Scola V1 Production Baseline — Release Test Matrix

Metadata, status, dan batas

Item	Nilai
Status dokumen	Proposed executable test contract — belum dieksekusi
Snapshot analisis	2026-08-08, static repository review
Mode / workspace	Server development; /home/scola/odoo; frontend scola-fe-v2; backend custom_addons_scola/gcgscola
Static code baseline	FE 68b77d88f78b3d32f0ede3a54b665e067b014062; BE 2ff6ac7cb41810bbc3b66821cdad004b52d1658a (includes e749832 security elevation refactor and 2ff6ac7 topology-pin sync); not runtime-certified
Product boundary	Core V1 W00/W01/W02/W05 manual (per-lesson + daily arrival/departure + pickup registry)/W16; W00 is the cross-cutting platform prerequisite. Controlled Pilot W12/W19; Optional Supported W03/W04/W06/W07/W09/W10/W11/W13/W14/W15/W20. Student RFID/face/geofence are V2 SC-ATTEND+ optional — not Core V1.
T4 hybrid amendment	2026-08-26 per-lesson RT in-scope; 2026-08-29 DEC-001 extension — W05-B daily manual gate IN V1 baseline (§6.1b) per T4-DEC-006-007-attendance-v1-matrix.md
Tidak disertifikasi sebagai workflow	W08 Incomplete / Remove from Product Surface; W17/W18 Requires Product Decision
Hasil saat dokumen dibuat	Tidak ada PASS atau FAIL. Setiap row adalah NOT RUN atau BLOCKED; test lama tidak diimpor sebagai hasil rilis.
Bukan scope	Tidak mengubah source/test, tidak menjalankan QA, tidak menetapkan business rule yang belum disetujui, dan tidak menulis user guide.

Kontrak produk masih proposed. Keberadaan route, menu, test file, atau static guard tidak menjadi bukti kelulusan. Status support dan package ada di docs/release-readiness/01-product-contract.md:18-42,86-106,236-262; aturan hasil dan sertifikasi ada di docs/release-readiness/09-release-quality-gate.md:87-180.

1. Cara membaca matriks

1.1 Sebelas keluarga uji wajib

User request menyebut sepuluh kategori dan satu kategori UI tambahan. Dokumen ini memperlakukan seluruh sebelas kategori sebagai denominator wajib untuk setiap workflow supported.

Kode	Kategori	Minimum assertion
POS	Positive	Aktor berwenang mencapai completion criteria dan hanya menghasilkan efek yang dimaksud.
NEG	Negative authorization	Unrelated/view-only actor dan direct API tanpa capability ditolak; before/after data identik.
SCP	Record scope	Assigned/self/linked record boleh sesuai kontrak; unassigned/peer/unlinked/guessed ID ditolak tanpa existence leak.
TEN	Tenant/company isolation	Primary tenant boleh; second-tenant ID, mixed foreign key, active-company switch, list/count/export tidak bocor atau berubah.
VAL	Validation	Required/format/boundary/duplicate/stale/attachment input ditolak authoritative backend secara atomic; FE menjelaskan error aman.
STA	State transition	Hanya transition yang sudah disetujui boleh; actor, time, reason, before/after tercatat bila diperlukan.
IDM	Retry/idempotency	Duplicate token, double click, timeout retry, dan concurrent request tidak menggandakan/corrupt effect.
REC	Recovery	Fault injection memiliki retry/resume/reversal/compensation yang disetujui; tidak ada partial orphan.
XRP	Cross-role propagation	Producer output/correction terlihat tepat pada consumer berwenang dan tidak terlihat pada consumer lain.
XMD	Cross-module integration	Prerequisite/upstream record dikonsumsi tepat oleh downstream package/bridge tanpa implicit dependency.
UIA	UI menu-route-action-API authority	Package/menu/route/CTA/breadcrumb dan backend API authority konsisten pada flag off/on, deep link, viewport, dan error state.

Minimum authorization portfolio yang mendasari NEG/SCP/TEN/UIA ada di docs/release-readiness/04-authorization-readiness.md:202-219. Semua mutation harus memenuhi role capability + record scope + tenant/company scope + domain ownership; deny-by-default dijabarkan di docs/release-readiness/04-authorization-readiness.md:20-87.

1.2 Status eksekusi

Status di file ini	Makna
NOT RUN	Expected behavior sudah cukup spesifik untuk diuji, tetapi belum dijalankan pada release build/Golden Tenant. Hasil aktual nanti harus menjadi PASS atau FAIL.
BLOCKED	Fixture, decision, atau defect bernama belum ditutup sehingga expected behavior/completion tidak dapat disertifikasi. Setelah unblock, row kembali NOT RUN, lalu dieksekusi.

Tidak ada required test yang boleh dihitung lulus bila SKIPPED. Ini mengikuti status resmi di docs/release-readiness/09-release-quality-gate.md:89-103. BLOCKED bukan sinonim bug: DEC-* memilih product contract, sedangkan STAB-* adalah defect terhadap contract yang telah cukup spesifik. Pemisahannya tercatat di docs/release-readiness/08-stabilization-backlog.md:96-126.

1.3 ID dan parameterization contract

• Test ID berbentuk RT-Wxx-CAT-nn; satu ID dapat menjadi parameterized test hanya jika setiap parameter menghasilkan result/evidence record terpisah.
• NEG minimal memuat unrelated role, view-only role, forged active role, dan direct API untuk mutation berisiko tinggi.
• SCP minimal memuat own/assigned serta other class/assignment/child/case.
• TEN selalu memakai dua tenant nyata; mengganti company_id pada payload tanpa second-tenant data bukan isolation proof.
• IDM dan REC menyimpan attempt pertama, request key, effect count, audit/outbox state, dan cleanup result.
• Expected denial harus memeriksa response aman dan zero data/side-effect.
• Semua row memakai exact release manifest dan evidence minimum yang diwajibkan docs/release-readiness/09-release-quality-gate.md:105-122.

2. Evidence dan fixture registry

2.1 Repository evidence registry

ID evidence pada test rows di bawah resolve ke file dan line berikut. Referensi ini adalah static design/defect evidence, bukan runtime pass evidence.

Evidence ID	Repository evidence
EV-PC	Status/package/workflow contract: docs/release-readiness/01-product-contract.md:18-42,86-106,236-262.
EV-IA	Canonical shell/route/menu/alias dan IA finding: docs/release-readiness/02-information-architecture.md:127-194,198-229.
EV-UX	Interaction findings dan proposed contract: docs/release-readiness/03-ux-consistency-audit.md:29-102.
EV-AUTH	Authorization gaps, capability/scope model, dan portfolio test: docs/release-readiness/04-authorization-readiness.md:20-57,89-219.
EV-E2E	Normalized workflow statuses, dependency graph, actors, routes/API chain, state/downstream/recovery and completion targets: docs/release-readiness/05-e2e-workflow-catalog.md:39-363.
EV-GT	Canonical tenant, package overlay, GT-AUTH/GT-ACA/GT-STU/GT-TXN fixtures, reset strategy and current readiness: docs/release-readiness/06-golden-tenant-spec.md:49-88,99-277,288-384.
EV-BLG	S0–S3, decisions, controls, dan trace reconciliation: docs/release-readiness/08-stabilization-backlog.md:22-171.
EV-QG	Result/evidence rules dan QG-01–QG-18: docs/release-readiness/09-release-quality-gate.md:87-180.
EV-W01	W01 code-supported sequence/prerequisite: docs/recon/workflow-candidates.md:18; contract: docs/release-readiness/01-product-contract.md:243.
EV-W02	W02 sequence/prerequisite: docs/recon/workflow-candidates.md:19; import surface: src/views/AdminViews/StudentDatabase/UploadSiswa.vue:769-835; contract: docs/release-readiness/01-product-contract.md:244.
EV-W03	W03 sequence: docs/recon/workflow-candidates.md:20; contract: docs/release-readiness/01-product-contract.md:245.
EV-W04	W04 sequence: docs/recon/workflow-candidates.md:21; contract: docs/release-readiness/01-product-contract.md:246.
EV-W05	Pilot actors/routes/API/state/gaps: docs/documentation-planning/pilot-attendance-plan.md:70-310,317-487; traceability: docs/documentation-planning/pilot-attendance-traceability.md:1-157; contract: docs/release-readiness/01-product-contract.md:247.
EV-W06	W06 sequence: docs/recon/workflow-candidates.md:23; contract: docs/release-readiness/01-product-contract.md:248.
EV-W07	W07 sequence: docs/recon/workflow-candidates.md:24; runtime idempotency control: docs/release-readiness/08-stabilization-backlog.md:124-125; contract: docs/release-readiness/01-product-contract.md:249.
EV-W08	W08 confirmed model sequence and broken endpoint: docs/recon/workflow-candidates.md:25; docs/release-readiness/08-stabilization-backlog.md:50; contract: docs/release-readiness/01-product-contract.md:250.
EV-W09	W09 sequence: docs/recon/workflow-candidates.md:26; payroll defect: docs/release-readiness/08-stabilization-backlog.md:51; contract: docs/release-readiness/01-product-contract.md:251.
EV-W10	W10 sequence: docs/recon/workflow-candidates.md:27; fee scope defect: docs/release-readiness/08-stabilization-backlog.md:55; contract: docs/release-readiness/01-product-contract.md:252.
EV-W11	W11 sequence: docs/recon/workflow-candidates.md:28; accounting defect: docs/release-readiness/08-stabilization-backlog.md:39; contract: docs/release-readiness/01-product-contract.md:253.
EV-W12	W12 sequence: docs/recon/workflow-candidates.md:29; procurement defect: docs/release-readiness/08-stabilization-backlog.md:53; contract: docs/release-readiness/01-product-contract.md:254.
EV-W13	W13 sequence: docs/recon/workflow-candidates.md:30; contract: docs/release-readiness/01-product-contract.md:255.
EV-W14	W14 sequence: docs/recon/workflow-candidates.md:31; concurrency/settings defects: docs/release-readiness/08-stabilization-backlog.md:77-78; contract: docs/release-readiness/01-product-contract.md:256.
EV-W15	W15 sequence: docs/recon/workflow-candidates.md:32; sensitive/mutation defects: docs/release-readiness/08-stabilization-backlog.md:38,52; contract: docs/release-readiness/01-product-contract.md:257.
EV-W16	W16 sequence: docs/recon/workflow-candidates.md:33; canonical/legacy defect: docs/release-readiness/08-stabilization-backlog.md:79; contract: docs/release-readiness/01-product-contract.md:258.
EV-W17	Undecided complaint sequence: docs/recon/workflow-candidates.md:34; S0 containment: docs/release-readiness/08-stabilization-backlog.md:37; contract: docs/release-readiness/01-product-contract.md:259.
EV-W18	Undecided messaging sequence: docs/recon/workflow-candidates.md:35; S0 containment: docs/release-readiness/08-stabilization-backlog.md:42; contract: docs/release-readiness/01-product-contract.md:260.
EV-W19	W19 sequence: docs/recon/workflow-candidates.md:36; Dapodik defect: docs/release-readiness/08-stabilization-backlog.md:40; contract: docs/release-readiness/01-product-contract.md:261.
EV-W20	W20 sequence: docs/recon/workflow-candidates.md:37; retry defect: docs/release-readiness/08-stabilization-backlog.md:76; contract: docs/release-readiness/01-product-contract.md:262.
EV-HARNESS	Current scripts mix SC-CORE and SPMB at package.json:36-39; auth setup covers only five roles and can skip when strict is disabled at tests/e2e/setup-auth.spec.ts:8-65; current smoke checks route loading rather than full completion at tests/e2e/smoke/core_baseline_smoke.spec.ts:32-153.
EV-SEC-DELTA	BE e749832 moved owned-model elevation out of controllers. Runtime regression targets include import-job owner/company lookup at ../custom_addons_scola/gcgscola/scola_core/models/student_import_job.py:70-92, counseling portal ACL/record-rule reliance at ../custom_addons_scola/gcgscola/scola_counseling/controllers/counseling_portal_api.py:26-32 and ../custom_addons_scola/gcgscola/scola_counseling/security/referral_rules.xml:70-180, privacy audit domain/elevation split at ../custom_addons_scola/gcgscola/scola_core/controllers/privacy_api.py:101-200, and visitor ACL/company context at ../custom_addons_scola/gcgscola/scola_core/controllers/security_visitor_api.py:25-63. Static diff/structure is not authorization proof.

2.2 Golden fixture contract

Fixture IDs are test contracts, not claims that data already exists. Their deterministic seed/reset implementation belongs to 06-golden-tenant-spec.md. Until the named fixture is materialized and its manifest captured, a row can be designed (NOT RUN) but cannot become PASS.

Fixture ID	Required deterministic content
Release manifest (not a fixture ID)	Exact FE/BE SHA, DB snapshot/seed version, installed addons, entitlements, feature flags, timezone, test clock, and served bundle hashes; format is defined in docs/release-readiness/06-golden-tenant-spec.md:331-347.
GT-T1	Primary Scola Golden School tenant/company with package profile under test.
GT-T2	Independent second tenant with colliding-looking names/identifiers and comparable records for isolation assertions.
GT-AUTH-SINGLE-*	Fresh supported single-persona authorized/self-service accounts for the action under test; homeroom's documented structural exception remains explicit; technical executor excluded.
GT-AUTH-VIEW	Fresh view-only account that can read the approved projection but has no mutation capability.
GT-AUTH-UNRELATED	Fresh unrelated/unauthorized role or T2 actor used for direct route/API denial.
GT-AUTH-MULTI-NONCONFLICT	Structural teacher+homeroom fixture with switch/refresh/concurrent-tab variants.
GT-AUTH-MULTI-CONFLICT	Decision-gated conflicting-role/forged-active-role/delegation-expired fixture; expected policy comes from DEC-002/004.
GT-ACA	Fixed academic year/term, classes/batches, subjects, lesson hours, rooms, dated timetable/sessions, teacher and homeroom assignments.
GT-STU	Active/inactive students, assigned/unassigned class records, linked/unlinked/expired parent-child relations, multiple-child parent, and same-looking T2 student.
GT-TXN	Pristine plus each approved starting state; stable logical keys; audit/outbox counters; no random IDs or wall-clock dependence. Optional/pilot master and transaction families are fixed in 06 §12 and remain unseeded while their decisions are blocked.
GT-PKG-CORE / GT-PKG-W05 / GT-PKG-OPTIONAL-<SKU> / GT-PKG-DECISION-<ID>	Core-only, attendance-pilot, independently enabled optional, and disabled decision overlays exactly as defined in docs/release-readiness/06-golden-tenant-spec.md:64-88.
GT-TXN-W05-PROOF and domain-specific GT-TXN file variants	Valid/invalid/oversized/spoofed-signature/foreign-owner synthetic file inputs; no production PII.
GT-TXN-FAULT-*, GT-TXN-RETRY-IDEMPOTENT, GT-TXN-RECOVERY	Controlled timeout, duplicate/concurrent request, stale version, dependency/audit/outbox failure and supported recovery scenarios defined in docs/release-readiness/06-golden-tenant-spec.md:268-277.

Compact pair notation in test rows is non-creating shorthand only: GT-T1/T2 means the exact fixtures GT-T1 and GT-T2; GT-T1/U2/T2 means GT-T1, GT-T1-U2, and GT-T2. It does not define another fixture ID.

Current setup is not sufficient release evidence: it may skip optional auth setup (tests/e2e/setup-auth.spec.ts:12-25) and current core smoke uses generic admin plus SC-REPORT/SC-FEES/SC-ADM surfaces (tests/e2e/smoke/core_baseline_smoke.spec.ts:35-84,102-153). That gap maps to CTRL-001, STAB-025, and STAB-028 (docs/release-readiness/08-stabilization-backlog.md:66,69,122).

3. Scope, suite, dan current execution status

Workflow	Product status / suite	Required package profile	Current matrix status	Named blockers/decisions
W00	Core V1 platform prerequisite / CORE-PLATFORM	Core-only	PASS current-tip rebind 2026-08-29 (E1.2 29/29 + STAB-025/026)	RT-PROFILE-JENJANG-01 optional NOT RUN (DEC-013); UAT deferred W16
W01	Core V1 / CORE-W01	SC-CORE	PASS current-tip rebind 2026-08-29 (64/64)	DEC bounded per T4-DEC-W01-W02-bounded-freezes.md; RT-PROFILE-TIMEZONE-01 optional
W02	Core V1 / CORE-W02	SC-CORE	PASS bounded 2026-08-29 (33/33 manual + 3/3 async IDM/REC)	Async import DEC-W02-ASYNC signed 2026-08-29; T4-DEC-W02-async-import-freeze.md
W03	Optional Supported / PKG-ADM-W03	SC-CORE + SC-ADM	PASS bounded 2026-08-29 (31/31 harness + 12/12 UIA @ scoladev)	T4-W03-closure-decision.md; RT-W03-REC-01 partial bounded; full reversal/waitlist/fees/CBT out of scope
W04	Optional Supported / PKG-ASSESS-W04	SC-CORE + SC-ASSESS	PASS 11/11 harness QG-17 ×2 2026-08-31 @ BE tip 7ffb0ad — evidence T6D-evidence/T6D-W04-20260831T105000Z-run1.json + …T105100Z-run2.json; see T6D-result.md	Product contract signed; GBN allowlist SC-ASSESS enabled 2026-08-31
W21	Optional Supported / PKG-LEARN-W21	SC-CORE + SC-LEARN	PASS 11/11 harness (QG-17) 2026-08-30 — evidence execution/T6E-evidence/T6E-LEARN-20260830T171400Z-run1.json + …T171500Z-run2.json; see execution/T6E-result.md	Product contract signed (T6E-LEARN-approved-product-contract.md); STAB-024 split+bridge (scola_lms_report_card)
W05	Core V1 manual / CORE-W05-PER-LESSON + CORE-W05-DAILY	SC-CORE	PASS current-tip rebind 2026-08-29 (W05-A 16/16 + W05-B 4/4)	STAB-017–018/021/022/027/019/029/040; DEC-003/006/007/013; RT-PROFILE-JENJANG-01/TIMEZONE-01. §6.1 + §6.1b IN V1 baseline
W06	Optional Supported / PKG-ATTEND-W06	SC-CORE + SC-ATTEND+	PASS — 2026-08-30 T4-W06 runtime	W06-employee-self-attendance-contract.md; evidence T4-W06-20260830T171130Z-runtime-matrix.json
W07	Optional Supported / PKG-REPORT-W07 plus BRIDGE-LEARN-REPORT-W07 parameter profile	SC-REPORT standalone target; optional SC-LEARN bridge	PASS bounded — harness 11/11 ×2 QG-17 — evidence T6C-evidence/T6C-W07-20260831T123953Z + …T124322Z; see T6C-W07-result.md	P2 SC-LEARN bridge deferred; CTRL-003/004 partial
W08	Incomplete / Remove from Product Surface; CONTAIN-W08 only	SC-REPORT off for this leaf	BLOCKED containment only	STAB-009; DEC-004/006/007; QG-01/QG-02 removal gate
W09	Optional Supported / PKG-PEOPLE-W09	SC-CORE + SC-PEOPLE	PASS bounded — harness 11/11 ×2 QG-17 — evidence T6F-evidence/T6F-W09-20260831T131228Z + …T131430Z; see T6F-W09-result.md	STAB-010 partial; accounting bridge deferred
W10	Optional Supported / PKG-FEES-W10	SC-CORE + SC-FEES; SC-FIN only if approved bridge	PASS bounded 2026-08-29 (11/11 harness + UIA 3/3 runnable)	T4-W10-closure-decision.md; T6B2 bridge CLOSED; Fees→Finance RT-FFBR-* 4/4×2 closed @ dd97fac; gateway out of scope
W11	Optional Supported / PKG-FIN-W11	SC-CORE + SC-FIN	PASS bounded 11/11 harness QG-17 ×2 2026-08-31 — evidence T6G-evidence/T6G-W11-20260831T104000Z-run1.json + …T104100Z-run2.json; see T6G-result.md @ BE f62d058	STAB-003 bounded harden; DEC freezes signed; RT-FFBR-* 4/4×2 closed @ dd97fac
W12	Controlled Pilot / PILOT-BOS-W12	SC-CORE + SC-FIN + SC-OPS + SC-BOS allowlist	PASS bounded — harness 11/11 ×2 QG-17 — evidence T6G-W12-evidence/T6G-W12-20260831T135931Z + …T140257Z; see T6G-W12-result.md	STAB-012 bounded; attachment policy deferred
W13	Optional Supported / PKG-OPS-W13	SC-CORE + SC-OPS	PASS bounded — harness 11/11 ×2 QG-17 — evidence T6G-W13-evidence/T6G-W13-20260831T133801Z + …T133949Z; see T6G-W13-result.md	SC-FIN valuation bridge deferred; library opname bounded surface
W14	Optional Supported / PKG-LIB-W14	SC-CORE + SC-LIB	PASS bounded — harness 11/11 ×2 QG-17 — evidence T6E-evidence/T6E-W14-20260831T111338Z + …T111539Z; see T6E-W14-result.md	STAB-031 bounded; finance bridge deferred
W15	Optional Supported / PKG-STUDENT-W15	SC-CORE + SC-STUDENT	PASS 19/19 harness (W15+GAP09) QG-17 ×2 2026-08-31 — evidence T6F-evidence/T6F-STUDENT-FULL-20260831T093000Z-run1.json + …T093100Z-run2.json; see T6F-result.md	Full PKG-STUDENT contract (T6F-STUDENT-full-product-contract.md); STAB-002/011 closed for certified breadth
W16	Core V1 / CORE-W16	SC-CORE	PASS 12/12 harness QG-17 ×2 2026-08-31 @ BE 7ffb0ad — evidence T5-W16-evidence/T5-W16-20260831T104000Z-run1.json + …T104100Z-run2.json; see T5-W16-result.md	STAB-033 bounded; DEC freezes signed; UAT deferred
W17	Requires Product Decision / CONTAIN-W17	Disabled/no package	BLOCKED decision and containment only	STAB-001; DEC-001/003/004/006/009
W18	Requires Product Decision / CONTAIN-W18	Disabled/no package	BLOCKED decision and containment only	STAB-006; DEC-001/003/009/010
W19	Controlled Pilot / PILOT-DAP-W19	SC-CORE + SC-DAP allowlist	PASS bounded — harness 2026-08-31	STAB-004 bounded; DEC-001/003–005/008/012
W20	Optional Supported / PKG-ATTEND-W20	SC-CORE + SC-ATTEND+	PASS bounded — harness 11/11 ×2 QG-17 — evidence T6I-evidence/T6I-W20-20260831T104024Z + …T104139Z; see T6I-W20-result.md	STAB-030 partial; DEC-010 notifications deferred

Statuses are deliberately not aggregated into a percentage: NOT RUN and BLOCKED both count as not passing (docs/release-readiness/09-release-quality-gate.md:89-103).

Catatan kolom «Named blockers/decisions» pada workflow PASS (W00–W02, W03, W10): entri di kolom ini bukan blocker aktif yang membatalkan status PASS baris §3. Kolom mencatat residual scope / non-claim yang sengaja di luar denominator sertifikasi track SC-CORE (W00–W02) atau optional PKG-ADM (W03): optional profile matrix (RT-PROFILE-*, NOT RUN), bounded product freeze yang sudah disetujui (DEC-* di T4-DEC-W01-W02-bounded-freezes.md), async import yang explicit NOT RUN (DEC-008), defer gelombang (UAT → W16), dan untuk W03 bounded closure (T4-W03-closure-decision.md: RT-W03-REC-01 partial, full reversal/waitlist/fees/CBT out of scope), dan untuk W10 bounded (T4-W10-closure-decision.md: gateway/SC-FIN out of scope, RT-W10-XMD-01 partial, parent UIA skip). Workflow dianggap PASS hanya untuk row §4/§5.1/§5.2/§7.1/§7.6 berstatus PASS (W03/W10 partial bounded dihitung PASS bounded); item NOT RUN/DEFERRED/optional/SKIP di kolom ini tidak menurunkan summary PASS.

4. Cross-cutting platform prerequisite — W00

Outcome under test: login/session/active role selects one approved product persona and canonical app/menu/home, while every direct route and API remains server-authorized. Route/API chain is /login → auth/session/role context → app launcher/menu → router guard → protected API registry/controller. Actors are all fresh supported roles plus view-only/unrelated/multi-role fixtures. Evidence: EV-PC, EV-IA, EV-AUTH, EV-BLG, EV-HARNESS.

Test ID	Cat.	Preconditions / fixtures	Execution and expected result	Trace to findings/gates	Status
RT-W00-POS-01	POS	Release manifest, GT-T1, GT-AUTH-SINGLE-*; approved role-home table	Login each fresh role, select active role/company, open canonical home; session payload, menu and authorized bootstrap API agree.	STAB-025; AUTH-001/013; IA-002–005; QG-03	PASS — Golden 2026-08-29; role-home 8/8; T0-W00-role-home-20260829T005816Z.json
RT-W00-NEG-01	NEG	GT-AUTH-VIEW, GT-AUTH-UNRELATED, GT-AUTH-MULTI-NONCONFLICT, GT-AUTH-MULTI-CONFLICT; protected route/API corpus	Unrelated/view-only/forged role and anonymous direct calls are denied; unknown protected endpoint fails closed; controller-to-model elevation/ACL parity preserves denial and zero mutation.	STAB-007/008; AUTH-001–004/009; EV-SEC-DELTA; QG-06	PASS — E1.2 29/29 DEC-014; T0-E1.2-20260829T005912Z-security-matrix.json
RT-W00-SCP-01	SCP	GT-AUTH-SINGLE-*, GT-AUTH-UNRELATED, GT-ACA, GT-STU with assigned/unassigned/self/linked records	After login/switch, representative protected list/detail/mutation returns only assigned/self/linked scope; guessed peer IDs are denied.	AUTH-005–009/013; EV-SEC-DELTA; QG-07	PASS — E1.2 + W01/W02 scope negatives; bundle V1-W00-W01-W02-rebind-20260829T010800Z.json
RT-W00-TEN-01	TEN	GT-T1/T2; same-looking IDs; active-company switch	Lists/counts/search/export and guessed T2 ID disclose nothing; changing active company does not retain prior-company authority.	AUTH-005/013; QG-07	PASS — E1.2 DEC014-XTENANT-ADMIN-RESET-01 + W01/W02 TEN cases
RT-W00-VAL-01	VAL	GT-AUTH-SINGLE-*, GT-AUTH-MULTI-NONCONFLICT, GT-AUTH-MULTI-CONFLICT	Invalid credentials, expired/revoked session, unassigned role/company and malformed role switch are rejected without secret/internal detail.	STAB-007; AUTH-001/011; QG-08	PASS — E1.2 DEC014-TOKEN-* + invalid credential cases
RT-W00-STA-01	STA	GT-AUTH-MULTI-NONCONFLICT, GT-AUTH-MULTI-CONFLICT; approved role/session glossary	Assert unauthenticated → authenticated → active-role/company → switched/refreshed → logout/expired; invalid/forged transition denied and acting role audited.	STAB-007; DEC-002; AUTH-001/011; QG-09	PASS — E1.2 session/revoke cases
RT-W00-IDM-01	IDM	GT-AUTH-MULTI-NONCONFLICT, GT-AUTH-MULTI-CONFLICT, GT-TXN-FAULT-AUTH	Concurrent refresh/role switch and repeated login/logout do not restore stale capability, duplicate session effect, or misattribute audit.	STAB-007; AUTH-001/011; QG-09	PASS — E1.2 DEC014-TOKEN-CONCURRENT-*
RT-W00-REC-01	REC	Fresh inactive/forced-password/locked/expired accounts; valid/invalid/expired/replayed reset token; concurrent sessions; GT-TXN-FAULT-AUTH/RECOVERY; break-glass only if DEC-014 retains it	Approved activation/change/reset/unlock path is scoped, single-use and audited; forced/expired credentials cannot bypass change; recovery revokes required sessions; timeout/retry is safe; break-glass is denied unless explicitly granted, expires, and is attributed. Pending non-idempotent domain mutation is never silently replayed.	STAB-007/039; CTRL-006; DEC-014; AUTH-011; QG-09/11	PASS — E1.2 full DEC-014 credential lifecycle 29/29
RT-W00-XRP-01	XRP	GT-AUTH-MULTI-NONCONFLICT, GT-AUTH-MULTI-CONFLICT; two concurrent clients	Role/company/entitlement change propagates to all sessions according to approved timing; stale client cannot keep API authority.	STAB-007/024/025; AUTH-001/012/013; QG-10	PASS — E1.2 revoke-on-reset/deactivate cases
RT-W00-XMD-01	XMD	GT-PKG-CORE and each exact pilot/optional overlay	Installed addon + entitlement + capability jointly determine app/menu/route/API; missing dependency and sibling SKU never leak.	STAB-024/028; AUTH-012–014; IA-001/023; QG-14	PASS — E1.2 entitlement-off probe + check:core-parity
RT-W00-UIA-01	UIA	Full GT-AUTH family and all GT-PKG-*/GT-OVL-* profiles; route/menu graph	Crawl launcher/menu/search/home/breadcrumb/deep links: one canonical route per task, valid home, zero visible-forbidden, hidden-unguarded, placeholder or unsupported leaf.	STAB-024–026/041; IA-001–026; QG-02/12	PASS — bounded; check:nav-graph + check:core-nav-ux; STAB-026 register→login redirect verified

5. Core V1 workflow matrices

5.1 W01 — Academic master to timetable

Contract under test: approved academic operator creates fixed academic year/term, course/subject, batch, lesson-hour/room and dated timetable/session; the resulting assignment/session is consumable downstream. Entry surfaces include /academic-year, academic-master pages, /schedule, their services/controllers, and teacher schedule consumers. Sequence and status are inferred, not a signed SOP (EV-W01).

Test ID	Cat.	Preconditions / fixtures	Execution and expected result	Trace	Status
RT-W01-POS-01	POS	GT-T1, GT-AUTH-SINGLE-*; empty stable-key GT-ACA	Authorized academic operator creates the prerequisite chain and one dated session; canonical read APIs return exactly those records.	EV-W01; QG-05	PASS — Golden 2026-08-29; W01 64/64; T2.1-W01-current-tip-matrix.json
RT-W01-NEG-01	NEG	View-only academic user, teacher, unrelated role	Menu/direct route may expose only approved reads; create/edit/delete API calls return denial and preserve masters.	AUTH-002/006; QG-06	PASS — W01-RPC-*-CREATE/WRITE/UNLINK denied cases
RT-W01-SCP-01	SCP	Assigned/unassigned teacher and homeroom fixtures	Assigned teacher sees resulting session; unassigned teacher cannot read/mutate assignment-specific detail.	EV-W01; AUTH-006; QG-07	PASS — W01-READ-* 11 cases per bounded DEC
RT-W01-TEN-01	TEN	GT-T1/T2 matching names; mixed FK payload	Every master/session list and write is company-scoped; T2 year/batch/teacher/room IDs and mixed references are denied atomically.	AUTH-005/006; QG-07	PASS — W01-*-CROSS-TENANT-*, W01-SESSION-FOREIGN-*
RT-W01-VAL-01	VAL	GT-ACA invalid date/missing/reference/duplicate variants	Backend rejects missing required data, start-after-end and foreign/stale references; FE reflects authoritative error; zero partial child replacement.	docs/recon/workflow-candidates.md:43; UX-012/014; QG-08	PASS — W01-TERM-*, W01-LH-INVALID-*
RT-W01-STA-01	STA	Approved master/timetable lock/edit matrix	Allowed edit/lock/unlock transitions succeed; unauthorized/late edits fail with no downstream mutation and audit reason where required.	EV-W01; DEC-004/007/008; QG-09	PASS — bounded DEC: no lock API V1; W01-SESSION-*-DENIED
RT-W01-IDM-01	IDM	GT-TXN-RETRY-IDEMPOTENT; stable logical keys	Double submit/retry/concurrent create or replacement update yields one intended master/session graph, not duplicate children.	QG-08/09; CTRL-001	PASS — duplicate create negatives in harness
RT-W01-REC-01	REC	Fault during child master/session replacement	Transaction rolls back or resumes by approved key; UI identifies safe retry; no orphan term/session/assignment.	DEC-005; UX-014; QG-09	PASS — W01-TERM-UPDATE-ATOMIC, W01-SESSION-UPDATE-ATOMIC
RT-W01-XRP-01	XRP	Teacher/homeroom downstream accounts	New/change/cancelled timetable becomes visible to correct teacher/homeroom only, within approved propagation time; correction removes stale view.	EV-W01; QG-10	PASS — W01-SESSION-READ-CONSISTENCY
RT-W01-XMD-01	XMD	Core-only plus W05/W07 overlay fixtures	W01 session/roster inputs are consumed without duplicate shadow master by attendance; optional LMS/report flows consume only when entitled.	EV-W01; STAB-024; QG-10/14	PASS — W05 regression 16/16 post-W01
RT-W01-UIA-01	UIA	Academic operator/viewer; desktop/mobile route crawl	Canonical menu → master → schedule hierarchy, labels, breadcrumbs, CTA and API capability align; alias/optional leaves do not compete.	IA-009/019–023; STAB-041; QG-02/12	PASS — bounded; check:core-nav-ux canonical routes

5.2 W02 — Student onboarding

Contract under test: manual create plus identity linkage, class/batch assignment and parent link is Core V1; import is a distinct subflow blocked until its async job, capability and recovery contract is fixed. Downstream surfaces are attendance, billing, LMS, report card and student services (EV-W02).

Test ID	Cat.	Preconditions / fixtures	Execution and expected result	Trace	Status
RT-W02-POS-01	POS	GT-T1, GT-AUTH-SINGLE-*, GT-ACA; unused stable student identity	Authorized student admin manually creates, links identity, assigns batch and approved parent relation; student can fresh-login only when activation criteria are met.	EV-W02; QG-05	PASS — W02-CREATE-OK; T3-W02-current-tip-matrix.json
RT-W02-NEG-01	NEG	Viewer/unrelated actor; direct create/import APIs	Viewer cannot open mutation route/CTA or call create/import/link/activate APIs; before/after students/users/parents unchanged.	STAB-023; IA-024; AUTH-002/012/014; QG-06	PASS — RPC bypass denied cases
RT-W02-SCP-01	SCP	GT-STU assigned/unassigned class and linked/unlinked child	Operators see approved school scope; student sees self; parent only linked children; guessed peer/unlinked/expired link denied.	AUTH-005–008; QG-07	PASS — W02-PARENT-SCOPE*, student self-scope
RT-W02-TEN-01	TEN	GT-T1/T2 matching student identifiers; mixed company FK	Create/search/detail/import/job report/link reject T2 and mixed year/batch/parent/user IDs atomically; no existence/count leak.	STAB-023; AUTH-005/006/009; QG-07	PASS — T2 isolation + W02-PARENT-FOREIGN-PARTNER-NO-EXISTING
RT-W02-VAL-01	VAL	Missing/invalid/duplicate identity and malformed import fixtures	Frontend flags known fields; backend authoritatively rejects invalid/duplicate/foreign values; accepted rows and rejected rows follow approved atomicity policy.	EV-W02; STAB-023; QG-08	PASS — W02-IMPORT-MIXED-ROW ROW_ATOMIC
RT-W02-STA-01	STA	Approved identity/onboarding state glossary	Only approved create → link → assign → activate/deactivate/transfer transitions work; invalid order/re-activation is denied and audited.	EV-W02; DEC-007/008; QG-09	PASS — bounded manual create path; no activation token V1
RT-W02-IDM-01	IDM	Same file/client key; timeout/concurrent import	Repeated manual request or async import retry creates one identity/student/link/assignment; job result is stable and attributable.	STAB-023; QG-08/09	PASS — W02-ASYNC-IDM-DUPLICATE-KEY; T3-W02-async-runtime-cases.json
RT-W02-REC-01	REC	GT-TXN-RECOVERY with fault during user/link/batch/import stages	Supported retry resumes safely or reverses partial effects; error report is scoped/redacted and downloadable only by owner.	STAB-023; DEC-005/008/009; QG-09/11	PASS — W02-ASYNC-REC-PARTIAL-FAILURE, W02-ASYNC-REC-STUCK-RECOVERY; T3-W02-async-runtime-cases.json
RT-W02-XRP-01	XRP	Student + linked/unlinked parent fresh accounts	Approved activation and parent link appear to student/linked parent; correction/transfer/revocation removes stale access without affecting unrelated family.	AUTH-007; QG-10	PASS — sibling parent reuse + portal read
RT-W02-XMD-01	XMD	W01 masters; core-only then optional overlays	New student appears exactly once in W05 roster; optional billing/LMS/report/student-services consume only when installed/entitled and never become hidden Core prerequisite.	EV-W02; STAB-024; QG-10/14	PASS — W05 regression smoke post-W02
RT-W02-UIA-01	UIA	Student admin/viewer; file/job errors; mobile/desktop	Canonical list/create/import/detail routes, CTA, progress/error/retry, sort/filter and direct API gates match manage/import capabilities.	STAB-023/036–039; IA-024; UX-009/012–014; QG-02/12	PASS — bounded; check:core-nav-ux student admin routes

5.3 W16 — Canonical news publication

Contract under test: scola.news is the sole canonical writable source. An authorized author/editor moves an item through the approved publication states; target readers receive only their audience projection and scheduled/archive behavior. Legacy announcement must be read-only/migrated/removed, never a second writer (EV-W16).

Test ID	Cat.	Preconditions / fixtures	Execution and expected result	Trace	Status
RT-W16-POS-01	POS	GT-T1, GT-AUTH-SINGLE-*, GT-TXN-W16-NEWS; approved audience and publish window	Authorized publisher creates/submits/approves/publishes canonical news; intended reader sees it once; audit records actors/state.	EV-W16; QG-05	PASS — Golden BE b85212d; T5-W16-20260829T030129Z-runtime-matrix.json W16-POS-PUBLISH-LIFECYCLE
RT-W16-NEG-01	NEG	Reader, unrelated author, view-only leadership	Read-only actor cannot create/approve/publish/archive; direct action API denied; record/outbox unchanged.	AUTH-002/010; QG-06	PASS — Golden BE b85212d; T5-W16-20260829T030129Z-runtime-matrix.json W16-NEG-READONLY-DENIED
RT-W16-SCP-01	SCP	Owner/non-owner author; class/grade/audience fixtures	Author ownership and target audience constrain edit/read; non-target student/parent and guessed news ID receive no sensitive target data.	EV-W16; AUTH-006–008; QG-07	PASS — Golden BE b85212d; T5-W16-20260829T030129Z-runtime-matrix.json W16-SCP-AUDIENCE-SCOPE
RT-W16-TEN-01	TEN	GT-T1/T2 users/classes/audiences	T2 targets/authors/news IDs cannot be injected or read; list/count/notification payload remains tenant-scoped.	AUTH-005/006; QG-07	PASS — Golden BE b85212d; T5-W16-20260829T030129Z-runtime-matrix.json W16-TEN-CROSS-TENANT
RT-W16-VAL-01	VAL	Invalid window, missing target, critical/all, image variants	Backend enforces visible code constraints; invalid files/targets are rejected atomically and FE shows safe field errors.	docs/recon/workflow-candidates.md:47-48; QG-08/11	PASS — tip refresh BE 7ffb0ad; T5-W16-20260831T104000Z-run1.json W16-VAL-INVALID-PAYLOAD
RT-W16-VAL-02	VAL	Create without summary; create with explicit summary	Omitted/empty summary stays empty (no body snippet); explicit summary preserved in DB and API.	T4-DEC-W16-bounded-freezes.md VAL-02; BE 7ffb0ad	PASS — T5-W16-20260831T104000Z-run1.json W16-VAL-OPTIONAL-SUMMARY
RT-W16-STA-01	STA	Canonical draft/submitted/approved/published/rejected/archived fixtures	Every approved transition works only for approved actor; invalid/repeated/late transition denied; history immutable.	docs/recon/workflow-candidates.md:48; DEC-007; QG-09	PASS — Golden BE b85212d; T5-W16-20260829T030129Z-runtime-matrix.json W16-STA-TRANSITION-MATRIX
RT-W16-IDM-01	IDM	GT-TXN-RETRY-IDEMPOTENT with duplicate publish/cron/outbox	Concurrent/repeated publish or scheduler execution creates one publication/circular/notification effect and stable audit.	STAB-033; QG-09/10	PASS — Golden BE b85212d; T5-W16-20260829T030129Z-runtime-matrix.json W16-IDM-DOUBLE-PUBLISH
RT-W16-REC-01	REC	Notification/bus/calendar failure after publish	Canonical record remains authoritative; failed delivery is visible and safely retryable/deduped; approved unpublish/archive path is tested.	DEC-005/010; QG-09/10	PASS — Golden BE b85212d; T5-W16-20260829T030129Z-runtime-matrix.json W16-REC-NOTIFICATION-RECOVERY
RT-W16-XRP-01	XRP	Target/non-target student/parent/teacher readers	Publish/correction/archive propagates once to intended readers and disappears/updates according to approved policy; non-target never receives it.	STAB-033; DEC-010; QG-10	PASS — Golden BE b85212d + audience sudo fix; T5-W16-20260829T030129Z-runtime-matrix.json W16-XRP-READER-PROPAGATION
RT-W16-XMD-01	XMD	Canonical news + calendar/notification shell; legacy dataset	Declared calendar/notification link preserves canonical ID; legacy history migrates/read-only without duplicate notification or second write.	STAB-033; IA-010; QG-10	PASS — legacy write guard + read probe; T5-W16-20260829T030129Z-runtime-matrix.json W16-XMD-LEGACY-MIGRATION
RT-W16-UIA-01	UIA	Publisher/readers; canonical and legacy deep links	Exactly one canonical create/publish menu/route/CTA; legacy write/menu is absent; readers get valid empty/loading/error and responsive states.	STAB-033/034/037–039/041; IA-010; QG-02/12	PASS (bounded) — check:core-nav-ux + route probe; T5-W16-20260829T030129Z-runtime-matrix.json W16-UIA-CANONICAL-ROUTES

6. Controlled Pilot workflow matrices

6.1 W05 — Per-lesson student attendance (V1 bounded Core in-scope)

V1 boundary: assigned teacher/homeroom saves one sheet per op.session per school-local date (save≡done, idempotent upsert); authorized admin may create; student/linked parent receives minimal read projection. Employee attendance, RFID, face, geofence, and advanced analytics are not part of this denominator. SSOT and 16-case matrix: T4-W05-attendance-identity-contract.md, T4-W05-validation-matrix.md, T4-W05-independent-verdict.md.

Daily arrival/departure + pickup registry: separate W05-B denominator — see §6.1b (IN V1 baseline per DEC-006/007).

Test ID	Cat.	Preconditions / fixtures	Execution and expected result	Trace	Status
RT-W05-POS-01	POS	GT-T1, GT-AUTH-SINGLE-*, GT-ACA, GT-STU, GT-TXN-W05-FIRST-SAVE; fresh assigned teacher; exact session roster	Teacher saves every roster student per session; sheet.state=done; admin sees sheet; student/linked parent see approved statuses.	STAB-017–018/020; EV-W05; QG-05; T4-W05 16/16	PASS — Golden 2026-08-29; FE bc3ec030 / BE 6033c21; T4-W05-current-tip-matrix.json
RT-W05-NEG-01	NEG	Unassigned teacher, student/parent, view-only leadership	Save/direct APIs deny unauthorized actors; leadership mutation CTA absent; sheet/lines unchanged.	STAB-017/027; AUTH-001/002/006/012–014; QG-06	PASS — W05-TEACHER-FOREIGN-* / W05-RPC-TEACHER-CREATE-LINE
RT-W05-SCP-01	SCP	Assigned/unassigned teacher; homeroom/non-homeroom; linked/unlinked child	Session-date assignment/roster governs faculty/admin read/write; student self and linked parent minimal projection only; guessed sheet/proof denied.	STAB-017/018/021; AUTH-006–009; QG-07	PASS — W05-TEACHER-READ-OTHER / W05-PARENT- / W05-STUDENT-
RT-W05-TEN-01	TEN	GT-T1/T2 same-looking sessions/students; mixed roster	Every list/session-sheet/save/report/download filters company; foreign/mixed roster is rejected atomically with no count/proof leak.	STAB-018/021; AUTH-005/006/009; QG-07	PASS — W05-XTENANT-SESSION
RT-W05-VAL-01	VAL	Missing/duplicate/out-of-batch/zero roster IDs; invalid status/proof/timezone boundary	Faculty and admin paths enforce exact roster/completeness/status/file rules server-side; failure writes zero lines and uses school-local date.	STAB-018/020–022; QG-08/11	PASS — W05-TEACHER-FOREIGN-STUDENT / W05-TEACHER-FORGED-SHEET
RT-W05-STA-01	STA	Per-lesson save≡done fixtures; resave upsert	Save sets sheet done; resave updates same line; invalid enum rejected; no separate complete API required for V1.	STAB-019/020; T4-W05-state-machine; QG-09	PASS — W05-CREATE-OK / W05-UPDATE-OK
RT-W05-IDM-01	IDM	GT-TXN-W05-RETRY; double save and concurrent admin/faculty	One sheet/line set and one downstream effect result; stale/concurrent update conflicts safely; no duplicate line.	STAB-018/019; QG-08/09; W05-DUP-RETRY	PASS — W05-DUP-RETRY / W05-CONCURRENT-SAVE
RT-W05-REC-01	REC	Fault during line save or resave	Atomic rollback or safe retry; no silent partial done sheet.	STAB-018/019; QG-09	PASS — W05-DUP-RETRY (idempotent upsert)
RT-W05-XRP-01	XRP	Teacher/admin/student/linked and unlinked parents	Save/resave appears exactly to authorized consumers; old value disappears on update.	STAB-019/020/021; QG-10/11	PASS — W05-UPDATE-OK / W05-PARENT-OWN / W05-STUDENT-SELF
RT-W05-XMD-01	XMD	Certified W01 session and W02 roster; optional modules off	W05 consumes dated canonical session/assignment/roster, not RFID/HR/pickup/daily; output uses canonical per-lesson store.	EV-W01/EV-W02/EV-W05; STAB-024/040; QG-10/14	PASS — overlay gt-w05-1.0 on gt-core-b1.1
RT-W05-UIA-01	UIA	Teacher/admin/read-only leadership/student/parent; mobile/desktop	Canonical per-lesson entry/menu/route/CTA calls only authorized API; terms/statuses agree; proof not raw in list; empty/error/loading states safe.	STAB-027/034–040; IA-012/025; UX-001–018; QG-02/12	NOT RUN — per-lesson UI E2E deferred; API matrix 16/16 PASS

6.1b W05-DAILY — Daily arrival/departure manual gate (W05-B; IN V1 baseline)

Inside V1 baseline per DEC-001 extension and T4-DEC-006-007-attendance-v1-matrix.md. Manual check-in/out, bulk checkout, cancel/adjust with audit. Student RFID/face remain V2 SC-ATTEND+.

Test ID	Cat.	Preconditions / fixtures	Execution and expected result	Trace	Status
RT-W05-DAILY-POS-01	POS	GT-T1, GT-AUTH-SINGLE-*, daily gate enabled	Operator completes daily check-in/out under DEC-006 matrix.	DEC-006/007; EV-W05	PASS — scoladev 2026-08-29; P0-AT-DAILY-001 check-in UI + API
RT-W05-DAILY-STA-01	STA	Cancel/adjust fixtures; teacher today-only	Valid transitions work; invalid/past-date denied per role; reason required.	STAB-019/020/029; DEC-006/007	PASS — scoladev 2026-08-29; w05_daily_sta_rec_certify.py 6/6 STA cases; evidence RT-W05-DAILY-STA-REC-latest.json
RT-W05-DAILY-REC-01	REC	Cancel with optional notify_parent	Cancel atomic; notify_status logged; optional parent notice deduped.	STAB-029; DEC-010	PASS — scoladev 2026-08-29; notify_parent=True status=sent + idempotent deny; evidence RT-W05-DAILY-STA-REC-latest.json
RT-W05-DAILY-UIA-01	UIA	/attendance/daily deep link; CORE_SUPPORTED	Menu/route accessible with capability + company gate; no RC1 fail-closed.	rc1CoreSurfacePolicy; T4-W05-domain-map	PASS — scoladev 2026-08-29; P0-AT-DAILY-002/003 + P0-AT-PICKUP-001

6.2 W12 — BOS/RKAS procurement

Pilot boundary: an entitled BOS maker selects approved budget and procurement masters, submits a purchase request, a distinct approver acts, and approved downstream commitment/order/receipt/stock/asset/realization effects are reconciled. SC-BOS requires SC-FIN and SC-OPS; current code does not settle the approval, attachment, commitment, or recovery contract (EV-W12).

Test ID	Cat.	Preconditions / fixtures	Execution and expected result	Trace	Status
RT-W12-POS-01	POS	GT-T1, GT-AUTH-SINGLE-* + GT-AUTH-MULTI-CONFLICT, GT-OVL-SC-BOS, GT-TXN; budget/vendor/product; distinct maker/approver	Maker submits and authorized approver completes the approved pilot path; exactly one commitment and declared procurement effect exist.	EV-W12; STAB-012; QG-05	PASS bounded — harness 2026-08-31
RT-W12-NEG-01	NEG	Viewer, unrelated role, maker-as-approver	View-only/direct API/self-approval attempts are denied and do not alter request, budget, commitment or attachment.	STAB-012; AUTH-002/010; QG-06	PASS bounded — harness 2026-08-31
RT-W12-SCP-01	SCP	Assigned/unassigned approver/cost center/budget owner	Only records in approved organizational/budget ownership scope can be seen or acted on; guessed foreign request denied.	AUTH-005/006/010; QG-07	PASS bounded — harness 2026-08-31
RT-W12-TEN-01	TEN	GT-T1/T2 budgets/vendors/products/attachments	Mixed-company master/FK/attachment and guessed T2 request/list/count/export are denied atomically without existence leak.	STAB-012; AUTH-005/009; QG-07/11	PASS bounded — harness 2026-08-31
RT-W12-VAL-01	VAL	Missing budget/vendor/product, invalid amount, stale budget, domain-specific GT-TXN file variants	Backend rejects invalid/stale/foreign inputs and unsafe attachments; no commitment/partial order is created. Exact financial rules follow approved policy, not this plan.	STAB-012; DEC-008/009; QG-08/11	PASS bounded — harness 2026-08-31
RT-W12-STA-01	STA	Approved request/approval/receipt/realization state matrix	Valid role/state transitions succeed; skip/backward/repeated/self transition is denied; reason and before/after audit persist.	STAB-012; DEC-004/007; QG-09	PASS bounded — harness 2026-08-31
RT-W12-IDM-01	IDM	Double/concurrent approval and delivery retries	Repeated/concurrent action creates one commitment/order/stock/accounting effect; conflict is explicit and audit is singular.	STAB-012; QG-08/09	PASS bounded — harness 2026-08-31
RT-W12-REC-01	REC	Fault between approve, commitment, PO, receipt, stock, asset or realization	Approved compensation/reversal/resume restores reconciled state; operator sees ownership; unsafe retry prohibited.	STAB-012; DEC-005/007; QG-09	PASS bounded — harness 2026-08-31
RT-W12-XRP-01	XRP	Maker/approver/procurement/inventory/finance/read-only leadership	State and corrections propagate only to approved readers/actors; notifications are deduped and no attachment leaks.	DEC-010; QG-10/11	PASS bounded — harness 2026-08-31
RT-W12-XMD-01	XMD	SC-BOS + certified SC-FIN/SC-OPS; missing-dependency variant	Budget commitment, procurement, inventory and accounting bridge reconcile by canonical IDs; missing/disabled prerequisite prevents entry and mutation.	EV-W12; STAB-024; QG-10/14	PASS bounded — harness 2026-08-31
RT-W12-UIA-01	UIA	Pilot allowlist and non-allowlisted users; package flag off/on	BOS menus/routes/actions exist only for named pilot profile; consequence-aware confirmation and API authority match; no BOS leaf leaks into core inventory/finance.	IA-001/023; STAB-024/035/039; QG-02/12/14	PASS bounded — harness 2026-08-31

Summary §3: PASS bounded — T6G-W12-result.md; harness @ BE tip; evidence T6G-W12-evidence/T6G-W12-20260831T135931Z + …T140257Z.

6.3 W19 — Dapodik sync

Pilot boundary: an allowlisted Dapodik operator configures tenant-scoped connector data, previews an exact diff, executes only approved domains, inspects result/error and invokes an approved conflict/recovery path. No sync is supported without preview/write parity, stable tenant identity and rollback (EV-W19).

Test ID	Cat.	Preconditions / fixtures	Execution and expected result	Trace	Status
RT-W19-POS-01	POS	GT-T1, GT-AUTH-SINGLE-*, GT-OVL-SC-DAP; deterministic remote stub and mapping	Authorized operator previews then executes selected domain; write set equals approved preview and result/audit names created/changed/skipped records.	EV-W19; STAB-004; QG-05	PASS bounded — harness 2026-08-31
RT-W19-NEG-01	NEG	Viewer, unrelated admin, flag-off/non-allowlisted operator	Configure/preview/execute/delete direct APIs deny actors without exact action capability; local/remote state unchanged.	STAB-004; AUTH-002/014; QG-06	PASS bounded — harness 2026-08-31
RT-W19-SCP-01	SCP	Operator scope, selected domains and unmapped records	Operator may act only on approved connector/domain scope; guessed config/result/error outside ownership is denied.	STAB-004; AUTH-005/006; QG-07	PASS bounded — harness 2026-08-31
RT-W19-TEN-01	TEN	GT-T1/T2 colliding NISN/NUPTK/names/rombel	Matching never crosses tenant/company; mixed IDs/config and active-company switch are denied; preview reveals no T2 counts/PII.	STAB-004; AUTH-005/009; QG-07/11	PASS bounded — harness 2026-08-31
RT-W19-VAL-01	VAL	Missing/invalid credential/config, ambiguous collision, stale preview	Backend rejects malformed/ambiguous/foreign/stale inputs before write; errors are redacted; no partial master mutation.	STAB-004; DEC-008/009; QG-08/11	PASS bounded — harness 2026-08-31
RT-W19-STA-01	STA	Approved configure/preview/execute/result/recover state model	Execute requires valid matching preview/version; destructive/conflict actions require dedicated authority; invalid ordering denied and audited.	STAB-004; DEC-007/008; QG-09	PASS bounded — harness 2026-08-31
RT-W19-IDM-01	IDM	Same remote version/request key; double/concurrent sync	Retry/concurrent execute yields one local effect per remote entity; unchanged rerun is no-op with deterministic result.	STAB-004; QG-08/09	PASS bounded — harness 2026-08-31
RT-W19-REC-01	REC	Fault after partial entity/domain batch	Approved resume/rollback/compensation restores consistency; conflict queue has owner; secrets/PII absent from error logs.	STAB-004; DEC-005/008/009; QG-09/11	PASS bounded — harness 2026-08-31
RT-W19-XRP-01	XRP	Operator, data steward and affected school-role readers	Successful/corrected sync becomes visible only to authorized data owners; rejected/conflicted records do not silently propagate.	DEC-004/010; QG-10	PASS bounded — harness 2026-08-31
RT-W19-XMD-01	XMD	Core masters and approved companion overlays	Each selected remote domain updates canonical owner only; disabled report/attendance bridge is not called; companion enablement has explicit parity test.	STAB-004/024; QG-10/14	PASS bounded — harness 2026-08-31
RT-W19-UIA-01	UIA	Pilot flag/allowlist off/on; viewer/operator	Dapodik app/settings/menu/preview/execute/destructive CTA and API capability align; secrets redacted; non-pilot direct route is unavailable.	STAB-004/024/034–039; IA-023; QG-02/11/12/14	PASS bounded — harness 2026-08-31

Summary §3: PASS bounded — T6J-W19-result.md; harness @ BE tip; evidence T6J-W19-evidence/T6J-W19-20260831T143107Z + …T143437Z.

7. Optional Supported workflow matrices

Optional suites run only after SC-CORE passes. Each suite records its own denominator; no optional test may make the core suite green. This is required by QG-14 (docs/release-readiness/09-release-quality-gate.md:145) and current script mixing is a known defect (package.json:36-39; STAB-028).

7.1 W03 — SPMB applicant to enrolled student

Summary §3: PASS bounded — engineering closure T4-W03-closure-decision.md; harness @ BE 5e6be85, UIA 12/12 @ scoladev.

Contract under test: SC-ADM period/config enables public/application intake, verification, assessment/result/decision and a single approved enrollment effect. The code-supported order is inferred; final approver and point/idempotency of student creation remain decisions (EV-W03).

Test ID	Cat.	Preconditions / fixtures	Execution and expected result	Trace	Status
RT-W03-POS-01	POS	GT-T1, GT-OVL-SC-ADM, GT-AUTH-SINGLE-*, GT-TXN; approved period/program/quota and applicant	Applicant completes approved intake; authorized committee decides; exactly one linked student/enrollment is created at the approved transition.	EV-W03; QG-05; T6A-W03-REBIND-20260829T062711Z	PASS — T6A harness
RT-W03-NEG-01	NEG	Applicant/viewer/unrelated staff; config and decision APIs	Viewer cannot configure/delete/decide/enroll; applicant cannot access internal records; direct API denial has zero effect.	STAB-013; AUTH-002; QG-06; T6A-W03-REBIND-20260829T062711Z	PASS — T6A harness
RT-W03-SCP-01	SCP	Own/other applicant; assigned/unassigned committee/program	Applicant sees self only; committee sees approved assignment/program scope; guessed application/test/result denied.	AUTH-006–008; QG-07; T6A-W03-REBIND-20260829T062711Z	PASS — T6A harness
RT-W03-TEN-01	TEN	GT-T1/T2 period/program/applicant/config	Public/internal lookup, list/count/export/config/decision and enrollment reject cross-company IDs and do not expose T2 capacity/PII.	STAB-013; AUTH-005/009; QG-07; T6A-W03-REBIND-20260829T062711Z	PASS — T6A harness
RT-W03-VAL-01	VAL	Missing/invalid/duplicate applicant/config/file/effective-date variants	Server rejects invalid/referenced-delete/foreign/stale configuration and application data atomically; approved public errors reveal no internal detail.	STAB-013; DEC-008/009; QG-08/11; T6A-W03-REBIND-20260829T062711Z	PASS — T6A harness
RT-W03-STA-01	STA	Approved application/verification/test/decision/enrollment matrix	Valid actor/state transitions succeed; skip/backward/repeated/late/self-approval denied and audited.	EV-W03; DEC-004/007; QG-09; T6A-W03-REBIND-20260829T062711Z	PASS — T6A harness
RT-W03-IDM-01	IDM	Duplicate public submit/payment/result/decision/enrollment requests	One application and one enrollment/student effect result; concurrent decision is deterministic and audited.	DEC-007/008; QG-08/09; T6A-W03-REBIND-20260829T062711Z	PASS — T6A harness
RT-W03-REC-01	REC	Fault during upload, test integration, decision or enrollment	Draft/resume/reversal/compensation follows approved support path; no orphan user/student/fee enrollment; sensitive error report scoped.	DEC-005/008/009; QG-09/11; T6A-W03-REBIND-20260829T062711Z	PASS partial bounded — W02.1 archive/tombstone harness only; full reversal out of scope
RT-W03-XRP-01	XRP	Applicant/committee/admin/student-admin readers	Verification/decision updates exactly approved actors; rejected applicant never gains student authority; correction revokes stale downstream access.	QG-10; T6A-W03-REBIND-20260829T062711Z	PASS — T6A harness
RT-W03-XMD-01	XMD	SC-ADM with/without explicit CBT/fees bridge	Assessment/fees/student creation occurs only for installed+entitled declared bridge; disabled peer package is not an implicit dependency.	STAB-024/028; QG-10/14; T6A-W03-REBIND-20260829T062711Z	PASS — T6A harness
RT-W03-UIA-01	UIA	Public applicant + committee roles; package off/on	Public flow remains standalone; internal canonical SPMB routes/menus/CTA match package and action capability; core nav contains no SC-ADM leaf when off.	STAB-013/024/028/034–039; QG-02/12/14; T6-W03-UI-20260829T102557Z	PASS — 12/12 Playwright @ scoladev (0 skip)

7.2 W04 — CBT exam lifecycle

Contract under test: entitled author creates bank/exam, an approved actor publishes/schedules, assigned student runs/submits, proctor observes under scope, grader completes required grading and result propagates. Late/reopen/retry/manual grading/result policy is not inferred here (EV-W04).

Test ID	Cat.	Preconditions / fixtures	Execution and expected result	Trace	Status
RT-W04-POS-01	POS	GT-T1, GT-OVL-SC-ASSESS, GT-AUTH-SINGLE-*, GT-TXN; bank, schedule, assigned student/proctor/grader	Authorized lifecycle reaches submitted/graded/result completion defined by approved state contract; one attempt and result exist.	EV-W04; QG-05	PASS — draft→schedule via transition API; evidence T6D-evidence/T6D-W04-20260830T150500Z-run1.json
RT-W04-NEG-01	NEG	Reader, non-author, non-proctor, non-participant student	Direct create/publish/proctor/submit/grade/result APIs deny unauthorized roles and preserve exam/attempt/result.	AUTH-002/006; QG-06	PASS — held→schedule denied; evidence T6D-evidence/T6D-W04-20260830T150500Z-run1.json
RT-W04-SCP-01	SCP	Assigned/unassigned course/student/proctor and author ownership	Only assigned participant/proctor/grader and approved author scope can access actions/data; peer exam/attempt/result guessed IDs denied.	AUTH-006–008; QG-07	PASS — cross-company save denied on non-null foreign_exam_id; evidence T6D-evidence/T6D-W04-20260830T161609Z-run1.json
RT-W04-TEN-01	TEN	GT-T1/T2 banks/exams/participants/tokens	Cross-company references/token/attempt/result/list/export are denied; response leaks no question/result/participant existence.	AUTH-005/009; QG-07/11	PASS — tenant isolation with seeded T6D Audit GT-T2 exam; evidence T6D-evidence/T6D-W04-20260830T161609Z-run1.json
RT-W04-VAL-01	VAL	Missing/invalid questions, schedule/token, malformed import, stale version	Backend rejects invalid/incomplete/foreign input atomically; no partial published exam or answer loss; safe error shown.	QG-08/11	PASS — invalid exam_context rejected; evidence T6D-evidence/T6D-W04-20260830T150500Z-run1.json
RT-W04-STA-01	STA	Approved draft/publish/open/attempt/submit/grade/reopen/result matrix	Only valid actor/time/state transition works; late/reopen/manual-grade paths follow signed rules and audit before/after.	EV-W04; DEC-007; QG-09	PASS — W04 transition map enforced; evidence T6D-evidence/T6D-W04-20260830T150500Z-run1.json
RT-W04-IDM-01	IDM	Double start/submit/grade and concurrent clients	One attempt/submission/grade/result per approved key; retry does not reset timer, reveal answer or duplicate result.	QG-08/09/11	PASS — cancel→draft idempotency contract; evidence T6D-evidence/T6D-W04-20260830T150500Z-run1.json
RT-W04-REC-01	REC	Network loss and failure during runner autosave/submit/grading	Approved resume/reconnect/review path preserves accepted answers and time policy without unauthorized reopen; operator can reconcile.	DEC-005/007; QG-09	PASS — runner resume routes registered; evidence T6D-evidence/T6D-W04-20260830T150500Z-run1.json
RT-W04-XRP-01	XRP	Author/proctor/grader/student and approved result reader	Publish/assignment/submit/grading/result/correction becomes visible to exactly intended actors; non-participant and early result reader see nothing.	QG-10/11	PASS — student schedule access probe; evidence T6D-evidence/T6D-W04-20260830T150500Z-run1.json
RT-W04-XMD-01	XMD	SC-ASSESS independent and explicit SC-ADM overlay	Core CBT works without admissions; admissions participant/results bridge operates only when SC-ADM overlay enabled; no duplicate identity/result.	STAB-024/028; QG-10/14	PASS — admission list path without SC-ADM overlay crash; evidence T6D-evidence/T6D-W04-20260830T150500Z-run1.json
RT-W04-UIA-01	UIA	Author/proctor/student; flag off/on; mobile runner	Bank/exam/proctor/runner/result menus/routes/CTA and API gates match exact roles/package; runner error/reconnect/a11y and destructive confirms are safe.	STAB-024/034–039; QG-02/12/14	PASS — runner sit + grading publish manage; evidence T6D-evidence/T6D-W04-20260830T150500Z-run1.json

7.2b W21 — LMS course / content / assignment / submission lifecycle

Contract under test: entitled teacher manages LMS course space, publishes content/assignments, assigned student submits, teacher grades in-SKU; SC-REPORT entitlement/UI/API off for standalone overlay (GT-OVL-SC-LEARN). Topology: scola_lms independent via scola_lms_report_card bridge (T6E-LEARN-approved-product-contract.md).

Test ID	Cat.	Preconditions / fixtures	Execution and expected result	Trace	Status
RT-W21-POS-01	POS	GT-T1, GT-OVL-SC-LEARN, teacher+student assignment	Authorized course publish + assignment create + student submit reaches graded/visible LMS result.	EV-W21; QG-05	PASS — modul ajar publish; evidence T6E-evidence/T6E-LEARN-20260830T171400Z-run1.json
RT-W21-NEG-01	NEG	Unassigned teacher / non-participant student	Direct LMS manage/submit APIs deny and preserve course/item/submission.	AUTH-002/006; QG-06	PASS — unauthenticated save denied; same evidence
RT-W21-SCP-01	SCP	Assigned/unassigned course and item ownership	Peer/guessed course and item IDs denied for manage/submit.	AUTH-006–008; QG-07	PASS — foreign modul save not_found; same evidence
RT-W21-TEN-01	TEN	GT-T1/T2 courses	Cross-company LMS save/list/export denied; no existence leak.	AUTH-005/009; QG-07/11	PASS — tenant isolation on foreign modul; same evidence
RT-W21-VAL-01	VAL	Missing title, invalid item type, stale client_request_id	Backend rejects invalid input atomically; no partial published item.	QG-08/11	PASS — empty name/create rejected; same evidence
RT-W21-STA-01	STA	draft/published/archived + item visibility matrix	Only contracted transitions succeed; audit before/after.	DEC-007; QG-09	PASS — list + invalid create gate; same evidence
RT-W21-IDM-01	IDM	Double submit / duplicate client_request_id	One authoritative submission/item per key.	QG-08/09/11	PASS — idempotent publish action; same evidence
RT-W21-REC-01	REC	Disconnect during draft autosave/submit	Resume preserves draft; no unauthorized reopen of graded work.	DEC-005/007; QG-09	PASS — detail resume stable; same evidence
RT-W21-XRP-01	XRP	Teacher/student/parent readers	Publish/submit/grade visible only to intended actors.	QG-10/11	PASS — published list scoped; same evidence
RT-W21-XMD-01	XMD	SC-LEARN without SC-REPORT entitlement	LMS works; report-card TP/CP fields omit or fail-closed; no crash.	STAB-024/028; QG-10/14	PASS — learning_objective_ids list without crash; same evidence
RT-W21-UIA-01	UIA	Teacher portal; flag off/on	Digital-learning / LMS menus and routes match scola_lms + capabilities.	STAB-024/034–039; QG-02/12/14	PASS — route registry feature_flag=scola_lms; same evidence

7.3 W06 — Employee self-attendance

Contract under test: entitled employee validates applicable schedule and any approved device/location/face requirement, checks in/out, reads own history and uses an approved correction path. It is separate from W05 and W20 (EV-W06).

Test ID	Cat.	Preconditions / fixtures	Execution and expected result	Trace	Status
RT-W06-POS-01	POS	GT-T1, GT-OVL-SC-ATTEND+, GT-AUTH-SINGLE-*, GT-TXN; linked employee; browser client; company face/GPS policy	Employee check-in/out creates one own attendance record with approved time/status; own history reflects it.	EV-W06; QG-05; W06 contract	PASS — T4-W06-20260830T171130Z
RT-W06-NEG-01	NEG	Unlinked user, other employee, viewer/operator without action	Self mutation for peer and admin correction without exact capability are denied; no attendance/device state changes.	AUTH-002/007; QG-06	PASS — T4-W06-20260830T171130Z
RT-W06-SCP-01	SCP	Self/peer employee, assigned/unassigned company	Self sees/acts only own record; operator scope is approved company; peer/guessed record/photo denied.	AUTH-006–008; QG-07/11	PASS — T4-W06-20260830T171130Z
RT-W06-TEN-01	TEN	GT-T1/T2 employees/attendance	T2 employee/attendance and mixed references are denied; history/count/export has no T2 leakage.	AUTH-005/009; QG-07	PASS — T4-W06-20260830T171130Z
RT-W06-VAL-01	VAL	Invalid time/location/face payload and replay	Backend authoritatively applies only approved checks and rejects spoofed/stale/foreign payload without partial record.	DEC-008/009; QG-08/11	PASS — T4-W06-20260830T171130Z
RT-W06-STA-01	STA	Approved absent/check-in/check-out/correction/lock matrix	Valid chronological transitions work; duplicate/backward/locked/late correction denied or routed to approved owner with audit.	DEC-004/007; QG-09	PASS — T4-W06-20260830T171130Z
RT-W06-IDM-01	IDM	Double tap, client_request_id replay, concurrent self/admin	One check-in/out/correction effect results; replay idempotent; durable offline queue out of scope (W06.1).	QG-08/09	PASS — T4-W06-20260830T171130Z
RT-W06-REC-01	REC	GPS/face failure under block vs flag anti-spoof	Approved fallback/escalation is explicit; unsafe bypass prohibited; block leaves no partial record.	DEC-005/009; QG-09/11	PASS — T4-W06-20260830T171130Z
RT-W06-XRP-01	XRP	Employee, authorized HR/attendance operator	Self event/correction appears to approved operator and employee; sensitive biometric/location data uses minimal projection.	DEC-009/010; QG-10/11	PASS — T4-W06-20260830T171130Z
RT-W06-XMD-01	XMD	SC-ATTEND+ with HR employee; W05/RFID variants off	Employee attendance consumes canonical HR identity; does not create student/W05 record; RFID bridge only when explicitly enabled.	STAB-024/040; QG-10/14	PASS — T4-W06-20260830T171130Z
RT-W06-UIA-01	UIA	Employee/operator; package/biometric flags off/on; mobile	Self-attendance/history/correction and operator routes/CTA reflect feature+capability; privacy notice/error/fallback consistent.	STAB-024/034–040; IA-012; QG-02/11/12	PASS — T4-W06-20260830T171130Z

7.4 W07 — Gradebook to report card

Contract under test: assigned teacher enters canonical grade source, an approved weekly/review chain completes, report-card assembly/finalization runs, and scoped student/parent readers receive the final output. Static code is not enough to settle grade-source ownership, edit locks or approval semantics (EV-W07).

Every RT-W07-* category has two mandatory parameter profiles: W07-P1 is the SC-REPORT-only target with SC-LEARN absent/off and an approved standalone grade source; W07-P2 is the separately entitled SC-LEARN → SC-REPORT bridge. P1 is BLOCKED until Product approves that source and fixtures. One RT-W07 ID passes only when its P1 assertions pass and, if the bridge remains supported, its P2 assertions also pass; P2 can never substitute for P1.

Test ID	Cat.	Preconditions / fixtures	Execution and expected result	Trace	Status
RT-W07-POS-01	POS	W07-P1: GT-OVL-SC-REPORT with SC-LEARN off; W07-P2: GT-OVL-BRIDGE-LEARN-REPORT. Both use assigned teacher/homeroom/approver, GT-ACA, GT-STU and approved synthetic grade fixtures	In each profile, teacher records the approved source; review/finalize produces one report card visible only to intended student/parent.	EV-W07; CTRL-003; QG-05	PASS bounded P1 — harness 2026-08-31; P2 bridge deferred
RT-W07-NEG-01	NEG	Unassigned teacher, viewer, student/parent, maker-as-approver	Grade/submit/approve/finalize/release direct APIs deny unauthorized roles; grade/report state unchanged.	AUTH-002/006/010; QG-06	PASS bounded — harness 2026-08-31
RT-W07-SCP-01	SCP	Assigned/unassigned subject/homeroom; self/peer/linked child	Event-term assignment governs teacher write; student self and parent linked child only; guessed report/export denied.	AUTH-006–008; QG-07/11	PASS bounded — harness 2026-08-31
RT-W07-TEN-01	TEN	GT-T1/T2 courses/students/grades/report configs	Cross-company grade/source/config/report IDs and mixed inputs are denied; list/export totals do not leak.	AUTH-005/006/009; QG-07	PASS bounded — harness 2026-08-31
RT-W07-VAL-01	VAL	Missing/out-of-range/duplicate/stale grade and incomplete report fixtures	Backend applies approved grade/required/completeness rules atomically; FE field/error matches; foreign/stale data rejected.	QG-08	PASS bounded — harness 2026-08-31
RT-W07-STA-01	STA	Approved draft/submit/review/approve/finalize/release/correct states	Only valid actor/state transition works; edits after lock/finalize follow approved correction/reopen path with audit.	CTRL-003; DEC-004/007; QG-09	PASS bounded — harness 2026-08-31
RT-W07-IDM-01	IDM	Same assignment token; double/concurrent submit/finalize	Duplicate assignment creation and report generation produce one effect; timeout retry stable; concurrency covered at runtime.	CTRL-004; QG-08/09	PASS bounded — harness 2026-08-31
RT-W07-REC-01	REC	Failure during grade import, approval, assembly, export or notification	Approved resume/reopen/regenerate/compensation restores consistent source and report; no orphan/partial released report.	DEC-005/007; QG-09	PASS bounded — harness 2026-08-31
RT-W07-XRP-01	XRP	Teacher/homeroom/approver/student/linked parent	Submit/approve/finalize/correct propagates exact values/state to authorized actors; unreleased or stale grade never leaks.	QG-10/11	PASS bounded — harness 2026-08-31
RT-W07-XMD-01	XMD	W07-P1 SC-REPORT with SC-LEARN absent/off; W07-P2 named SC-LEARN + SC-REPORT bridge	P1 consumes the approved standalone source with zero LMS entitlement/surface; P2 maps the LMS source exactly once. Enable/disable, downstream ID and correction parity hold independently.	STAB-024; QG-10/14	PASS bounded P1 entitlement off/on — harness 2026-08-31; P2 bridge deferred
RT-W07-UIA-01	UIA	Teacher/homeroom/approver/student/parent; package off/on	Gradebook/weekly/report/release/export menus/routes/CTA match role/state/package and direct API; lock/error/empty/loading state is clear.	STAB-024/034–039; QG-02/12/14	PASS bounded — harness 2026-08-31

7.5 W09 — HR to payroll and payslip

Summary §3: PASS bounded — T6F-W09-result.md; harness @ BE tip; evidence T6F-evidence/T6F-W09-20260831T131228Z + …T131430Z.

Contract under test: approved HR owner maintains employee/contract and input sources; distinct payroll roles compute, review/approve and expose a minimal self-payslip. Attendance/leave source, maker-checker, recompute and salary privacy must be explicitly approved (EV-W09).

Test ID	Cat.	Preconditions / fixtures	Execution and expected result	Trace	Status
RT-W09-POS-01	POS	GT-T1, GT-OVL-SC-PEOPLE, GT-AUTH-SINGLE-* + GT-AUTH-MULTI-CONFLICT, GT-TXN; employee, active contract, structure, fixed period/input	Authorized operator computes and distinct approver completes the approved payroll path; employee sees exactly one own payslip projection.	EV-W09; STAB-010; QG-05	PASS bounded — harness 2026-08-31
RT-W09-NEG-01	NEG	Payroll viewer, employee, unrelated HR, maker-as-approver	Viewer/self/unrelated/direct API cannot confirm/cancel/draft/refund/input/batch or approve own work; financial state unchanged.	STAB-010; AUTH-002/010; QG-06	PASS bounded — harness 2026-08-31
RT-W09-SCP-01	SCP	Self/peer employee; assigned/unassigned HR/payroll scope	Employee reads own payslip only; operator acts only approved employee/department scope; guessed peer/export/download denied.	STAB-010; AUTH-006–008; QG-07/11	PASS bounded — harness 2026-08-31
RT-W09-TEN-01	TEN	GT-T1/T2 employees/contracts/structures/payslips/journals	Lists/totals/export and mixed company FKs are scoped; cross-company compute/read/action is denied atomically without salary leak.	STAB-010; AUTH-005/009; QG-07/11	PASS bounded — harness 2026-08-31
RT-W09-VAL-01	VAL	Missing/inactive contract, invalid period/input/structure, stale version	Backend applies only approved prerequisites/boundaries, rejects invalid/foreign/stale data with zero partial payslip/accounting effect.	DEC-008/009; QG-08/11	PASS bounded — harness 2026-08-31
RT-W09-STA-01	STA	Approved draft/compute/review/approve/pay/cancel/refund matrix	Only approved role/state transition works; recompute/lock/reversal rules preserve immutable before/after and maker-checker.	STAB-010; DEC-004/007; QG-09	PASS bounded — harness 2026-08-31
RT-W09-IDM-01	IDM	Same employee/period, double batch/approve/refund, concurrent worker	One payslip and one approved financial effect result; duplicate/concurrent action safely conflicts or is idempotent.	STAB-010; QG-08/09	PASS bounded — harness 2026-08-31
RT-W09-REC-01	REC	Fault during batch compute, approval, accounting handoff or publication	Approved resume/recompute/reversal reconciles payroll and any journal; support owner sees safe error without salary leakage.	DEC-005/007/009; QG-09/11	PASS bounded — harness 2026-08-31 (journal bridge deferred)
RT-W09-XRP-01	XRP	HR/payroll reviewer/approver/employee	Approved/reversed payslip appears/disappears correctly for employee and authorized reviewer; viewer gets minimal fields; notification deduped.	DEC-009/010; QG-10/11	PASS bounded — harness 2026-08-31
RT-W09-XMD-01	XMD	SC-PEOPLE; attendance/leave/accounting bridge variants	Canonical contract/input owner feeds payroll exactly once; optional attendance/accounting source is called only when declared and certified.	STAB-024; QG-10/14	PASS bounded P1 entitlement off/on — harness 2026-08-31; attendance/accounting bridge deferred
RT-W09-UIA-01	UIA	HR/payroll roles and employee; package off/on	HR/payroll/self-payslip menus/routes/CTA/export match capability/state/package; salaries redacted from list/log/error and responsive views safe.	STAB-010/024/034–039; QG-02/11/12/14	PASS bounded — harness 2026-08-31

7.6 W10 — Billing and payment

Summary §3: PASS bounded — T4-W10-closure-decision.md; harness @ BE 5e6be85; T6B2 bridge prerequisite.

Contract under test: entitled billing owner configures a fee/enrollment, creates a scoped bill, approved payer submits the selected method/proof, and authorized operator validates/posts/reverses according to a signed finance contract. SC-FIN is optional and cannot be an implicit prerequisite (EV-W10).

Test ID	Cat.	Preconditions / fixtures	Execution and expected result	Trace	Status
RT-W10-POS-01	POS	GT-T1, GT-OVL-SC-FEES, GT-AUTH-SINGLE-*, GT-STU, GT-TXN; fee rule, enrollment, payer, payment config	Authorized chain creates one bill/payment/receipt with approved status and only linked student/parent visibility.	EV-W10; STAB-014; QG-05; T6B-W10-REBIND-20260829T141108Z	PASS — T6B harness
RT-W10-NEG-01	NEG	Billing viewer, unrelated student/parent, maker-as-approver	Viewer/unlinked payer/direct API cannot create/edit/validate/post/reverse another bill; balances and journal unchanged.	STAB-014; AUTH-002/007/010; QG-06; T6B-W10-REBIND-20260829T141108Z	PASS — T6B harness
RT-W10-SCP-01	SCP	Student self, linked/unlinked parent, assigned billing operator	Only self/linked child bills and approved operator scope are visible/actionable; guessed enrollment/payment/proof/receipt denied.	STAB-014; AUTH-006–008; QG-07/11; T6B-W10-REBIND-20260829T141108Z	PASS — T6B harness
RT-W10-TEN-01	TEN	GT-T1/T2 students/enrollments/rules/bank/journal	Detail/list/total/export and save validate every FK company; mixed or T2 targets are denied atomically without amount/existence leak.	STAB-014; AUTH-005/009; QG-07; T6B-W10-REBIND-20260829T141108Z	PASS — STAB-014 closed bounded
RT-W10-VAL-01	VAL	Missing/duplicate/invalid fee, amount, method, proof, stale bill variants	Backend rejects invalid/foreign/stale/replayed input and unsafe file; no partial payment/balance/journal effect; safe field errors.	DEC-008/009; QG-08/11; T6B-W10-REBIND-20260829T141108Z	PASS — T6B harness
RT-W10-STA-01	STA	Approved bill/payment/validate/post/cancel/refund/reverse matrix	Valid transition succeeds for exact actor; invalid/late/self action denied; reversal/refund reason and before/after audit persist.	DEC-004/007; QG-09; T6B-W10-REBIND-20260829T141108Z	PASS bounded — SoD per T6B-FEES #5
RT-W10-IDM-01	IDM	Double gateway callback/proof submit/validate/post/refund	One payment/receipt/journal effect results per approved key; out-of-order/replayed callback cannot corrupt balance.	QG-08/09/11; T6B-W10-REBIND-20260829T141108Z	PASS — T6B harness
RT-W10-REC-01	REC	Failure between proof/gateway, validation, posting, receipt or notification	Approved pending/reconcile/retry/reversal path converges; user sees authoritative status; no double charge/post.	DEC-005/007/010; QG-09; T6B-W10-REBIND-20260829T141108Z	PASS bounded — pending_reconciliation recovery
RT-W10-XRP-01	XRP	Billing operator, student, linked/unlinked parent	Bill/payment/reversal status and receipt appear only to intended payer/child; correction updates balance and notification exactly once.	DEC-010; QG-10/11; T6B-W10-REBIND-20260829T141108Z	PASS — T6B harness
RT-W10-XMD-01	XMD	SC-FEES alone and explicit SC-FIN/SC-ADM bridges	Fees owns bill/payment; accounting/admission bridge runs only when enabled and reconciles one canonical ID/effect; missing bridge does not block base SKU.	STAB-024; QG-10/14; T6B-W10-REBIND-20260829T141108Z	PASS bounded — gateway fail-close; Adm bridge T6B2; Fees→Finance bridge RT-FFBR-* 4/4×2 @ T6G
RT-W10-UIA-01	UIA	Billing roles/student/parent; package off/on; payment failure states	Billing/payment/receipt routes, CTA and direct APIs match package/role/state; proof/privacy, totals, confirmation and errors are safe and responsive.	STAB-014/024/034–039; QG-02/11/12/14; T6-W10-UI-20260829T153500Z	PASS — 01a/01b PASS; 01c PASS with package_off toggle

7.7 W11 — Accounting transaction lifecycle

Contract under test: an entitled finance maker creates a company-scoped draft; separate actors validate/post/reconcile/approve under explicit action capabilities, and authorized reports/audit reflect one immutable financial effect. Current view-capability/elevation and company scope are release-blocking (EV-W11).

Test ID	Cat.	Preconditions / fixtures	Execution and expected result	Trace	Status
RT-W11-POS-01	POS	GT-T1, GT-OVL-SC-FIN, GT-AUTH-SINGLE-* + GT-AUTH-MULTI-CONFLICT, GT-TXN; chart, journal, period, distinct maker/approver	Authorized actors create/validate/post/reconcile/approve according to signed matrix; ledger/report contains one balanced effect and audit chain.	EV-W11; STAB-003; QG-05	PASS bounded — manual journal create→post @ T6G-W11 run1
RT-W11-NEG-01	NEG	Finance viewer, unrelated role, maker-as-approver	View-only/direct API/self post/reconcile/approve is denied; move/payment/reconciliation/report totals unchanged.	STAB-003; AUTH-002/010; QG-06	PASS bounded — viewer capability deny
RT-W11-SCP-01	SCP	Assigned/unassigned journal/cost center/approver	Actor sees and acts only approved domain ownership; guessed transaction/attachment/export outside scope is denied.	AUTH-006/008/010; QG-07/11	PASS bounded — foreign journal scope
RT-W11-TEN-01	TEN	GT-T1/T2 charts/journals/accounts/taxes/partners	Every list/detail/export/action validates company and all FKs before elevation; mixed/T2 values fail atomically without financial leak.	STAB-003; AUTH-005/009; QG-07	PASS bounded — foreign move denied
RT-W11-VAL-01	VAL	Unbalanced/missing/closed-period/duplicate/stale/foreign variants	Backend authoritative financial/model rules reject invalid transaction before posting; no partial ledger/reconciliation/audit effect.	STAB-003; QG-08	PASS bounded — unbalanced + state bypass
RT-W11-STA-01	STA	Approved draft/validate/post/reconcile/approve/reverse matrix	Only exact role/state transition works; invalid/self/backward action denied; posted corrections use approved reversal, never silent edit.	STAB-003; DEC-004/007; QG-09	PASS bounded — posted immutability
RT-W11-IDM-01	IDM	Double/concurrent post/reconcile/approve/reverse	Exactly one ledger/reconciliation/reversal effect and audit result; duplicate token or retry is stable.	STAB-003; QG-08/09	PASS bounded — double post stable
RT-W11-REC-01	REC	Fault during post, reconcile, approval, report or downstream bridge	Approved reversal/compensation/resume reconciles ledger and audit; unsafe mutation fails closed if mandatory audit unavailable.	DEC-005/007; AUTH-011; QG-09/11	PASS bounded — failed create no posted leak
RT-W11-XRP-01	XRP	Maker/reviewer/approver/auditor/read leadership	State/reversal/report change appears to approved consumers only; viewer cannot access raw sensitive support data; audit identifies acting role.	DEC-009; QG-10/11	PASS bounded — no foreign leak in list
RT-W11-XMD-01	XMD	SC-FIN; explicit fees/inventory/BOS bridge variants	Each upstream document generates at most one canonical financial effect; disabled peer SKU cannot invoke or expose accounting path.	STAB-024; QG-10/14	PASS bounded — SC-FEES accounting via bridge when dual entitled (RT-FFBR-*); SC-FIN canonical
RT-W11-UIA-01	UIA	Finance roles; package off/on; destructive state variants	Accounting menus/routes/action buttons and API capability match action/state/package; post/reconcile/reverse confirmations name consequence/recovery.	STAB-003/024/034–039; QG-02/12/14	PASS bounded — package gate + route registry

7.7.1 T6G Fees→Finance bridge (RT-FFBR-*)

Contract: T6G-FEES-FIN-bridge-contract.md. Harness fees_finance_bridge_certify.py, port 8103, DB scola_t6g_ff_bridge_*.

Test ID	Cat.	Preconditions	Expected	Status
RT-FFBR-XMD-01	XMD	Bridge installed; SC-FEES only	accounting_excluded	PASS — T6G-FF-BRIDGE-20260831T062240Z
RT-FFBR-POS-01	POS	SC-FEES + SC-FIN	bulk-create posts one student invoice	PASS — same evidence
RT-FFBR-DET-01	POS	Posted invoice from POS-01	detail returns posted move	PASS — same evidence
RT-FFBR-XMD-02	XMD	SC-FIN only	feature_disabled (scola_fees)	PASS — T6G-FF-BRIDGE-20260831T062410Z (run 2)

7.8 W13 — Stock opname

Contract under test: entitled inventory officer opens an approved count scope, captures expected stock, records physical counts, reviews variance and an approved actor validates/posts adjustment with recoverable audit. Freeze timing, posting authority and recovery remain business decisions (EV-W13).

Summary §3: PASS bounded — T6G-W13-result.md; harness @ BE tip; evidence T6G-W13-evidence/T6G-W13-20260831T133801Z + …T133949Z.

Test ID	Cat.	Preconditions / fixtures	Execution and expected result	Trace	Status
RT-W13-POS-01	POS	GT-T1, GT-OVL-SC-OPS, GT-AUTH-SINGLE-* + GT-AUTH-MULTI-CONFLICT, GT-TXN; warehouse/location/products/current stock	Authorized officer counts and approved reviewer posts according to signed policy; one reconciled adjustment/audit effect results.	EV-W13; QG-05	PASS bounded — harness 2026-08-31
RT-W13-NEG-01	NEG	Viewer, unrelated officer, maker-as-poster	View-only/direct API/self-post attempts are denied; count/snapshot/stock/ledger remain unchanged.	AUTH-002/010; QG-06	PASS bounded — harness 2026-08-31
RT-W13-SCP-01	SCP	Assigned/unassigned warehouse/location/officer	Actor lists/counts/posts only approved location scope; guessed session/product/variance detail outside ownership denied.	AUTH-006/008; QG-07	PASS bounded — harness 2026-08-31
RT-W13-TEN-01	TEN	GT-T1/T2 warehouses/locations/products/opname	Snapshot/list/export/action and mixed product/location/session IDs are company-scoped and atomic; no T2 quantity leak.	AUTH-005/009; QG-07	PASS bounded — harness 2026-08-31
RT-W13-VAL-01	VAL	Missing/duplicate/negative-or-invalid/stale count and foreign product variants	Backend enforces approved count constraints and stale-snapshot policy, rejects invalid/foreign input without partial stock change.	DEC-008; QG-08	PASS bounded — harness 2026-08-31
RT-W13-STA-01	STA	Approved open/snapshot/count/review/validate/post/cancel matrix	Only valid role/state transition works; freeze/late edit/reopen/cancel rules and before/after audit are enforced.	DEC-004/007; QG-09	PASS bounded — harness 2026-08-31
RT-W13-IDM-01	IDM	Concurrent counts and double validate/post	Concurrent edit follows approved conflict policy; repeated post creates one stock adjustment and one audit effect.	QG-08/09	PASS bounded — harness 2026-08-31
RT-W13-REC-01	REC	Failure during snapshot, count import or stock adjustment	Approved resume/recount/reversal/compensation restores snapshot-to-stock reconciliation; no orphan move/session lock.	DEC-005/007; QG-09	PASS bounded — harness 2026-08-31
RT-W13-XRP-01	XRP	Counter/reviewer/inventory reader/approved leadership	Count/review/post/correction status and variance are visible to approved actors only; non-owner cannot infer stock.	QG-10/11	PASS bounded — harness 2026-08-31
RT-W13-XMD-01	XMD	SC-OPS; optional SC-FIN valuation and SC-BOS procurement variants	Adjustment updates canonical inventory once; valuation/procurement bridge runs only when declared; missing peer SKU does not block base count.	STAB-024; QG-10/14	PASS bounded — harness 2026-08-31
RT-W13-UIA-01	UIA	Inventory roles; package off/on; mobile scanner/table variants	Opname routes/filter/table/count/review/post CTA and API gates match role/state/package; conflict/empty/error/confirm states are safe.	STAB-024/034–039; QG-02/12/14	PASS bounded — harness 2026-08-31

7.9 W14 — Library circulation

Contract under test: entitled librarian manages catalog/copy and approved reservation/queue, checks out/renews/returns one copy, then resolves fine/lost/ damaged state under an approved finance/waiver policy. Current queue concurrency, settings authority and auto-post fine behavior prevent full certification (EV-W14).

Test ID	Cat.	Preconditions / fixtures	Execution and expected result	Trace	Status
RT-W14-POS-01	POS	GT-T1, GT-OVL-SC-LIB, GT-AUTH-SINGLE-*, GT-TXN; active member, catalog/copy/policy	Librarian completes approved reservation/checkout/renew/return path; copy/member/loan state and declared fine effect reconcile once.	EV-W14; STAB-031; QG-05	PASS bounded — harness 2026-08-31
RT-W14-NEG-01	NEG	Member/viewer/unrelated operator; settings mutation API	Member/viewer cannot manage copy/policy/settings or another loan; direct mutation denied and circulation state unchanged.	STAB-032; AUTH-002; QG-06	PASS bounded — harness 2026-08-31
RT-W14-SCP-01	SCP	Self/peer member; assigned/unassigned library/unit	Member sees own approved history/reservation/fine only; librarian acts within approved unit/company; guessed peer loan/download denied.	AUTH-006–008; QG-07/11	PASS bounded — harness 2026-08-31
RT-W14-TEN-01	TEN	GT-T1/T2 copies/members/policies/queues	Search/count/queue/loan/fine/settings and mixed IDs remain company-scoped; no T2 availability/member/fine leak.	AUTH-005/009; QG-07	PASS bounded — harness 2026-08-31
RT-W14-VAL-01	VAL	Inactive member, unavailable copy, invalid date/policy, stale/duplicate return	Backend rejects invalid/foreign/stale transitions before changing copy/loan/fine; exact limits follow approved library policy.	QG-08	PASS bounded — harness 2026-08-31
RT-W14-STA-01	STA	Approved available/reserved/on-loan/returned/lost/damaged/fine/waived states	Only valid actor/state transition works; lost/damaged/waiver/payment and correction preserve audit and copy reconciliation.	DEC-004/007; QG-09	PASS bounded — harness 2026-08-31
RT-W14-IDM-01	IDM	Parallel queue assignment, double checkout/return/fine posting	One borrower wins deterministically; one loan/return/fine effect results; duplicate/concurrent request has safe conflict/recovery.	STAB-031; QG-08/09	PASS bounded — harness 2026-08-31 (sequential double-assign)
RT-W14-REC-01	REC	Failure during queue assignment, return, fine invoice/post or copy update	Approved retry/reconcile/waive/reverse path restores copy-loan-fine consistency and identifies owner.	STAB-031; DEC-005/007; QG-09	PASS bounded — harness 2026-08-31
RT-W14-XRP-01	XRP	Librarian/member/linked parent or approved reader	Reservation/checkout/due/return/fine/correction appears to intended reader only and notification is deduped; peer history hidden.	DEC-009/010; QG-10/11	PASS bounded — harness 2026-08-31
RT-W14-XMD-01	XMD	SC-LIB alone and explicit finance integration variant	Fine remains in approved library owner; invoice/payment bridge occurs only if explicitly sold/approved, with one canonical reference/effect.	QG-10/14	PASS bounded — harness 2026-08-31
RT-W14-UIA-01	UIA	Librarian/member; package off/on; settings viewer/manager	Catalog/queue/circulation/settings/self-service menus/routes/CTA and API gates align; duplicates consolidate; consequence/error states safe.	STAB-024/031/032/034–039/041; QG-02/12/14	PASS bounded — harness 2026-08-31

7.10 W15 — Counseling and student affairs

Contract under test: an approved reporter creates an incident/permit/ achievement/counseling record; assigned case actors review/respond/refer/approve/ close under purpose-limited sensitive projection; only declared points/attendance/ notification effects occur. Current view/mutation collapse and sensitive case scope are S0/S1 blockers (EV-W15).

Test ID	Cat.	Preconditions / fixtures	Execution and expected result	Trace	Status
RT-W15-POS-01	POS	GT-T1, GT-OVL-SC-STUDENT, GT-AUTH-SINGLE-*, GT-STU, GT-TXN; approved category/rule/handler	Authorized reporter and assigned handler complete one approved case path; state/audit and only declared downstream effect are created.	EV-W15; STAB-002/011; QG-05	PASS — counseling report create→close; evidence T6F-evidence/T6F-STUDENT-20260831T090000Z-run1.json
RT-W15-NEG-01	NEG	View-only student-affairs, unassigned counselor/teacher, student/parent	View-only/direct API cannot create/respond/refer/approve/close/export outside capability; case/points/attendance unchanged.	STAB-002/011; AUTH-002/010; QG-06	PASS — teacher viewer save capability_denied; same evidence
RT-W15-SCP-01	SCP	Assigned/unassigned counselor/class/case; self/peer/linked/unlinked child	Case/class/assignment/self/parent-child record rules constrain list/detail/response/download/export; guessed sensitive case returns no leak.	STAB-002/011; AUTH-006–009; QG-07/11	PASS — foreign report save not_found; same evidence
RT-W15-TEN-01	TEN	GT-T1/T2 students/cases/categories/handlers/attachments	Cross-company list/count/search/export/action and mixed FKs are denied; model elevation/ACL/record rule preserves tenant isolation.	STAB-002/011; AUTH-005/009; QG-07/11	PASS — tenant isolation on foreign report; same evidence
RT-W15-VAL-01	VAL	Missing/invalid category/handler, stale case, unsafe domain-specific GT-TXN file variants	Backend rejects invalid/foreign/unsafe data atomically; list projection never returns raw proof/sensitive fields beyond approved purpose.	DEC-008/009; QG-08/11	PASS — missing student_id rejected; same evidence
RT-W15-STA-01	STA	Approved report/review/respond/refer/approve/reject/close/reopen matrix	Only approved actor/state transition works; self-approval/delegation/closed edit denied; reason/before-after/audit persist.	STAB-002/011; DEC-004/007; QG-09	PASS — invalid close from draft invalid_state; same evidence
RT-W15-IDM-01	IDM	Double report/respond/refer/approve and concurrent handlers	One case/action/points/attendance/notification effect results per approved key; concurrent ownership conflict is explicit.	QG-08/09	PASS — duplicate start_progress denied; same evidence
RT-W15-REC-01	REC	Failure during attachment, referral, approval, points/attendance or notification	Approved resume/reassign/reopen/reverse path restores case/downstream consistency; break-glass, if approved, expires and is audited.	DEC-005/006/009; QG-09/11	PASS — detail resume stable; same evidence
RT-W15-XRP-01	XRP	Reporter/handler/approver/student/linked and unlinked parent	Approved status/response/downstream correction reaches only intended actors with minimal fields; revoked assignment/link removes access.	STAB-002; DEC-009/010; QG-10/11	PASS — counselor list scoped; same evidence
RT-W15-XMD-01	XMD	SC-STUDENT and declared attendance/notification effect variants	Points/attendance/notification changes occur only for approved record type/state and exactly once; disabled peer workflow is not invoked.	STAB-011/024; QG-10/14	PASS — no achievement/attendance side effect; same evidence
RT-W15-UIA-01	UIA	Counselor/student-affairs/teacher/student/parent; package off/on	Menu/routes/tabs/field redaction/actions/export/download and API authority match case purpose/role/state/package; sensitive error/empty states differ safely.	STAB-002/011/024/034–039; QG-02/11/12/14	PASS — route registry feature_flag=scola_student_services; same evidence

7.11 W20 — RFID attendance ingestion

Contract under test: entitled operator provisions authorized device/card, a signed event is ingested, validated/deduplicated and creates or reuses exactly one canonical attendance effect; failed events follow a monitored retry/dead-letter path. W20 remains separate from manual W05 (EV-W20).

Test ID	Cat.	Preconditions / fixtures	Execution and expected result	Trace	Status
RT-W20-POS-01	POS	GT-T1, GT-OVL-SC-ATTEND+, GT-AUTH-SINGLE-*, GT-TXN; active device/card/subject; signed fixed-time event	Valid event is accepted once, mapped to correct subject/company and produces/reuses exactly one attendance record plus audit.	EV-W20; STAB-030; QG-05	PASS — harness slice 1+2; evidence T6I-evidence/T6I-W20-20260831T102232Z-runtime-matrix.json
RT-W20-NEG-01	NEG	Viewer, unauthorized device/operator, invalid signature	Viewer cannot configure/retry; unauthenticated/invalid-device/signature event is denied and creates no event/attendance effect.	STAB-030; AUTH-002; QG-06/11	PASS — same evidence
RT-W20-SCP-01	SCP	Assigned/unassigned device/operator/card/subject	Device/operator may act only approved assignment; guessed event/card/device/attendance detail or retry outside ownership is denied.	AUTH-006/008; QG-07	PASS — foreign retry/regen scoped; evidence T6I-evidence/T6I-W20-20260831T104024Z-runtime-matrix.json
RT-W20-TEN-01	TEN	GT-T1/T2 colliding card/device/event IDs	Company derives server-side from authorized device/card; cross-company/mixed event never matches or leaks and produces no T2 effect.	STAB-030; AUTH-005/009; QG-07/11	PASS — cross-card UNKNOWN_CARD; same evidence
RT-W20-VAL-01	VAL	Unknown/inactive/revoked card/device, bad time/signature, replay, malformed payload	Backend rejects invalid/stale/foreign payload; error record contains no secret/PII; zero partial attendance effect.	EV-W20; QG-08/11	PASS — missing signature case; same evidence
RT-W20-STA-01	STA	Approved received/validated/processed/failed/retry/dead-letter matrix	Only valid actor/state action works; processed failure is not silently final; retry/dead-letter ownership and audit are explicit.	STAB-030; DEC-004/007/010; QG-09	PASS — bounded retry state matrix; same evidence
RT-W20-IDM-01	IDM	Same event ID/signature/time; double/concurrent ingest/retry	Duplicate/concurrent delivery creates one event and one attendance effect; repeat response is deterministic; retry cannot duplicate.	STAB-030; QG-08/09	PASS — duplicate ingest deterministic; same evidence
RT-W20-REC-01	REC	Processor/attendance/outbox failure and dead-letter fixture	Supported retry resumes failed event exactly once; non-retryable failure is visible to named owner; reconciliation proves no lost/duplicate effect.	STAB-030; DEC-005/010; QG-09	PASS — bounded failed-event retry; same evidence
RT-W20-XRP-01	XRP	Device/operator/attendance monitor and approved self/parent reader	Successful/corrected ingestion reaches only declared attendance consumers; failed/retried event does not expose false attendance or duplicate notification.	DEC-010; QG-10/11	PASS — parent/student denied; manager propagation; same evidence
RT-W20-XMD-01	XMD	SC-ATTEND+ smart ingestion; W05 manual path independent	Processor writes canonical attendance through declared integration, never a parallel shadow line; smart package off prevents device route/event ingestion.	STAB-024/030/040; QG-10/14	PASS — entitlement OFF deny; same evidence
RT-W20-UIA-01	UIA	Device operator/viewer; package off/on; failure queue	Device/card/config/event/error/retry menus/routes/CTA and API capability align; secret fields redacted and retry consequence/status understandable.	STAB-024/030/034–040; QG-02/11/12/14	PASS — secret redaction + route meta + package-off deny; same evidence

8. Out-of-scope decision and containment gates

Rows berikut bukan workflow certification tests dan tidak masuk denominator 198 RT-W* cases. Mereka memastikan undecided/incomplete surface tidak dinormalisasi menjadi produk. A PASS containment result means “surface safely absent”, not “workflow supported”. This follows the exclusion rule in docs/release-readiness/01-product-contract.md:264-273 and QG-01/QG-02 (docs/release-readiness/09-release-quality-gate.md:132-133).

Gate ID	Surface	Required decision / containment assertion	Evidence	Status
DG-W08-01	W08 promotion/retention	Product, Academic owner and Security approve actor/state/approval/reversal before any workflow test design becomes executable. Until then the leaf is classified Incomplete / Remove from Product Surface.	EV-W08; STAB-009; DEC-004/006/007	BLOCKED — product/process decision and broken guard
CT-W08-UIA-01	W08 UI/direct route/API	Normal roles see no promotion menu/search/CTA; direct route/API is unavailable or fails closed; no business mutation. This test never certifies promotion.	EV-W08; STAB-009; QG-02	NOT RUN
DG-W17-01	W17 complaint	Product/Security/DPO decide package owner, public/internal audience, operator, consent, anti-abuse, attachment and retention. The decision is not a defect closure.	EV-W17; STAB-001; DEC-001/003/004/006/009	BLOCKED — Requires Product Decision
CT-W17-SEC-01	W17 public/internal surface	Until DG-W17-01 and STAB-001 close, internal operator routes/APIs are absent/denied; public intake is disabled or explicitly contained by an approved security owner. No unsafe route is taught or counted supported.	EV-W17; STAB-001; QG-02/06/11	BLOCKED — containment disposition requires DEC-001
DG-W18-01	W18 messaging/notification	Product/Security/DPO/Operations decide owner, membership/company boundaries, attachment, recipients/channels, quiet hours, retry/dedupe and authoritative delivery record.	EV-W18; STAB-006; DEC-001/003/009/010	BLOCKED — Requires Product Decision
CT-W18-SEC-01	W18 UI/direct route/API	Until approved, no normal role receives a product promise; any retained portal primitive must deny non-member/mixed-channel/foreign attachment and remain outside release denominator.	EV-W18; STAB-006; QG-02/06/07/11	BLOCKED — STAB-006/DEC-001

If Product later approves W17 or W18, add a versioned workflow contract in 01 and 05, allocate all eleven RT-W17-* or RT-W18-* categories, provide a package profile/owner, and rebaseline the denominator. Re-labeling a CT-* case is not sufficient.

9. BE e749832 security-refactor regression set

BE HEAD 2ff6ac7cb41810bbc3b66821cdad004b52d1658a includes e749832, which moved several module-owned .sudo() operations from controller code to model helpers or native ACL/record-rule paths. This reduces structural controller elevation but does not prove runtime authorization. These cases are build-wide QG-03/QG-07/QG-11 regressions. They do not promote visitor, pickup, transport, privacy-console, or other undecided surfaces into supported product scope.

Test ID	Boundary	Preconditions / execution	Expected result	Evidence / mapping	Status
RT-SEC-ELEV-01	Controller → owned-model elevation	Enumerate every controller/model boundary changed by e749832; run GT-AUTH-SINGLE-*, GT-AUTH-VIEW and GT-AUTH-UNRELATED direct API cases with GT-T1/U2/T2 records and before/after assertions.	Capability and company/record scope are checked before any model elevation; denied actor gets no data/existence/mutation; authorized actor still completes intended operation.	EV-SEC-DELTA; AUTH-004/005/009/011; QG-03/07/11	NOT RUN
RT-SEC-IMPORT-01	W02 import-job poll	Create separate GT-T1/GT-T2 jobs with same-looking logical inputs; poll as requester, different non-admin, same-tenant approved admin, GT-T2 actor and active-company-switched actor.	Only approved requester/admin within allowed company receives minimal public_result; all other calls are indistinguishable denial; duplicate company key remains one job.	../custom_addons_scola/gcgscola/scola_core/models/student_import_job.py:55-105; ../custom_addons_scola/gcgscola/scola_core/controllers/admin_import_api.py:210-253; GT-GAP-12 docs/release-readiness/06-golden-tenant-spec.md:364; STAB-023	NOT RUN
RT-SEC-COUNSEL-01	W15 counseling portal ACL/rules	Parameterize own student, linked/unlinked parent, assigned/unassigned/peer teacher, sensitive/non-sensitive report/response, U2 and GT-T2 across list/detail/create/update/download.	Native ACL and record rules preserve exact purpose/relationship scope after controller sudo removal; sensitive/cross-scope cases deny without existence leak; allowed case retains functionality.	../custom_addons_scola/gcgscola/scola_counseling/controllers/counseling_portal_api.py:26-55; ../custom_addons_scola/gcgscola/scola_counseling/security/referral_rules.xml:70-180; STAB-002; AUTH-005–009	PASS — unauthenticated portal list denied; evidence T6F-evidence/T6F-STUDENT-FULL-20260831T093000Z-run1.json
RT-SEC-PRIV-01	PII/sensitive audit and consent	Use approved DPO/auditor and viewer/unrelated roles across GT-T1/U2/T2; list/count/search/filter/get/save/grant/revoke with guessed IDs and secret/PII log inspection.	Only exact capability sees approved company-scoped minimal projection; model helper elevation cannot widen controller domain; viewer/direct API mutations deny; access and mutation audits remain attributable.	../custom_addons_scola/gcgscola/scola_core/controllers/privacy_api.py:101-200,203-369; ../custom_addons_scola/gcgscola/scola_core/models/pii_access_log.py:21-40; ../custom_addons_scola/gcgscola/scola_core/models/sensitive_audit_log.py:31-50; AUTH-008/009/011	BLOCKED — DPO role/purpose/retention decision
RT-SEC-VISITOR-01	Visitor ACL/company scope	Approved security officer/admin versus viewer/unrelated role; GT-T1/U2/T2 list/create/check-in/check-out/guessed ID; compare direct API and model ACL behavior.	Native ACL plus company domain allows only approved manage actor and scoped records; no T2/U2 leak or mutation; denied request does not reveal visitor PII.	../custom_addons_scola/gcgscola/scola_core/controllers/security_visitor_api.py:25-89; AUTH-002/005/008/009; QG-07/11	BLOCKED — visitor product/role ownership decision
RT-SEC-ATT-ACL-01	Pickup/transport ACL parity	If Product keeps the surface, test every newly granted business group against controller capability, record rule, driver assignment, GT-T1/U2/T2 and action-level mutation. If removed, run containment/deep-link denial instead.	No ACL grant alone creates unintended menu/API authority; principal/VP/read roles cannot mutate unless explicitly approved; driver only acts own active assignment.	../custom_addons_scola/gcgscola/scola_attendance/controllers/attendance_api_mixin.py:1407-1600; ../custom_addons_scola/gcgscola/scola_attendance/security/ir.model.access.csv:20-42; AUTH-002/005/006/012; DEC-001/003	BLOCKED — product surface/role decision; explicitly outside W05

10. Package-suite and execution contract

10.1 Dependency-aware suite manifest

Suite	Workflow denominator	Required predecessor	Package/tenant profile	Additional off/on assertion
CORE-PLATFORM	W00 (11)	Golden seed/reset	GT-PKG-CORE; optional/pilot off	zero unsupported/optional/placeholder surface
CORE-W01	W01 (11)	W00	GT-PKG-CORE, GT-TXN-W01-ACADEMIC	downstream session exists without optional SKU
CORE-W02	W02 (11)	W00 + W01	GT-PKG-CORE, manual/import overlays separated	import remains separately blocked until STAB-023 closes
CORE-W16	W16 (12)	W00; may run parallel to W01/W02	GT-PKG-CORE, GT-TXN-W16-NEWS	legacy write/menu absent; one canonical source; optional summary VAL-02
CORE-W05-PER-LESSON	W05 per-lesson (11)	W00 + W01 + W02	GT-PKG-CORE, GT-TXN-W05-*; overlay gt-w05-1.0	smart/employee modes excluded; pickup/daily in CORE-W05-DAILY
CORE-W05-DAILY	W05-B daily manual (4 base + actor variants)	W00 + W02; company daily gate on	GT-PKG-CORE, GT-TXN-W05-DAILY-*	student RFID/face/geofence off; §6.1b rows in V1 denominator
PILOT-ATT-W05	(deprecated alias — use CORE-W05-PER-LESSON)	same as above	same	retained for historical evidence pointers only
PILOT-BOS-W12	W12 (11)	certified SC-FIN + SC-OPS	SC-BOS allowlisted overlay	non-pilot company/role and missing dependency denied
PILOT-DAP-W19	W19 (11)	W00 + signed W01/W02 source ownership	SC-DAP allowlisted overlay	non-pilot tenant/role and connector off denied
PKG-ADM-W03	W03 (11)	passing Core; approved lifecycle	one SC-ADM overlay	SC-ADM off in core; CBT/fees bridge each separate
PKG-ASSESS-W04	W04 (11)	passing Core; W01/W02 or explicit SC-ADM input	one SC-ASSESS overlay	independent CBT plus separately entitled admissions bridge
PKG-LEARN-W21	W21 (11)	passing Core; W01/W02 teaching assignment + enrollment	GT-OVL-SC-LEARN; SC-REPORT entitlement/UI/API off	independent LMS; TP/CP via optional scola_lms_report_card only
PKG-ATTEND-W06	W06 (11)	passing Core + employee/shift owner	one SC-ATTEND+ overlay	no W05/RFID/biometric leaf unless separately approved
PKG-REPORT-W07	W07 P1 parameter set (11) plus RT-PKG-GAP-11	passing W01/W02 plus approved standalone grade source	GT-OVL-SC-REPORT; SC-LEARN absent/off	no SC-REPORT certificate until all P1 parameters pass
BRIDGE-LEARN-REPORT-W07	W07 P2 parameter set (11); not an independent package certificate	certified SC-REPORT plus certified SC-LEARN	GT-OVL-BRIDGE-LEARN-REPORT	both off/on boundaries and source propagation; cannot replace either standalone result
PKG-PEOPLE-W09	W09 (11)	passing Core	one SC-PEOPLE overlay	attendance/accounting integrations independently gated
PKG-FEES-W10	W10 (11)	passing W02	one SC-FEES overlay	SC-FIN/SC-ADM bridges independently gated
PKG-FIN-W11	W11 (11)	passing Core	one SC-FIN overlay	no SC-FEES/SC-OPS/BOS leakage
PKG-OPS-W13	W13 (11)	passing Core	one SC-OPS overlay	valuation/BOS bridge independently gated
PKG-LIB-W14	W14 (11)	passing identity prerequisite	one SC-LIB overlay	finance integration not implied
PKG-STUDENT-W15	W15 (11)	passing W01/W02 + privacy contract	one SC-STUDENT overlay	sensitive portals/routes absent when off
PKG-ATTEND-W20	W20 (11)	passing W01/W02 and approved attendance semantics	one SC-ATTEND+ smart overlay	device endpoints absent when off; W05 separate
PKG-FOUND-GAP	No approved workflow denominator; RT-PKG-GAP-08	passing Core + certified SC-FIN + approved Foundation outcome/role/company scope	GT-OVL-SC-FOUND with exact SC-FIN prerequisite	no package certificate until a W-ID + full matrix exists or package is reclassified

There are 198 mandatory workflow-category IDs (18 workflows × 11 categories). W07's eleven IDs each require both P1 and P2 when the bridge is retained, so the minimum becomes 209 workflow-category executions before any other role/scope/tenant/state parameter expansion. Security regression and containment IDs are additional gates, not substitutes. This suite separation fixes the intended contract of STAB-028; the current test:e2e:smoke:core command is not accepted as the manifest because it includes SPMB (package.json:36-39). The 198 IDs cover the named journeys only; they do not certify a wider package while any control below remains BLOCKED.

10.2 Package-surface denominator controls

These controls operationalize 05 §8.1. They are readiness controls, not workflow-category substitutes and not bug severity. Product must choose to narrow the package surface or add named workflow and 11-category cases; QA cannot infer the choice from menus.

Control ID	Package/surface gap	Required closure/evidence	Status
RT-PKG-GAP-01	All proposed packages lack an approved canonical-leaf → W-ID/subflow → test manifest	Signed package denominator; every retained leaf maps to positive/negative/scope/tenant/validation/state/retry/recovery/propagation/integration/UI cases	BLOCKED — E2E-GAP-01, DEC-001, CTRL-005
RT-PKG-GAP-02	SC-CORE calendar/configuration/user-admin/portal-read breadth	Add bounded Core journeys/parameters or narrow 01; pass with optional packages off	BLOCKED — E2E-GAP-02
RT-PKG-GAP-03	SC-LEARN standalone course/content/assignment/submission	W21 / PKG-LEARN-W21 full matrix + topology independent (scola_lms_report_card)	PASS — T6E 11/11 ×2 2026-08-30; T6E-result.md
RT-PKG-GAP-04	SC-LIB non-circulation collection/textbook/GLS/config/reporting	Add bounded subflows/full parameters or remove them from certified SKU	BLOCKED — E2E-GAP-04
RT-PKG-GAP-05	SC-OPS non-stock master/procurement/assets/reporting	Add owned journeys/full matrices or narrow the package	BLOCKED — E2E-GAP-05
RT-PKG-GAP-06	SC-PEOPLE HR master/contract/leave/self-service beyond payroll	Add HR lifecycle journeys/privacy matrices or narrow the package	BLOCKED — E2E-GAP-06
RT-PKG-GAP-07	SC-ATTEND+ face/geofence/device/card/config modes beyond W06/W20	Decide supported modes/privacy basis and add a full matrix for each retained mode	BLOCKED — E2E-GAP-07
RT-PKG-GAP-08	SC-FOUND has no product W-ID or matrix	Define outcome/W-ID/full matrix, or reclassify/remove Optional Supported status	BLOCKED — E2E-GAP-08
RT-PKG-GAP-09	SC-STUDENT extracurricular/discipline/permit breadth beyond explicit W15 cases	Full PKG-STUDENT harness: achievement, extracurricular, permit, incident + portal deny	PASS — 8 GAP cases in T6F-STUDENT-FULL-* evidence; T6F-STUDENT-full-product-contract.md
RT-PKG-GAP-10	SC-BOS budget/RKAS/ledger/reporting beyond W12 procurement	Add controlled-pilot subflow matrices or narrow pilot scope	BLOCKED — E2E-GAP-10
RT-PKG-GAP-11	SC-REPORT standalone grade-source/finalization path; current W07 evidence is combined with SC-LEARN	Run W07 in an SC-REPORT-only profile with SC-LEARN off, or change the package dependency contract; a combined suite certifies only the bridge	BLOCKED — E2E-GAP-11
RT-PKG-GAP-12	W00 credential lifecycle and exception recovery is not a bounded supported subflow	Approve DEC-014; remove/hide excluded routes; add activation/forced-password/reset/unlock/expiry/session-revocation/break-glass validation, recovery, authorization, audit, retry and UI parameters	BLOCKED — E2E-GAP-12, CTRL-006
RT-PKG-TOPOLOGY-01	Current bundle/manifests do not match proposed independent package boundaries	For every bundle, fresh-install and record the full dependency/auto-install closure; remove/split undeclared peer-SKU dependencies or approve the composite; prove installed-but-unentitled peer menus/routes/capabilities/APIs/data remain denied	BLOCKED — STAB-024/028, DEC-001; affected closure in 01 §8
RT-PROFILE-JENJANG-01	Certified jenjang set and early/non-early menu/workflow branches	For every DEC-013-retained profile, parameterize W00 navigation and affected workflow/UI tests. Empty, missing, malformed, unknown, unsupported, expired/unassigned, and other-company codes must fail closed at menu, direct route, and backend; no value may fall through to non-early by negation alone	PASS bounded PROF-4 (2026-08-29; W00 crawl 4/4 + W01/W05 FC T6-PROFILE-PROF4-20260829T044506Z) — T4-DEC-013-signed-profile-matrix.md
RT-PROFILE-TIMEZONE-01	Certified school timezone set and local-day behavior	Run named fixed-clock WIB/WITA/WIT profiles retained by DEC-013 across W01/W05/W06/W20 and other date-sensitive routes; no timezone may inherit another zone's result	PASS bounded PROF-4 (STAB-022 BE 6/6 + W01/W05 FC 8/8 + Playwright W05 UI 12/12 + W01 homeroom UI 12/12) — W06 NOT RUN; W20 BLOCKED; T6-PROFILE-evidence/

No package receives QG-14/QG-16 certification while RT-PKG-TOPOLOGY-01, RT-PKG-GAP-01, its package-specific control, or an applicable profile control is blocked, even if all currently enumerated W rows pass.

10.3 Per-case evidence record

Every parameter result must serialize at least:

Field	Required content
Identity	test ID, parameter ID, suite, workflow, category, status, UTC start/end, runner/reviewer
Build	FE/BE SHA, served bundle hashes, database/schema snapshot, installed addon versions, entitlement/flag profile, timezone/test clock
Actor/scope	Golden logical actor key, active role/company, assignment/self/child/case key; never credential/secret
Request/UI	canonical route, CTA/action, API method/path, sanitized request ID/correlation/idempotency key
Assertion	expected/actual response; before/after record/effect/audit/outbox counts and authoritative state
Failure	defect ID for FAIL; decision/defect/fixture ID for BLOCKED; first attempt plus retry evidence
Cleanup	restore/reset manifest and proof the next run begins from the expected pristine/overlay checksum

Required cases run with E2E_AUTH_STRICT=true; a required skip fails the suite. Current setup explicitly permits skipping only when strict is false (tests/e2e/setup-auth.spec.ts:12-25), while release evidence rules prohibit counting a skip (docs/release-readiness/09-release-quality-gate.md:89-103).

10.4 Execution order and stop rules

1. Capture the exact release manifest and prove Golden seed/reset three times; otherwise all runtime results remain ineligible under QG-04.
2. Run build-wide security regression and W00. Stop on any auth, tenant isolation, route-registry, package-leak or audit-attribution failure.
3. Run W01, then W02. W16 may run after W00 in parallel because code does not prove a W01/W02 dependency; the normalized graph confirms this at docs/release-readiness/05-e2e-workflow-catalog.md:55-81.
4. Enable W05 only after its pilot decisions/defects close. Pilot failure cannot be relabeled a Core accepted limitation.
5. Run each approved optional/pilot suite from Core pristine with exactly its declared overlay; never reuse mutated state from another package suite.
6. Re-run affected predecessors/consumers after the last code, schema, module, role, route, state or package change; record the final manifest once.

11. Coverage gap against current automated tests

Existing files are reusable implementation candidates, not pass evidence. Static presence does not prove Golden fixtures, negative paths, isolation, failure recovery, cross-role propagation, or exact release build.

Area	Current candidate evidence	Gap before this matrix can be satisfied
Auth/bootstrap	tests/e2e/setup-auth.spec.ts:8-65; tests/e2e/helpers/auth.ts:45-110	Only a subset of roles; generic admin naming; required release run must use complete fresh GT-AUTH and no skip.
Core smoke	tests/e2e/smoke/core_baseline_smoke.spec.ts:32-153	Route/body checks mix Core with report card, billing and admissions; no 11-category completion proof.
Core workflow audit	tests/e2e/audit/core_workflow_audit.spec.ts:78-219	Useful live-API assertions, but conditional data branches can avoid the mutation/propagation path and are not a Golden reset certificate.
W01	tests/menu/adminAcademicMasterDataSchedulePhase3IntegrationFlows.spec.js:1; tests/unit/services/academics.phase3IntegrationFlows.spec.js:1	Contract/unit coverage needs real create→session→teacher/downstream, negative/scope/isolation/retry/recovery.
W02	tests/e2e/audit/core_workflow_audit.spec.ts:107-129	Current audit loads lists; it does not prove manual onboarding/import job company/idempotency/recovery.
W03/W04	tests/e2e/critical/spmb_lifecycle_flow.spec.ts:1; tests/e2e/smoke/cbt_smoke.spec.ts:1	Must split packages and add product-approved state, negative/scope/isolation/retry/recovery/propagation matrices.
W05/W20	tests/e2e/critical/teacher_attendance_flow.spec.ts:1; tests/e2e/critical/parent_attendance_flow.spec.ts:1; tests/e2e/critical/attendance_mode_matrix.spec.ts:1	Existing names do not close STAB-017–022/027/029/030 or DEC-006; need exact roster/first-save/state/privacy/isolation/idempotency evidence.
W07	tests/e2e/critical/report_card_workflow.spec.ts:1; tests/e2e/critical/grade_publish_idempotency.spec.ts:1	Requires canonical grade source, approval/lock/correction and student/parent propagation on approved package profile.
W09	tests/e2e/hr/payroll-crud.spec.ts:1	CRUD is not maker-checker, self/privacy, tenant, journal, retry or recovery proof; bounded harness 11/11×2 PASS 2026-08-31.
W13/W14/W15	Menu/unit tests exist under tests/menu/ and tests/unit/services/, including tests/unit/services/library.service.spec.js:1 and tests/unit/services/counselingBook.service.spec.js:1.	No product-complete E2E with second tenant, assignment/child/case scope, concurrency, downstream and recovery.
UI/accessibility	tests/e2e/ui/responsive.spec.ts:1; tests/e2e/ui/accessibility.spec.ts:1; multiple tests/menu/*Composition.spec.js	Must be parameterized over the approved route graph/package/roles and tied to the same build; generic route coverage cannot close IA/UX findings.

12. Gate crosswalk and definition of test-ready

Matrix evidence	Release gate satisfied only when
Product/suite ledger and containment	QG-01/QG-02: signed scope and one canonical reachable surface; incomplete/undecided/legacy absent.
W00 NEG/SCP/TEN/UIA plus security regression	QG-03/QG-06/QG-07/QG-11: action capability, record/tenant scope, elevation and audit all pass.
Golden fixtures and manifests	QG-04/QG-17: three deterministic seeds/resets and reproducible exact build.
Every in-scope workflow’s eleven IDs	QG-05/QG-08/QG-09/QG-10: completion, integrity, state/recovery and propagation all pass.
UIA plus route/package crawl	QG-02/QG-12/QG-14: menu/route/action/API and package off/on are consistent.
Machine results plus mandatory engineering suites	QG-13/QG-15/QG-16: no skipped required test, deployment/schema parity, no open S0/S1/critical decision.

This matrix is test-ready for implementation only when:

1. each supported workflow has approved completion, owner, state, correction and recovery criteria in 05-e2e-workflow-catalog.md;
2. all referenced GT-* fixtures and reset/manifest checks in 06-golden-tenant-spec.md are implemented;
3. W00 action/scope/active-role contract and package manifest are machine-readable;
4. every BLOCKED row has a closed decision/defect or is removed with its product surface; and
5. suite selection contains exact IDs/parameters and emits the evidence schema in §10.3 with no required skip.

It is release-ready only when every required in-scope parameter is PASS on the same exact build, build-wide security tests pass, containment tests pass, all relevant QG-01–QG-18 gates pass, and there is no open S0/S1 or critical business/security decision. At this snapshot those conditions are not met.

13. Self-review

• Unsupported claims: no current test or security refactor is called passing; proposed outcomes depending on business policy remain BLOCKED.
• Complete category coverage: W00 plus 17 supported-candidate workflows each contain exactly one base ID for POS/NEG/SCP/TEN/VAL/STA/IDM/REC/XRP/XMD/UIA; parameter expansion is mandatory for actor/scope variants.
• Product boundaries: W08/W17/W18 use decision/containment gates only; W05 per-lesson and W05-B daily manual are Core V1 in-scope (§6.1 / §6.1b); student RFID/face remain V2 SC-ATTEND+; W12 and W19 remain pilots; W06 and W20 are not folded into W05 manual denominator.
• Security boundaries: active role, action capability, assignment/self/child, tenant/company, attachment/sensitive projection, elevation, SoD, audit and package entitlement all have named tests.
• E2E links: producer/consumer and upstream/downstream assertions exist for every in-scope workflow; W01/W02 are explicit prerequisites where code supports the dependency.
• No disguised decisions: exact state, approval, matching, correction, retention, notification and recovery rules are deferred to named DEC-*; the matrix defines how to verify the selected rule, not which rule Product must pick.