Test plan: New Hire Preboarding Console

Expands on spec.md's Scope and Acceptance Criteria into concrete scenarios, grouped by flow area. Several scenarios that the Figma flow (design/figma-export.md) implies but that current spec.md hasn't confirmed as in-scope are marked blocked — see spec.md's Open Question 3 (scope reconciliation between the PRD-derived spec and the 25-screen Figma flow) rather than guessing at an answer.

Scenarios

Console access & session

1. Magic-link invitation grants time-bound access.
2. Given a candidate receives a gated Guest Console invitation email
3. When they open the link within its validity window

4. Then they land in the console scoped to their own pre-boarding record only.

5. Expired or already-used invitation is rejected.

6. Given a candidate's invitation link has expired or was already redeemed
7. When they attempt to open it

8. Then access is denied with a clear message, and no session is issued.

9. Console access cannot reach another candidate's record.

10. Given a candidate is authenticated in the console
11. When any request is made (task list, document, preferences)
12. Then only that candidate's own pre-boarding record is ever returned or modified — verify explicitly with a second candidate's identifiers, not just the happy path.

HR Concierge / chat-driven canvas

1. Concierge greets the candidate and frames what's left. (blocked — depends on the canvas-mode shell in nova-frontend-litjs, not yet built; see ../software-design/adr-canvas-mode-shell.md)
2. Given a candidate enters the console for the first time
3. When the HR Concierge agent greets them
4. Then it states the number of remaining steps, estimated time, and the candidate's start date, consistent with the Figma flow's "Greeted by name" screen.

5. Cannot be verified end-to-end until the canvas-mode shell and its SSE directive (spec.md Dependencies) exist — this Feature builds neither itself.

6. Concierge escalates rather than guessing.

7. Given a candidate asks the HR Concierge agent a question it's uncertain about, or one on a sensitive topic
8. When the agent evaluates confidence

9. Then it hands off to a named HR Ops contact instead of answering speculatively.

10. Step advances via canvas button, independent of chat. (blocked — same canvas-mode-shell dependency as Scenario 4)

11. Given a candidate is on any step's canvas
12. When they click the canvas's primary CTA button without typing anything to the agent
13. Then the step advances the same way it would if driven by a chat instruction — both paths must converge on the same step-state update.

Task list & sequencing

1. Task list shows sequence and progress.
2. Given a candidate has an active pre-boarding plan
3. When they view their task list

4. Then remaining tasks are shown in policy-determined order (e.g. Security Policy and handbook before the employment contract) with clear progress (e.g. "0 of 6 done").

5. Universal-tasks fallback on a rule gap is explained, not silent.

6. Given business rules (owned by hr-admin-deterministic-transactions) don't cover this candidate's worker-type/jurisdiction combination
7. When their task list is generated
8. Then they see universal tasks only, and are not shown an incomplete list without explanation — HR Ops is notified to assign the rest.

Policy read & sign

1. Policies are read before they can be signed.
2. Given a candidate has one or more required policy documents
3. When they attempt to sign a policy

4. Then they must have opened/read it first, per the Figma flow's "Policies & NDA — read" step preceding "— sign".

5. Signing the offer and required policies completes those tasks.

   • Given a candidate completes e-signature on the offer and each required policy
   • When each signature is captured
   • Then the corresponding task is marked complete and the candidate sees in-console confirmation — no separate email confirmation required.

Document upload & EDM

1. Bulk upload classifies and files documents automatically.

   • Given a candidate drops multiple documents at once (e.g. ID for I-9 verification)
   • When the system processes them
   • Then each is classified and filed into the candidate's personal EDM without manual per-document labelling.

2. Unclassifiable upload is flagged, never silently accepted.

   • Given an uploaded document the system cannot confidently classify or validate
   • When classification completes
   • Then both the candidate and HR Ops are notified and asked for re-upload — it is never filed into the EDM without confirmation.

3. Pending-replacement flag on a temporary document.

   • Given a candidate has only a temporary version of a required document (e.g. a temporary license)
   • When they upload it with an attached explanatory message
   • Then it's filed in the EDM flagged as pending replacement, and HR Ops is notified of the gap rather than it appearing silently incomplete.

Contract renewal (contingent workers)

1. Expiring contract triggers a fresh gated re-entry, not persistent access.

   • Given a contingent worker's contract is approaching its end date
   • When the renewal workflow (owned by hr-admin-deterministic-transactions) fires
   • Then the contractor receives an expiry notification and a new, time-bound gated invitation — not standing access to the console.

2. Signing the renewal supersedes the prior contract.

   • Given a contractor re-enters via the renewal invitation and signs the renewed contract
   • When the signature completes
   • Then the renewed contract is auto-stored in the EDM, the prior contract is marked superseded, and the EDM status label updates from expiring to active.

3. Missing/ambiguous contract end date blocks the renewal flow.

   • Given a contractor's contract end date is missing or ambiguous in the source record
   • When the renewal check runs
   • Then HR Ops is alerted instead of a renewal re-entry being generated on an incorrect date.

Cross-cutting

1. Access window enforcement holds across all task types.
   • Given a candidate's gated console access window has expired
   • When they attempt any action (view tasks, upload, sign, message)
   • Then every action is denied, not just the initial login.

Blocked — pending scope reconciliation (spec.md Open Question 3)

The Figma flow (design/figma-export.md) depicts additional steps not yet confirmed as in-scope for this Feature. These are named here so they're not lost, not because they're assumed to ship:

• Agent personalization sub-flow (name/look/voice selection for the Concierge agent).
• Equipment (laptop), swag (T-shirt size), and accommodations selection tasks.
• Background-check hand-off/resume via Checkr.
• Live ID-badge preview tied to preferred name.
• Explicit guest → full-employee account-state conversion on the start date.

Out of scope for this pass

• HR Admin workspace, deterministic task engine, recruiter hand-off/ATS readiness, the orchestration layer, and the HR-Ops-facing half of contract renewal — covered by hr-admin-deterministic-transactions's own test-plan.md, not here.
• The actual ATS integration (SmartRecruiters) — this Feature only receives whatever the sibling Feature's endpoint delivers.
• Manager and HRBP readiness/insight views — deferred, not in scope this quarter.
• EDM classification/extraction internals — owned by worker-document-management.