Documentation Blocker Register¶

Metadata dan batas analisis¶

Atribut	Nilai
Mode	Server development; analisis statis/read-only, tanpa perubahan application code
Workspace root	`/home/scola/odoo`
Snapshot reconnaissance	`scola-fe-v2/docs/recon`, terakhir diverifikasi 2026-08-05
Verifikasi ulang	2026-08-08
Frontend HEAD	`0275f7061e6e892b1f860eeb825c6f6a21851888`
Backend HEAD	`44425cc81d8d281ec76e9336c30b3e109a7fc473`
Dokumen tata kelola yang dibaca	`scola-fe-v2/docs/ai-guidelines/AI_AGENT_MASTER_GUIDE.md`, `scola-fe-v2/docs/ai-guidelines/development-guide.md`, `scola-fe-v2/docs/ai-guidelines/workspace-governance.md`, `scola-fe-v2/docs/ai-guidelines/architecture-api.md`, `scola-fe-v2/docs/ai-guidelines/DOCUMENTATION_GOVERNANCE.md`
Sumber produk	Seluruh file Markdown pada `scola-fe-v2/docs/recon/`, user guide yang ada, dokumentasi domain/modular yang relevan, serta FE/BE pada HEAD di atas

Register ini adalah backlog sebelum penulisan dokumentasi, bukan kontrak produk dan bukan daftar defect yang telah diperbaiki. Route alias yang memakai component/handler sama digabung. Bukti file:line menunjuk snapshot HEAD di atas; nomor baris harus diperbarui setelah source berubah.

Aturan klasifikasi dan confidence¶

Blocker A — prosedur atau klaim terdampak tidak boleh diterbitkan/digunakan ulang sebelum defect diperbaiki atau keputusan eksplisit diwujudkan dan acceptance criteria lulus.
Blocker B — dokumentasi boleh diterbitkan hanya dengan limitation/warning yang disetujui owner; tidak boleh mengubah defect menjadi perilaku yang dianggap normal.
Non-blocker — tidak menghambat penulisan, tetapi verifikasi yang disebutkan tetap diperlukan.
Confirmed from code — jalur statis terlihat langsung pada HEAD.
Inferred from code — dampaknya merupakan kesimpulan dari beberapa jalur statis dan perlu pengujian.
Requires runtime verification — module install, group, tenant, data, atau served bundle belum dibuktikan pada runtime bernama.
Requires business confirmation — kode tidak dapat menetapkan kebijakan/ownership yang benar.

Delta sejak reconnaissance 2026-08-05¶

Area	Perkembangan HEAD	Implikasi backlog
Multi-role login	Backend kini mengekspos `assigned_roles` dan FE menyediakan role switcher, tetapi switching tidak mengurangi union group backend (`custom_addons_scola/gcgscola/scola_core/controllers/auth.py:207-210,485-517`; `scola-fe-v2/src/components/RoleSwitcher.vue:135-170`).	BLK-A02 tetap Blocker A; menu persona tidak boleh dianggap bukti least privilege.
Weekly approval	Registry dan controller kini memiliki capability serta company checks eksplisit (`custom_addons_scola/gcgscola/scola_platform_support/api_route_access.py:74-76`; `custom_addons_scola/gcgscola/scola_lms/controllers/lms_weekly_approval_api.py:20-82,123-220`).	Temuan reconnaissance SEC-02 tidak direproduksi statis; dipindahkan ke NB-01.
Import siswa	FE sekarang mendukung job asynchronous dan fallback (`src/views/AdminViews/StudentDatabase/UploadSiswa.vue:769-778,835`), sedangkan route create/import dan guide lama belum konsisten.	BLK-B03 diperbarui; jangan mendokumentasikan UI snapshot lama.
W05 attendance	Audit current HEAD menemukan gap ACL first-save, validasi roster, state/correction, status, dan privacy proof.	BLK-A19 sampai BLK-A23 ditambahkan dan menjadi gate pilot.

Ringkasan register terdeduplikasi¶

ID	Klasifikasi	Module/workflow	Disposisi dokumentasi
BLK-A01	Blocker A	Runtime/product baseline	Bekukan klaim supported/role-specific sampai baseline bernama lulus.
BLK-A02	Blocker A	Multi-role authorization	Jangan ajarkan role switching sebagai pengurangan hak akses.
BLK-A03	Blocker A	Global API route gate	Jangan mengandalkan intended capability pada prefix yang shadowed.
BLK-A04	Blocker A	Public complaint	Jangan terbitkan workflow operator/attachment.
BLK-A05	Blocker A	Promotion	Jangan gunakan guide kenaikan kelas.
BLK-A06	Blocker A	Counseling	Jangan ajarkan mutasi/view data konseling.
BLK-A07	Blocker A	Payroll	Batasi guide pada self-service yang tervalidasi; blokir operator workflow.
BLK-A08	Blocker A	Kesiswaan	Jangan ajarkan approve/reject/mutation.
BLK-A09	Blocker A	Accounting	Jangan ajarkan posting/reconciliation/budget mutation.
BLK-A10	Blocker A	BOS/RKAS procurement	Jangan ajarkan approval/attachment.
BLK-A11	Blocker A	Dapodik sync	Jangan ajarkan execute sync.
BLK-A12	Blocker A	Core contextual mail tracking	Jangan mendokumentasikan endpoint generik.
BLK-A13	Blocker A	SPMB configuration	Jangan ajarkan save/delete master config.
BLK-A14	Blocker A	Fee enrollment	Jangan ajarkan operator mutation lintas tenant sampai scoping lulus.
BLK-A15	Blocker A	Messaging	Jangan ajarkan batch preview/attachment generik.
BLK-A16	Blocker A	Admin calendar	Jangan ajarkan create/edit dengan arbitrary record/attendee.
BLK-A17	Blocker A	Company/notification settings	Jangan ajarkan config write berdasarkan view permission.
BLK-A18	Blocker A	Placeholder/register	Jangan membuat prosedur untuk halaman placeholder/incomplete.
BLK-A19	Blocker A	W05 first save	Blokir pilot guru sampai ACL first-save lulus.
BLK-A20	Blocker A	W05 roster integrity	Blokir save sampai exact roster/tenant validation atomik.
BLK-A21	Blocker A	W05 completion/correction	Blokir klaim completion/correction/approval.
BLK-A22	Blocker A	W05 attendance state glossary	Blokir status `Sakit` sebagai status canonical.
BLK-A23	Blocker A	W05 proof privacy	Blokir upload/view proof.
BLK-B01	Blocker B	Feature/module availability	Tulis hanya dengan tenant-specific availability warning.
BLK-B02	Blocker B	Menu/route/alias drift	Gunakan canonical route dan runtime capability; jangan salin menu snapshot.
BLK-B03	Blocker B	Student create/import	Perbarui trace dan limitation sebelum reuse guide.
BLK-B04	Blocker B	W05 principal/VP UI	Dokumentasikan read-only saja setelah CTA dibatasi/diverifikasi.
BLK-B05	Blocker B	Existing W05 guides	Freeze reuse sampai BLK-A19–A23 selesai.
BLK-B06	Blocker B	Attendance cancellation notice	Jangan menjanjikan parent notification.
BLK-B07	Blocker B	RFID ingestion/retry	Nyatakan manual exception handling; jangan janjikan auto recovery.
BLK-B08	Blocker B	Library queue assignment	Warning concurrency; jangan janjikan atomic fair allocation.
BLK-B09	Blocker B	Library fines/invoice	Jelaskan hanya setelah ownership auto-post disetujui.
BLK-B10	Blocker B	Library settings route	Gunakan manage-only; route/UI harus selaras.
BLK-B11	Blocker B	News vs legacy announcement	Hanya canonical `scola.news`; legacy harus diberi deprecation boundary.
NB-01	Non-blocker	Weekly approval	Lanjutkan setelah runtime UAT role/company.
NB-02	Non-blocker	LMS assignment idempotency	Bisa didokumentasikan setelah runtime negative/retry test.

Blocker A — tidak boleh didokumentasikan sebelum diperbaiki¶

BLK-A01 — Baseline runtime dan supported surface belum bernama¶

Module/workflow: lintas aplikasi; role-specific user documentation.
Affected route/API: seluruh route; khususnya module/feature-gated route.
Finding: reconnaissance adalah snapshot statis dan menyatakan module terpasang, effective groups, representative accounts, database, dan tenant belum diverifikasi. Keberadaan route/menu tidak membuktikan surface didukung. Status: Requires runtime verification; Requires business confirmation.
User impact: panduan dapat mengarahkan pengguna ke menu yang tidak ada atau route 403 pada sekolah tertentu.
Security/business impact: role matrix yang hanya statis dapat mengajarkan akses lebih luas daripada konfigurasi produksi atau menjanjikan module yang belum dilisensikan/provisioned.
Recommended owner: Product Owner + Platform Operations + Security Owner.
Required decision or fix: tetapkan release/module profile per tenant, database baseline, effective group fixtures, representative user accounts, dan supported-surface approval.
Evidence: docs/recon/README.md:9-14; docs/recon/open-questions.md:77-81; docs/domains/governance/README.md:98-102.
Proposed acceptance criteria: tenant/database/build/module list bernama; semua role target login; menu, route, API success/403, dan company scope diuji; hasil bertanggal dilampirkan ke release dokumentasi; PO menyetujui supported surface.

BLK-A02 — Active role mengubah persona, bukan union permission backend¶

Module/workflow: authentication, role switching, seluruh role-specific workflow.
Affected route/API: /api/auth/login, role switch endpoint, seluruh protected API.
Finding: backend mempertahankan union group dan secara eksplisit menyatakan role switch tidak menghapus group; capability dihitung dari semua role/group authoritative. FE menampilkan persona dari assigned_roles. Status: Confirmed from code; policy Requires business confirmation.
User impact: pengguna dapat melihat persona A namun tetap memiliki hak API dari persona B; guide berbasis active role dapat menyesatkan.
Security/business impact: least-privilege, segregation of duties, dan audit attribution tidak dapat dijanjikan.
Recommended owner: Security Owner + Product Owner + Backend Auth Owner.
Required decision or fix: pilih active role sebagai security context yang benar-benar mempersempit capability, atau nyatakan role switch hanya navigasi dan rancang dokumentasi/approval berdasarkan effective union.
Evidence: custom_addons_scola/gcgscola/scola_core/controllers/auth.py:485-517; custom_addons_scola/gcgscola/scola_core/services/auth_capabilities.py:713-771; scola-fe-v2/src/components/RoleSwitcher.vue:135-170; docs/user-guide/troubleshooting/login.md:25-47.
Proposed acceptance criteria: contract test membuktikan capability set sebelum/sesudah switch; matrix effective permission untuk akun multi-role disetujui Security; UI menampilkan scope yang benar; audit event merekam acting role.

BLK-A03 — Resolver capability memakai first-prefix match dan shadowing¶

Module/workflow: platform route access; library, fees, LMS, dan route prefix lain.
Affected route/API: /api/v1/library/purchase-requests/update*, /api/v1/fees/generate-preview*, /api/v1/lms/modul-ajar/*.
Finding: resolver mengembalikan rule prefix pertama, bukan prefix terpanjang. Rule broad muncul sebelum rule spesifik sehingga update library menerima view-capability; fee preview dapat menerima capability generate; intended LMS modul-ajar rule ter-shadow rule LMS umum. Status: Confirmed from code.
User impact: tombol/guide dapat menyebut permission yang berbeda dari gate yang benar-benar berjalan.
Security/business impact: mutasi bisa diotorisasi terlalu longgar atau read/preview ditolak terlalu ketat.
Recommended owner: Platform Security Owner.
Required decision or fix: longest-prefix/exact-match resolution atau ordering invariant tervalidasi; audit seluruh overlap.
Evidence: custom_addons_scola/gcgscola/scola_platform_support/api_route_access.py:60,226,254,289,294,458,482-500.
Proposed acceptance criteria: automated overlap detector tanpa shadowing tak disengaja; contract tests setiap prefix spesifik; capability matrix dihasilkan dari resolver aktual; security review menyetujui exception eksplisit.

BLK-A04 — Aduan publik: operator guard, attachment, dan anti-bot belum aman¶

Module/workflow: public complaint intake dan internal complaint handling.
Affected route/API: /api/complaint/* internal/detail/mutation dan public submission/attachment.
Finding: internal endpoints memakai auth='user' dan elevated model access tanpa capability registry yang setara; attachment tidak memiliki server-side size/type allowlist; Turnstile dapat fail-open. Guide yang ada mengajarkan operator flow. Status: Confirmed from code.
User impact: pengguna dapat menerima atau membuka data aduan di luar tugasnya; upload berbahaya/besar mungkin diterima.
Security/business impact: data pelapor sensitif, abuse, malware/storage exhaustion, dan privacy incident.
Recommended owner: Security Owner + Complaint Process Owner + DPO.
Required decision or fix: capability/action matrix, company/ownership domain, strict anti-bot policy, attachment validation/scanning/retention, dan redaction rules.
Evidence: custom_addons_scola/gcgscola/scola_public_complaint/controllers/public_complaint_api.py:107-120,140-155,223-231,351-405,440-478; custom_addons_scola/gcgscola/scola_platform_support/api_route_access.py:1-500 (tidak ada rule /api/complaint); scola-fe-v2/docs/user-guide/school-admin/komunikasi/aduan.md:10-17.
Proposed acceptance criteria: anonymous abuse/size/type negative tests; operator without manage capability mendapat 403; tenant/assignment isolation test; DPO-approved field/view/retention matrix; guide lama ditarik sampai UAT lulus.

BLK-A05 — Promotion admin memanggil helper yang tidak didefinisikan¶

Module/workflow: kenaikan kelas/promotion.
Affected route/API: /api/v1/report-card/promotion/admin/*.
Finding: controller memanggil _can_view_report_cards, tetapi tidak ada definisi pada controller/mixin yang ditelusuri; semua route promotion admin bergantung padanya. Guide existing menjelaskan flow seolah berfungsi. Status: Confirmed from code; runtime failure Requires runtime verification.
User impact: daftar, kandidat, dan aksi promotion berisiko gagal sebelum workflow dimulai.
Security/business impact: keputusan akademik penting dapat tertunda atau guide menjanjikan workflow rusak.
Recommended owner: Academic/Report Card Engineering Owner.
Required decision or fix: implementasikan/warisi guard yang benar, role/action matrix, tests dan UAT promotion.
Evidence: custom_addons_scola/gcgscola/scola_report_card/controllers/promotion_admin_api.py:21-24,63-172; scola-fe-v2/docs/user-guide/school-admin/akademik/kenaikan-kelas.md:13-23.
Proposed acceptance criteria: import/startup test memastikan helper tersedia; authorized/unauthorized route tests; happy path dan rollback promotion pada tenant uji; guide existing direvisi setelah hasil UAT.

BLK-A06 — Counseling view dan manage tidak dipisahkan¶

Module/workflow: counseling reports, responses, referrals, schedules.
Affected route/API: /api/v1/counseling/*, /api/v1/counselor/*.
Finding: helper manage mengembalikan hasil view access; controller memakai elevated environment untuk read/mutation. Registry juga menggunakan capability view broad. Status: Confirmed from code.
User impact: pengguna yang hanya perlu melihat dapat membuat/mengubah laporan, respons, atau referral.
Security/business impact: catatan konseling sangat sensitif; risiko unauthorized mutation dan disclosure.
Recommended owner: Counseling Process Owner + Security Owner + DPO.
Required decision or fix: pisahkan view/create/respond/refer/close/export; scope ke counselor/child/company; tentukan emergency/break-glass.
Evidence: custom_addons_scola/gcgscola/scola_counseling/controllers/counseling_domain_api.py:39-59,81,171-174,233-236,314-338; custom_addons_scola/gcgscola/scola_platform_support/api_route_access.py:441-448; scola-fe-v2/docs/user-guide/school-admin/kesiswaan/pembinaan-izin-pelanggaran.md:17-33.
Proposed acceptance criteria: action-specific capability tests; cross-counselor/cross-company/parent/student negative tests; audit and redaction policy; DPO + school counselor approval.

BLK-A07 — Payroll operator mutation memakai capability view¶

Module/workflow: payroll admin/config/report/action; employee self-service.
Affected route/API: /api/payroll/*, /api/payroll/admin/*, /api/payroll/config/*.
Finding: registry memakai hr.payslip.view; admin manage helper memakai capability yang sama ditambah model write ACL, lalu menyediakan confirm/cancel/draft/refund/input/batch. Payload report memuat gross/net/deductions. Self paths tampak own-scoped dan tidak termasuk blocker operator ini. Status: Confirmed from code.
User impact: reviewer/read-only berpotensi menjalankan mutasi payroll.
Security/business impact: kerahasiaan gaji, fraud, segregation-of-duties, dan perubahan finansial tanpa approval ownership.
Recommended owner: HR/Payroll Owner + Finance Approver + Security Owner + DPO.
Required decision or fix: capability self/operator/reviewer/approver/auditor; company/employee scope; maker-checker dan audit.
Evidence: custom_addons_scola/gcgscola/scola_platform_support/api_route_access.py:404-406; custom_addons_scola/gcgscola/scola_payroll/controllers/payslip_admin_api.py:33-66,391-558; custom_addons_scola/gcgscola/scola_payroll/controllers/payroll_api.py:37-149,274-354.
Proposed acceptance criteria: role/action/company negative tests; payslip state-machine and approval audit; self endpoint exposes only current employee; DPO-approved field matrix; operator guide only after payroll sign-off.

BLK-A08 — Kesiswaan memakai view-capability untuk mutation/approval¶

Module/workflow: prestasi, izin, pelanggaran, dan approval kesiswaan.
Affected route/API: /api/v1/kesiswaan/*.
Finding: broad registry menggunakan students.list.view; helper view menerima capability itu; achievement save/delete/approve/reject dan permit actions menggunakan view-named capability sebagai manage gate. Company context ada, tetapi ownership/action separation tidak terbukti. Status: Confirmed from code; ownership Requires business confirmation.
User impact: viewer daftar siswa dapat tampak/bertindak sebagai operator approval.
Security/business impact: integritas catatan siswa dan keputusan disiplin/izin.
Recommended owner: Student Affairs Owner + Security Owner.
Required decision or fix: pisahkan read/create/edit/delete/approve/reject per domain serta assignment/class/company scope.
Evidence: custom_addons_scola/gcgscola/scola_platform_support/api_route_access.py:435; custom_addons_scola/gcgscola/scola_student_activity/controllers/kesiswaan_domain_api.py:42-54,78-84,165-221,1032-1077; scola-fe-v2/docs/user-guide/school-admin/kesiswaan/pembinaan-izin-pelanggaran.md:17-33.
Proposed acceptance criteria: viewer cannot mutate; maker cannot approve own item unless explicitly accepted; class/company boundary tests; transition/audit tests; Student Affairs signs approval matrix.

BLK-A09 — Accounting view-capability membuka mutation dengan elevated model¶

Module/workflow: accounting journals, budget, reconciliation.
Affected route/API: /api/v1/accounting/*.
Finding: catch-all registry memakai accounting.journal.view; manage helper menerima beberapa view-capability; elevated model paths browse/mutate budget dan reconciliation tanpa automatic company domain pada common search helper. Status: Confirmed from code.
User impact: accounting viewer dapat memperoleh UI/API mutation semantics yang tidak sesuai.
Security/business impact: posting/reconciliation lintas scope dan perubahan ledger/budget.
Recommended owner: Finance Controller + Security Owner.
Required decision or fix: view/create/edit/post/reconcile/approve capability split, company domain pada setiap record, maker-checker.
Evidence: custom_addons_scola/gcgscola/scola_platform_support/api_route_access.py:407; custom_addons_scola/gcgscola/scola_account/controllers/accounting_modules_api.py:20-59,69-167,212-300.
Proposed acceptance criteria: per-action permission and tenant tests; record rule/equivalent scoped service; immutable audit for posted actions; finance sign-off before any operator documentation.

BLK-A10 — BOS/RKAS approval idempotency dan attachment ownership belum aman¶

Module/workflow: budget dan procurement BOS/RKAS.
Affected route/API: budget admin, purchase request action, procurement attachment upload.
Finding: budget manage sama dengan view; purchase-request approval tidak menegakkan transition guard dan dapat menambahkan commitment setiap pemanggilan; attachment menerima arbitrary model/res_id tanpa size/type allowlist. Status: Confirmed from code.
User impact: double action dapat menggandakan commitment; file dapat dilekatkan ke record yang tidak menjadi kewenangan operator.
Security/business impact: salah saji anggaran, duplicate financial effect, unauthorized attachment, malware/storage risk.
Recommended owner: BOS/RKAS Owner + Finance Approver + Security Owner.
Required decision or fix: state/idempotency guard, action-specific permissions, record ownership check, attachment validation/scanning.
Evidence: custom_addons_scola/gcgscola/scola_bos_rkas/controllers/budget_admin_api.py:31-52; custom_addons_scola/gcgscola/scola_bos_rkas_procurement/models/purchase_request.py:142-164; custom_addons_scola/gcgscola/scola_bos_rkas_procurement/controllers/procurement_admin_api.py:35-62,355-384; custom_addons_scola/gcgscola/scola_platform_support/api_route_access.py:354,357-359,396.
Proposed acceptance criteria: repeated action has one financial effect; invalid state returns 409/validation error; viewer cannot mutate; cross-company/model attachment negative tests; file controls and audit pass.

BLK-A11 — Dapodik sync memakai view permission dan identity lookup tidak tenant-scoped¶

Module/workflow: Dapodik configuration and sync students/GTK/rombel.
Affected route/API: /api/v1/dapodik/*.
Finding: registry broad memakai settings.dapodik.view; config GET/POST/save dan destructive sync berada di surface yang sama. NISN, NUPTK, dan nama rombel lookup terlihat tidak dibatasi company. Guide mengajarkan preview lalu sync, sedangkan generic dry-run contract tidak terbukti. Status: Confirmed from code; real cross-tenant exploit Requires runtime verification.
User impact: operator dapat memperbarui master yang salah atau tidak dapat memulihkan hasil sync.
Security/business impact: cross-tenant identity collision, mass mutation, dan sumber data master tidak jelas.
Recommended owner: Integration Owner + School Data Operator + Security Owner.
Required decision or fix: manage capability, tenant-scoped identifiers, mandatory dry-run/diff, idempotency, source-of-truth dan rollback policy.
Evidence: custom_addons_scola/gcgscola/scola_platform_support/api_route_access.py:52; custom_addons_scola/gcgscola/scola_dapodik_connector/controllers/dapodik_api.py:22-95,214-313,327-435,474-571; scola-fe-v2/docs/user-guide/school-admin/pengaturan/dapodik.md:11-24.
Proposed acceptance criteria: cross-company collision tests; preview exactly predicts write set; rerun idempotent; recoverable audit/snapshot; explicit authorized operator; existing guide revised to verified semantics.

BLK-A12 — Contextual mail tracking menerima arbitrary model/res_id¶

Module/workflow: core contextual mail tracking/attachments.
Affected route/API: contextual mail tracking endpoint under core reference API.
Finding: route gate menggunakan users.profile.view; request memilih arbitrary model dan res_id, kemudian elevated tracking dilakukan tanpa record-level access check yang terlihat. Status: Confirmed from code.
User impact: pengguna dapat mengaitkan/melacak komunikasi pada record di luar scope.
Security/business impact: record enumeration, metadata disclosure, dan unauthorized cross-record mutation.
Recommended owner: Core Platform Security Owner.
Required decision or fix: model allowlist, record check_access_rights/check_access_rule, capability per domain, tenant/owner filter.
Evidence: custom_addons_scola/gcgscola/scola_core/controllers/core_reference_api.py:42-49; custom_addons_scola/gcgscola/scola_platform_support/api_route_access.py:26.
Proposed acceptance criteria: arbitrary model rejected; inaccessible record returns 403 without existence leak; allowed model/action contract tests; security review of all generic model/res_id endpoints.

BLK-A13 — SPMB configuration mutation memakai view-capability¶

Module/workflow: admission pathways, document types, education levels, scholarships, parent relationships.
Affected route/API: SPMB/admin configuration save/delete endpoints.
Finding: registry menetapkan view-named capabilities dan controller menggunakan mapping yang sama untuk save/delete master configuration. Status: Confirmed from code.
User impact: user read-only berpotensi mengubah master penerimaan.
Security/business impact: perubahan syarat, jalur, beasiswa, dan relasi dapat mengubah keputusan penerimaan/biaya.
Recommended owner: Admissions Owner + Security Owner.
Required decision or fix: split view/manage/delete, protect referenced masters, audit and effective-date policy.
Evidence: custom_addons_scola/gcgscola/scola_platform_support/api_route_access.py:39-47; custom_addons_scola/gcgscola/scola_admission/controllers/admission_config_api.py:31-58,268-295,327-352,393-424,451-476,532-554.
Proposed acceptance criteria: viewer mutation gets 403; referenced master deletion constrained; company and effective-date tests; Admissions signs master ownership.

BLK-A14 — Fee enrollment lookup/detail tidak membuktikan tenant ownership¶

Module/workflow: student fee enrollment and schedules.
Affected route/API: fee enrollment list/lookups/schedule/save routes.
Finding: controller memakai elevated allowed-company context, tetapi student/course/batch lookup dan arbitrary enrollment detail/schedule browse tidak menunjukkan record-company ownership validation pada jalur yang ditelusuri. Mutation role gate ada; blocker ini khusus tenant/data integrity. Status: Inferred from code; Requires runtime verification.
User impact: operator dapat memilih atau membuka master/enrollment tenant lain jika ID diketahui.
Security/business impact: disclosure atau perubahan tagihan lintas sekolah.
Recommended owner: Fees Owner + Security Owner.
Required decision or fix: explicit company domain/ownership validation untuk semua foreign key dan record ID.
Evidence: custom_addons_scola/gcgscola/scola_fees/controllers/fee_enrollment_api.py:135-175,180-235,263-267.
Proposed acceptance criteria: cross-company IDs rejected atomically on read/write; every lookup filtered to active company set; multi-company integration tests and finance sign-off.

BLK-A15 — Messaging batch preview tidak memeriksa membership¶

Module/workflow: direct/group messaging and attachment access.
Affected route/API: /api/v1/messaging/channels/last-messages, /api/v1/messaging/attachments/read.
Finding: normal message read/send memeriksa channel membership, tetapi batch last-message menerima arbitrary channel IDs dan membaca mail.message dengan elevated model tanpa membership filtering. Attachment read menerima arbitrary IDs/fields dan mengandalkan generic ACL. Status: Confirmed from code.
User impact: preview pesan dari channel yang bukan miliknya mungkin terungkap; attachment behavior tidak memiliki domain-specific ownership contract.
Security/business impact: komunikasi siswa/orang tua/guru dapat bocor lintas channel.
Recommended owner: Messaging Owner + Security Owner + DPO.
Required decision or fix: membership-filter every channel; attachment must be linked to an accessible message/channel with safe field allowlist.
Evidence: custom_addons_scola/gcgscola/scola_portal/controllers/general_messaging_api.py:439-482,520-550,945-982; route ownership custom_addons_scola/gcgscola/scola_portal/controllers/general_messaging_message_api.py:12-46.
Proposed acceptance criteria: non-member IDs omitted/403 without preview; mixed authorized/unauthorized batch cannot leak; attachment bytes inaccessible without linked-channel membership; DPO-approved retention/download policy.

BLK-A16 — Admin calendar browse/save tidak scoped ke owner/company¶

Module/workflow: admin calendar events and attendee search.
Affected route/API: /api/v1/calendar/admin/events/detail, /save, /users/search.
Finding: role-local manage helper accepts several roles; detail/save uses elevated arbitrary event ID and attendee user IDs without owner/company validation terlihat. Registry uses view-named capability. Status: Confirmed from code; cross-tenant impact Requires runtime verification.
User impact: operator dapat membaca/mengubah event atau menambahkan attendee di luar scope.
Security/business impact: calendar disclosure, unwanted invitations, and cross-tenant mutation.
Recommended owner: Communication Owner + Security Owner.
Required decision or fix: calendar manage capability, event owner/company domain, attendee scope and notification policy.
Evidence: custom_addons_scola/gcgscola/scola_portal/controllers/calendar_admin_api.py:23-83; custom_addons_scola/gcgscola/scola_platform_support/api_route_access.py:454.
Proposed acceptance criteria: viewer cannot save; arbitrary inaccessible event/user rejected; owner/company tests; invite notification and cancellation behavior approved.

BLK-A17 — Company dan notification configuration write tidak memiliki manage contract konsisten¶

Module/workflow: school settings and notification event toggles.
Affected route/API: company settings update; /api/v1/admin/notification-config/save.
Finding: company settings FE/update gate memakai view semantics dan local role allowlist; notification registry memakai communication.news.view sedangkan controller hanya role admin atau system dan menulis global config parameters. Menu/capability, local role check, dan mutation ownership tidak konsisten. Status: Confirmed from code; desired ownership Requires business confirmation.
User impact: tombol dapat muncul tetapi backend menolak, atau viewer dapat mengubah setting berdampak luas.
Security/business impact: school identity/config dan channel-event delivery behavior berubah tanpa approval/audit yang jelas.
Recommended owner: Platform Operations + Communication Owner + Security Owner.
Required decision or fix: distinct settings manage capabilities, tenant/global scope, secret handling, audit and approval ownership.
Evidence: scola-fe-v2/src/router/settingsRoutes.js:34-39; custom_addons_scola/gcgscola/scola_core/controllers/company_settings_api.py:119-125,205-249; custom_addons_scola/gcgscola/scola_platform_support/api_route_access.py:162,176-177; custom_addons_scola/gcgscola/scola_portal/controllers/notification_config_api.py:25-57.
Proposed acceptance criteria: view account cannot write; tenant config isolated; global write limited to named platform role; secret values never returned/logged; config changes audited and rollbackable.

BLK-A18 — Placeholder, lab, dan register bukan supported workflow¶

Module/workflow: laboratory placeholders, public registration, incomplete pages.
Affected route/API: enam lab routes dan /register yang diinventarisasi.
Finding: reconnaissance menemukan page/route placeholder atau incomplete; route presence tidak membuktikan workflow/API siap. Tidak ada post-snapshot evidence yang mengubah status ini. Status: Confirmed from code for placeholder rendering; supported status Requires business confirmation.
User impact: panduan dapat berakhir pada layar kosong/placeholder atau form yang tidak menyelesaikan transaksi.
Security/business impact: false product promise dan support burden.
Recommended owner: Product Owner + owning module engineer.
Required decision or fix: complete and test, explicitly pilot, or remove/deprecate route/menu.
Evidence: scola-fe-v2/docs/recon/open-questions.md:41-50; corresponding route/components in docs/recon/route-inventory.md.
Proposed acceptance criteria: each route has named owner/status, API contract, permissions, empty/error states, runtime UAT; otherwise excluded from product surface and search/contextual help.

BLK-A19 — W05 teacher first-save gagal untuk ACL standar¶

Module/workflow: Daily Student Attendance; teacher/faculty first save.
Affected route/API: faculty regular attendance save, model op.attendance.line.
Finding: sheet creation dielevasi, tetapi line creation memakai normal environment. Scola Teacher ACL memberi create=0 untuk sheet/line; Teacher hanya mengimplikasikan faculty, sedangkan create datang dari group OpenEduCat attendance terpisah. Akun fresh tanpa legacy group berisiko gagal pada first save. Status: Confirmed from code; exact runtime error Requires runtime verification.
User impact: guru tidak dapat mencatat kehadiran pertama kali meskipun UI menawarkan Save.
Security/business impact: attendance tidak tercatat atau provisioning bergantung group legacy tak terdokumentasi.
Recommended owner: Attendance Backend Owner + Identity/RBAC Owner.
Required decision or fix: perbaiki ACL/group/service boundary tanpa broad sudo dan tetapkan canonical provisioning.
Evidence: custom_addons_scola/gcgscola/scola_attendance/controllers/attendance_api_mixin.py:4304-4332; custom_addons_scola/gcgscola/scola_attendance/security/ir.model.access.csv:4,8; custom_addons_scola/gcgscola/scola_core/security/scola_security.xml:88-93; custom_addons_scola/openeducat/openeducat_attendance/security/ir.model.access.csv:3-4.
Proposed acceptance criteria: fresh-provisioned teacher tanpa legacy extra group dapat first-save atomically; unauthorized teacher tetap ditolak; ACL/group regression test mencakup create/write/read.

BLK-A20 — W05 regular save tidak memvalidasi exact roster/completeness¶

Module/workflow: Daily Student Attendance; teacher and admin regular session save.
Affected route/API: faculty regular save dan admin attendance mutation.
Finding: kedua jalur mempercayai supplied student IDs, mengizinkan partial list, dan tidak membandingkan exact batch roster; admin memakai elevated line model. Combined faculty path justru memiliki duplicate/exact-roster checks, menunjukkan invariant tersedia tetapi tidak diterapkan konsisten. Status: Confirmed from code.
User impact: siswa dapat terlewat, diduplikasi, atau siswa bukan anggota kelas dapat dimasukkan.
Security/business impact: integritas kehadiran, cross-company/student disclosure, dan downstream summary salah.
Recommended owner: Attendance Backend Owner + School Operations SME.
Required decision or fix: exact roster, duplicate, membership, company, and completeness validation atomik pada semua save path.
Evidence: custom_addons_scola/gcgscola/scola_attendance/controllers/attendance_api_mixin.py:3335,3398-3422,4238-4275,4307-4334.
Proposed acceptance criteria: duplicate, missing, out-of-batch, zero, dan cross-company IDs ditolak tanpa partial write pada faculty/admin endpoints; positive exact-roster tests lulus.

BLK-A21 — W05 Save langsung `done`, correction tanpa reason/window/audit contract¶

Module/workflow: Daily Student Attendance completion and correction.
Affected route/API: faculty/admin save; completed attendance sheet edit UI.
Finding: save menulis line lalu langsung menetapkan sheet done. FE mengaktifkan ulang edit sheet completed dan resubmit ke endpoint sama. Payload tidak menerima reason, cutoff, approval, atau audit fields pada jalur tersebut. Status: Confirmed from code; desired process Requires business confirmation.
User impact: pengguna tidak dapat membedakan draft, complete, dan corrected; koreksi dapat dilakukan tanpa alasan/periode yang dijelaskan.
Security/business impact: histori akademik tidak accountable; correction/approval claims akan mengarang business rule.
Recommended owner: Product Owner + School Attendance SME + Compliance/Security Owner.
Required decision or fix: state machine, correction authority/window/reason, approval/escalation, immutable audit; atau kontrak produk dipersempit secara eksplisit.
Evidence: custom_addons_scola/gcgscola/scola_attendance/controllers/attendance_api_mixin.py:3398-3422,4307-4334; scola-fe-v2/src/views/AttendanceManagement/Faculty/AttendanceSheet.vue:667-671,733-772.
Proposed acceptance criteria: PO-approved transition table; invalid/late correction rejected; every correction stores actor/time/before/after/reason; faculty/admin/principal role tests; guide wording traced to tested transitions.

BLK-A22 — W05 `Sakit` collapse menjadi `Izin`¶

Module/workflow: Daily Student Attendance status entry, summaries, parent/student view.
Affected route/API: faculty save and attendance serializers/summary.
Finding: FE mendefinisikan direct statuses tanpa Sakit dan menaruh Sakit sebagai subtype remark dari Izin; backend canonicalizer mengembalikan Izin untuk setiap excused sebelum mempertimbangkan remark. Existing guide mengajarkan Sakit sebagai status langsung. Status: Confirmed from code; canonical glossary Requires business confirmation.
User impact: input dan tampilan/rekap dapat tidak round-trip dengan istilah yang diajarkan.
Security/business impact: laporan attendance dan interpretasi sekolah/orang tua tidak konsisten.
Recommended owner: Attendance Product Owner + School SME + Analytics Owner.
Required decision or fix: setujui canonical status/remark model dan samakan FE, backend, serializer, aggregation, migration.
Evidence: scola-fe-v2/src/i18n/attendanceStatus.js:33-54; custom_addons_scola/gcgscola/scola_attendance/controllers/attendance_api_mixin.py:63-73,2855-2875,4313-4324; scola-fe-v2/docs/user-guide/quick-start/input-absensi-harian.md:18-23.
Proposed acceptance criteria: approved glossary; Sakit/Dispensasi/Izin round-trip deterministically; period aggregates tested; legacy rows migrated/interpreted; guide and UI labels updated together.

BLK-A23 — W05 proof upload tidak divalidasi dan raw proof mengalir ke parent payload¶

Module/workflow: Daily Student Attendance supporting proof.
Affected route/API: faculty attendance save; student daily serializer; parent daily response.
Finding: browser accept hanya hint; FE membaca file terpilih sebagai Data URL dan mengirim raw proof. Backend menyimpan raw file/name tanpa server-side size/type/content checks. Student serializer menyertakan raw proof; parent serializer menggunakannya dan tidak membuang proof. Status: Confirmed from code.
User impact: upload berbahaya/besar dapat diterima; orang tua dapat menerima bytes/data yang tidak diperlukan.
Security/business impact: malware/storage DoS, sensitive medical evidence disclosure, excessive payload, unclear retention/viewer rights.
Recommended owner: Security Owner + DPO + Attendance Product Owner.
Required decision or fix: server allowlist/size/content scan, data minimization, authorized viewer/download endpoint, retention/deletion policy.
Evidence: scola-fe-v2/src/views/AttendanceManagement/Faculty/AttendanceSheet.vue:315-319,592-603,749-750; custom_addons_scola/gcgscola/scola_attendance/controllers/attendance_api_mixin.py:2795-2796,2816-2833,4323-4324.
Proposed acceptance criteria: invalid MIME/extension/content/oversize rejected; parent list payload omits raw proof unless explicitly approved; authorized download enforces child/company relation; DPO approves fields/viewers/retention; negative tests pass.

Blocker B — hanya boleh didokumentasikan dengan limitation/warning¶

BLK-B01 — Feature/module availability bersifat tenant-specific¶

Module/workflow: optional modules dan feature-flagged apps.
Affected route/API: seluruh route dengan feature_flag/module dependency.
Finding: approved product taxonomy tidak sama dengan provisioned runtime; static menu/route tidak menjamin module enabled. Status: Confirmed from documentation architecture; runtime per tenant required.
User impact: artikel dapat menampilkan langkah yang tidak tersedia di sekolah tertentu.
Security/business impact: false entitlement/licensing promise dan support load.
Recommended owner: Product Operations.
Required decision or fix: page metadata availability, tenant/module version prerequisites, dan hiding/search rules.
Evidence: scola-fe-v2/docs/domains/governance/README.md:98-102; scola-fe-v2/docs/modular/product-tier-and-feature-flags.md:17-28,33-100,140-150; scola-fe-v2/src/config/featureFlagFragments/moduleFeatureFlags.js:1-63; platform defaults scola-fe-v2/src/config/featureFlagFragments/platformFeatureFlags.js:1-7.
Proposed acceptance criteria: each optional article names module/tier/version; contextual help checks runtime flag; disabled module article excluded or clearly labeled; PO approves taxonomy.

Module/workflow: navigation across roles.
Affected route/API: canonical routes plus aliases in route inventory.
Finding: reconnaissance snapshot menemukan menu/route/capability inconsistencies dan 119 aliases; current menu changed after snapshot, sehingga hitungan snapshot tidak boleh dianggap current. Status: Confirmed from reconnaissance; residual count Requires regeneration/runtime verification.
User impact: langkah berbasis label/menu dapat tidak cocok dengan persona atau route sekarang.
Security/business impact: docs dapat menyiratkan access karena menu tampil, padahal API menolak.
Recommended owner: FE Navigation Owner + Documentation Owner.
Required decision or fix: canonical page ID/route, alias/deprecation registry, generate current menu-capability diff.
Evidence: scola-fe-v2/docs/recon/open-questions.md:30-37; scola-fe-v2/docs/recon/route-inventory.md; scola-fe-v2/src/config/apps/roleApps.js:1-260.
Proposed acceptance criteria: zero unexplained menu/route/API capability mismatch on supported surface; aliases point to one article; screenshots/steps generated from served current bundle.

BLK-B03 — Student create/import guard dan guide tertinggal dari async job UI¶

Module/workflow: create/import siswa.
Affected route/API: /students/create, /students/import, /api/v1/admin/import/*.
Finding: FE route meta memakai students.list.view, list CTA memakai manage, backend import gate memakai students.manage; HEAD UI memakai async job/fallback sementara existing guide menjelaskan flow CSV validate/import lama. Status: Confirmed from code and existing documentation.
User impact: viewer mungkin bisa membuka route namun gagal action; instruksi UI tidak sesuai.
Security/business impact: mass mutation capability ambigu dan support burden.
Recommended owner: Identity Admin Product Owner + FE/BE Owners.
Required decision or fix: align route/CTA/API to manage capability; retrace supported file format/job states/error recovery.
Evidence: scola-fe-v2/src/router/studentDataAdminRoutes.js:14-20,37-43; scola-fe-v2/src/views/AdminViews/StudentDatabase/StudentList.vue:18,303; scola-fe-v2/src/views/AdminViews/StudentDatabase/UploadSiswa.vue:769-778,835; custom_addons_scola/gcgscola/scola_platform_support/api_route_access.py:153,159; scola-fe-v2/docs/user-guide/quick-start/impor-siswa.md:5-25.
Proposed acceptance criteria: view user cannot enter mutation route; manage user completes async import, retry and error-download UAT; file/version limits documented from code; old guide revised or archived.

BLK-B04 — Principal/VP mendapat mutation CTA attendance tetapi backend read-only¶

Module/workflow: W05 admin monitoring/correction.
Affected route/API: shared attendance sheet list/create/pending routes and admin create API.
Finding: shared component renders Create/Pending dari students.attendance.edit; principal/VP route memakai component itu. Backend mutation helper mengecualikan principal/VP, meskipun read helper memasukkan mereka. Status: Confirmed from code.
User impact: principal/VP melihat action yang berakhir access denied.
Security/business impact: ambiguous correction authority; docs tidak boleh mengajarkan mereka sebagai operator.
Recommended owner: Attendance Product Owner + FE RBAC Owner.
Required decision or fix: default principal/VP read-only dan sembunyikan mutation CTA, kecuali PO mengubah policy serta backend capability.
Evidence: scola-fe-v2/src/views/AttendanceManagement/Admin/AttendanceSheetList.vue:9-20,192; scola-fe-v2/src/router/principalRoutes.js:196-218; scola-fe-v2/src/router/vicePrincipalRoutes.js:214-231; custom_addons_scola/gcgscola/scola_attendance/controllers/attendance_api_mixin.py:146-199,3335-3337.
Proposed acceptance criteria: route/CTA/capability/controller matrix sama; principal/VP runtime test read succeeds and mutations hidden/403; correction owner documented only after BLK-A21.

BLK-B05 — Existing W05 guides mengajarkan perilaku yang tidak cocok dengan HEAD¶

Module/workflow: Daily Student Attendance quick start/troubleshooting.
Affected route/API: faculty attendance page/session list; parent/student results.
Finding: quick guide mengajarkan direct Sakit dan menjanjikan hasil dapat dilihat orang tua tanpa state/fetch caveat; troubleshooting menyuruh guru mengubah tanggal, sedangkan teacher session list current path bersifat today-only. Status: Confirmed from code/document drift.
User impact: guru tidak menemukan field/filter atau mengira status/visibility pasti sama.
Security/business impact: defect/status ambiguity dinormalisasi sebagai contract.
Recommended owner: Documentation Owner + Attendance Product Owner.
Required decision or fix: freeze reuse; retrace and revise bersama BLK-A19–A23, including runtime parent visibility.
Evidence: scola-fe-v2/docs/user-guide/quick-start/input-absensi-harian.md:18-23,35-38; scola-fe-v2/docs/user-guide/troubleshooting/absensi.md:17-32; W05 code evidence pada BLK-A19–A23.
Proposed acceptance criteria: every statement mapped in pilot traceability; no direct Sakit/date-change/parent-delivery claim without tested contract; old pages marked superseded or updated atomically.

BLK-B06 — Attendance cancellation `notify_parent` diabaikan¶

Module/workflow: daily arrival/attendance cancellation.
Affected route/API: daily cancel endpoint.
Finding: endpoint menerima notify_parent, tetapi memanggil service dengan notification disabled. Status: Confirmed from code.
User impact: operator mengira orang tua diberi tahu padahal tidak.
Security/business impact: missed safeguarding/operational communication.
Recommended owner: Attendance Owner + Notification Owner.
Required decision or fix: implement/test delivery or remove control/claim and provide manual notice warning.
Evidence: custom_addons_scola/gcgscola/scola_attendance/controllers/attendance_api_mixin.py:1261-1320.
Proposed acceptance criteria: parameter and delivered behavior agree; audit delivery/failure state visible; cancellation article states tested behavior and fallback.

BLK-B07 — RFID failure state memerlukan manual retry semantics¶

Module/workflow: RFID attendance ingestion and exception recovery.
Affected route/API: /api/rfid/*, retry endpoint, event processor.
Finding: registry memakai read-named students.rfid_config.view untuk prefix termasuk config mutation; processor menandai beberapa failure processed=True/state=error. Model retry menolak processed event, sementara API reset lebih dulu lalu retry. Status: Confirmed from code.
User impact: gagal scan tidak otomatis pulih; operator perlu path retry yang tepat.
Security/business impact: attendance hilang, duplicate/retry ambiguity, config ownership tidak jelas.
Recommended owner: Smart Attendance Owner + Operations + Security Owner.
Required decision or fix: manage capability for config/retry, explicit retry state machine/idempotency and monitoring ownership.
Evidence: custom_addons_scola/gcgscola/scola_platform_support/api_route_access.py:222; custom_addons_scola/gcgscola/scola_smart_attendance/controllers/rfid_events_api.py:450-478,657-672; custom_addons_scola/gcgscola/scola_smart_attendance/models/rfid_attendance_processor.py:35-75,133-157; custom_addons_scola/gcgscola/scola_smart_attendance/models/rfid_event.py:147-168; scola-fe-v2/docs/user-guide/school-admin/kehadiran/rfid-dan-wajah-siswa.md:12-36.
Proposed acceptance criteria: documented state/retry matrix matches API; repeated retry idempotent; viewer cannot mutate config; alert/dead-letter owner and manual recovery UAT established.

BLK-B08 — Library queue assignment belum membuktikan concurrency lock¶

Module/workflow: reservation queue auto-assignment/collection.
Affected route/API: library queue assignment and collected actions.
Finding: assignment checks copy availability and writes assignment, tetapi jalur yang ditelusuri tidak menunjukkan database lock/final concurrency guard. Race impact merupakan inference. Status: Inferred from code; Requires runtime verification.
User impact: dua queue requests mungkin menerima copy yang sama pada concurrent execution.
Security/business impact: inventory inconsistency dan unfair allocation.
Recommended owner: Library Engineering Owner + Librarian SME.
Required decision or fix: atomic locking/constraint atau documented serialized job ownership.
Evidence: custom_addons_scola/gcgscola/scola_library/controllers/library_queue_return_api.py:161-180; custom_addons_scola/gcgscola/scola_library/models/library_queue_auto.py:112-169.
Proposed acceptance criteria: concurrent test cannot double-assign; deterministic priority tie-break; recovery job/audit for conflict; warning retained until test passes.

BLK-B09 — Library fine dapat membuat dan mem-post invoice otomatis¶

Module/workflow: circulation return/fines.
Affected route/API: return workflow and fine generation.
Finding: fine processing dapat membuat lalu mem-post invoice; ownership/approval dan reversal policy tidak dapat ditentukan dari kode. Status: Confirmed from code; policy Requires business confirmation.
User impact: petugas mungkin memicu konsekuensi finansial tanpa menyadari posting otomatis.
Security/business impact: receivable, accounting period, waiver/reversal dan segregation-of-duties.
Recommended owner: Librarian SME + Finance Controller.
Required decision or fix: decide draft versus auto-post, threshold/waiver/approval, reversal and notification.
Evidence: custom_addons_scola/gcgscola/scola_library/models/circulation_extend.py:228-293; scola-fe-v2/docs/user-guide/per-role/librarian.md:6-33.
Proposed acceptance criteria: finance-approved state/effect matrix; UI confirmation names invoice effect; duplicate fine prevention and reversal UAT; guide carries explicit warning until product decision implemented.

BLK-B10 — Library settings route memakai view sedangkan API manage¶

Module/workflow: library configuration.
Affected route/API: library settings page and save API.
Finding: FE route meta menggunakan library settings view, sementara registry/API memerlukan manage untuk get/save. Status: Confirmed from code.
User impact: viewer dapat masuk route tetapi gagal memuat/menyimpan.
Security/business impact: ambiguous configuration ownership.
Recommended owner: Library Product Owner + FE RBAC Owner.
Required decision or fix: use manage route gate or split get/view and save/manage intentionally.
Evidence: scola-fe-v2/src/router/libraryManagementRoutes.js:146-152; scola-fe-v2/src/services/library/library.service.js:759-795; custom_addons_scola/gcgscola/scola_platform_support/api_route_access.py:263; custom_addons_scola/gcgscola/scola_library/controllers/library_portal_reading_api.py:63-72.
Proposed acceptance criteria: route/load/save capability matrix consistent; runtime tests for viewer and manager; article audience names manager only unless split approved.

BLK-B11 — Canonical news dan legacy announcement berjalan paralel¶

Module/workflow: news/announcement publishing and audience delivery.
Affected route/API: canonical scola.news workflow; legacy scola.announcement portal APIs.
Finding: canonical news memiliki workflow sendiri, sementara legacy announcement model/controller masih tersedia dan mengirim notification. Existing guide sudah menyuruh memakai model baru, tetapi deprecation/runtime migration belum menjadi hard boundary. Status: Confirmed from code; deprecation date Requires business confirmation.
User impact: operator dapat memakai dua tempat untuk publikasi dengan state/audience berbeda.
Security/business impact: duplicate/conflicting communications, approval bypass, unclear read receipts.
Recommended owner: Communications Product Owner + Platform Owner.
Required decision or fix: declare canonical source, block new legacy writes, map/migrate history, deprecate route/menu.
Evidence: custom_addons_scola/gcgscola/scola_news/models/scola_news.py:96-198,571-634; custom_addons_scola/gcgscola/scola_portal/models/announcement.py:15-27,146-212,262-325; custom_addons_scola/gcgscola/scola_portal/controllers/portal_api.py:205-245; scola-fe-v2/docs/user-guide/quick-start/publish-berita.md:9-24.
Proposed acceptance criteria: one writable canonical surface; legacy route read-only/removed with migration report; audience/approval/notification parity UAT; article links only canonical page.

Non-blocker — tidak menghambat, tetap perlu verifikasi¶

NB-01 — Weekly approval static guard telah menguat¶

Module/workflow: weekly teacher report approval.
Affected route/API: weekly approval list/detail/decision routes.
Finding: current registry has specific capabilities; controller enforces access and company checks; model has decision helper. Ini mengoreksi reconnaissance SEC-02 secara statis. Status: Confirmed from code; Requires runtime verification.
User impact: tidak ada blocker statis yang sama pada HEAD, tetapi actual role provisioning belum dibuktikan.
Security/business impact: residual risk pada effective groups/runtime data.
Recommended owner: LMS Owner + QA/Operations.
Required decision or fix: tidak perlu defect fix dari finding lama; lakukan role/company UAT sebelum publication.
Evidence: custom_addons_scola/gcgscola/scola_platform_support/api_route_access.py:74-76; custom_addons_scola/gcgscola/scola_lms/controllers/lms_weekly_approval_api.py:20-82,123-220; custom_addons_scola/gcgscola/scola_lms/models/weekly_teacher_report.py:258-289.
Proposed acceptance criteria: authorized approver success; teacher/unrelated company denied; self-approval policy tested and approved; audit/state transition traced.

NB-02 — LMS assignment idempotency memiliki current-code guard¶

Module/workflow: assignment creation/submission request retry.
Affected route/API: LMS assignment mutation routes changed after snapshot.
Finding: FE mempertahankan client_request_id, memakai timeout create 90 detik, lalu mencari replay yang mungkin berhasil setelah timeout. Controller mencari existing item dengan key+course dan mengembalikan idempotent_replay; model menyimpan key berindeks dan menunda publish side effects. Key belum terlihat memiliki unique constraint pada field definition yang ditelusuri, sehingga klaim dibatasi pada adanya guard dan concurrency tetap harus diuji. Status: Confirmed from code; Requires runtime verification for retry/concurrency.
User impact: guide dapat menjelaskan safe retry hanya setelah actual response/state diuji.
Security/business impact: duplicate assignment/submission bila deployment/runtime tidak sesuai HEAD.
Recommended owner: LMS Owner + QA/Operations.
Required decision or fix: verify served backend/module version and retry semantics.
Evidence: scola-fe-v2/src/services/lms/assignment.service.js:108-180; scola-fe-v2/src/views/AssignmentManagement/Faculty/components/AddAssignmentModal.vue:347-399; custom_addons_scola/gcgscola/scola_lms/controllers/lms_course_item_api.py:276-318,336-346; custom_addons_scola/gcgscola/scola_lms/models/lms_course_item.py:87-123.
Proposed acceptance criteria: identical idempotency token, termasuk dua concurrent requests, menghasilkan satu record dan satu publish side effect; timeout lalu retry memberi response deterministik; deployed module hash direkam; guide tidak memberi guarantee lebih luas dari path yang diuji.

Gate penggunaan register¶

Item Blocker A harus ditutup dengan bukti acceptance, bukan hanya keputusan verbal.
Item Blocker B harus memiliki limitation text yang disetujui owner dan tanggal review; warning tidak boleh menggantikan security fix untuk supported mutation.
Setiap perubahan FE/BE setelah HEAD metadata memicu re-trace item terdampak.
Existing guides yang disebut sebagai evidence tidak menjadi sumber kebenaran bila bertentangan dengan code/runtime.
Penutupan item harus menambahkan runtime environment, akun/role, request/response atau test ID, dan approver bisnis/security yang relevan.