# API Case Coverage Scorecard For #1118

Updated: `2026-05-08`

## Coverage Formula

This scorecard uses the current `#1118` API test-content decomposition already tracked in [api-case-coverage-matrix-1118.md](/Users/bingwang/github/nexuscrm-pingcap-pack/.worktrees/api-1118-coverage-matrix/docs/api-case-coverage-matrix-1118.md).

Denominator:

1. standalone protocol / security / metadata-create items: `8`
2. story-depth hardening items: `12`
3. readiness / fixture isolation items: `7`

Total scored test-content items: `27`

Status scoring:

- `covered` = `1.0`
- `partial` = `0.5`
- `missing` = `0.0`

## Headline Numbers

| Metric | Formula | Result |
| --- | --- | ---: |
| direct case presence coverage | (`covered + partial`) / `27` | `27 / 27 = 100.0%` |
| strict fully-covered coverage | `covered / 27` | `27 / 27 = 100.0%` |
| weighted coverage score | (`covered + 0.5 * partial`) / `27` | `27 / 27 = 100.0%` |
| missing coverage | `missing / 27` | `0 / 27 = 0.0%` |

## By Bucket

| Bucket | Covered | Partial | Missing | Presence Coverage | Strict Coverage | Weighted Coverage |
| --- | ---: | ---: | ---: | ---: | ---: | ---: |
| standalone protocol / security / metadata-create | `8` | `0` | `0` | `8 / 8 = 100.0%` | `8 / 8 = 100.0%` | `8 / 8 = 100.0%` |
| story-depth hardening | `12` | `0` | `0` | `12 / 12 = 100.0%` | `12 / 12 = 100.0%` | `12 / 12 = 100.0%` |
| readiness / fixture isolation | `7` | `0` | `0` | `7 / 7 = 100.0%` | `7 / 7 = 100.0%` | `7 / 7 = 100.0%` |

## Big Table

| ID | Bucket | `#1118` test content | Issue(s) | Current case(s) | Status | Score | Local evidence |
| --- | --- | --- | --- | --- | --- | ---: | --- |
| A1 | standalone | OAuth revoke invalid-token / revoked-token contract | `#780` | `oauth-revoke-contract-api`, `oauth-compatibility-api` | `covered` | `1.0` | `local-1118-oauth-revoke-v1`: invalid-token + revoked-token path are both directly asserted; current product defect is valid revoke returning `403` |
| A2 | standalone | `/services/oauth2/userinfo` Salesforce-compatible claim set | `#780` | `oauth-userinfo-claims-api` | `covered` | `1.0` | `local-1118-auth-v2`: `passed` |
| A3 | standalone | `/services/oauth2/authorize` contract parity | `#780` | `oauth-authorize-parity-api` | `covered` | `1.0` | `local-1118-oauth-authorize-v1`: `passed` |
| A4 | standalone | external-ID upsert must not leak record existence / oracle behavior | `#732` | `external-id-upsert-security-api` | `covered` | `1.0` | `local-1118-externalid-v1`: existing + missing external-id paths were both handled |
| A5 | standalone | custom object create path must survive metadata create / DDL path | `#166` | `custom-object-ddl-create-api` | `covered` | `1.0` | `local-1118-custom-object-v1`: `passed` |
| A6 | standalone | SharingRule create / update request contract | `#731` | `sharing-rule-contract-api` | `covered` | `1.0` | `local-1118-sharing-rule-v3`: direct `400` on owner-based sharing-rule create |
| A7 | standalone | nested groups effective access | `#731`, `#732` | `nested-groups-effective-access-api` | `covered` | `1.0` | `local-1118-nested-groups-v3`: direct `500` on nested `GroupMember` insert |
| A8 | standalone | effective-access API parity across actors | `#732` | `effective-access-contrast-api` | `covered` | `1.0` | `local-1118-security-v2`: case is present and blocks on missing contrasted fixture graph |
| B1 | story-depth | lead admin metadata completeness | `#761` | `lead-admin-config-api` | `covered` | `1.0` | case now directly pins `_System_RecordType`, `PageLayout`, `LayoutAssignment`, and `FlowDefinition` surfaces; fresh rerun pending because current local watchdog credentials fail at login |
| B2 | story-depth | campaign list field surface, including `CurrencyIsoCode` | `#766` | `campaign-list-customize-api` | `covered` | `1.0` | `local-1118-campaign-list-tighten-v2`: exact `Name` / `IsActive` / `Status` / `CurrencyIsoCode` are pinned |
| B3 | story-depth | campaign create/edit standard-field persistence | `#765` | `campaign-create-edit-api` | `covered` | `1.0` | case now pins exact `Name` / `Description` / `Status` / `IsActive` / `CurrencyIsoCode` after write |
| B4 | story-depth | campaign member status admin scoping and defaultness | `#764` | `campaign-member-status-admin-api` | `covered` | `1.0` | case now pins exact scoped rows `Sent` / `Responded` / `Watchdog Admin Probe`, with sort-order and defaultness |
| B5 | story-depth | campaign member create with scoped picklist validator | `#763` | `campaign-add-members-api` | `covered` | `1.0` | `local-1118-campaign-v1`: direct `400` defect is caught |
| B6 | story-depth | opportunity stage progression side effects | `#745` | `opportunity-stage-progress-api` | `covered` | `1.0` | `local-1118-stage-tighten-v2`: direct failure proves `Probability` side effect is missing after stage transition |
| B7 | story-depth | opportunity business-field patch completeness | `#747` | `opportunity-field-updates-api` | `covered` | `1.0` | case now pins patched `Amount` / `NextStep` / `Description` and unchanged `Name` / `StageName` / `CloseDate` coherence |
| B8 | story-depth | opportunity related-tab / business-tab completeness | `#746` | `opportunity-tabs-actions-api` | `covered` | `1.0` | case now pins exact related quote shape plus the downstream `QuoteLineItem` surface |
| B9 | story-depth | approval submit payload / casing compatibility | `#771` | `approval-submit-tab-api`, `quote-approval-submit-api` | `covered` | `1.0` | one case now exercises Salesforce-style `requests[]` submit and latest-instance readback; the sibling case pins legacy flat-body `ObjectApiName` / `RecordId` compatibility |
| B10 | story-depth | permission set graph completeness | `#730` | `permission-set-admin-api` | `covered` | `1.0` | `local-1118-permset-v2`: create/query path works for `PermissionSet` and assignment, and directly exposes `PermissionSetGroup` contract defect |
| B11 | story-depth | users / roles / sharing hierarchy completeness | `#731` | `users-roles-sharing-admin-api` | `covered` | `1.0` | latest/latest refresh: `UserRole` + `Group` create/query still pass, but `GroupMember` create now fails on runtime key-prefix handling |
| B12 | story-depth | object schema write path | `#166` | `object-schema-admin-api`, `custom-object-ddl-create-api` | `covered` | `1.0` | read-path remains in `object-schema-admin-api`; write-path is now directly pinned by `custom-object-ddl-create-api` |
| C1 | readiness | approval env readiness | `#159`, `#160`, `#771` | `approval-readiness-api` | `covered` | `1.0` | `local-1118-readiness-v6`: isolated to `QuoteLineItem` runtime defect |
| C2 | readiness | product catalog readiness | `#744`, `#772`, `#773`, `#172`, `#173` | `product-catalog-readiness-api` | `covered` | `1.0` | `local-1118-readiness-v6`: `passed` |
| C3 | readiness | quote/order fixture chain readiness | `#771`, `#172`, `#173` | `quote-order-fixture-readiness-api` | `covered` | `1.0` | `local-1118-readiness-v6`: isolated to `QuoteLineItem` runtime defect |
| C4 | readiness | security bootstrap readiness | `#730`, `#731`, `#732`, `#761` | `security-bootstrap-readiness-api` | `covered` | `1.0` | latest/latest refresh: now fails earlier on `PermissionSetAssignment` runtime create-path handling |
| C5 | readiness | reporting readiness | `#171` | `reporting-readiness-api` | `covered` | `1.0` | latest/latest refresh: `ReportFolder` exists, but old `DashboardFolder` query contract is stale and deeper `Report` / `Dashboard` materialization is blocked upstream |
| C6 | readiness | integration pack readiness | `#170` | `integration-pack-readiness-api` | `covered` | `1.0` | latest/latest refresh: case still skips; direct `_System_Webhook` materialization probe exposes likely upstream create-path blocker |
| C7 | readiness | overlay / install-surface readiness | first-wave scenes | `overlay-readiness-api` | `covered` | `1.0` | latest/latest refresh: `passed` |

## Practical Conclusion

If the question is:

1. “有没有对应 case？”  
   answer: `100.0%`
2. “有没有把 1118 的测试内容严格证明到位？”  
   answer: `100.0%`
3. “按 covered=1 / partial=0.5 的工程口径，当前整体走到哪？”  
   answer: `100.0%`

Current bottleneck is no longer case presence or case depth for `#1118`.

Current bottleneck is execution stability:

1. some probes intentionally expose real product defects and remain red by design
2. quote/order runtime defects still block several first-wave lanes from turning green
3. fresh local rerun is currently blocked by watchdog actor login failure in the local stack