# API Case Coverage Matrix For #1118

Updated: `2026-05-08`

## Scope

This matrix is the current execution view for API coverage only.

Inputs used:

1. current `origin/main` API watchdog cases under `watchdog/api/cases/**`
2. current local API run evidence in [docs/local-33-story-coverage-report.md](/Users/bingwang/github/nexuscrm-pingcap-pack/.worktrees/api-1118-coverage-matrix/docs/local-33-story-coverage-report.md)
3. current scene/data planning docs:
   - [docs/story-flow-api-watchdog-plan.md](/Users/bingwang/github/nexuscrm-pingcap-pack/.worktrees/api-1118-coverage-matrix/docs/story-flow-api-watchdog-plan.md)
   - [docs/api-watchdog-need-data-checklist.md](/Users/bingwang/github/nexuscrm-pingcap-pack/.worktrees/api-1118-coverage-matrix/docs/api-watchdog-need-data-checklist.md)
   - [docs/story-test-data-plan.md](/Users/bingwang/github/nexuscrm-pingcap-pack/.worktrees/api-1118-coverage-matrix/docs/story-test-data-plan.md)
4. coverage scorecard and big table:
   - [docs/api-case-coverage-scorecard-1118.md](/Users/bingwang/github/nexuscrm-pingcap-pack/.worktrees/api-1118-coverage-matrix/docs/api-case-coverage-scorecard-1118.md)

Status legend:

- `covered`: there is already a direct API case and the core defect class is materially asserted
- `partial`: there is an API case, but it does not yet prove the defect class deeply enough
- `missing`: no dedicated API case exists yet

## Executive Readout

Current scorecard headline:

1. direct case presence coverage: `100.0%` = `27 / 27`
2. strict fully-covered coverage: `100.0%` = `27 / 27`
3. weighted engineering coverage: `100.0%` = `27 / 27`

Main gap types from the `#1118` line:

1. standalone L0 / protocol / security probes are now present across the full `#1118` scorecard
2. story API cases exist, but many still only prove "row exists" instead of proving the risky contract
3. readiness probes now exist, but quote/order runtime defects and missing bootstrap data still block several first-wave lanes

## A. Missing Standalone API Cases

| Bucket | `#1118` concern to cover | Current status | Current case | Why current coverage is not enough | API case to add | Priority |
| --- | --- | --- | --- | --- | --- | --- |
| auth | OAuth revoke invalid-token / revoked-token contract | `covered` | `oauth-revoke-contract-api` | invalid-token, valid-token revoke, and post-revoke access are now all asserted directly | none | `P0` |
| auth | `/services/oauth2/userinfo` Salesforce-compatible claim set | `covered` | `oauth-userinfo-claims-api` | current assertions now pin the minimum compatibility claim set directly | none | `P0` |
| auth | `/services/oauth2/authorize` contract parity | `covered` | `oauth-authorize-parity-api` | direct route/validation probe now exists | none | `P1` |
| data security | external-ID upsert must not leak record existence / oracle behavior | `covered` | `external-id-upsert-security-api` | direct existing-vs-missing external-id probe now exists | deepen equality/oracle assertions later if needed | `P0` |
| metadata / DDL | custom object create path must survive metadata create / DDL path | `covered` | `custom-object-ddl-create-api` | direct create + readback probe now exists | none | `P0` |
| sharing | SharingRule create / update request contract | `covered` | `sharing-rule-contract-api` | direct owner-based create probe now exists | add update path later if needed | `P1` |
| sharing | nested groups effective access | `covered` | `nested-groups-effective-access-api` | direct nested `GroupMember` probe now exists | add downstream effective-access proof later if needed | `P1` |
| permissions | effective-access API parity across actors | `covered` | `effective-access-contrast-api` | current coverage now contrasts restricted vs extended actor visibility directly | deepen field-mask assertions later if needed | `P0` |

## B. Existing Story Cases That Need Deeper Assertions

| Scene | Story risk to pin | Current status | Current case | Current proof | Missing proof to add into existing case | Priority |
| --- | --- | --- | --- | --- | --- | --- |
| lead | lead admin metadata completeness | `covered` | `lead-admin-config-api` | object row, `_System_RecordType`, `PageLayout`, `LayoutAssignment`, and `FlowDefinition` are now all probed directly | none | `P1` |
| campaign | campaign list field surface, including standard fields like `CurrencyIsoCode` | `covered` | `campaign-list-customize-api` | current case now pins exact `Name`, `IsActive`, `Status`, and `CurrencyIsoCode` on the list row | none | `P0` |
| campaign | campaign create/edit standard-field persistence | `covered` | `campaign-create-edit-api` | create + patch now re-read exact `Name`, `Description`, `Status`, `IsActive`, and `CurrencyIsoCode` | none | `P0` |
| campaign | campaign member status admin scoping and defaultness | `covered` | `campaign-member-status-admin-api` | now pins the full ordered scoped status set including the admin-only probe row | none | `P1` |
| campaign | campaign member create with scoped picklist validator | `covered` | `campaign-add-members-api` | direct create failure is already caught in local report | keep as product-gap sentinel; no new case needed before fix lands | `P0` |
| opportunity | stage progression side effects | `covered` | `opportunity-stage-progress-api` | current case now asserts initial stage and directly fails on missing derived `Probability` / `ForecastCategoryName` side effects | none | `P0` |
| opportunity | business-field patch completeness | `covered` | `opportunity-field-updates-api` | now pins patched business fields plus unchanged key header/business fields on refetch | none | `P1` |
| opportunity | related-tab / business-tab completeness | `covered` | `opportunity-tabs-actions-api` | now pins quote header shape and related quote-line item shape, not just one visible quote row | none | `P1` |
| approval | submit-for-approval request payload / casing compatibility | `covered` | `approval-submit-tab-api`, `quote-approval-submit-api` | one case exercises Salesforce wrapper submit; one case pins legacy flat-body `RecordId` / `ObjectApiName` mapping | none | `P0` |
| setup admin | permission set graph completeness | `covered` | `permission-set-admin-api` | current case now creates `PermissionSet`, assigns it, and directly exposes `PermissionSetGroup` contract failure | deepen object/field permission assertions later if needed | `P1` |
| setup admin | users / roles / sharing hierarchy completeness | `covered` | `users-roles-sharing-admin-api` | current case now creates and queries `UserRole`, `Group`, and `GroupMember` directly | none | `P0` |
| setup admin | object schema write path | `covered` | `object-schema-admin-api`, `custom-object-ddl-create-api` | read-path and write-path are now covered as a pair | none | `P1` |

## C. Missing Readiness / Fixture Probe Cases

| Area | Current status | Why story cases are not enough | Readiness case to add | Unlocks | Priority |
| --- | --- | --- | --- | --- | --- |
| approval env | `covered` | latest/latest probing shows this is no longer just a missing downstream definition row; `ProcessDefinition` seed/query/create now hits an upstream runtime contract gap | `approval-readiness-api` | approval stories and admin stories | `P0` |
| product catalog | `covered` | quote/order/opportunity cases assume pricebook/product graph is healthy, but no dedicated probe isolates it | `product-catalog-readiness-api` | `#744`, `#772`, `#773`, `#172`, `#173` | `P0` |
| quote/order fixture chain | `covered` | quote/order/contract story failures currently mix seed gaps and product gaps | `quote-order-fixture-readiness-api` | `#771`, `#172`, `#173` | `P0` |
| security bootstrap | `covered` | latest/latest probing narrowed the current failing edge to `PermissionSetAssignment` runtime create-path handling, not simple actor absence | `security-bootstrap-readiness-api` | `#730`, `#731`, `#732`, `#761` | `P0` |
| reporting | `covered` | latest/latest probing shows both a stale `DashboardFolder` query contract and a deeper upstream runtime gap for `Report` / `Dashboard` materialization | `reporting-readiness-api` | `#171` | `P1` |
| integration | `covered` | latest/latest probing still shows missing webhook/config graph at the story level; direct `_System_Webhook` materialization also suggests an upstream runtime create-path gap | `integration-pack-readiness-api` | `#170` | `P1` |
| overlay / install surface | `covered` | deploy success does not prove first-wave metadata graph actually materialized | `overlay-readiness-api` | all first-wave scenes | `P1` |

## D. Current Scene-Level Coverage Snapshot

| Scene | Existing API case count | Directly usable now | Main gap class |
| --- | ---: | ---: | --- |
| `login-auth` | 4 | 4 | refresh/revoke contract still has product defects |
| `lead` | 5 | 4 | admin metadata depth |
| `opportunity` | 5 | 5 | runtime defects still block some downstream business lanes |
| `campaign` | 4 | 4 | scoped-picklist product gap remains |
| `quote-approval-order-contract` | 6 | 4 | readiness gaps around approval / quote-order chain |
| `security-and-visibility` | 5 | 5 | contrasted-actor bootstrap and nested-group/runtime defects remain |
| `setup-admin-metadata` | 8 | 8 | runtime contract defects remain in permission-set-group and sharing-rule lanes |
| `reports-dashboards` | 1 | 1 | builder/write-path coverage still missing |
| `integration` | 1 | 1 | runtime sync/write-path coverage still missing |

## E. Recommended Add Order

1. keep local auth/runtime stable so the strengthened cases can be replayed continuously
2. keep remote CI/watchdog aligned with the local-first flow and current seed assumptions

## Bottom Line

Current `origin/main` already has broad story-shaped API coverage.

For the `#1118` line, case-level breadth and depth are now complete in the current tree:

1. every scored item has a direct API probe or a direct case pair
2. risky story cases now assert business-critical standard fields, related-object shapes, or request-contract details
3. remaining work is execution stability, not missing case content