Category coverage identifies the kind of proof present. Detailed transition, permission and invariant obligations and unbound proposals remain in the coverage finding until their individual cases are accounted for.
Read and history reach do not grant lifecycle or edit actions. The structured interaction rows identify the related capabilities exercised and any remaining gap. Cross-capability workflow seams remain subject to the detailed coverage audit.
Coverage
Rulecovered
Transitiongap: FND-PFM-MTD-073
Validationcovered
Permissioncovered
Edgegap: FND-PFM-MTD-073
Failuregap: FND-PFM-MTD-073
Boundarygap: FND-PFM-MTD-073
Concurrencygap: FND-PFM-MTD-073
Invariantgap: FND-PFM-MTD-073
Interactioncovered
Test Scenarios
8 scenarios proving CAP-PFM-MTD-011; 7 bound to an existing test.
01One-object grants do not widen to other typespermissionapinegativetest
[
{
"do": "List Boat and Manufacturer records.",
"provenance": "test",
"source": "services-platform:modules/custom-objects/tests/e2e/custom-object-records.e2e.spec.js#refuses the same role another object’s records, answering as if the object were not there"
}
]
Expected
Boats are available while manufacturers return not found.
Enforcement Actions is restricted to Investigators.
Steps
[
{
"do": "Read and browse as broad staff and as a scoped investigator.",
"provenance": "test",
"source": "react-console:acceptance/custom-objects/playwright/journeys/PLAT-M5-S14.spec.ts#PLAT-M5-S14: restricted to the Investigators role and granted in Security: only investigators see and edit"
}
]
Expected
Broad staff receive not found and no entry point; investigators can view and edit.
Data
Enforcement Actions is restricted to Investigators.
[
{
"do": "Inspect Administrator, User and Read Only grants.",
"provenance": "test",
"source": "services-platform:modules/custom-objects/tests/unit/custom-object-permission-keys.spec.ts#gives Platform User reading, querying, creating and updating records and their history, and reading definitions"
}
]
Expected
Their definition and record permissions match the corresponding tiers.
[
{
"do": "Inspect archive and restore authorization.",
"provenance": "test",
"source": "services-platform:modules/custom-objects/tests/unit/custom-object-permission-keys.spec.ts#requires one key per route, each a console route, the health route public, every record route scoped to its object"
}
]
Expected
Both actions require object-scoped delete permission.
The record contains properties at each exposure level.
Steps
[
{
"do": "Project it for staff, owner, portal and public audiences.",
"provenance": "test",
"source": "services-platform:modules/custom-objects/tests/unit/exposure.spec.ts#shows a portal member the portal and public properties"
}
]
Expected
The visible property sets narrow by audience while retaining record standard fields.
Data
The record contains properties at each exposure level.
Owners, crew, role holders and publication and eligibility fixtures exist.
Steps
[
{
"do": "Evaluate operation predicates for current, expired, archived and foreign-workspace cases.",
"provenance": "test",
"source": "services-platform:modules/custom-objects/tests/integration/services/persistence/portal-ownership-predicates.integration.spec.js#grants the owner the boat it owns now, and neither an ended ownership nor an archived boat"
}
]
Expected
Only the supported local access conditions grant records and archived records remain unavailable.
Data
Owners, crew, role holders and publication and eligibility fixtures exist.
[
{
"do": "Open the boat list, boat page and linked contact page.",
"provenance": "test",
"source": "react-console:acceptance/custom-objects/playwright/journeys/PLAT-M5-S08.spec.ts#PLAT-M5-S08: a read-only volunteer is offered no edit actions; a person without access sees no menu and no card"
}
]
Expected
Readers have no edit controls and inaccessible users receive no object menu or card.
Two objects have records; one uses roles-only reach.
Steps
[
{
"do": "Use an object-scoped reader with history permission to open navigation, records and history; attempt update, archive and publication without their grants.",
"provenance": "proposed",
"source": [
"services-platform:modules/custom-objects/tests/e2e/custom-object-records.e2e.spec.js#keeps a roles-only object from a customer-wide assignment, answering as if it were not there",
"services-platform:modules/custom-objects/tests/unit/custom-object-permission-keys.spec.ts#requires one key per route, each a console route, the health route public, every record route scoped to its object",
"services-platform:modules/custom-objects/tests/integration/services/history/custom-object-record-history.integration.spec.js#refuses a caller who may read boats but not their history"
]
}
]
Expected
Inspect visible objects, history access and each refused action.
Data
Two objects have records; one uses roles-only reach.
Source
services-platform:modules/custom-objects/tests/e2e/custom-object-records.e2e.spec.js#keeps a roles-only object from a customer-wide assignment, answering as if it were not there,services-platform:modules/custom-objects/tests/unit/custom-object-permission-keys.spec.ts#requires one key per route, each a console route, the health route public, every record route scoped to its object,services-platform:modules/custom-objects/tests/integration/services/history/custom-object-record-history.integration.spec.js#refuses a caller who may read boats but not their history