RC1 Demo Authenticated UAT¶
Outcome: DEMO AUTHENTICATED UAT 8/8 PASS
This packet does not claim CORE RC1 CERTIFIED and does not authorize production.
| Item | Value |
|---|---|
| Mode | Server · /home/scola/odoo |
| Date | 2026-08-14 |
| Demo FE | fd3aba832bb8535e75c900b6fdcdc0fbe4c5d7c8 · fe-build-fd3aba832bb8-mssrc0va |
| Demo BE | 3d7a213d2c97bb660316b65ccbd74dbe5541e46d · tree 69bd9993…b2e9 · immutable release |
| DB | scoladev_demo / fad7c305-f131-11f0-9409-bc241149eb4e |
| Isolation | PASS after UAT |
| Production | unchanged (3b7e5780… / 334db599…) |
Disposable UAT principals rc1.uat.admin, rc1.uat.teacher.a, rc1.uat.teacher.b were created, used, then deactivated. Secrets stayed in /tmp/rc1_demo_uat.env (not committed). Teacher B password was restored after the DEC-014 generate probe.
Cases¶
| Case | Result |
|---|---|
| Login admin / teacher A / teacher B | PASS |
| 15 former false-Core leaves not visible as Core (admin, teacher) | PASS |
Teacher cannot admin-reset (capability_denied) |
PASS |
| Admin caller-chosen reset rejected; server temp revealed once; chosen login fails | PASS |
Teacher RPC cannot read foreign op.session ids 167/175/183 |
PASS |
Limits (honest)¶
- Demo has no internal
school_admin/homeroomusers. Student/parent exist only as portal share users without known UAT secrets, so those three Golden roles were not re-logged on demo. - Golden already proved five-role fail-close and W01/W02/W05 isolation. Demo proves the served candidate pair enforces DEC-014 and teacher foreign-session deny.
- RC1F-006 remains open for production. Per the independent auditor: production needs a separate promotion audit with backup, canary, stop-on-first-failure, and served-identity checks.
Evidence¶
docs/release-readiness/audit/RC1-demo-uat/RC1-demo-authenticated-uat.json