failed, which is what makes it retryable - provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js#says so in the snapshot too, with the failure summary the task refused with - provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js#answers 200 and a new job to the retry - provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js#leaves the tenant usable after the retry - provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js#answers the retry’s job to a reader afterwards, which is the latest provisioning - provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js#refuses to provision a tenant again whose provisioning did not fail - provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js#refuses a tenant that does not exist as 404 - provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js#refuses an anonymous call as 401 - provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js#initializing a participant of a tenant already in use - provenance: test source: 'services-platform:modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js#answers 200' - provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js#says which participant ran for which tenant, and what it did - provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js#refuses a participant nobody has heard of as 400 - provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js#refuses an anonymous call as 401 - provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js#what a customer administrator may not do - provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js#may read their own tenant, which is the premise: the context is a working one - provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js#may not ask for a tenant at all - provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js#may not watch the provisioning of their own tenant - provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js#may not provision their own tenant again - provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js#may not initialize a participant of their own tenant - provenance: test source: >- services-platform:modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js#leaves the tenant exactly as it was after all of those refusals dependency_evidence: >- The local request harness exercises the route dispatcher and the prepared database. The suite controls Cognito, message delivery, workflow execution, remote service participants, the signing key at the declared seams; those collaborators remain outside its live proof. evidence: - 'services-platform:modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js' - >- Static review at the recorded source revision; executable results remain not-run and conformance remains not-verified. binding_note: >- Each binding names the scenario to which this file contributes assertions. A binding is not a recorded pass and does not extend the file’s dependency boundary. examiner: codex examined_at: '2026-10-23' final_text: OpenAI dependency_review: provenance: test source: 'services-platform:modules/tenants/tests/e2e/tenant-provisioning.e2e.spec.js' explicit_no_doubles: false identified_double_boundaries: - Cognito - message delivery - workflow execution - remote service participants - the signing key --- # Workspace provisioning request checks ## Verification Boundary The file exercises public request handling through the local service harness. The assertion references identify the source checks for workspace provisioning. ## What This Suite Proves The source assertions support the observations named in the bound scenarios. A scenario spanning multiple files must retain the other files’ contributions. ## What It Does Not Prove This examination does not run the suite. Passing behavior, deployed conformance and the behavior of substituted dependencies require separate execution evidence. ## Real Dependencies and Test Doubles The local request harness exercises the route dispatcher and the prepared database. The suite controls Cognito, message delivery, workflow execution, remote service participants, the signing key at the declared seams; those collaborators remain outside its live proof. ## Must Not Be Doubled Keep route dispatch, signed-context verification and the exercised service decisions real. A test key can supply signatures, but replacing the authorization decision cannot prove request enforcement.