The coverage map distinguishes a dedicated scenario from an unresolved category. Proposed scenarios define proof to build; bindings retain the exact assertion references and identify their executable suite.
Use an isolated custom and built-in access definition in active state, with the required authority and guard fixtures.
Steps
[
{
"do": "Publish a release omitting the built-in and inspect holders and impact history.",
"expect": "Read the resulting custom and built-in access definition as archived; inspect the associated records and recorded history for this transition.",
"provenance": "proposed",
"source": [
"services-platform:modules/security/services/catalog/reconcile-catalog.ts:reconcileCatalog",
"services-platform at ad3f6a65: modules/security/db/security-roles.table.ts, security-policies.table.ts; services/definitions/manage-roles.ts, manage-policies.ts, impact.ts; services/catalog/*."
]
}
]
Expected
Read the resulting custom and built-in access definition as archived; inspect the associated records and recorded history for this transition.
Data
A disposable customer, workspace and named actor; a controllable clock where the transition depends on time.
Source
services-platform:modules/security/services/catalog/reconcile-catalog.ts:reconcileCatalog,services-platform at ad3f6a65: modules/security/db/security-roles.table.ts, security-policies.table.ts; services/definitions/manage-roles.ts, manage-policies.ts, impact.ts; services/catalog/*.
13Custom and built-in access definition: archived to activetransitionapiproposed
Use an isolated custom and built-in access definition in archived state, with the required authority and guard fixtures.
Steps
[
{
"do": "Publish a later release that declares the archived built-in again.",
"expect": "Read the resulting custom and built-in access definition as active; inspect the associated records and recorded history for this transition.",
"provenance": "proposed",
"source": [
"services-platform:modules/security/services/catalog/catalog-plan.ts:planBuiltInPolicy",
"services-platform at ad3f6a65: modules/security/db/security-roles.table.ts, security-policies.table.ts; services/definitions/manage-roles.ts, manage-policies.ts, impact.ts; services/catalog/*."
]
}
]
Expected
Read the resulting custom and built-in access definition as active; inspect the associated records and recorded history for this transition.
Data
A disposable customer, workspace and named actor; a controllable clock where the transition depends on time.
Source
services-platform:modules/security/services/catalog/catalog-plan.ts:planBuiltInPolicy,services-platform at ad3f6a65: modules/security/db/security-roles.table.ts, security-policies.table.ts; services/definitions/manage-roles.ts, manage-policies.ts, impact.ts; services/catalog/*.
14Publish shared access definitions from releases with model customer responsibilities with roles and policiesinteractionapiproposed
A built-in role and a customer-owned copy are both referenced.
Steps
Withdraw and republish the built-in in release reconciliation, then read both definitions.
Expected
The built-in restores its identity; the customer copy remains a separately editable definition.
Data
An isolated customer with two workspaces, ordinary and staff identities, and records owned by this run.
Source
services-platform:modules/security/tests/e2e/definitions.e2e.spec.js#refuses a write against a built-in as read-only rather than as a record that is not there,services-platform:modules/security/tests/integration/services/catalog/reconcile-catalog.integration.spec.js#makes a retired built-in grant nothing while its holder keeps every other grant
15Publish shared access definitions from releases with enforce access at request boundariesinteractionapiproposed