EF-070 · EFx enablement and station admin passcode

Account-level EFx enablement unlocks event modules and each event owns a station passcode. Rotation blocks new station joins immediately while existing live station sessions keep their signed session token.

Happy path

Enable EFx for the account.
An authorized admin opens EFx settings, turns on the account capability, and sees an audit-backed enabled state.
Set or rotate an event station passcode.
The event-level passcode form validates strength, saves through the station admin endpoint, and writes an audit row for every rotation.
Station joins with the current passcode.
The station receives a session token, opens the WebSocket namespace for the event, and receives the current snapshot before any deltas.

Failure modes

Live runtime contract

The story includes all EFx WebSocket rubric probes: reconnect snapshot, ordered deltas, 5000-station load, late join snapshot, pause semantics, gated sensitive display, idempotent station auth, and event-scoped isolation.

Passcode rotation evidence

Rotation writes an audit row and rejects new joins with the previous passcode without killing already-connected stations.

Enablement boundary

Disabled accounts cannot create modules or issue station session tokens, and the UI exposes a visible gap panel rather than a broken shell.

Stable test attributes

Visibility teeth. Each listed attribute must be effectively visible in the state where the probe expects it; interactive rows must also be focusable and unobscured.

data-test	Where	Purpose
`efx-enable-panel`	EFx admin settings	Account-level enablement state
`efx-enable-toggle`	EFx admin settings	Enable or disable EFx
`efx-passcode-form`	Event EFx settings	Passcode editor
`efx-passcode-input`	Event EFx settings	New passcode input
`efx-passcode-save-cta`	Event EFx settings	Save passcode
`efx-passcode-rotate-cta`	Event EFx settings	Rotate passcode
`efx-passcode-audit-row`	Audit table	Rotation evidence
`efx-station-passcode-form`	Station entry	Passcode gate
`efx-station-shell`	Station runtime	Authenticated shell
`efx-station-socket-status`	Station runtime	Connection state
`efx-station-active-state`	Station runtime	Module state
`efx-enable-gap-panel`	EFx admin settings	Disabled capability explanation

Agent test plan

- enablement-visible
- enablement-save
- passcode-rotation-audited
- current-passcode-opens-station
- old-passcode-rejected-after-rotation
- all WebSocket rubric probes listed in JSON-LD failureModes