Story 1746: BDD Living Doc

pramaan-functions · Story-1746 · generated 2026-06-25T10:26:21+00:00

This page is rendered from the checked-in Gherkin files and pytest-bdd cucumber JSON. Refusal scenarios that pass are shown as ✅ correctly blocked, because the expected product behavior is denial, invisibility, or rejection.
2passed
1correctly blocked
0failed
1not tested / manual-only

Delivery

The fresh CI render is uploaded as the bdd-living-doc build artifact with its source cucumber.json. After merge, the committed Story page publishes through the existing walkthrough distribution at https://walkthroughs.pramaan.io/1746.html.

Executable Scenarios

Meridian lists only Meridian matters

tests/features/cross_firm_isolation.feature:15

✅ passed
@smoke
  1. When the firm lists matters through row-level securitypassed
  2. Then the visible matters include "Meridian Seed Matter"passed
  3. And the visible matters do not include "Crestline Seed Matter"passed
625.8 ms

Meridian cannot directly read Crestline matter row

tests/features/cross_firm_isolation.feature:21

✅ correctly blocked
@refusal
  1. When the firm asks directly for the matter named "Crestline Seed Matter"passed
  2. Then no matter row is returnedpassed
  3. And no row belonging to firm "Crestline" is returnedpassed
858.8 ms

Parse an acceptance value without shared mutable state

tests/features/pytest_bdd_smoke.feature:2

✅ passed
  1. Given an acceptance value named "smoke"passed
  2. When the BDD step returns the valuepassed
  3. Then the scenario sees "smoke"passed
0.4 ms

NOT Tested / Manual-Only

This section keeps known manual or deferred scenarios visible instead of letting them disappear from a green test run.

Request-level authorizer denial is a separate proof

tests/features/cross_firm_isolation.feature:27

⚪ not tested / manual-only
@tier2
  1. When a request uses the wrong firm authority before RLS is openednot tested
  2. Then the gateway authorizer denial is left to the Tier-2 proof for pramaan-spec#1738not tested