--- id: ATS-PFM-TNL-011 scope: CAP-PFM-TNL-011 product_area: platform module: tenant-lifecycle revision: 3 status: proposed approved_by: null approved_at: null source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 services-crm: a8d1364f1dd44b723bb5f9acba12f983e9ec8d69 services-commerce: c8b66a98e2490617aec38ba5c8165dd9bd0a8f9b services-committees: 36129c24daeaadcdb339218c38cdeaff9861359d services-membership: 5994c270e8a37a30f848e99ba5b5ee6b87c08893 services-submissions: 64236c19be89579ef5897aad7de3925ed3ce03bf services-websites: 5fc6823c69d5e6f208c21dba8c0eb3132f8bdc4c services-marketing: d071a159fe9782bb71ff246d5c67d5bbfe07fbfa rhythm-v2-docs: d318a948692343e2f0a7ecc2e11c50db179a8c95 scenarios: - id: ATS-PFM-TNL-011-01 title: Loading requires import authority level: api proves: - BR-CAP-PFM-TNL-011-01 preconditions: 'An implementation workspace is targeted by activation-only, customer and anonymous identities.' steps: Attempt to open loading with each identity. expected: All requests are refused. negative: true data_needs: >- Use the run-owned records and caller contexts created by the cited tests; use their provider and clock seams only where declared. bound_to: - >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses the staff member who may only activate a tenant, the two keys being separate - >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses an administrator of the tenant’s own customer, a customer never loading a tenant of its own - 'services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses an anonymous caller' - TST-PFM-TNL-049 provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses the staff member who may only activate a tenant, the two keys being separate category: permission action_evidence: provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses the staff member who may only activate a tenant, the two keys being separate assertion_evidence: provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses the staff member who may only activate a tenant, the two keys being separate binding_note: >- All cited checks for this scenario occur in the registered file. The link establishes inspected executable source rather than a passing run. - id: ATS-PFM-TNL-011-02 title: Live workspaces cannot enter initial loading level: api proves: - BR-CAP-PFM-TNL-011-02 preconditions: The workspace has live business status. steps: Request loading. expected: The status requirement is reported and the workspace remains unchanged. negative: true data_needs: >- Use the run-owned records and caller contexts created by the cited tests; use their provider and clock seams only where declared. bound_to: - >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses a live tenant, an initial import going only into an implementation tenant - >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#names the status rule in that refusal, so an operator knows which half stopped it - >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#left the live tenant exactly as it was, so the refusal did not half-happen - >- services-platform:modules/tenants/tests/integration/services/reset/reset-tenant.integration.spec.js#refuses a live tenant by name: an initial import loads only an implementation tenant provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses a live tenant, an initial import going only into an implementation tenant category: validation action_evidence: provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses a live tenant, an initial import going only into an implementation tenant assertion_evidence: provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses a live tenant, an initial import going only into an implementation tenant binding_note: >- The original test-title references contribute separate assertions from several files. No suite receives an implements link for the complete combined scenario; a full executable mapping remains FND-PFM-TNL-084. binding_gap: FND-PFM-TNL-084 - id: ATS-PFM-TNL-011-03 title: Load opening retains its original attribution level: api proves: - BR-CAP-PFM-TNL-011-03 preconditions: An implementation workspace has not entered loading. steps: 'Open loading with a reason, then repeat the action.' expected: 'Operator, time and explanation are recorded once and preserved on repetition.' negative: false data_needs: >- Use the run-owned records and caller contexts created by the cited tests; use their provider and clock seams only where declared. bound_to: - >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#is served to a staff member holding hq.data-runs.manage, answering the loading state - >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#records who opened the load and why, which is what the row is evidence of - >- services-platform:modules/tenants/tests/integration/services/reset/reset-tenant.integration.spec.js#puts the tenant into its loading state - >- services-platform:modules/tenants/tests/integration/services/reset/reset-tenant.integration.spec.js#changes nothing when the tenant is already loading, so a repeated step is not an error provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#is served to a staff member holding hq.data-runs.manage, answering the loading state category: transition action_evidence: provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#is served to a staff member holding hq.data-runs.manage, answering the loading state assertion_evidence: provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#is served to a staff member holding hq.data-runs.manage, answering the loading state binding_note: >- The original test-title references contribute separate assertions from several files. No suite receives an implements link for the complete combined scenario; a full executable mapping remains FND-PFM-TNL-084. binding_gap: FND-PFM-TNL-084 - id: ATS-PFM-TNL-011-04 title: Import permission cannot activate level: api proves: - BR-CAP-PFM-TNL-011-04 preconditions: 'A workspace is loading and callers exercise import-only, customer, anonymous and activation authority.' steps: Attempt activation for each. expected: Only the caller with activation authority succeeds. negative: true data_needs: >- Use the run-owned records and caller contexts created by the cited tests; use their provider and clock seams only where declared. bound_to: - >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses the staff member who ran the import, activation being the other key - >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses an administrator of the tenant’s own customer - >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#is served to a staff member holding hq.tenants.activate, returning the tenant to active - TST-PFM-TNL-049 provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses the staff member who ran the import, activation being the other key category: permission action_evidence: provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses the staff member who ran the import, activation being the other key assertion_evidence: provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses the staff member who ran the import, activation being the other key binding_note: >- All cited checks for this scenario occur in the registered file. The link establishes inspected executable source rather than a passing run. - id: ATS-PFM-TNL-011-05 title: Activation leaves business mode unchanged level: api proves: - BR-CAP-PFM-TNL-011-05 preconditions: The workspace is loading in implementation mode. steps: Activate the completed load. expected: Lifecycle becomes active while implementation status and load history remain. negative: false data_needs: >- Use the run-owned records and caller contexts created by the cited tests; use their provider and clock seams only where declared. bound_to: - >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#is served to a staff member holding hq.tenants.activate, returning the tenant to active - >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#leaves the status where it was, going live being the separate decision - >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#keeps the record of the load, which is the evidence of what was done to the tenant - >- services-platform:modules/tenants/tests/integration/services/reset/reset-tenant.integration.spec.js#returns it to active, so its own people reach it again provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#is served to a staff member holding hq.tenants.activate, returning the tenant to active category: transition action_evidence: provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#is served to a staff member holding hq.tenants.activate, returning the tenant to active assertion_evidence: provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#is served to a staff member holding hq.tenants.activate, returning the tenant to active binding_note: >- The original test-title references contribute separate assertions from several files. No suite receives an implements link for the complete combined scenario; a full executable mapping remains FND-PFM-TNL-084. binding_gap: FND-PFM-TNL-084 - id: ATS-PFM-TNL-011-06 title: Import journey separates activation from go-live level: api proves: - AS-JNY-PFM-TNL-003-02 preconditions: The import journey reaches its approved load fixture. steps: Activate and inspect its status. expected: Customer availability returns without an automatic change to live business mode. negative: false data_needs: >- Use the run-owned records and caller contexts created by the cited tests; use their provider and clock seams only where declared. bound_to: - >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#leaves the status where it was, going live being the separate decision - >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#keeps the record of the load, which is the evidence of what was done to the tenant - TST-PFM-TNL-049 provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#leaves the status where it was, going live being the separate decision category: interaction action_evidence: provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#leaves the status where it was, going live being the separate decision assertion_evidence: provenance: test source: >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#leaves the status where it was, going live being the separate decision binding_note: >- All cited checks for this scenario occur in the registered file. The link establishes inspected executable source rather than a passing run. - id: ATS-PFM-TNL-011-07 title: Activation during reset exposes the next batch guard category: interaction level: api proves: - BR-CAP-PFM-TNL-011-05 interacts_with: - CAP-PFM-TNL-012 - CAP-PFM-TNL-005 preconditions: >- A loading implementation workspace has a reset paused between batches and a separate caller with activation authority. steps: >- Activate the load while reset remains open, then resume the next reset batch and inspect already removed and remaining rows. expected: >- Activation can return the workspace to active; the next reset batch refuses its changed lifecycle. Earlier committed removals stay removed and the reset cannot silently continue. negative: true data_needs: >- Create a separate run-owned workspace for each decision branch and an unaffected comparison workspace. Use a controlled clock, paused task or injected fault at the boundary named in the scenario. bound_to: [] provenance: proposed source: >- rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-011-open-a-workspace-for-its-initial-import-and-let-its-people.md; rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-012-empty-a-loading-workspace-so-it-can-be-loaded-again.md; rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-005-keep-people-and-background-work-out-of-a-workspace-that-is.md action_evidence: provenance: proposed source: >- rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-011-open-a-workspace-for-its-initial-import-and-let-its-people.md; rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-012-empty-a-loading-workspace-so-it-can-be-loaded-again.md; rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-005-keep-people-and-background-work-out-of-a-workspace-that-is.md assertion_evidence: provenance: proposed source: >- rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-011-open-a-workspace-for-its-initial-import-and-let-its-people.md; rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-012-empty-a-loading-workspace-so-it-can-be-loaded-again.md; rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-005-keep-people-and-background-work-out-of-a-workspace-that-is.md evidence: - >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses the staff member who may only activate a tenant, the two keys being separate - >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses a live tenant, an initial import going only into an implementation tenant - >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#is served to a staff member holding hq.data-runs.manage, answering the loading state - >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#refuses the staff member who ran the import, activation being the other key - >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#is served to a staff member holding hq.tenants.activate, returning the tenant to active - >- services-platform:modules/tenants/tests/e2e/hq-tenant-loading.e2e.spec.js#leaves the status where it was, going live being the separate decision - >- rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-011-open-a-workspace-for-its-initial-import-and-let-its-people.md; rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-012-empty-a-loading-workspace-so-it-can-be-loaded-again.md; rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-005-keep-people-and-background-work-out-of-a-workspace-that-is.md coverage: rule: 'gap: FND-PFM-TNL-076' transition: 'gap: FND-PFM-TNL-076' validation: covered permission: covered edge: 'gap: FND-PFM-TNL-076' failure: 'gap: FND-PFM-TNL-076' boundary: 'gap: FND-PFM-TNL-076' concurrency: 'gap: FND-PFM-TNL-076' invariant: 'gap: FND-PFM-TNL-076' interaction: covered coverage_notes: transition: >- The listed scenarios sample lifecycle changes. Complete transition, guard and side-effect proof is still owed for the state models named in the coverage finding. interaction: >- The added interaction is proposed. Related capabilities not included in that scenario remain named in the coverage finding. transition_obligations: - state_model: STATE-PFM-TNL-001 transition_n: 1 coverage: 'gap: FND-PFM-TNL-076' provenance: observed source: 'services-platform:modules/tenants/services/persistence/tenants.ts:activateProvisionedTenant' - state_model: STATE-PFM-TNL-001 transition_n: 2 coverage: 'gap: FND-PFM-TNL-076' provenance: observed source: >- services-platform:modules/tenants/services/provisioning/provision-tenant-failure.ts:applyTenantProvisioningFailure - state_model: STATE-PFM-TNL-001 transition_n: 3 coverage: 'gap: FND-PFM-TNL-076' provenance: observed source: >- services-platform:modules/tenants/services/provisioning/submit-tenant-provisioning.ts:retryTenantProvisioning - state_model: STATE-PFM-TNL-001 transition_n: 4 coverage: 'gap: FND-PFM-TNL-076' provenance: observed source: 'services-platform:modules/tenants/services/deletion/request-deletion.ts:requestTenantDeletion' - state_model: STATE-PFM-TNL-001 transition_n: 5 coverage: 'gap: FND-PFM-TNL-076' provenance: observed source: 'services-platform:modules/tenants/services/persistence/tenants.ts:enterTenantLoading' - state_model: STATE-PFM-TNL-001 transition_n: 6 coverage: 'gap: FND-PFM-TNL-076' provenance: observed source: 'services-platform:modules/tenants/services/deletion/request-deletion.ts:requestTenantDeletion' - state_model: STATE-PFM-TNL-001 transition_n: 7 coverage: 'gap: FND-PFM-TNL-076' provenance: observed source: 'services-platform:modules/tenants/services/persistence/tenants.ts:activateLoadedTenant' - state_model: STATE-PFM-TNL-001 transition_n: 8 coverage: 'gap: FND-PFM-TNL-076' provenance: observed source: 'services-platform:modules/tenants/services/lifecycle/lifecycle-transitions.ts:SUCCESSORS' - state_model: STATE-PFM-TNL-001 transition_n: 9 coverage: 'gap: FND-PFM-TNL-076' provenance: observed source: 'services-platform:modules/tenants/services/deletion/deletion-holds.ts:cancelTenantDeletion' - state_model: STATE-PFM-TNL-001 transition_n: 10 coverage: 'gap: FND-PFM-TNL-076' provenance: observed source: 'services-platform:modules/tenants/services/deletion/begin-destruction.ts:beginTenantDestruction' - state_model: STATE-PFM-TNL-001 transition_n: 11 coverage: 'gap: FND-PFM-TNL-076' provenance: observed source: 'services-platform:modules/tenants/services/persistence/tenants.ts:forceTenantDeletingAfterRestore' - state_model: STATE-PFM-TNL-003 transition_n: 1 coverage: 'gap: FND-PFM-TNL-076' provenance: observed source: 'services-platform:modules/tenants/services/reset/reset-tenant.ts:requestTenantReset' - state_model: STATE-PFM-TNL-003 transition_n: 2 coverage: 'gap: FND-PFM-TNL-076' provenance: observed source: 'services-platform:modules/tenants/services/reset/tenant-reset-operations.ts:tenantResetOperations' - state_model: STATE-PFM-TNL-003 transition_n: 3 coverage: 'gap: FND-PFM-TNL-076' provenance: observed source: >- services-platform:modules/tenants/services/reset/tenant-reset-workflow.ts:ensureTenantResetJobTypeRegistered - state_model: STATE-PFM-TNL-003 transition_n: 4 coverage: 'gap: FND-PFM-TNL-076' provenance: observed source: 'services-platform:modules/tenants/services/reset/reset-tenant.ts:requestTenantReset' - state_model: STATE-PFM-TNL-003 transition_n: 5 coverage: 'gap: FND-PFM-TNL-076' provenance: observed source: 'services-platform:modules/tenants/services/persistence/tenants.ts:activateLoadedTenant' - state_model: STATE-PFM-TNL-003 transition_n: 6 coverage: 'gap: FND-PFM-TNL-076' provenance: inferred source: >- services-platform:modules/tenants/services/persistence/tenants.ts:activateLoadedTenant (no reset check); services/reset/tenant-reset-operations.ts - state_model: STATE-PFM-TNL-003 transition_n: 7 coverage: 'gap: FND-PFM-TNL-076' provenance: observed source: 'services-platform:modules/tenants/services/persistence/tenants.ts:enterTenantLoading' - state_model: STATE-PFM-TNL-003 transition_n: 8 coverage: 'gap: FND-PFM-TNL-076' provenance: inferred source: 'services-platform:modules/tenants/services/persistence/tenants.ts:activateLoadedTenant (no reset check)' permission_obligations: - key: hq.data-runs.manage where_checked: api scenario_examples: - ATS-PFM-TNL-011-01 - ATS-PFM-TNL-011-04 coverage: 'gap: FND-PFM-TNL-076' note: 'Examples do not establish the complete key-by-key grant, revoked-grant and staff-context matrix.' provenance: documented source: >- rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-011-open-a-workspace-for-its-initial-import-and-let-its-people.md - key: hq.tenants.activate where_checked: api scenario_examples: - ATS-PFM-TNL-011-01 - ATS-PFM-TNL-011-04 coverage: 'gap: FND-PFM-TNL-076' note: 'Examples do not establish the complete key-by-key grant, revoked-grant and staff-context matrix.' provenance: documented source: >- rhythm-v2-docs:specs/platform/tenant-lifecycle/planning/capabilities/CAP-PFM-TNL-011-open-a-workspace-for-its-initial-import-and-let-its-people.md evidence_note: >- The test-specific convention lists an Evidence body section, but the corpus checker rejects it. Sources and verification limits remain in frontmatter so this artifact conforms without changing the checker. --- # Control the initial import and subsequent opening: Capability Test Specification ## Coverage The category map separates defined scenarios from missing proof. A covered category has a scenario; a binding records inspected test assertions and carries no execution result. State-model completeness and untested interactions remain explicit gaps. | Rule | Proved by | |---|---| | `BR-CAP-PFM-TNL-011-01` | `ATS-PFM-TNL-011-01` | | `BR-CAP-PFM-TNL-011-02` | `ATS-PFM-TNL-011-02` | | `BR-CAP-PFM-TNL-011-03` | `ATS-PFM-TNL-011-03` | | `BR-CAP-PFM-TNL-011-04` | `ATS-PFM-TNL-011-04` | | `BR-CAP-PFM-TNL-011-05` | `ATS-PFM-TNL-011-05`, `ATS-PFM-TNL-011-07` | | `BR-CAP-PFM-TNL-011-06` | No scenario: `FND-PFM-TNL-076` | ## Interactions With Related Capabilities Activation during reset exposes the next batch guard. The combined scenario sets up the stated boundary, changes the upstream condition and observes its effect on the dependent outcome. Its steps and assertions are proposed; component tests do not establish this combined execution. | Related capability | Combined coverage | |---|---| | `CAP-PFM-TNL-005` | `ATS-PFM-TNL-011-07` (proposed) | | `CAP-PFM-TNL-012` | `ATS-PFM-TNL-011-07` (proposed) |