Context-derived entitlements

Verification Boundary

Context fixtures check product-to-domain mappings, wildcards, feature values, synthetic keys and scoped custom-object grants. They establish local derivation without performing service reads or enforcing product licensing in the database.

This register records static review at the supplied source commits. The suite exists, but this pass does not run it or mark its conformance verified.

What This Suite Proves

• Known context products enable only their mapped domains.
• Staff wildcard authority cannot invent a product.
• Synthetic keys depend on an enabled keyless domain.
• Removing a context product removes its domain.
• Scoped authority opens the surface but limits its records.
• Product aliases and shared domains follow the context map.

Bindings that span files are collective: each file contributes only its recorded assertions. The exact anchors are in frontmatter.

What It Does Not Prove

The register claims only the linked scenario outcomes at this boundary. It establishes no passing deployment result, complete permission matrix or unlisted cross-capability journey. Proposed scenarios and the remaining lifecycle, invariant and race obligations stay in the coverage findings.

Real Dependencies and Test Doubles

The imported functions, registry declarations and any static component rendering are real. Independent in-memory inputs represent grants, contexts or records; there is no deployed service or browser session.

Must Not Be Doubled

Do not replace the function, component, registry or source declaration under test. Keep the expected outcome independent of its implementation; injected inputs do not justify stubbing the computation being verified.