Capability design scenarios

Normal, failure and recovery cases for the Phase 7 capability contracts, with implementation owners.

1 min read Updated Sep 5, 2026

Capability design scenarios

Every implementation ticket on this page is merged, and tests prove the rows. Each row defines an expected result under the capability contract.

Three test sets hold the proof:

ac-python-api scripts/agentic_phase7_exit_test/run.sh drives the five contracts through the live API and the live ac CLI. Its steps are read, start, refuse, attribute, cancel, isolate and parity.
ac-python-api tests/agentic/ holds the unit and integration tests. capabilities/<capability>/ covers each product. runtime/definitions/ and runtime/runs/ cover the registry and the Run lifecycle. entry_control/front_door/ covers routing.
ac-frontend e2e/features/agentic-phase7-exit.spec.ts drives the five browser journeys.

Each section names its implementation owner. A section names more proof only when that proof is specific to it. The runtime repositories are on their agentic-platform branches. This page is on ac-docs main.

Superadmin company identity writes

ENG-2311 owns these cases. Apply each write case to create and update unless the row states otherwise.

ID	Input or event	Required result
IW01	Mixed case, locale host, surrounding spaces or trailing slash	Store `linkedin.com/<kind>/<slug>` with lowercase kind and slug
IW02	Query, fragment or page subpath such as `/about/`	Store the same key as the organization root
IW03	A match key without a scheme	Store the same value; repeated normalization changes nothing
IW04	The same slug under company, school and showcase paths	Keep three distinct keys
IW05	Person profile, wrong host, misleading host suffix, free text or missing slug	HTTP 400; no database call or cache invalidation
IW06	Malformed URL that raises a parser error	HTTP 400; no database call or cache invalidation
IW07	Non-null, non-string JSON value	Existing request validation returns HTTP 422 before the service
IW08	Omitted, null, empty or whitespace-only LinkedIn field with other valid fields	Write only the other fields; preserve the stored key on update
IW09	Create with only name, only domain or only a valid LinkedIn value	Preserve all three supported create forms
IW10	Create has no usable identity; update has no fields after cleaning	Keep the existing HTTP 400 validation errors
IW11	Create or update collides with an existing match key, including concurrent writes	Existing unique index rejects the collision; return HTTP 409; do not merge rows
IW12	Update repeats its own key; another field changes	Keep the same identity and write the other field
IW13	Valid write succeeds or the database reports a missing row or error	Keep existing success, 404 and error handling; invalidate cache only after success
IW14	A write succeeds, then CompanyIntelStore or company.search reads by LinkedIn	The normalized key selects the written identity; old display-form rows still require ENG-2310

Intelligence identity repair

ENG-2310 owns these cases. Its migration is ac-backend supabase/migrations/20260903161608_intel_linkedin_match_keys.sql. The migration is merged on agentic-platform. It has not run against staging or production.

ID	Input or event	Required result
IR01	One person display URL	Store its match key; keep its UUID and facts
IR02	One company, school or showcase display URL	Store its key; keep all three kinds distinct
IR03	One row already holds the match key	No update; preserve `updated_at`
IR04	A display row and a key row resolve to one identity	Preserve both; report both UUIDs
IR05	Several company rows with different domains resolve to one identity	Preserve all rows, including an existing key row; report the whole group
IR06	Duplicate company keys with different domains already exist	Preserve and report the duplicate group despite the partial unique index
IR07	The same slug exists in both tables or in different organization kinds	Keep separate groups; do not merge identities
IR08	A company URL is null	Preserve null; include the row in the inventory
IR09	Blank, wrong kind, wrong host, free text or unsupported URL variant	Stop before persistent writes; report the unsupported count
IR10	Case, locale, query, fragment, subpath, Unicode or malformed URL requires parsing	Stop for inspection; do not implement another parser in SQL
IR11	A supported slug contains percent escapes, digits, apostrophes, ampersands or other allowed punctuation	Preserve its exact bytes; do not decode or resolve aliases
IR12	Empty tables or no display rows	Complete safely; record zero changes
IR13	Repeat the migration against unchanged data	No row update and no duplicate report snapshot
IR14	A prior display-form collision report exists	Preserve it; write a separate match-key report with all current members
IR15	A writer runs during candidate selection	The table lock serializes the write and repair; no stale candidate set
IR16	Lock timeout, statement error or interrupted connection	Roll back row changes and new report rows together
IR17	An ordinary reader runs during the repair	Reads continue; committed state changes atomically
IR18	The caller uses anon or authenticated credentials	No access to the retained cross-tenant report, including TRUNCATE
IR19	Repair changes a row with facts, source IDs, freshness dates or references	Preserve those values and its UUID; only the URL and update timestamp can change
IR20	CRM display rows or stored Run results exist	Leave them unchanged; shared CRM canonicalization still returns display URLs
IR21	PeopleIntelStore writes a repaired identity, then people.search reads it	Reuse the same row and return its stored fact; create no duplicate person
IR22	Target writers still store display URLs	Stop rollout until the writer fixes are deployed
IR23	Staging or production cannot be inventoried	Record the exact access failure; do not claim its counts or deploy there

Start and lifecycle

ID	Input or event	Required result	Owner
C01	Valid input for each of the five IDs	Resolve one tenant executor; validate version and schema; enter RunManager once	ENG-2275, ENG-2276
C02	A guest or an actor lacks a required scope	Refuse before Run creation or provider work	ENG-2275, ENG-2276
C03	Another tenant's Run, CRM row, prospect, list or saved-search ref	Product input resolvers refuse before provider work; start replay cannot cross tenants	ENG-2276, ENG-2301, ENG-2278, ENG-2279
C04	Unknown ID; missing installation; disabled executor	Distinct unknown/unavailable results; no guessed definition	ENG-2275, ENG-2276, ENG-2286
C05	Two active bindings or schemas from an unpublished draft	Unavailable; fail closed and report the binding error	ENG-2287, ENG-2275
C06	Missing field, unknown field, wrong type, negative count or excessive list	Path-specific invalid-input result; no provider call	ENG-2276
C07	Double click or replay with identical input and key	Same Run and version, including after a binding upgrade	ENG-2276, ENG-2303
C08	Same key with a different capability, version or normalized input	Idempotency conflict; no second Run	ENG-2276
C09	Policy denies, asks approval or refuses budget	Preserve RunManager's admission result; no bypass or hidden retry	ENG-2276
C10	Concurrent install or crash before binding activation	One active binding; retry incomplete install; preserve healthy prior state	ENG-2277
C11	Incompatible schema or a stale form after a version upgrade	Refuse the version; do not translate silently. A schema change at an unchanged contract version refuses the switch	ENG-2303, ENG-2284
C12	Upgrade, rollback or disable while a parent Run is live	Frozen child UUIDs, contracts and grants remain unchanged. A switch writes only `capability_active`	ENG-2303, ENG-2298
C13	Managed upgrade collides with a tenant-authored definition	Preserve tenant work and report the conflict. A bound row outside the released revisions is a conflict	ENG-2277, ENG-2303
C14	Child binding changes but a published parent still names the old UUID	Keep the old executor valid; publish a replacement bound parent and switch its binding. The manifest test refuses a child bump that its bound ancestors do not follow	ENG-2303
C15	Profile request with an email-enabled executor, but actor lacks an email tool scope	Refuse at admission under the whole published scope set; do not narrow grants from request fields	ENG-2281, ENG-2299

Initial installation and reconciliation

ENG-2277 owns these cases. They test the initial V1 installer and its durable drivers.

ID	Input or event	Required result
I01	Organization has no managed definitions	Publish and activate all five capabilities in dependency order
I02	Reconcile a complete installation	Return five `current` results; write nothing
I03	Two reconcilers start together	Deterministic IDs and storage constraints leave one tree and one active binding per capability
I04	Process stops after draft creation	Retry locates the exact draft, validates it and continues
I05	Process stops after child publication	Retry reuses the exact child and publishes the remaining tree
I06	Process stops after binding attachment	Retry activates the exact binding when no active binding exists
I07	Process stops after activation	Retry reports `current`; it creates no second row
I08	Managed draft matches its manifest	Publish it through the normal validator
I09	Managed draft was edited	Report `conflict`; do not overwrite or publish it
I10	Deterministic UUID holds another kind, name or configuration	Report `conflict`; preserve that row and retain exact managed progress
I11	Another definition has the same display name	Ignore the name collision; use deterministic identity only
I12	Tenant-authored binding is active for the capability	Preserve it and report `conflict`; do not install a competing active binding
I13	Tenant-authored binding is inactive	Report `conflict`; attach or activate no managed binding for that capability
I14	Exact managed binding is inactive and its executor is active	Activate it only when no active binding exists
I15	Exact managed executor is disabled	Report `disabled`; do not enable or replace it
I16	Managed binding metadata, scopes or graph is invalid	Report `invalid`; do not infer or repair data
I17	Two active bindings exist in corrupted storage	Report `invalid`; select neither row
I18	One independent capability fails validation	Report that capability; continue independent capabilities and block its dependants
I19	Company Search does not install	Block People Search and Signals Search; continue Company Enrich and People Enrich where valid
I20	Any required child of Signals Search is unavailable	Do not create or activate the Signals root
I21	Database or network read fails	Raise for durable retry; never convert the fault to a stable conflict
I22	New organization event is delivered twice or after 24 hours	Database idempotency produces the same complete installation
I23	New organization event send fails	Organization creation succeeds; the scheduled sweep sends the same reconcile event later
I24	Backfill and new-organization delivery overlap	Both call the same reconciler and converge on the same rows
I25	Organization is deleted before reconciliation starts	Return run-level `absent_organization` with no capability results; create no definition
I26	Operator runs report mode	Return `missing` or the exact stable state for each capability; change no data
I27	Operator runs apply mode	Use the same reconciliation service and print all capability results
I28	Any released manifest content or UUID namespace changes	Golden contract tests fail; a content change requires a new ENG-2303 revision
I29	Existing binding is valid but differs from the manifest	Report `conflict`; do not replace its text, schemas, version or managed marker
I30	Organization count exceeds one durable run's step limit	Continue the sweep by cursor event; process one bounded page in each run

Binding persistence

ENG-2287 owns these cases.

ID	Scenario	Expected result	Owner
B01	Existing custom or platform definition	No implicit binding; existing lifecycle remains valid	ENG-2287
B02	Each of the five stable IDs	Persist the exact ID and positive contract version	ENG-2287
B03	Unknown or case-changed ID; JSON null; missing or extra metadata field	Reject the metadata	ENG-2287
B04	Zero, negative, Boolean or fractional version	Reject the version	ENG-2287
B05	Invalid, oversized or open root schema; remote schema reference	Reject before attachment	ENG-2287
B06	Missing, non-string or malformed required scopes	Fail closed; do not infer a run.start-only contract	ENG-2287
B07	Draft, Agent, Skill, disabled executor or platform template	Refuse binding attachment	ENG-2287
B08	Foreign tenant UUID or missing UUID	Same non-disclosing result; no write	ENG-2287
B09	Publish or draft save races with attachment	Exact row token fails; reload and validate again	ENG-2287
B10	Attach metadata while changing published configuration or references	Database refuses the mixed write	ENG-2287
B11	Two activations for one tenant and ID	One succeeds; one returns a bounded conflict	ENG-2287
B12	Same capability in different tenants	Both activate independently	ENG-2287
B13	Active and inactive executor versions	One active binding; older executor stays runnable	ENG-2287
B14	Change or remove inactive binding metadata; change tenant, kind or UUID	Database refuses the write	ENG-2287
B15	Edit a bound draft or fork its definition	Published contract stays fixed; fork is unbound	ENG-2287
B16	Generic republish of a bound definition	Refuse; require a new definition row	ENG-2287
B17	Disable races with activation	Final disabled row has no active binding; stale activation writes nothing	ENG-2287
B18	Enable a disabled bound definition	Revalidate; keep binding inactive	ENG-2287
B19	Delete an active or inactive bound definition	Refuse; preserve retained executor identity	ENG-2287
B20	Anonymous, tenant, foreign tenant and service-role access	Enforce schema grants, column grants, RLS and service-only writes	ENG-2287
B21	Crash before or during replacement	Two guarded writes; a half switch leaves no active binding and the next pass repairs it	ENG-2303
B22	Child instructions or Skill change with the same scopes	The child needs a new revision, which needs a new bound-root revision, which needs an operator switch. Nothing is implicit	ENG-2303
B23	Replacement during a Run	Frozen UUIDs and capability metadata remain unchanged	ENG-2298

Registry read stress cases

These refine C01 to C05. ENG-2275 owns them. Its implementation tests and one local dry run prove them.

ID	Input or event	Required result
R01	Organization installed nothing	Five records, each `not_installed`; the vocabulary is code
R02	One binding metadata or scope contract does not validate	That ID reads `invalid_binding`; the other four stay available
R03	Executor is disabled, or its binding was deactivated	`inactive_executor`, never `not_installed`
R04	Bound row is an Agent, a Skill, a platform template or a withdrawn row	`invalid_binding`; no delegable result
R05	Two active bindings for one ID	`invalid_binding`; no executor selected by row order
R06	Bound row stores an ID outside the five	Ignored; it adds no record and replaces none
R07	Actor holds no `run.start`	The registry answers five `unauthorized` records; no binding read runs
R08	Actor holds `run.start` and lacks one required scope	`unauthorized` for that ID alone
R09	Child Run actor carries its parent's narrowed grant	The parent grant decides; no role read
R10	Rights read or binding read fails	Raise; never report an empty catalogue for a full tenant
R11	Unknown ID, or a stable ID in changed case	Unknown, not unavailable; the vocabulary is case-sensitive
R12	Organization retains many superseded executors	Active rows are read first; a truncation loses a retained row alone

Read API stress cases

These refine C04 at the HTTP and CLI layer. ENG-2286 owns them. The registry answers each case; these rows fix how a reply reports it.

ID	Input or event	Required result
A01	Actor holds no `run.start`; default `available_only`	200 and an empty `items`; the reply names no capability
A02	The same actor with `available_only=false`	200 and five `unauthorized` records, each without a contract
A03	Organization installed nothing; member holds `run.start`	200 and an empty `items`, which A01 cannot be told from; both mean the caller starts nothing
A04	Two capabilities available and three not; default	Only the two, in stable capability-ID order
A05	`available_only` holds a value that is not a boolean	422; no registry read
A06	The rights read or the binding read raises	500; never an empty catalogue for a full tenant
A07	Any list or single reply	The body holds no `executor_id`, no executor configuration and no provider Tool definition
A08	An available record	It carries `required_scopes`; an unavailable record omits it
A09	Unknown ID, and a stable ID in changed case	404 for both; the vocabulary is case-sensitive
A10	Single read — `unauthorized`, from no `run.start` or from one missing required scope	403 in both cases. The list answers 200 for the same actor; see A01 and A02
A11	`not_installed`, `inactive_executor` or `invalid_binding`	200; the body carries `availability: unavailable` and that reason, and no contract field
A12	Unauthenticated caller	403 from the shared bearer dependency, which answers `Not authenticated`; no route body runs
A13	The organization of the reply	It comes from the token claims alone; a query or body value never selects it
A14	`ac agentic capabilities list` and `get`	The same fields as the API, under `--json`; a table renders the ID, the availability and the reason

Direct start stress cases

ENG-2276 owns these cases. The harness step start checks ST01, ST02, ST07, ST08, ST12, ST13, ST22 and ST27 against a live stack. The unit tests own the other cases. The start identity contract defines the decision order.

ID	Input or event	Required result
ST01	All five known IDs with valid published input	Resolve and start the selected executor; do not hard-code one product
ST02	Unknown or case-changed ID with a fresh key	404 capability_not_found; no Run
ST03	Missing, inactive, duplicate or invalid binding	409 capability_unavailable with a bounded reason; no Run
ST04	Guest or missing required scope	403 capability_unauthorized; no Run or provider call
ST05	The shared rights reader reports a missing scope during resolution	RunManager refuses before insertion
ST06	Extra envelope field, missing input, null input or invalid version type	422; no service call
ST07	Missing, empty, blank or 201-character key	400; no start
ST08	Missing or extra input field; wrong type, enum, count or list size	422 with a field path; no Run
ST09	Invalid UUID or URI under a declared format	422; local schema references still resolve
ST10	Input at 32768 bytes and one byte above, including Unicode	Accept the limit if schema-valid; refuse the excess with 413
ST11	NaN, infinity, invalid Unicode or excessive nesting	Bounded refusal; no Run
ST12	Equivalent object key order and JSON whitespace	Same digest and Run
ST13	Changed array order, string case, parsed numeric type or omitted default	409 idempotency_conflict for the reused key
ST14	Same key with another capability or contract version	409 idempotency_conflict; no second Run
ST15	Identical key in different tenants, callers or sources	Independent Runs; no cross-boundary replay
ST16	Same raw key on the generic Run endpoint	Separate namespace; generic replay behavior stays unchanged
ST17	Identical simultaneous requests	One insert wins; one admission and dispatch; all others return that Run
ST18	Different simultaneous requests sharing a key	One insert wins; the loser returns conflict
ST19	Upgrade or disable before the final executor check	Fresh start refuses; no replacement executor is selected
ST20	Upgrade after the final executor check	The selected immutable executor remains fixed for this start
ST21	Replay after upgrade, disable, budget exhaustion or scope removal	Return the admitted Run without current binding or admission checks
ST22	Replay of a queued, running, waiting, succeeded, failed or cancelled Run	Return current durable status; do not dispatch again
ST23	Crash before insertion	No key claim; a retry can start
ST24	Crash after insertion or lost HTTP response	The Run and digest survive together; retry returns the same Run; incomplete admission remains held
ST25	Dispatch fails after insertion	Replay does not dispatch; the existing reaper owns recovery
ST26	Stored digest missing or malformed	Conflict; no guessed replay and no new Run
ST27	Stale version with a fresh key	409 contract_version_conflict; no silent conversion
ST28	Policy deny or approval	Preserve failed or waiting Run and HTTP 200 started outcome
ST29	Day budget exhausted or policy service unavailable	Preserve 429 with Retry-After or 503; create no Run
ST30	Reference belongs to another tenant or provider connection is missing	The product resolver refuses before provider work; shared start does not duplicate the resolver
ST31	CLI start, JSON output, malformed input and each HTTP refusal	Exact request, required key and version, unchanged Run response, standard exit codes
ST32	Crash after insertion but before admission completes	Temporary approval hold prevents dispatch; wait recovery fails it with wait_abandoned
ST33	Cancellation or human approval hold races with admission release	Conditional release writes nothing; it cannot queue terminal or human-held work
ST34	API/CLI route registration	Live strict audit: zero API-only, CLI-only and method differences

Search and identity

ID	Input or event	Required result	Owner
S01	Supplied domains, repeated domains and a domainless company LinkedIn URL	Stable refs; merged duplicates; LinkedIn fallback; no enrichment	ENG-2278
S02	Provider and supplied observations identify the same company	Deduplicate before gates; retain bounded evidence from both	ENG-2295
S03	Domain and LinkedIn keys identify different canonical companies	Identity conflict; no automatic merge or write	ENG-2278, ENG-2279
S04	Company filter value is missing versus explicitly contradictory	Keep unknown with a diagnostic; exclude contradiction once	ENG-2278
S05	Technology, city, web thesis or funding-event filter in direct Company Search	Unsupported-filter error; no silent broad query	ENG-2295
S06	Page limit, 500 candidates, 60-second deadline or budget reached	Bound calls and retries; preserve usable rows with partial diagnostics	ENG-2295, ENG-2291
S07	Provider timeout after one good page; all provider calls fail	Partial result in the first case; failed Run in the second	ENG-2295, ENG-2291
S08	Valid query finds no matches	Successful empty result; no infinite refill	ENG-2278, ENG-2280
S09	Known-company People Search with supplied person LinkedIn refs	Skip company discovery; normalize identities; apply persona gates	ENG-2280
S10	Name-only person, profile URL conflict or duplicate provider person IDs	Unresolved/conflict diagnostics; never use provider ID as canonical identity	ENG-2280, ENG-2291
S11	Company brief resolves 25 companies or no companies	First 20 distinct refs with explicit truncation; complete zero scope is empty; partial zero scope stays partial	ENG-2293
S12	Both company-scope alternatives, or 21 explicit company refs	Invalid input; no arbitrary scope choice	ENG-2293
S13	One company has many people; another has none	Respect per-company and total caps; report both companies	ENG-2291
S14	Person location differs from employer location	Gate on person location; do not substitute employer country	ENG-2291
S15	Retry selected Search rows; source Run is deleted or foreign	Reuse stable refs; report stale or unauthorized refs without guessing	ENG-2301, ENG-2279

Company supplied-list stress cases

These cases refine S01, S03, S04 and S08. ENG-2278 owns them. They cover the supplied-list tool contract. The public discovery contract also supports Explorium; see CP01 to CP28. The review uses runtime trunk fa3edcc92 and documentation main b24e147.

ID	Input or event	Required result
CS01	Missing source, duplicate sources, Explorium or unknown source	Reject before cache work
CS02	Zero or 101 refs; target 0, 101, boolean or numeric text	Reject the input
CS03	Unknown fields, mixed reference tags, malformed UUID or invalid identity	Reject the input; never accept display text as identity
CS04	Valid uncached domain or organization LinkedIn URL	Return a selectable normalized identity without a canonical write
CS05	Same company by domain, UUID and LinkedIn; repeated inputs	One row, first-input order, all input indexes, at most three evidence records
CS06	Domain and LinkedIn identify different cache records; duplicate canonical keys	Exclude the conflict; never pick a record by query order
CS07	Domainless LinkedIn observation joins one known domain	Merge before gates; preserve the domain as primary identity
CS08	Same LinkedIn key links two different domains	Do not merge the companies; report identity conflicts
CS09	Missing, matching and contradictory values across duplicates	Keep missing values; any explicit contradiction excludes the group once
CS10	Multiple filter values and fields; unknown observed band	OR within a list; AND between fields; unknown band stays unknown
CS11	Empty filter list, duplicate values, unknown field or unsupported band	Reject before cache work
CS12	Zero matches; all identities fail; one identity fails and another fails filters	Empty success; empty partial result; empty partial result, respectively
CS13	100 rows survive, target is 1	Return the first row; no refill or extra provider work
CS14	More than 100 diagnostics	Keep 100 and count every omitted diagnostic
CS15	Long Unicode text and evidence exceed the byte limit	Remove optional content in stable order; retain identities; report truncation
CS16	Required identities alone exceed the result limit	Fail with `payload_too_large`
CS17	Same Run replays; new Run uses the same inputs	Same result UUIDs on replay; different UUIDs for the new Run
CS18	Foreign or missing source Run beside valid direct refs	Refuse the whole request before cache reads; use the same error
CS19	Accessible Run has a missing row, wrong capability or malformed output	Item `stale_reference`; never guess from current display data
CS20	Cache read fails or times out	Fail the tool; never report an empty successful search
CS21	Publish succeeds, draft creation fails or publish refuses	Use the standard lifecycle; report the exact refusal and any retained draft
CS22	Published graph, grants and dry run	One read tool; no provider, Agent, enrichment, canonical write or CRM scope

People supplied-list stress cases

These cases refine S08, S09 and S10. ENG-2280 owns them. The review uses runtime trunk 5b3ed1ca2 and documentation main ca6954b.

ID	Input or event	Required result
PS01	Missing source, duplicate sources, Explorium or unknown source	Reject before cache work
PS02	Absent scope, a `company_search` brief, 21 company refs or both scope forms	Accept the absent scope; reject the brief and the oversized scope
PS03	Zero or 101 person refs; `target_per_company` 0, 11, boolean or numeric text	Reject the input
PS04	A `crm_person` tag, mixed reference tags, unknown fields or a malformed UUID	Reject the input; never accept display text as identity
PS05	Absent persona, empty list, duplicate values, unknown field or unsupported value	Reject before cache work
PS06	Valid uncached individual LinkedIn profile URL	Return a selectable normalized identity without a canonical write
PS07	Organization LinkedIn URL, or a name with an employer, offered as a person	Unresolved; never guess a profile
PS08	Same person by UUID and LinkedIn; repeated inputs	One row, first-input order, all input indexes, at most three evidence records
PS09	Canonical UUID with no record; record with no LinkedIn URL	`not_found` and `unresolved`, respectively
PS10	One LinkedIn key links two canonical records; duplicate canonical keys	Exclude the conflict; never pick a record by query order
PS11	Provider person ID supplied as the only identity	Unresolved; a provider ref is evidence, never an entity key
PS12	Missing, matching and contradictory persona values across duplicates	Keep missing values; any explicit contradiction excludes the group once
PS13	Multiple persona values and fields; a department or seniority criterion	OR within a list; AND between fields; the cache stores neither field, so both stay unknown
PS14	Person country differs from the observed employer country	Gate on person country; never substitute the employer country
PS15	Supplied person with a company scope and a cached employer name	Keep the employer unknown; a display name is never an identity, so the scope excludes nobody
PS16	Zero matches; all identities fail; one identity fails and another fails gates	Empty success; empty partial result; empty partial result, respectively
PS17	100 rows survive with a company scope and `target_per_company` 1	Return the first 100; `per_company` stays empty; the target changes nothing
PS18	More than 100 diagnostics	Keep 100 and count every omitted diagnostic
PS19	Long Unicode text and evidence exceed the byte limit	Remove optional content in stable order; retain identities and counts; report truncation
PS20	Required identities alone exceed the result limit	Fail with `payload_too_large`
PS21	Same Run replays; new Run uses the same inputs	Same result UUIDs on replay; different UUIDs for the new Run
PS22	Foreign or missing source Run beside valid direct refs	Refuse the whole request before cache reads; use the same error
PS23	Accessible Run has a missing row, a `company.search` capability or malformed output	Item `stale_reference`; never guess from current display data
PS24	Cache read fails or times out	Fail the tool; never report an empty successful search
PS25	Publish succeeds, draft creation fails or publish refuses	Use the standard lifecycle; report the exact refusal and any retained draft
PS26	Published graph, grants and dry run	One read tool; no provider, Agent, enrichment, canonical write or CRM scope
PS27	Cached person holds skills, languages and the three history lists	Return `skills` and `languages`; omit the history lists, which have no closed schema

Company provider stress checks

ENG-2295 owns CP01 to CP28.

ID	Input or event	Required result
CP01	Provider only, supplied only, both source orders	Exact source set; supplied-first order; no implicit source
CP02	Provider selected without filters; empty lists, nulls, duplicate sources or unknown properties	Invalid input before work; supplied-only filters remain optional
CP03	Mixed-case supported industries, unknown industry or unsupported city	Normalize supported names; reject unknown values without a broad query
CP04	Every country and employee/revenue token	Exact mapping; no inferred numeric bands
CP05	Old supplied-only definition or grant	Zero provider calls; no paid authority from the old grant
CP06	Foreign or missing saved Run with provider selected	Non-disclosing refusal before provider work
CP07	Same domain in provider and supplied input	One group; preserve supplied indexes and evidence from each source
CP08	Duplicate provider ID with different domains; same domain with different IDs	Provider ID does not merge identities; domain duplicates merge
CP09	Domainless LinkedIn row; name-only row; malformed sibling	Keep LinkedIn identity; diagnose unresolved siblings
CP10	Provider keys identify two cached canonical companies	Identity conflict; do not merge canonical companies
CP11	Cache contradicts a provider filter value	Exclude the merged group once; no refill
CP12	Missing industry in a filtered response	Unknown diagnostic; do not manufacture a matching industry
CP13	Exact country name versus unrecognized country name	Map the exact ISO name; otherwise keep unknown
CP14	Target reached before gates remove duplicates or contradictions	Stop collection; return fewer rows without another request
CP15	Successful empty page or terminal page	Stop cleanly; empty succeeds only without other failures
CP16	More pages than allowed, oversized page or invalid page number	Bound calls and rows; diagnose truncation or provider failure
CP17	First request fails with and without usable supplied identity	Partial with usable identity; otherwise fail the Run
CP18	Later request fails; earlier identities all fail gates	Preserve partial status, counters and failure reason even with zero output rows
CP19	Slow provider or shortened root deadline	Ten-second attempt bound; reserve result time; keep earlier rows
CP20	Insufficient root budget before the first or next page	No unaffordable call; partial budget result; no no_matches claim
CP21	Timeout, 429, 5xx or malformed JSON	No hidden retry; meter uncertain spend once; stable error
CP22	Valid credits, absent credits or invalid credits	Use valid charge or conservative estimate; never count total query matches as billed rows
CP23	Meter read or write fails	Terminal failure; no next provider request
CP24	Missing key or entitlement; development dummy key	No fake results; explicit provider failure; preserve usable supplied identities
CP25	Cancellation, completed-step replay or process stop before meter persistence	Propagate cancellation; reuse completed result; interrupted steps can repeat calls and leave uncertain charges
CP26	Long facts, many diagnostics or required output exceeds byte cap	Trim optional facts; exact omitted count; fail if identities cannot fit
CP27	Repeated call with one Run ID; new Run ID	Stable IDs within a Run; different IDs for a new Run
CP28	Root already has child usage or two concurrent searches	Read canonical tree usage; do not double-charge summaries; document bounded concurrent overshoot

The root meter is an accrual check, not an atomic reservation. Concurrent calls can each pass before either records its charge. One lane has only one in-flight page. Cross-lane overshoot follows the existing platform policy and is bounded per admitted page. Atomic tree-wide reservations require a platform budget change and are outside this provider adapter.

People provider design checks

ENG-2291 owns these cases. ENG-2300 owns the live provider evidence. They use API trunk 73fa64cae and docs 8d58913 as their baseline.

ID	Input or event	Required result
PP01	Missing or duplicate source; invalid persona vocabulary	Reject before reads or calls
PP02	Provider source without scope; company brief; more than 20 refs	Reject; the brief belongs to ENG-2293
PP03	Supplied-only request through either tool	Same rows and no provider cost; old grant stays free
PP04	Canonical, domain, LinkedIn and selected company refs overlap	Resolve and deduplicate in first-input order
PP05	Foreign company or person source Run	Same stale-reference refusal before provider work
PP06	Missing selected row, company UUID or canonical identity conflict	Per-company unresolved reason; continue valid companies
PP07	Null match, repeated match, wrong echoed input or item error	No prospect query for that company
PP08	Two distinct company identities match one business ID	Both unresolved; no duplicated provider query
PP09	Title, department, seniority and person country together	OR within lists; AND between fields; no related-title expansion
PP10	Employer country differs from person country	Use only the person's country
PP11	Missing department, unsupported level or multi-level fallback	Unknown diagnostic; never claim verified fit
PP12	Employer ID is absent or differs from requested company	Unknown when absent; exclude merged group on contradiction
PP13	Missing, invalid or organization LinkedIn URL	Unresolved row; provider ID never supplies identity
PP14	Repeated provider ID on distinct LinkedIn URLs; alias arrays	Keep primary URLs separate; do not merge aliases
PP15	Supplied and provider observations share a profile URL	Merge before gates; preserve indexes and source evidence
PP16	Cache UUID conflict or contradictory observed title	Exclude the full merged group
PP17	Empty company, target 1 or 10, twenty full companies	One page per company; fair order; 100-row output cap
PP18	Mixed sources exceed 100 rows	Company round-robin first, then supplied-only groups; report truncation
PP19	Provider returns too many rows, wrong page or malformed payload	Bound memory and candidates; explicit partial or failed source
PP20	Timeout, 429 or 5xx on one company	Keep earlier rows; continue later companies within remaining bounds
PP21	401, 403, missing key or missing license	Stop provider work; preserve usable supplied rows
PP22	Deadline or root budget reached before first or later call	No next call; mark all unattempted companies; no false empty success
PP23	Missing, invalid, exact or excessive credit report	Conservative estimate or valid credits; stop on excessive charge
PP24	Meter read or write fails	Terminal failure; no later provider call
PP25	Completed-step replay, cancellation or process interruption	Stable rows on replay; propagate cancellation; document uncertain spend
PP26	Long facts, 100 diagnostics or large company refs	Stable trimming; exact omitted count; fail if required fields exceed limit
PP27	All calls fail, successful empty calls, or all matches unresolved	Failed, empty, or partial respectively; never conflate outcomes
PP28	Provider failure leaves identities that gates later exclude	Partial zero-row result; retain failure evidence
PP29	Provider query returns the same person for two companies	Merge once; assign first company; report both company counts
PP30	Old published supplied grant invokes the new provider tool	Authorization refuses; republishing needs the new grant

Enrichment and asynchronous work

ID	Input or event	Required result	Owner
E01	Basic/Standard request with all requested fields current	Cache hit; no paid call; no fabricated per-field timestamps	ENG-2279, ENG-2281
E02	Current row has a missing requested field	Fill that gap; currentness does not imply completeness	ENG-2279, ENG-2281
E03	Missing tier stamp, exact TTL boundary or stale refresh	Treat as stale; refresh only requested targets	ENG-2279, ENG-2281
E04	Later source contradicts an accepted earlier source	Preserve deterministic precedence; do not clear fields with null	ENG-2279, ENG-2281
E05	All refresh sources fail while old cache values exist	Preserve old facts and timestamps; report failure, not fresh success	ENG-2279, ENG-2281
E06	Two Runs update the same canonical identity	Preserve both source lineages; conflict check or serialize writes	ENG-2279, ENG-2281
E07	CRM identity input includes private notes or manually edited fields	Read identity under tenant scope; no CRM write or private global-cache write	ENG-2301
E08	Deep preset, phone, arbitrary research or fields outside the selected preset	Reject before paid work	ENG-2279, ENG-2281
E09	Profile succeeds; email remains running	Persist profile early; keep root live; show email pending	ENG-2299, ENG-2289
E10	Callback arrives before wait registration	Read durable terminal job state; do not wait forever for a lost event	ENG-2210, ENG-2299
E11	Callback arrives before the platform job exists	Reserve before POST; bind the vendor ID from the verified callback; do not submit twice	ENG-2300, ENG-2210
E12	Callback replay, reordered contacts, duplicate or unknown echoed refs	Match exact refs; report invalid refs; patch and settle once	ENG-2210, ENG-2299
E13	Some emails found, others absent, provider reports unverified email	Keep successes; distinguish not-found from failed; preserve verification meaning	ENG-2299
E14	Cancel or timeout, then receive a late callback	No cancelled-lane writes or resumed Run; settle any real charge once	ENG-2299
E15	Provider job completes but canonical write fails	Retry the write, not provider submission; never report refreshed before persistence	ENG-2299
E16	Profile-only write while email is stale	Preserve the old email hot stamp; do not suppress email refresh. Trunk already does this; keep it under a regression test	ENG-2281
E17	Stale title refresh succeeds, stale summary refresh fails; summary is requested again	Preserve warm stamp; repeat the summary lookup; do not mark the retained old summary current	ENG-2281
E18	Request only email; reopen the result after canonical email changes	Return verification metadata independent of selected value fields; preserve the frozen pair; old cache without evidence is unknown	ENG-2299, ENG-2289

Company Enrich design stress cases

ENG-2279 owns these cases. Runtime comparisons use ac-python-api/agentic-platform. Documentation comparisons use ac-docs/main.

ID	Input or event	Required result
CE01	Empty subjects, 101 subjects, unknown preset or field	Reject before cache reads or paid calls
CE02	Repeated domain, canonical ID and selected row for one company	Resolve once; retain all input indexes in input order
CE03	Selected row belongs to another tenant or deleted Run	Reject the request before provider work
CE04	Missing selected row, failed source Run or wrong result kind	Return an unresolved item with a stable diagnostic
CE05	Canonical ID and domain identify different rows	Reject the conflicting item; do not join the companies
CE06	Client display contains a name, private notes or provider payload	Use verified identity only; never persist client facts
CE07	Known canonical company has only a LinkedIn identity, stored as a key or URL	Resolve company, school and showcase pages to the public URL; do not manufacture a domain
CE08	All requested values exist and warm time is current	Return a hit without provider work; cached LinkedIn logo maintenance can write a stable URL while preserving tier times
CE09	Warm time is current but one selected field is absent	Request that gap only; currentness does not prove completeness
CE10	Missing warm time, exact 30-day boundary or future timestamp	Treat as stale; reuse one durable evaluation time
CE11	Missing-only refresh finds an existing stale value	Keep it with retained state and a stale cache decision; do not claim verification
CE12	Selected stale field succeeds; another retained stale field is untouched	Preserve warm and cold stamps before the write
CE13	Selected stale field returns no replacement	Keep the stored fact and old stamps; mark the requested field unavailable
CE14	All selected providers fail	Keep prior facts; report partial or failed outcome, never refreshed
CE15	Provider returns null, blank, wrong types, fractional counts, negative numbers or NaN	Drop invalid facts and their derived fields; retain valid zero counts through the store
CE16	Later provider contradicts an accepted earlier provider	First accepted source wins within the attempt
CE17	Domain or LinkedIn evidence conflicts with a provider	Reject that provider payload before persistence
CE18	Request only founding_year or one exact count	Gate by the selected field; legacy preset omissions and alternative bands do not satisfy it
CE19	Provider cannot supply a selected field	Skip that source; do not fetch unrelated fields to satisfy the legacy gate
CE20	Logo rehosting fails	Keep the stored old fact and any usable old output logo; omit an unusable LinkedIn URL and mark it failed, never refreshed
CE21	Canonical write fails after provider calls complete	Retry persistence with durable provider results; do not repeat completed paid steps
CE22	Two Runs write the same identity	Recheck identity, preserve concurrent fact groups and union full source lineage; report refreshed only for the accepted group
CE23	Concurrent writer changes identity or deletes the record	Refuse the stale write and final-row projection; do not attribute another company's facts to the original ref
CE24	Partial update leaves old qualifiers or unrelated extra fields	Preserve extra fields; reject incomplete group changes that would attach old currency, year, count or address data to a new fact
CE25	Lineage or diagnostics exceed output limits	Trim them with exact omitted counts; retain full canonical lineage and all selected values and states
CE26	Selected values or required row data exceed output byte limit	Preflight after deduplication and between children; stop further paid work with payload_too_large and preserve persisted facts and usage
CE27	Durable component invoked from an ordinary tool step	Reject nested steps; invoke from the workflow orchestration boundary
CE28	Component or legacy helper imported into src.agentic	Import contracts fail; use the registered function ID across the boundary
CE29	Provider timeout, 429, malformed response or uncertain charge	Bound attempts and time; retain per-item failures and conservative cost evidence
CE30	Completed step replay, settings change or retry after persistence	Reuse source eligibility, durable results and usage IDs; do not skip saved usage or charge summary rows again
CE31	Worker dies after provider accepts a request	State the uncertain charge; do not promise exactly-once provider execution
CE32	Root deadline, cancellation or cost limit reached between sources	Start no next source and make no late canonical write
CE33	Meter read or write fails	Stop paid work with metering_unavailable; do not swallow the fault
CE34	One failed item in a 100-item batch that fits the byte limit	Preserve ordered sibling results and bounded diagnostics; unstarted rows use not_read cache state
CE35	Publish refusal, missing grants or missing provider connection	Preserve lifecycle refusal; never publish a bypass or synthetic result
CE36	Existing Sonar caller omits the new target options	Preserve the legacy caller contract and source order
CE37	Component runs for more than 150 seconds; another worker retries	Preserve the durable claim until its deadline; never dispatch a second invocation
CE38	Policy requests approval, then the user approves	Wait durably; validate approval coverage; claim and dispatch once
CE39	Approval is rejected, expires, or the Run is cancelled while waiting	Start no component and take no claim
CE40	Worker stops after preparation or after dispatch	Replay the preparation and invocation IDs; retain the original claim token
CE41	Component completes; worker stops before settlement	Reuse its result; validate and complete the journal without another provider call
CE42	Legacy and agentic apps have different IDs	Invoke the configured legacy app and fixed company component ID
CE43	Agent or direct ordinary tool path selects the durable binding	Return an explicit unavailable result; do not execute inside a nested step
CE44	Cancellation races with an already submitted provider or database request	Start no subsequent work; record the uncertain outcome without promising rollback
CE45	Claim commits but preparation does not checkpoint	Recover the same durable owner, token and deadline; do not wait for lease expiry or renew the operation

Runtime integration gate

An ordinary workflow tool runs inside step.run. Inngest does not permit a nested component invocation there. ENG-2279 needs a workflow orchestration seam for an authorized durable tool before it can publish the enrichment workflow. Use a trusted durable binding in the tool registry and keep the public workflow ToolNode shape. Only the workflow executor can execute this binding. User definitions cannot supply arbitrary component or app IDs. Extract preparation and settlement from the existing invoker; do not create a second policy or journal implementation. Preparation returns a typed, internal invocation record. The normal result schema never exposes its claim token. Settlement validates, bounds and records the output, completes the claim, and updates the original telemetry. The seam must keep the existing tool validation, policy, approval, idempotency, output and usage owners. It must authorize before dispatch, invoke the registered component outside step.run, and settle the durable result afterward. The invocation must name the legacy component app explicitly; the agentic app has a different ID. The trusted binding has a 1,800-second operation limit, reduced by the remaining root deadline. After approval, persist the operation deadline and owner token in a durable step before acquiring the journal claim. Claim acquisition uses that owner token and the fixed request hash. If the claim commits before preparation checkpoints, the existing journal service must recover the same owner and token. Recovery cannot extend the operation deadline or claim a token owned by another invocation. The claim lasts until that deadline plus 30 seconds. It does not use the ordinary 120-second handler budget. The durable invocation key includes organization, Run and workflow node identity. It does not include the worker attempt. Preparation, dispatch and settlement replays reuse this key and the original claim token. After the operation deadline, a recovered invocation can settle completed evidence but cannot start more provider work. A worker that loses the claim cannot write canonical data or complete another worker's claim. A cached authorization must not permit new work after cancellation, deadline expiry or claim loss. A policy approval request suspends preparation without taking a claim or dispatching the component. Read approval state before and after the durable wait so an early decision cannot strand the Run. Approval resume validates the approval against the same principal, tool and argument hash through the existing invoker. Rejection, expiry or cancellation ends the call without dispatch. Approval replay cannot widen the original request. The component must recheck cancellation, deadline and remaining cost before each source and before canonical persistence. It must preserve completed provider results when only persistence needs a retry. Cancellation cannot undo a request already accepted by a provider or database. Record that race explicitly and stop subsequent work; never promise an external rollback. No raw event dispatch followed by an in-memory wait can replace this seam.

The existing provider log context identifies legacy workflow Runs. An agentic root ID cannot be written into that foreign key. Root usage needs explicit agentic attribution and stable usage IDs at the provider step boundary. A summary may read those charges; it must not write a second aggregate charge. Provider calls interrupted before a durable checkpoint can repeat. The design does not claim exactly-once external billing.

People Enrich design stress cases

ENG-2281 owns these cases. Runtime comparisons use ac-python-api/agentic-platform. Documentation comparisons use ac-docs/main.

Three contract decisions come from this review. Each one answers a case below.

The Standard preset dropped industry, skills, languages, experience_history, education_history and certifications. Only People Search discovery supplies them, and People Enrich takes identities rather than queries, so every request reported them missing.
Only a sourced field holds a tier stamp back. work_phone, mobile_phone and the six discovery-only fields have no V1 source, so under the company rule one stored value would pin the warm stamp forever and every later request would pay Hunter again.
Contract version 1 declares the whole PersonRef union. The tenant adapter resolves both tenant tags without a version bump.

ID	Input or event	Required result
PE01	Empty subjects, 101 subjects, unknown preset, or a field outside the chosen preset	Reject before cache reads or paid calls
PE02	A dropped discovery-only field name, such as `skills` or `experience_history`	Reject as an unknown field; the value stays stored and readable
PE03	`email_source` or `email_score` requested without `email`	Reject the input
PE04	`crm_person` or `search_result` ref	Keep the version 1 schema; apply the tenant adapter cases PI01 to PI28
PE05	Same person by canonical UUID and by LinkedIn URL; repeated inputs	One work item, first-input order, every input index retained
PE06	LinkedIn URL with tracking query, trailing slash or mixed case; a company or school URL	Normalize through the shared profile key; refuse a URL that is not an individual profile
PE07	`intel_person` UUID that never existed or whose row was deleted	Return `stale_reference`; never create a row from the UUID alone
PE08	Canonical row identity changes between the cache read and the write	Refuse that write with `identity_conflict`; never attribute one person's facts to another
PE09	Every selected field is present and the warm stamp is inside 90 days	Cache hit; no provider call and no canonical write
PE10	Warm stamp is current but one selected field is absent	Request that gap only; currentness does not prove completeness
PE11	Missing warm stamp, exact 90-day boundary, or a future stamp	Treat as stale; reuse one durable evaluation time
PE12	`refresh: missing` finds an existing stale value	Return it as `retained` with a `stale` cache decision; make no provider call for it
PE13	Every sourced warm field is verified or refreshed in this attempt	Advance the warm stamp
PE14	One sourced warm field stays unverified	Preserve the warm stamp; report that field `failed` or `not_found`
PE15	Only `work_phone`, `mobile_phone` or a discovery-only field is stale and unverified	Advance the warm stamp; an unsourced field never holds it back
PE16	Repeat the same Basic `refresh: stale` request after one successful full attempt	Second request is a cache hit with no provider call
PE17	Cached person already has an avatar and `current_title` is a pending selected field	Run the source; the discovery avatar guard does not apply to a selected request
PE18	The existing Headhunter caller runs with no selected targets	Preserve the avatar self-skip, the source order and every legacy step ID
PE19	No pending selected field is inside a source's output set	Skip that source; make no paid call
PE20	The source returns a new place string	Write `location`, `country` and `country_code` from that one observation
PE21	The source returns a changed place with no country	Keep the stored place group; leave the selected field unavailable
PE22	The source emits `email`, `email_source` or `email_score`	Drop them; FullEnrich alone owns the email family
PE23	Provider returns null, blank, a wrong type or an over-length string	Drop the invalid fact; keep the stored value; never write a partial group
PE24	Provider misses, rate-limits, times out, or has no configured key	Keep prior facts and stamps; report `failed`, never `refreshed`
PE25	Two Runs write the same LinkedIn identity	Union source lineage, preserve concurrent groups, recheck identity, report `refreshed` only for the accepted group
PE26	A concurrent writer changes or removes the row the canonical UUID named	Refuse the stale write; never insert a replacement row under the expected UUID
PE27	Canonical write fails after the provider call completes	Retry persistence with the durable provider result; make no second paid call
PE28	Profile-only write while the email is stale	Never stamp the hot time; keep the email refresh available
PE29	Email refresh fails	Preserve the old hot stamp as well as the old email value
PE30	Avatar rehost fails	Keep the stored avatar, mark the selected field `failed`, and write no newer tier stamp
PE31	A subject reaches the write with no normalizable LinkedIn identity	Refuse it with a diagnostic; a silent no-op must not read as success
PE32	100 subjects, long Unicode summaries, or lineage beyond the output limit	Trim lineage and diagnostics with exact omitted counts; return `payload_too_large` when required rows cannot fit
PE33	One item fails inside a 100-item batch	Preserve ordered sibling results and bounded diagnostics
PE34	Root deadline, cancellation or cost limit reached between subjects	Start no next child and make no late canonical write; unstarted rows use `not_read`
PE35	Meter read or write fails	Stop paid work with `metering_unavailable`; do not swallow the fault
PE36	Publish refusal, a missing grant, or a missing provider connection	Preserve the lifecycle refusal; never publish a bypass or a synthetic result
PE37	A legacy people helper is imported into `src.agentic`	Import contracts fail; cross the boundary by the registered component ID
PE38	`email` requested under a profile-only executor	Report the field unavailable; profile enrichment still succeeds
PE39	Warm stamp inside 90 days, hot stamp beyond 30, email requested	Judge each field by its own tier: request the email, never report it `current`, and hold the hot stamp

People Enrich input adapter design stress cases

ENG-2301 owns these cases. The runtime baseline is agentic-platform. The docs baseline is main. The People Search producer exists on runtime trunk through ENG-2280, ENG-2291 and ENG-2293. Use its frozen output format for adapter tests and live producer handoff checks.

ID	Input or event	Required result
PI01	Empty input, 101 subjects, invalid UUID or extra client display fields	Existing contract rejects before reads
PI02	All four reference tags in one request	Resolve identities; preserve first-input order and all indexes
PI03	Missing CRM person; foreign CRM person	Same batch refusal before canonical reads or provider work
PI04	Missing source Run; foreign source Run	Same batch refusal before canonical reads or provider work
PI05	One inaccessible tenant reference follows valid subjects	No partial dispatch or paid call
PI06	CRM LinkedIn key, URL, mixed case, query or trailing slash	Use the existing normalized individual profile identity
PI07	CRM identity absent, blank, wrong type, company URL or path traversal	Item unresolved; valid siblings survive
PI08	CRM record contains private notes, email or manual profile changes	Read identity columns only; no CRM mutation or global fact copy
PI09	Succeeded source Run has a complete or partial people.search outcome	Resolve the selected row from its frozen output
PI10	Source Run waiting, running, failed or cancelled	Item stale_reference; start no work for it
PI11	Wrong output slot, capability, version, envelope shape or more than 100 rows	Item stale_reference; no fallback to other output
PI12	Selected result ID missing, repeated or malformed	Item stale_reference; never choose the first duplicate
PI13	Saved row contains another tenant tag, provider ID or display-only identity	Item stale_reference; do not follow references or guess
PI14	Unselected row has invalid display; selected row has extra private display	Ignore display; use only selected identity fields
PI15	Saved canonical reference and canonical_id name different UUIDs	Item identity_conflict; do not select one
PI16	Saved LinkedIn identity and current canonical identity differ	Item identity_conflict; no provider work for that item
PI17	Saved canonical UUID is deleted; stored canonical profile is invalid	Item stale_reference; no fallback or replacement insertion
PI18	Same person appears as CRM, selected row, canonical UUID and URL	One work item; preserve the canonical guard and every input index
PI19	Two canonical UUIDs normalize to one profile	Every input in that group has identity_conflict; no merged UUID
PI20	Valid duplicates surround unresolved or stale items	Stable first-input order; failed inputs retain separate rows
PI21	100 selections repeat one CRM ID or one Run ID	Deduplicate lookup IDs; no per-selection query
PI22	100 distinct CRM IDs or source Runs; large canonical ID set	UUID batches at most 50; total preparation at most ten seconds
PI23	Tenant or canonical query fails or times out	Batch cache_unavailable; no person child dispatch or provider work
PI24	Cancellation during a read	Propagate cancellation; do not convert it to a cache miss
PI25	Required result exceeds the byte cap after grouping	Existing payload_too_large refusal before provider work
PI26	CRM edited or source deleted after a completed preparation checkpoint	Replay the saved preparation; a fresh Run reads the current state
PI27	Canonical row changes after preparation	Existing component rejects the identity change before work or persistence
PI28	Process stops before preparation checkpoints	Reads can repeat; do not promise a transaction across tenant and canonical reads

Composition and product surfaces

ID	Input or event	Required result	Owner
P01	Front Door selects a valid product ID	Validate the exact product schema; do not inject a `text` field	ENG-2283
P02	Front Door selects a custom Agent/Workflow UUID	Preserve the existing custom-definition path	ENG-2283
P03	Compound request, missing input or ambiguous "stop that"	Clarify once; do not invent a multi-start plan or cancel target	ENG-2283, ENG-2297
P04	Five products plus many custom definitions	Include eligible products in the bounded shortlist; retain custom routing	ENG-2283
P05	Signals discovery, company-set and saved-search starts	Preserve root schemas, scores, smart-feed/diff behavior and bounded scope	ENG-2282, ENG-2302
P06	Signals thesis/web discovery has no firmographic equivalent	Keep signal research; use supplied child search for identity and gates	ENG-2282
P07	Child retries, zero people or partial enrichment	Reuse child Run keys; retain parent lineage and single root cost accounting	ENG-2282, ENG-2302
P08	Select rows, navigate to Enrich or Find People, then reload	Restore tenant-scoped refs; require a separate start; preserve order	ENG-2288, ENG-2289, ENG-2292
P09	Switch organizations while a launch or result request is in flight	Clear selections and ignore the old tenant's late response	ENG-2284
P10	Stream disconnect, duplicate event or browser reload during email wait	Reconcile durable root and child Runs; no second start or duplicate row	ENG-2284, ENG-2289
P11	Capability unavailable, denied or version-changed after form load	Show the reason and retain valid inputs; require an explicit revised start	ENG-2284
P12	Finished Run is reopened after Intelligence changes	Keep the frozen Run output; do not replace it with current entity data	ENG-2298, ENG-2289

Front Door routing evaluations

ENG-2297 owns these cases. They test one conversational turn, and no other surface. Two layers read one case set. The deterministic layer drives FrontDoorService with a scripted decision and runs in CI. The model layer replays the same cases through the real Agno runtime, scores the route with record_routing(expected=), and runs locally only. A row that trunk already proves names its existing test; it gets no second test.

The model layer scores the rows a request can produce. It does not score a broken vendor answer, a UUID the model never reads, or a live Run, so FD17 to FD23, FD26 and FD27 are proved by the deterministic layer alone.

The shortlist is per case, and it was one fixture for every case. A refusal that rests on what the tenant may start is not presented by a request alone. EMPTY_SHORTLIST in capability_routing_suite.py names the cases whose actor holds no run.start, and the eval builds two empty halves for them.

⚠️ FD16 is model-scored, and FD17 is not. ENG-2341 made one rights answer decide both halves of the shortlist, so an actor that may start nothing reads nothing and the FD16 reply is fixed. FD17 has no such fixture. Three of the five stable IDs are searches, so a partial install always leaves a near neighbour of the missing product, and a delegate to that neighbour is a routing judgement rather than a disclosure. The deterministic layer proves FD17, and the case still fixes that the two replies match.

The case set lives twice, and one change edits both.ac-python-api tests/agentic/entry_control/front_door/capability_routing_suite.py holds ROUTING_CASES, and this section holds the same 28 rows. They sit in two repositories, so no build compares them. test_design_page_sync.py reads this page from the monorepo working tree and fails when the IDs, their order, their group or a required result differs. Run it with the rest of the front door suite.

Positive intents

Each row takes one direct request and two paraphrases.

ID	Request	Required result
FD01	Find companies that match a description	Delegate `company.search`. Input holds no `text` key
FD02	Add detail to companies the person already has	Delegate `company.enrich`
FD03	Find people at named companies	Delegate `people.search`
FD04	Add detail or work email to people the person already has	Delegate `people.enrich`
FD05	Find companies by an event or a change	Delegate `signals.search`

Near-miss separation

Three of the five IDs are searches, so these rows fix the boundary between them.

ID	Request	Required result
FD06	"Find companies that are hiring"	Clarify once. `signals.search` owns an event-shaped company request, and `company.search` holds no event filter
FD07	"Get me the CTOs and their emails"	Clarify once. Two capabilities cannot start on one turn
FD08	"Find CTOs at fintech companies in Berlin"	Delegate `people.search`. The published company brief is its own child, and not a second start
FD09	"Find companies, then enrich them"	Clarify once. Do not start the first step and imply the rest

An event-shaped company request belongs to signals.search (ENG-2338).company.search filters on country, industry, employee band and revenue band, and provider_filters refuses an empty filter set, so it can answer no event request. Hiring is the first member of the canonical signal vocabulary. FD06 required a question about which product the person meant, and there is one product, so the question is about the field the brief needs instead. The row names the owner, so a turn that selects signals.search and then asks for that field scores a pass, and a turn that selects company.search does not. The published signals.search description carries the event vocabulary, and a front door rule carries the boundary.

Missing input

One required field is absent in each row. The turn asks one question and starts no Run.

ID	Capability	Required result
FD10	`company.search`	Clarify naming the failing field path. No Run
FD11	`company.enrich`	Clarify naming the failing field path. No Run
FD12	`people.search`	Clarify naming the failing field path. No Run
FD13	`people.enrich`	Clarify naming the failing field path. No Run
FD14	`signals.search`	Clarify naming the failing field path. No Run

Refusals

ID	Input or event	Required result
FD15	A task no published capability performs	Answer that no published capability matches. No Run
FD16	The actor holds no `run.start` right	The same non-disclosing answer as FD17. The reply separates no tenant state
FD17	The tenant installed three of the five, and the request needs a fourth	The same non-disclosing answer as FD16. No Run
FD18	The model writes a stable ID outside the five	The decision is refused. The turn fails and creates no Run
FD19	The model writes a well-formed UUID the shortlist never held	Refuse deterministically. No Run
FD20	The model writes the UUID of a product-bound executor	Refuse. A bound executor is never a custom capability
FD21	The model writes the UUID of another tenant's definition	Refuse. The reply names no foreign row
FD22	The capability is disabled between the shortlist read and the start	`RunManager` resolves again and fails closed. The turn reports the reason

The tool boundary

ID	Input or event	Required result
FD23	Any shortlist reaches the prompt	The prompt holds no executor UUID, no scope and no output schema. It holds no tool name either, except the four stable IDs a tool shares its name with
FD24	The message names a provider by name	The selectable set stays the five stable IDs and the custom UUIDs. A provider is never one of them

Four tools carry the name of the capability that wraps them: company.search, company.enrich, people.search and people.enrich. FD23 reads the tool vocabulary minus those four, so the shared name is not read as a leak.

Preserved behavior

These rows keep their Phase 6 and ENG-2283 tests. The exit gate cites each node ID and resolves it by import.

ID	Input or event	Required result
FD25	A custom Agent or Workflow is selected by UUID	Start it with the message-text fallback
FD26	One live Run, and a clear request to stop it	Cancel through `RunManager`. Cancel stays idempotent
FD27	More than one live Run, and "stop that"	Clarify once. Cancel nothing
FD28	An `answer` or a `clarify` decision	No Run on either decision

Run cadence

The model layer calls a paid vendor API and it is not deterministic, so it carries the eval marker and pytest.ini excludes that marker. CI never runs it. It runs on a trigger instead, and the owner is the author of the change that fires the trigger.

Three changes invalidate the accuracy number. Each one is a trigger:

Trigger	What changes
The Front Door prompt	A new rule, a reordered instruction or a new example
A capability name, description or input schema	`build_capability_manifest` writes the text the model reads
The Front Door model	`FRONT_DOOR_MODEL`: the provider, the model, the version or the temperature

Bash

ANTHROPIC_API_KEY=sk-... uv run pytest \
    tests/agentic/entry_control/front_door/test_routing_accuracy_eval.py \
    -m front_door_eval --no-cov -p no:xdist -o "addopts=" -v

Record the score in the pull request that carries the change.

The observed band is 0.79 to 0.86. Four runs on claude-haiku-4-5 scored inside it. The floor is 0.70, and it is a regression bound rather than a target: a router that guesses over five products and four other outcomes scores near 0.15. A run inside the band is a pass. A run below the band is a finding, and the run prints the missed requests. Raise FRONT_DOOR_ACCURACY_FLOOR only when a prompt change fixes a miss and a second run holds the higher number.

Shared frontend shell stress cases

ENG-2284 owns these cases. ac-frontend src/components/capabilities/__tests__/ and the browser exit suite prove them. Product forms, result tables, provider execution and asynchronous canonical reads keep their existing owners.

ID	Case	Required result
F01	Gate absent, false, or another value	Hide all five navigation entries; direct URLs show not found
F02	Gate true on desktop and mobile	All five routes load; Search and Enrich navigation works; legacy URLs still load
F03	No authenticated user	Existing login guard applies before product reads
F04	Available, unavailable, unauthorized, empty catalogue, read failure	Show distinct states; never invent absent schemas
F05	Draft contains unknown fields or invalid nested values	Server decides validity; map bounded paths without rejected values
F06	Invalid JSON values or input exceeds 32 KiB	Refuse before POST; retain the draft
F07	Double click while POST is unresolved	Send one request with one key
F08	Server admits a Run but the response is lost	Explicit retry uses the frozen input and key; restore the same Run
F09	Reload during an uncertain start	Restore the attempt; require an explicit retry; no automatic POST
F10	Edit input while the earlier start is uncertain	Refuse replacement until the earlier attempt is resolved
F11	Version conflict, permission change, unavailable binding, budget refusal	Retain the draft; show the reason; require an explicit corrected start
F12	HTTP 200 contains waiting, failed or duplicate	Display the durable status; do not claim success from HTTP status
F13	Reopen an admitted Run after reload	GET the stored Run ID; never POST
F14	Stream gap, reconnect, quiet wait or failed transport	Re-read durable state; polling continues while the Run is nonterminal
F15	Duplicate hints or refresh while a read is in flight	Coalesce reads; no duplicate result state or stale response overwrite
F16	Child completes while root waits	Keep following the root
F17	Root completes, fails or cancels	Refresh frozen output; stop live resources after durable terminal state
F18	Navigation, organization change, logout or impersonation	Stop resources; clear visible state and selections; retain recovery records in their original scope; ignore late responses
F19	Ordered selection repeats a ref or exceeds 100 refs	Deduplicate in order; reject excess refs; never put refs in URLs
F20	Reload restores malformed, old-scope or wrong-entity selection	Clear invalid state; require selection again; never auto-start
F21	Session storage fails before launch	Show recovery failure; send no POST
F22	Search result points to a canonical entity	Preserve its typed ref; never infer CRM promotion or enrichment
F23	Empty, partial, failed, cancelled or newer canonical facts	Preserve the durable status and output; product adapter owns result interpretation
F24	Run read returns 403 or 404 after reload	Stop following; show the read failure; never launch replacement work
F25	Lost response, then rate-limit or auth refusal before replay lookup	Keep the original request and key; recover the first Run when retry succeeds
F26	Response body fails after HTTP 200	Keep the attempt uncertain; retry with the original key

Company Search journey stress cases

These cases define ENG-2290. They use runtime agentic-platform and documentation main. The shared shell cases F01-F26 and provider cases CP01-CP28 retain their owners.

ID	Case	Required result
CJ01	Gate off; direct route or navigation	Use F01; no Company Search entry
CJ02	Loading, unauthorized, uninstalled, read error	Keep the frame; show each reason; disable a new start
CJ03	Missing schema metadata or version other than 1	Show unsupported contract; do not guess controls or start
CJ04	Fresh supported schema	Use published limits and default 50; select only supplied
CJ05	Supplied domains and organization LinkedIn URLs	Keep order and raw identities; no CSV or name inference
CJ06	No companies, 100 refs, 101 refs	Require companies; accept boundary; refuse overflow without truncation
CJ07	Provider-only source	Require a supported filter; omit companies
CJ08	Both sources; source toggles	Include companies only when supplied is selected; no implicit provider source
CJ09	Four filters; no filter; blank filter	Use documented fields only; omit blank lists
CJ10	Duplicate filters; more than 20 values; invalid country or band	Show a field error; no silent broadening
CJ11	Unknown provider industry	Keep text; executor rejects before paid work; failed Run remains visible
CJ12	Count 0, 1, 100, 101, decimal or blank	Accept schema boundaries only; never clamp
CJ13	Unknown facts or fewer rows than target	Show unknown facts; do not refill or enrich
CJ14	Double click, lost response, reload, refusal	Reuse F07-F13 and F25-F26; retain frozen input and key
CJ15	Queued, running, approval wait, provider wait	Show durable Run state; lock new starts; retain result frame
CJ16	Succeeded complete, empty, partial with rows, partial with zero rows	Read nested company_search; distinguish all outcomes
CJ17	Failed or cancelled with no output	Show durable failure or cancellation; never show empty success
CJ18	Succeeded with missing output, bad IDs, duplicate IDs or wrong version	Show result error; disable selection; never invent rows
CJ19	Funnel counts, source failures, omitted diagnostics, estimated usage	Show frozen values and labels; do not recompute or double-count
CJ20	Missing display fields; markup or unsafe URLs in facts	Use identity fallback and escaped text; do not execute or guess links
CJ21	Select, deselect, select all, clear; up to 100 rows	Save ordered search-row refs; preserve the Run and result IDs
CJ22	Reload or leave and return to the same successful Run	Restore the frozen request and matching selection without POST
CJ23	New search admitted, refused or uncertain	Clear prior selection only after admission; never mix two Runs
CJ24	Stale refs or saved selections from another Run	Offer selection again; do not select guessed rows
CJ25	Storage write fails during selection	Show the failure; retain the previous saved selection
CJ26	Actor, tenant or impersonation changes while visible	Clear draft, rows and selection; reject late responses through the shell
CJ27	Stream duplicates, reconnect or terminal refresh	Use F14-F18; no duplicate rows or changed selection
CJ28	Navigate to Enrich or People	Retain shared refs; no automatic start; handoff controls keep their existing ticket owners
CJ29	Keyboard, desktop, mobile and long fields	Reach every control; scroll table inside frame; no page overflow
CJ30	Live supplied-only search and provider request	Capture desktop video and mobile screenshot from real Runs; prove no automatic second start

Company Enrich journey stress cases

These cases define ENG-2288 on runtime agentic-platform and docs main. The shared shell and backend cases retain their owners. This slice uses frozen details and defers live canonical reads.

ID	Scenario	Expected rule
EJ01	Gate off; direct URL	Keep the existing not-found behavior.
EJ02	Loading, read failure, uninstalled, disabled, unauthorized	Show distinct states. Preserve the form frame and valid draft.
EJ03	Unsupported version or missing field metadata	Disable new starts. Do not guess a schema.
EJ04	Fresh supported form	Use published Basic and stale defaults. Require explicit start.
EJ05	Search selects rows in a non-table order	Preserve selection order and source Run/result IDs.
EJ06	Search includes canonical and domainless companies	Send search-result refs. Resolve identity on the server.
EJ07	Select all, deselect, clear, zero selections	Disable handoff at zero. Do not send an empty Run.
EJ08	Handoff, back, reload	Restore same-tab scoped refs without a POST.
EJ09	New Search refs arrive while Enrich has an uncertain or active attempt	Keep the existing frozen request. Require recovery or completion first.
EJ10	New refs arrive after an older Enrich Run ended	Offer explicit use of the new selection. Do not silently replace restored input.
EJ11	Missing or malformed saved selection	Explain how to select again. Never rebuild refs from display text.
EJ12	Stale row, deleted Run, wrong result kind	Show the server refusal or item diagnostic. Preserve valid input.
EJ13	Foreign source Run or ownership changes	Preserve non-disclosing refusal. Never guess identities or expose cached display data.
EJ14	User chooses direct entry while a Search selection exists	Use an explicit input mode. Do not append hidden subjects.
EJ15	Direct domains or canonical UUIDs	Keep typed inputs, order and errors. Do not accept company names as identities.
EJ16	Zero, one, 100 and 101 subjects	Require 1-100 before POST. Reject overflow without truncation.
EJ17	Duplicate domain and canonical refs name one company	Let the server resolve identity. Show one result with all input indexes.
EJ18	Malformed UUID, empty domain, overlong value, person or CRM ref	Reject invalid shapes. Let the executor decide semantic identity validity.
EJ19	Basic, Standard, explicit field subset	Use published choices. Preserve the submitted field order.
EJ20	Change Standard to Basic with extra fields selected	Show the changed field set. Never submit hidden unsupported fields.
EJ21	Empty fields, duplicate fields, Deep, private or unknown field	Reject the request. Omitted fields mean the whole preset, not an empty selection.
EJ22	Missing-only versus stale refresh	Explain retained stale values. Never promise a provider will fill every field.
EJ23	Double click, response lost, reload, repeated refusal	Reuse the shared frozen input and key rules F07-F13 and F25-F26.
EJ24	Session storage fails	Refuse unsaved starts. Preserve the previous selection and show the failure.
EJ25	Actor, tenant, logout or impersonation changes	Clear visible product state and ignore old-scope responses.
EJ26	Queued, running, approval wait	Show durable Run state. Keep new starts locked. Link existing approval controls.
EJ27	Disconnect, duplicate hints, terminal event	Reconcile through the shared store. Do not append duplicate rows.
EJ28	Complete, partial, empty, failed or cancelled	Keep Run status and product outcome separate. Failure is not empty success.
EJ29	Missing output, wrong capability, version or row identity	Show result error. Do not fabricate rows or links.
EJ30	Deduplicated results, bad or repeated indexes	Map through frozen request indexes. Reject invalid row partitions.
EJ31	Current, retained, refreshed, not found, pending, failed, cancelled	Display the reported field state beside its value. Value presence does not prove success.
EJ32	Hit, miss, stale, not_read, absent timestamps	Show the reported cache decision. Do not invent per-field freshness.
EJ33	Estimated/settled usage, zero cost, unavailable Run meter	Label frozen usage. Keep unavailable distinct from zero. Do not add root and child totals.
EJ34	31 KiB overflow before or after paid work	Show payload failure. Preserve known usage. Explain that prior writes can remain. No automatic batch split or retry.
EJ35	Canonical ID without a CRM company	Show the canonical ref and frozen details. Do not build a CRM link.
EJ36	Ordinary user opens company details	Show frozen details and Run Explorer. No admin read or guard bypass.
EJ37	Canonical data changes or vanishes after the Run	Keep frozen results unchanged. This slice makes no live canonical read.
EJ38	Null canonical ID or unresolved item	Show the diagnostic. Do not enable an entity detail link.
EJ39	Omitted diagnostics and source IDs	Show exact omission counts. Do not claim full lineage.
EJ40	Markup, unsafe URLs, long text or monetary values	Escape text. Validate links. Use existing money and firmographic helpers.
EJ41	Keyboard, narrow viewport, many fields	Keep every control reachable. Keep horizontal table scroll inside the frame.
EJ42	Desktop Search -> Select -> Enrich; mobile	Use a live API and worker. Capture a desktop video and a mobile screenshot. Verify no automatic start.

Signals Search journey stress cases

These cases define ENG-2294 on runtime agentic-platform and docs main. The shared shell cases F01-F26, persona cases SP01-SP33 and saved-search API rules retain their owners.

ID	Case	Required result
SJ01	Gate off; direct route or navigation	Use F01; no Signals Search entry.
SJ02	Loading, denied, unavailable, empty catalogue or read failure	Keep the frame, show the exact state and disable a new start.
SJ03	Missing schema field, incompatible constraint or version other than 1	Show unsupported contract. Do not guess controls or start.
SJ04	Fresh direct form	Default to discovery and require an explicit start.
SJ05	Discovery mode with company refs left from company-set mode	Omit all company refs. Do not send hidden state.
SJ06	Company-set mode with domains, LinkedIn URLs, canonical IDs and prospect IDs	Preserve each type and line order. Let the server resolve identity.
SJ07	Company-set mode with zero, one, ten or eleven refs	Require 1-10. Reject overflow without truncation.
SJ08	Company name, malformed URL or malformed UUID	Show the field error. Do not infer an identity.
SJ09	ICP only, company criterion only or both	Accept each valid brief. Keep the unsaved draft; send and store a normalized execution copy.
SJ10	Missing, blank or whitespace-only ICP and no company criterion	Refuse before POST and retain the draft.
SJ11	One to ten company criteria; blank, whitespace-only or 201-character criterion	Enforce the documented bounds after whitespace trimming. Never change the saved draft silently.
SJ12	Required and optional company criteria	Preserve each flag and the displayed order.
SJ13	Each persona field alone or several fields together	Use the shared persona contract without a copied schema.
SJ14	Empty, duplicate, blank, 21-value or invalid-country persona	Show bounded field errors and send no POST.
SJ15	A separate signal theme or result limit appears in schema or stored data	Preserve stored unknown data, but do not add an unsupported V1 control.
SJ16	Source mode changes after validation errors	Clear hidden field errors only. Preserve visible brief values.
SJ17	Direct start is admitted	Open Prospect Review once with the admitted Run ID. Do not start again.
SJ18	Direct start is refused, uncertain or restored after reload	Stay on the form and use F07-F13 and F25-F26. Do not redirect.
SJ19	Replayed or old admitted direct attempt is reopened	Show the shell state and an explicit Prospect Review link. Do not auto-redirect.
SJ20	Prospect Run is queued, running, empty, partial, failed or cancelled	Let Prospect Review render durable state. Do not build a second result table.
SJ21	Saved-search list has zero, one or several pages	Distinguish empty from failed. Preserve stable ordering and cursors.
SJ22	Select a saved search or reload its query URL	Put only its ID in the URL and read the detail. Do not expose its brief in the URL.
SJ23	Create with a valid brief and unique name	Store once, select the returned search and show its exact detail.
SJ24	Blank, overlong or duplicate name	Keep the draft and map the server refusal.
SJ25	Edit documented fields in a brief that has unknown fields	Preserve every unknown field in the submitted brief.
SJ26	Rename a saved search with an incompatible legacy persona	Send a name-only patch and keep the brief unchanged.
SJ27	Edit a brief with legacy persona fields	Require a complete reviewed correction. Never drop, merge or guess fields.
SJ28	Another editor changes the saved search	A 409 keeps the draft and offers an explicit detail reload.
SJ29	Delete is cancelled or confirmed	Cancellation writes nothing. Confirmation removes the search but does not cancel a Run.
SJ30	Saved-search start is admitted	Stay in the workspace, follow the durable Run and offer Prospect Review.
SJ31	Same-key starts overlap while the search changes; the owner crashes before or after snapshot completion; a response is lost or the page reloads	Freeze one normalized input under the exact surface claim. A live loser retries after one second. One caller reclaims after 30 seconds. A lost fence starts no Run. Every completed claim admits or recovers one Run.
SJ32	Capability binding changes after the form loads	Return a version conflict. Never accept or expose an executor UUID.
SJ33	Stored brief is invalid or the complete input exceeds 32 KiB	Start no Run. Keep the search readable and show correction fields.
SJ34	No saved Run versus latest Run with no changes	Show distinct states. An empty diff is not the same as no Run.
SJ35	Latest diff has added, updated and removed rows	Show reported change kinds. Do not recompute them from live prospect data.
SJ36	A newer Run publishes between diff pages	On 409, discard the cursor and offer an explicit reload. Never join two Runs.
SJ37	Diff row opens prospect detail	Keep its diff Run ID in the Prospect Review URL and use the existing drawer.
SJ38	Watch, dismiss or promote from the routed prospect	Preserve the Phase 4 state rules and promotion flow. Signals adds no CRM write.
SJ39	Actor, organization, logout or impersonation changes during any request	Clear visible scoped state and ignore every old-scope response.
SJ40	Markup, long text or unsafe evidence URL appears	Escape text, contain overflow and link only safe HTTP or HTTPS URLs.
SJ41	Keyboard, desktop and narrow viewport	Keep every control reachable. Keep scrolling inside its result frame.
SJ42	Live direct start and saved-search start	Capture desktop video and mobile screenshot. Prove one start and correct Prospect Review handoff.
SJ43	Direct start, saved create, saved brief patch and saved start receive ICP with 2,000 or 2,001 characters after trimming	Apply one normalization rule. Accept 2,000. Refuse 2,001 and retain the unsaved draft.
SJ44	The same company ref repeats, or two ref types resolve to one company	Keep the first resolved company, count later refs as dropped and do not research the company twice.
SJ45	A domain or LinkedIn key maps to conflicting stored identities	Admit no company for that ref. Show the bounded conflict diagnostic and do not fill the freed position.
SJ46	An unmatched valid domain, unmatched LinkedIn URL or missing canonical ID	Keep the domain as a research seed. Drop the other two with their unresolved or not-found diagnostic. Keep unrelated valid refs.
SJ47	A prospect ID belongs to another organization	Return the same unresolved result as a missing prospect. Expose no foreign identity or cached display data.
SJ48	A saved-search start is redelivered after the 24-hour snapshot window or the 396-day Run window	Recover an existing Run through its stable key without a snapshot. If the Run also expired, treat the delivery as a new request and read current state.

Exit evidence

Signals shared persona design cases

ENG-2324 owns these cases. The shared persona contract owns these rules.

ID	Scenario	Required outcome
SP01	Each of four persona fields alone	Accept the shared contract and omit the other fields
SP02	Multiple values and multiple fields	OR within lists; AND between fields
SP03	Missing persona, empty object or only empty fields	Reject before company or paid work
SP04	Explicit null, scalar list value or non-string item	Reject with the field path
SP05	Whitespace, blank item or case-insensitive duplicate	Apply shared normalization and reject invalid or duplicate values
SP06	Unknown key, legacy key or mixed schemas	Reject without dropping a criterion
SP07	Twenty values versus twenty-one; 1,000 versus 1,001 characters	Keep exactly the People Search bounds
SP08	Valid, lowercase and unknown country codes	Use the existing ISO country validator; do not add aliases
SP09	Title matches; different title; related title only	Use exact case-insensitive matching; do not expand titles
SP10	Matching, absent and contradictory person country	Keep matches and unknowns; exclude contradictions
SP11	Employer country matches but person country is absent	Keep unknown person country; never substitute employer country
SP12	Department or seniority has unsupported observed vocabulary	Keep unknown with a diagnostic
SP13	Duplicate identity has an explicit contradiction	Exclude the whole merged group once
SP14	Duplicate identity has missing facts and a supported match	Retain the group and its source evidence
SP15	All candidates fail shared filters	Keep the company; preserve completed-search evidence
SP16	Unknown facts survive deterministic filtering	Require evidence before persona-fit selection; never claim verified fit from absence
SP17	One provider fails and another returns candidates	Keep usable candidates; do not claim complete no-match evidence
SP18	Many alternatives across every field	Keep every alternative in one query per company/provider; no Cartesian fan out
SP19	Maximum Unicode persona and candidate fields	Preflight all fixed intermediate envelopes before company work; reduce candidate allowance, never persona criteria
SP20	Discovery and company-set inputs are invalid	Refuse at the first scope step before reads and paid work
SP21	Create or patch contains an invalid brief	Refuse before a storage write with actionable field errors
SP22	Manual start contains an incompatible stored brief	Start no Run; return correction fields
SP23	Scheduled dispatch contains an incompatible stored brief	Record input_unbuildable; start no Run; preserve schedule
SP24	Saved-search read or name-only patch contains a legacy persona	Keep the original brief readable and permit the name change
SP25	Legacy title, family, function, seniority or location	Require explicit correction when equivalent meaning is not proved
SP26	Legacy and shared criteria coexist	Do not overwrite, merge, guess or drop criteria
SP27	Dry run sees already valid shared criteria	Report unchanged; perform no write
SP28	Confirmed correction preserves meaning	Keep a private original; validate and write only the reviewed persona
SP29	Report is rerun after the same correction	Report already applied; perform no second write
SP30	Another editor changes the brief or update token	Refuse the stale correction; preserve the newer edit
SP31	Search is deleted or belongs to another organization	Treat it as absent; perform no write
SP32	Correction fails partway through a batch	Keep per-row results and originals; resume without duplicate writes
SP33	A corrected search has watch members and a schedule	Preserve IDs and relationships; next start uses the corrected brief
SP34	Historical Run contains the legacy schema	Read frozen input and results without new persona validation
SP35	An admitted legacy Run can still resume at rollout	Hold rollout until it finishes or is cancelled; do not rewrite replay data
SP36	CLI creates, reads, corrects and starts a saved search	Pass the shared JSON unchanged and preserve field errors
SP37	Frontend correction form is absent from trunk	Keep ENG-2294 ownership; verify the API/CLI correction path here
SP38	Capability composition or enrichment changes are proposed	Keep those changes in ENG-2302 and their existing owners
SP39	Persona fits the root but its six-call plan exceeds the tool limit	Refuse before company work; never truncate calls or break the positional join

Signals company lane design cases

ENG-2282 owns these cases. The company lane contract owns the implementation rules.

ID	Scenario	Required outcome
SC01	Discovery has a valid thesis and persona	Keep web research and the existing scoring brief
SC02	Discovery produces zero companies	Skip Search and Enrich; preserve the empty Signals result path
SC03	Company set contains stored canonical IDs	Admit only those IDs; keep the ten-company limit
SC04	Company set contains a new domain	Match the exact domain after research; admit only its resolved ID
SC05	New domain remains missing or conflicts	Admit no replacement ID; retain the unresolved scope evidence
SC06	References repeat an identity	Preserve one canonical company and its existing evidence
SC07	Name-only, deleted or inaccessible references	Keep existing scope refusal or unresolved behavior; do not invent an identity
SC08	Saved search watches more than five companies	Keep the existing rotation and permit new discovery within ten results
SC09	Root input is malformed or has no usable brief	Refuse before provider work
SC10	Research returns an out-of-scope company	Exclude it before child enrichment and prospect promotion
SC11	Thesis has no firmographic equivalent	Use supplied Search without translating free text into provider filters
SC12	Search returns rows in a different order	Match canonical IDs and input indexes; preserve research order
SC13	Search returns unknown, replaced or duplicate IDs	Refuse the invalid handoff; do not attach another company's signals
SC14	Search excludes all companies	Skip Enrich and pass an empty scoring batch
SC15	Enrich returns no canonical ID	Exclude that company and retain other valid results
SC16	Enrich returns retained facts or partial field failures	Keep the company when its canonical ID remains valid
SC17	Enrich returns a different canonical ID	Refuse the handoff; do not move signal evidence
SC18	Research Agent or Skill can call private enrichment	Publication/configuration tests fail; one paid profile path is required
SC19	Enrichment requests unused profile fields	Configuration tests fail against the explicit field list
SC20	Empty wrapper result is replaced by missing output	Refuse; missing output does not mean zero results
SC21	Child result contains a truncation marker or wrong version	Refuse before scoring and promotion
SC22	Ten companies contain maximum Unicode text and evidence	Measure complete inputs; refuse overflow without silent evidence loss
SC23	Worker retries after a child starts or completes	Reuse the same child key and frozen output
SC24	Child or root is cancelled; deadline or budget expires	Stop subsequent work and prevent complete Smart Feed publication
SC25	Meter or durable storage fails	Preserve the platform failure; do not add a second aggregate charge
SC26	Child binding is absent, disabled, wrong-version or cross-tenant	Refuse publication before creating the root workflow
SC27	Wrapper publication fails after another wrapper succeeds	Return published IDs and the exact refusal for recovery
SC28	Signal scoring, company scoring and prospect promotion run	Preserve evidence, grade reuse, scoring and no direct CRM writes
SC29	Saved-search baseline changes after a Run completes	Keep the frozen result, diff rules and publication behavior
SC30	Stream reconnects or replays child events	Preserve Run lineage and existing replay semantics; no second product start
SC31	Warm company row has only `country_code`	Derive the scoring country name with the shared converter; preserve an existing country name
SC32	Custom workflow wraps the complete Signals graph	Refuse the fourth workflow level; preserve the existing depth cap and old snapshots

Signals people lane design cases

ENG-2302 owns these cases. They use the shared persona contract from ENG-2324. The people lane contract owns the implementation rules.

ID	Scenario	Required outcome
PL01	One to three promoted prospects have valid web candidates	Keep the existing six-call maximum and stable company-provider-result order
PL02	No prospect survives opportunity scoring	Start no People Search or People Enrich child; preserve the empty product path
PL03	A provider returns no rows and all provider calls complete	Search the remaining refs; permit `no_matching_people` only with complete evidence
PL04	One provider fails and another returns usable people	Attach valid people and retain the failed search evidence
PL05	All providers fail	Start no supplied Search; persist each exact reason only while its prospect is pending
PL06	A row has no valid LinkedIn person profile	Keep it unresolved; never send it to People Search or attach it
PL07	Providers repeat one LinkedIn identity for one prospect	Send each observation with a stable index; accept one merged Search row and preserve every source observation
PL08	One LinkedIn identity appears under several prospects	Treat employer ownership as ambiguous and attach it to none
PL09	More than 25 observations exist for one prospect	Keep the first 25 in stable order and report the dropped count
PL10	The full supplied list has 75 rows	Fit the 100-person Search bound without widening the three-company Signals bound
PL11	Search reorders rows or merges distant input indexes	Join only by validated `input_indexes`, never by result position
PL12	Search returns one valid row and one row with no `input_indexes`	Refuse the unowned row; never infer ownership from position or identity
PL13	Search repeats an input index across rows or returns an unknown index	Refuse the conflicting rows before persona scoring and preserve unrelated valid rows
PL14	Search returns a schema-invalid row, wrong contract, version, product key, missing result or truncation marker	Refuse the full child envelope before persona scoring and Enrich
PL15	Search excludes every observed contradiction	Preserve filter diagnostics and do not ask the model to restore an excluded row
PL16	Search keeps an identity with unknown persona facts	Let the agent assess evidence, but never claim verified fit from missing facts
PL17	Complete Search returns no row	Attach `no_matching_people` with complete search evidence
PL18	Partial Search returns no usable row	Persist the exact reason only while the prospect remains pending; do not claim no matches
PL19	One prospect is complete-empty while another prospect has a provider or Search failure	Mark only the complete prospect `no_matching_people`; keep the other pending
PL20	Persona-fit selects known rows with valid scores and reasons	Preserve the exact Search result IDs and compile only those Enrich subjects
PL21	Persona-fit returns an unknown or repeated result ID	Refuse the agent output before Enrich
PL22	Persona-fit returns an invalid score, missing reason, extra field or oversized output	Refuse the closed result before Enrich
PL23	Persona-fit selects no row after complete Search	Attach `no_matching_people` with a persona reason and complete evidence
PL24	Persona-fit selects no row after partial Search	Persist the exact reason only while the prospect remains pending
PL25	Search returns a canonical person ID	Prefer its canonical reference for Enrich and retain Search and provider evidence separately
PL26	Search returns no canonical person ID	Use its normalized LinkedIn reference for Enrich
PL27	A selected Enrich subject repeats	Deduplicate before the 100-subject limit and preserve all owning Search indexes
PL28	The selected set is empty	Take the nested empty arm; do not start Enrich or add a capability wrapper
PL29	Enrich returns rows out of order	Join by validated `input_indexes`, never by result position
PL30	A valid Enrich envelope repeats an input index across rows or omits a selected owner	Exclude conflicting rows, preserve unrelated valid siblings and keep unresolved owners pending
PL31	Any Enrich row is schema-invalid	Refuse the full child envelope; do not recover siblings from invalid JSON
PL32	Enrich returns a different canonical ID from the one Search supplied	Refuse that identity; do not move evidence to another person
PL33	Enrich returns no canonical ID for one row	Do not write evidence or attach that row; retain valid canonical siblings
PL34	Selected Exa and Parallel observations reach a canonical Enrich row	Persist them through the bounded Intelligence batch before prospect attachment
PL35	The evidence batch returns a changed canonical ID	Refuse that identity and its prospect attachment
PL36	The evidence batch loses an acknowledgement or retries after a partial write	Reuse the UUIDv5 source ID derived from the frozen Run, node, call and result positions; do not duplicate provenance
PL37	The evidence batch fails	Do not attach affected people or publish a complete Smart Feed result
PL38	Profile fields are retained, refreshed, missing or fail independently	Request only the nine Signals fields and preserve the child field states
PL39	The email child is still running	Keep the prospect people state pending and keep the root live
PL40	Final Enrich output contains a pending selected state	Refuse the final handoff; pending is not a prospect contact state
PL41	Email is verified with matching verification lineage	Map the person contact state to `verified` without copying the address in Signals
PL42	Email is settled not found	Map the person contact state to `unavailable`
PL43	Email is retained without safe verification, failed or cancelled	Map the person contact state to `unverified`; never invent an address
PL44	One child or the attachment batch retries after a crash	Reuse child keys and idempotent prospect writes; do not duplicate people
PL45	One bounded attachment batch changes several prospects	Publish one `result.item_ready` event for each changed prospect
PL46	Child or root is cancelled, or a budget or deadline ends	Stop later work and publish no complete Smart Feed result
PL47	A complete capability, agent, evidence or attachment payload exceeds its byte limit	Refuse before the next consumer; never trim criteria, identity or evidence silently
PL48	A people capability binding is missing, disabled, foreign or wrong-version	Refuse publication before writing the root definition
PL49	Signals starts People Search directly	Fit Signals, People Search and Company Search in the three workflow levels
PL50	Signals starts People Enrich directly	Fit Signals, People Enrich and People Email in the three workflow levels
PL51	Either people capability is put behind another wrapper	Refuse the fourth workflow level in publication tests
PL52	An old published Signals Run resumes after deployment	Use its frozen graph and payload; do not apply new child contracts to replay data
PL53	A stream reconnects while a child runs or after attachment	Preserve root-child lineage and existing replay semantics; start no second product Run
PL54	The old persona agent or Skill declares contact or person-write Tools	Publication/configuration tests fail; People Enrich and deterministic workflow writes own those effects
PL55	A partial-pending write races with or follows an existing found or no-match state	Change only a still-pending row; preserve either complete state and its reason

No duplicate product implementation is needed from ENG-2278, ENG-2295 or ENG-2279. Registry, installation, upgrades, people composition and product surfaces stay with their existing owners.

ENG-2285 owns direct API/CLI contract tests, including strict endpoint parity. ENG-2297 owns Front Door routing evaluations; its cases are FD01 to FD28 above. ENG-2296 owns desktop and mobile browser journeys. ENG-2300 owns the live FullEnrich evidence; unit tests cannot establish provider callback timing or account entitlement. Each scenario has one defined outcome and an implementation owner, and the implementation and exit tests pass. This page records the expected results. The test sets named at the top hold the executed proof.

The ENG-2285 harness proves the API and CLI cases against a live stack. Its start step checks three cross-field source rules. Every capability publishes the cross-field rules a schema can state. A rule over a provider vocabulary stays at execution time. Cross-field rule projection names both sets.

Browser exit journey cases

These ENG-2296 cases define the browser exit proof. They test the five product routes together. The shared shell cases F01-F26 and the journey cases CJ, EJ, PJ and SJ retain their owners. BJ01-BJ17 use recorded capability, Run and stream responses, so each durable status is exact and repeatable. BJ18 uses the live local API and worker, and it records the evidence.

F01 stays outside this table. The browser build fixes the rollout flag at build time, so one browser run cannot show both gate states. The route unit test owns the gate-off case.

ID	Case	Required result
BJ01	Gate on; sidebar and in-product navigation at 1440 px and 390 px	Each of the five entries reaches its route. The product and segment links mark the current page.
BJ02	Company Search succeeds; rows are selected; Company Enrich opens	Enrich shows the same refs in selection order. It sends no start request.
BJ03	Reload after the Company handoff	The same-tab refs return. No start request follows the reload.
BJ04	A second browser context opens Company Enrich	No selection returns. The refs stay inside the tab that saved them.
BJ05	People Search succeeds; rows are selected; People Enrich opens	The person refs follow the same rule as BJ02.
BJ06	Signals Search starts from the direct form; the Run succeeds	The finished Run reaches the existing prospect review page.
BJ07	Signals saved mode with an extra query key	The route keeps only `?saved=<uuid>`.
BJ08	Invalid input in each of the five forms	The form shows the field error and sends no start request.
BJ09	Two clicks on the start control	One start request with one `Idempotency-Key`.
BJ10	The Run reports queued, then running, then a terminal status	Each durable status appears. A new start stays locked while the Run is nonterminal.
BJ11	The Run succeeds with the empty outcome	An empty result appears. It is not a failure.
BJ12	The Run succeeds with a partial outcome and rows	A partial result appears and it keeps the rows.
BJ13	The Run fails, and the Run is cancelled	The durable failure or cancellation appears. An empty success never appears.
BJ14	People Enrich has a ready profile while the email job runs	The profile appears and the email state stays pending.
BJ15	The Run read answers 404 after a reload	The read failure appears. No replacement start follows.
BJ16	Each of the five products at 390 px and at 1440 px	The page never scrolls horizontally. A wide result table scrolls inside its own frame.
BJ17	Keyboard only, in each of the five products	Every launch control is reachable and the start control accepts focus.
BJ18	Live local API and worker; supplied-only sources	Record a desktop video and a mobile screenshot of Company Search to Enrich, People Search to Enrich, and Signals Search to prospect review. Record the viewport and the final authenticated URL.

Run attribution and telemetry stress cases

ENG-2298 owns these cases. The harness step attribute checks T01 against a live stack. The unit tests own T02 to T31.

ID	Scenario	Required outcome
T01	Each of the five IDs starts through a resolved definition	Exact ID and version persist
T02	Custom or legacy Run	Null identity; no inferred capability metrics
T03	Input spoofs identity or version	Published binding owns identity
T04	Definition is renamed or rebound after start	Run identity stays fixed
T05	API, CLI, Front Door and trigger start the same executor	Same identity path; bounded source labels
T06	Same start key is delivered twice or races	One row and one observed start
T07	Admission denies or requires approval	Attribution exists; wait emits no completion
T08	Root starts, then a child or skill is republished	Child uses the frozen tree
T09	Binding switches or old executor becomes disabled	Frozen child UUID, contract and scope ceiling stay fixed
T10	Parent belongs to another tenant	No snapshot access and no child Run
T11	Child UUID is absent from a versioned tree	Refuse; no live fallback
T12	Legacy parent has no versioned tree	Keep existing behavior; do not invent historical metadata
T13	Nested child, shared child, agent leaf and rendered skill	All reachable execution data is frozen
T14	Cycle, missing child, excessive depth or oversize snapshot	Refuse before insert; publish uses the same size check
T15	Rights are revoked, budget ends or parent is cancelled	Existing admission and cancellation checks still apply
T16	Retry, wait, resume or two terminal writers	Only the successful terminal write emits completion
T17	Complete, partial, empty, failed and cancelled Runs	Fixed distinct completion outcomes
T18	Failed provider returns no rows	Failure; never a zero-result success
T19	Signals result or missing output count	Read its supported shape; unknown is not zero
T20	Parent and child both incur cost	Canonical cost deltas only; no duplicate tree totals or per-call rounding
T21	Usage read fails or a provider settles late	Unknown stays unknown; meter remains authoritative
T22	Enrichment fields succeed, fail or have no value	Count only explicit terminal field states
T23	Thousands of tenants, UUIDs, prompts and versions	Metric label set stays bounded
T24	Unknown route, custom UUID or absent expected route	Fixed route bucket; unscored without an expectation
T25	Route is correct but executor fails	Routing correctness and execution failure remain distinct
T26	Concurrent and nested Run scopes	Spans receive only their own Run identity
T27	Exporter raises or process stops after database commit	No Run failure; possible sample loss is explicit
T28	Migration reruns; paired identity is null, valid or malformed	Existing rows survive; invalid pairs and later edits fail
T29	Existing Signals graph exceeds 32 KiB as a complete tree	Separate 256 KiB snapshot bound; input/result bounds stay unchanged
T30	Indirect descendant grows after ancestor publish	Preflight reports oversize graphs; start refuses without trimming or live fallback
T31	Usage write retries or has no matching Run scope	One observed cost delta per successful record call; unknown attribution emits none

People Search company scope

ENG-2293 owns PSC01 to PSC32. These checks cover composition, not the provider adapter in ENG-2291.

ID	Input or event	Required result
PSC01	Supplied people with no scope	Preserve the existing supplied path; no company child
PSC02	One or 20 known company refs	Skip the company child; pass the same refs to the selected sources
PSC03	21 known refs, both forms, null, empty object or unknown scope field	Reject before child work
PSC04	Valid supplied, Explorium or mixed company brief	Invoke exactly one source-selected child; normalize defaults and omit companies for Explorium only
PSC05	Free text, unsupported company field, or Explorium with missing filters or invalid industry	Reject before a child or provider call
PSC06	Invalid people source, supplied without people, empty persona or excessive target	Reject before company work; provider-only correctly omits people
PSC07	Missing, disabled, foreign, ambiguous or wrong-version company binding	Refuse publication; create no draft
PSC08	Published child upgrades after the parent Run starts	Existing Run uses its frozen child; new Runs use their own snapshots
PSC09	Known scope on a composed definition without a child grant	Preserve normal admission refusal; branches do not widen authority
PSC10	Company child waits or needs approval	Start no people source until the child succeeds
PSC11	Child fails, is denied or is cancelled	Stop the parent; do not report an empty success
PSC12	Child start repeats after a crash or lost response	Reuse the child for the same parent Run and node
PSC13	Child succeeds, then parent resumes	Consume the frozen result; do not repeat company discovery
PSC14	Company child exhausts the shared root budget or deadline	No extra allowance or hidden retry; preserve the runtime stop
PSC15	Child returns zero rows with complete search coverage	Empty people envelope; zero people reads and provider calls
PSC16	Partial company child returns zero rows	Partial people envelope; preserve reasons; no no_matches claim
PSC17	Partial child returns usable companies	Search only these companies; final outcome stays partial
PSC18	19, 20, 21 or 100 distinct child companies	Keep at most 20 in result order; truncate only above 20
PSC19	Duplicate identities occur before and after the ceiling	Deduplicate before the ceiling; preserve first appearance
PSC20	One canonical company has domain and LinkedIn rows	One canonical ref; preserve first appearance
PSC21	One identity names conflicting canonical IDs or repeats a result ID	Reject the malformed child output
PSC22	Child omits its envelope, uses another version or exceeds the byte bound	Fail closed before people work
PSC23	Display fields claim another company identity	Ignore display fields; map only stable refs and canonical IDs
PSC24	Every people source is selected	Pass exactly the same resolved scope to each source
PSC25	Supplied person has only an employer display name	Keep the employer unknown; do not infer company membership
PSC26	Company child has 100 diagnostics and omitted diagnostics	Bound final diagnostics; preserve omitted counts and scope truncation
PSC27	Child diagnostic has a company input index	Map it to a scope warning with item_index null
PSC28	Earlier root spend, company calls and people calls	Read root cost once, including empty/supplied branches; sum local call counts only; refuse meter failure
PSC29	Combined output exceeds 31 KiB	Trim optional evidence/display only; refuse if identities cannot fit
PSC30	Signals calls People Search, which calls Company Search	Fit the existing workflow depth and snapshot bounds without a wrapper
PSC31	Supplied person points to an inaccessible source Run; company scope later has zero or more rows	Refuse with stale_reference before company spend; read no person cache
PSC32	Child lookup has a wrong tenant, parent, source-selected hashed node key, source or frozen capability	Refuse before people work; never dispatch from the reader

People Search journey stress cases

ENG-2292 owns these product cases. Runtime uses agentic-platform; design docs use main. The shared-shell cases F01-F26 continue to cover admission, recovery, permission and stream behavior.

ID	Input or event	Required result
PJ01	Rollout gate off or on	Keep legacy pages; register the People Search view only when enabled
PJ02	Loading, unavailable, unauthorized or failed capability read	Keep distinct shared-shell states; send no start
PJ03	Unsupported version, missing bounds or unknown source	Disable new starts; retain saved recovery
PJ04	Fresh direct form	Select supplied only; no paid source or automatic start
PJ05	Supplied URLs, canonical IDs and restored search-row refs	Preserve typed identities and order; do not accept CRM refs
PJ06	Zero or 101 supplied people	Reject locally; require 1 to 100
PJ07	Provider-only or mixed people sources	Require a company scope; omit people only for provider-only
PJ08	Empty or repeated sources	Reject locally
PJ09	Supplied-only without scope	Omit scope; search supplied identities
PJ10	Known scope with 0, 1, 20 or 21 companies	Accept 1 to 20 only; do not truncate
PJ11	Company Search selection has 1 to 20 rows	Find People opens known scope with ordered refs; sends no POST
PJ12	Company Search selection has more than 20 rows	Explain the limit; require a smaller selection
PJ13	Company brief selects supplied, Explorium or both	Reuse Company Search controls; send the structured branch
PJ14	Company brief has invalid filters, no source or invalid target	Keep the invalid draft; block start
PJ15	Empty persona or empty optional list	Require one criterion; omit blank optional lists
PJ16	21 persona values, case-insensitive duplicates or long text	Reject locally with a field error
PJ17	Several titles and person countries	OR within fields; AND across fields; do not use employer country
PJ18	Unsupported provider department or seniority	Explain executor validation; show failed Run without losing the draft
PJ19	Target blank, fractional, zero, 1, 10 or 11	Accept integer 1 to 10; do not silently clamp
PJ20	Refusal or refreshed availability	Preserve edited fields and show field errors
PJ21	Saved request and a newer company selection	Restore the saved request first; offer explicit scope replacement after it ends
PJ22	Timeout, double click, reload or reconnect	Preserve the frozen key; no automatic POST; lock edits while unresolved
PJ23	Queued, running, waiting, failed or cancelled Run	Show durable state; no selectable terminal output from a failed Run
PJ24	Complete result, empty result or partial result with zero rows	Show distinct outcomes; partial zero is not no matches
PJ25	Missing, dropped or malformed envelope; wrong capability/version	Show a result error; disable selection
PJ26	Duplicate row IDs, invalid identity or oversized result	Reject output before selection
PJ27	Unknown facts, missing canonical ID or unknown persona fit	Show unknown or not linked; do not claim verified fit or CRM membership
PJ28	Sources, funnel, usage or optional output trimming	Display reported counts and omitted diagnostics; valid partial rows remain selectable, including with the global truncated flag
PJ29	Company has zero people, failure, unresolved match or quota limit	Show its reported counts and reason
PJ30	Brief returns empty, partial or more than 20 companies	Show people outcome and scope diagnostics; launch no client-side child
PJ31	Select, deselect, select all or clear	Store up to 100 ordered search-row refs
PJ32	Duplicate status read or selection reload	Preserve valid selection and order
PJ33	Stale refs or new admitted Run	Drop refs absent from displayed results; clear prior person selection on admission
PJ34	Refused or uncertain new start	Retain prior selection
PJ35	Session storage write fails	Show error; retain saved refs and checkbox state
PJ36	Navigate to People Enrich and back	Preserve person selection; send no start; do not build Enrich controls
PJ37	Actor, organization, logout or impersonation changes	Clear visible draft, results and selections; ignore late replies
PJ38	Long names, text markup or unsafe evidence URL	Render text safely; allow only safe external links
PJ39	Desktop, mobile and keyboard selection	Keep stable frames, contained table scroll and named focusable checkboxes
PJ40	Live supplied Run and structured provider dry run	Verify real results and selection; verify payloads without unnecessary paid discovery

People Enrich journey stress cases

These cases define ENG-2289 on runtime agentic-platform and docs main. The shared shell cases F01-F26, profile cases PE01-PE39, adapter cases PI01-PI28 and email cases EM01-EM45 retain their owners. This matrix tests only the People Enrich product journey. It does not repeat backend behavior.

ID	Scenario	Expected rule
PEJ01	Gate off, direct URL or hidden navigation	Use F01. Do not expose People Enrich.
PEJ02	Loading, read error, unavailable or unauthorized	Keep the form frame. Show the exact state. Disable a new start.
PEJ03	Version other than 1 or incomplete field metadata	Show an unsupported contract. Do not guess controls.
PEJ04	Fresh supported form	Use published Basic and stale defaults. Require an explicit start.
PEJ05	Search selects people in a non-table order	Preserve that order and each source Run and result ID.
PEJ06	Select all, clear or zero selected rows	Enable handoff only for 1 to 100 valid refs. Start no work.
PEJ07	Search handoff, back navigation or reload	Restore same-tab scoped refs. Send no POST.
PEJ08	A saved Enrich attempt and a newer Search selection exist	Keep the frozen attempt. Offer explicit replacement after it ends.
PEJ09	Missing, malformed, stale or foreign saved selection	Preserve non-disclosing errors. Never rebuild refs from display facts.
PEJ10	Direct LinkedIn, canonical and CRM values	Build typed refs in field order. Keep line order inside each field.
PEJ11	Restored input contains all four ref kinds	Preserve the exact typed order. Do not force it into direct fields.
PEJ12	Blank value, malformed UUID, long URL or non-person LinkedIn URL	Reject the known shape before POST. Let the server decide canonical meaning.
PEJ13	Zero, one, 100 or 101 subjects	Require 1 to 100. Reject overflow without truncation.
PEJ14	Repeated refs or different refs resolve to one person	Send the ordered refs. Show one result with all input indexes.
PEJ15	Basic, Standard or an explicit field subset	Use published choices. Preserve selected field order.
PEJ16	Preset changes while extra fields are selected	Replace the visible selection with the complete new preset.
PEJ17	No fields, duplicate fields or an unsupported field	Reject the request. Omitted fields alone mean the complete preset.
PEJ18	Email source or score without email	Show a field error. Send no POST.
PEJ19	Missing-only or stale refresh	Explain retained values and provider uncertainty. Make no guarantee of completion.
PEJ20	Double click, lost response, reload or refusal	Use F07-F13 and F25-F26. Keep the frozen request and key.
PEJ21	Session storage fails before a start	Keep the prior selection. Show the failure. Send no POST.
PEJ22	Actor, organization, logout or impersonation changes	Clear visible state. Reject late root and child replies.
PEJ23	Root queued or running before child creation	Show the root state. Do not claim that a profile preview exists.
PEJ24	Root is live with one valid email child	Read `input.profile`. Validate it against the root's frozen request.
PEJ25	No child, two children, wrong lineage, wrong source or extra child input	Clear the preview. Keep following the root.
PEJ26	Child list or detail read fails	Label temporary failure. Keep a valid snapshot only for temporary failure; clear it on 401, 403 or 404.
PEJ27	Duplicate hints, polling overlap or an older child reply	Coalesce reads. Keep the newest scoped snapshot. Add no duplicate row.
PEJ28	Profile is ready while email remains pending	Show profile values and pending email states. Label the data as a preview.
PEJ29	Child completes before the root finalizes	Keep following the root. Do not call the child result the root result.
PEJ30	Root returns complete, partial or empty output	Check V1 identity, all row bounds, complete selected-field coverage and exact input-index coverage. Replace the preview with valid frozen output. Keep outcome separate from status.
PEJ31	Root succeeds with missing, truncated or pending output; wrong capability or version; malformed refs or values; missing or extra states; missing, duplicate or out-of-range indexes	Show a result error. Resolve no links from invalid output. A valid preview remains a labelled non-final snapshot.
PEJ32	Root fails or cancels after the child exists	Keep the valid preview. Derive unfinished email state from the root status.
PEJ33	Root fails or cancels before the child exists	Show only the terminal root state. Do not read canonical data as a fallback.
PEJ34	A retained email exists while this lookup is pending, failed or cancelled	Show the value and operation state separately. Do not call it refreshed.
PEJ35	Email not found, evidence unknown, unverified or verified	Use field state and matching metadata. Never use score or Run success as proof.
PEJ36	Verification metadata names another email or has an invalid shape	Reject that result or preview. Missing metadata alone means unknown.
PEJ37	Cache hit, miss, stale, not read or missing timestamp	Show reported profile cache data. Do not invent per-field freshness.
PEJ38	Diagnostics, omitted lineage, output limit or unavailable usage	Preserve exact counts and labels. Never add root and child usage.
PEJ39	CRM input indexes, canonical IDs and LinkedIn result refs	Link explicit CRM inputs and safe profile URLs only. Do not infer CRM membership from canonical IDs.
PEJ40	Desktop Search to Enrich, mobile and keyboard	Use a live API and worker. Capture a desktop video and mobile screenshot.

People email design stress cases

ENG-2299 owns these cases. The baseline is ac-python-api agentic-platform. Provider infrastructure stays with ENG-2210.

Case	Input or event	Required outcome
EM01	Basic or selected profile-only request	No email provider call; published email scopes still apply
EM02	Current requested email family	Keep values and matching evidence; no paid lookup
EM03	Missing email with a current hot stamp	Start a lookup; freshness does not prove presence
EM04	Missing, future or exact-boundary hot stamp	Treat the selected email target as stale
EM05	Stale email with `refresh: missing`	Retain the email and evidence without a lookup
EM06	Current email with a missing selected score	Lookup only the missing email-family target; do not replace a protected address
EM07	Email-only request with cached identity context	Use canonical names and LinkedIn identity; return verification without selecting score/source
EM08	Email-only request without canonical names, or with one name	Report unresolved; do not invent names or fetch unselected profile fields
EM09	Duplicate identities through different input refs	One contact per canonical identity; preserve all input indexes
EM10	1, 25, 26, 75 and 100 resolved subjects	At most four sequential jobs; each job has at most 25 contacts
EM11	No eligible contacts in one or all partitions	Skip submit and wait; preserve all result rows
EM12	Unicode names or large fields exceed a boundary	Refuse certain overflow before paid work; never silently truncate identity
EM13	Signals Search invokes People Enrich	Publish within three workflow levels
EM14	Actor lacks submit or collect scope, including Basic	Refuse at admission using the full published scope set
EM15	Profile succeeds while the email job runs	Persist profile early; root stays live; email shows pending
EM16	Callback before submit response	Reuse the reserved job and first terminal data
EM17	Callback before wait registration	Durable pre-wait read skips the wait
EM18	Callback after pre-wait read, before registration	Timeout read finds completion; bounded delay only
EM19	Callback while waiting	Wake and read stored results; do not trust event payload as evidence
EM20	No callback or lost submit acknowledgement	Timeout the same reservation; do not repeat the provider POST
EM21	Callback after timeout has been frozen	No late canonical write or Run restart; cost can settle once
EM22	Callback and worker replay	Same job, same source ID and one canonical effect
EM23	Reordered contacts	Match exact canonical UUID refs
EM24	Duplicate, missing, unknown or malformed contact ref	Fail ambiguous contacts; preserve valid siblings
EM25	Wrong tenant, provider, child or root job	Refuse without exposing or writing data
EM26	Completed batch with no email	Report not_found; retain an old email and its matching evidence
EM27	Partial found results in failed or cancelled provider batch	Preserve found contacts; report the remaining terminal states
EM28	Deliverable non-role email	Preserve verified evidence and confidence
EM29	Catch-all, unverifiable, role mailbox or unknown provider grade	Never label the email verified without explicit eligible evidence
EM30	No provider verification timestamp	Keep checked_at null; do not use the callback clock
EM31	Score absent on an email replacement	Do not retain the previous address's score
EM32	Cached evidence absent, malformed or for a different email	Return unknown for the exact returned address
EM33	Canonical email changes after the final Run	Frozen result keeps its original email/evidence pair
EM34	Profile-only write or failed email refresh	Preserve the hot stamp
EM35	Successful email write	Preserve the warm stamp and unrelated profile fields
EM36	Concurrent profile update	Preserve both profile and email work and all source IDs
EM37	Concurrent email-group update or canonical identity change	Preserve the concurrent value; report a conflict without false refresh
EM38	Canonical write commits but acknowledgement is lost	Retry from stored evidence; do not advance freshness again
EM39	Canonical storage unavailable	Retry persistence; never repeat submit or profile work
EM40	Cancellation before submit, during wait or between writes	Stop further effects; preserve completed profile and email writes
EM41	Budget or deadline stops later work	Stop paid calls; retain completed evidence and an explicit Run reason
EM42	Callback settlement is delayed or repeated	Use one existing settlement path and stable usage ID
EM43	Final projection exceeds 31 KiB	Return the established size refusal; keep canonical successes
EM44	Client reconnects while root is live or cancelled	Use profile output plus child/Run state; never claim a final result exists
EM45	Empty, failed and partial operations	Preserve complete input coverage and selected field states

capabilities

validation

company

people

signals

Capability design scenarios

Capability design scenarios

Contents