EF-077 · EFx Access Control

Door checkpoints scan NFC or QR for event areas and sessions. The native scan endpoint and config exist; this branch demands hardware proof, capacity enforcement, late-arrival policy, and audit rows per scan.

Happy path

Organizer configures access areas.
Each area maps to sessions, capacity, allowed access types, and late-arrival policy.
Door staff scans QR or NFC.
Native runner resolves the attendee, enforces the session rule, and shows allow or deny.
Scan result broadcasts to station state.
Audit and capacity counters update without leaking across stations.

Failure modes

Access-control live rubric

All EFx WebSocket probes apply, plus physical NFC/QR scan proof, per-session capacity, late-arrival policy, and audit rows per scan.

Stable test attributes

Visibility teeth. Door result states must be visible and unambiguous; scan controls must be interactive on supported devices.

data-test	Where	Purpose
`efx-access-admin-panel`	Organizer EFx controls	Access setup
`efx-access-area-form`	Organizer EFx controls	Area rules
`efx-access-capacity-input`	Area rules	Capacity
`efx-access-late-policy`	Area rules	Late-arrival policy
`efx-access-scan-shell`	Door station	Scan surface
`efx-access-nfc-scan-cta`	Door station	NFC scan
`efx-access-qr-scan-cta`	Door station	QR scan
`efx-access-allow-state`	Door station	Allowed result
`efx-access-deny-state`	Door station	Denied result
`efx-access-audit-row`	Audit table	Scan evidence
`efx-station-socket-status`	Station runtime	Socket status
`efx-station-active-state`	Station runtime	Module state

Agent test plan

- access-admin-visible
- nfc-scan-success
- qr-scan-success
- capacity-deny
- late-policy-allow-or-deny
- audit-row-per-scan
- all WebSocket rubric probes in failureModes