T0-E1.1 independent findings

Finding	Original severity	Independent code review	Independent runtime proof	Evidence integrity	Verdict	Residual
T0F-001	S0	Main capability computation now uses active session role, and company scope helper is improved. However source still contains role/group fallbacks outside the canonical authority path; _user_has_scola_product_authority uses groups and resolve_role_id remains a legacy resolver.	E1.1 conflict evidence reports denial, but it is tied to a manifest whose DB/module/fixture state is false. No independently reproducible two-session exploit was accepted as certified proof.	Runtime identity is false-green; closure not established.	PARTIALLY_FIXED	Active-role architecture improved, but live closure is unproven until runtime identity is corrected and every authority call site is re-audited.
T0F-003	S0	Validator checks source/tree/build/route and case-set equality, but does not recompute installed modules, entitlements, fixture checksum, DB UUID, or loaded backend source. Backend probe trusts SCOLA_BACKEND_GIT_COMMIT_SHA.	Running validator with the recorded credential result returns E11 VALIDATOR PASS despite manifest installed_modules=[], empty entitlements, null fixture checksum, and live DB/module mismatch.	Direct false-green reproduction.	NOT_FIXED	Evidence certification remains invalid.
T0F-004	S0	Feature gates exist for tested routes; native RPC denial is model-list based rather than a complete entitlement/service proof.	Security matrix only tests entitlement-OFF negative paths; no valid enabled-package positive proof, and manifest entitlement payload is empty while live installation is mixed.	Matrix cannot certify the actual runtime.	PARTIALLY_FIXED	Positive entitlement boundary and native optional-model proof remain open.
T0F-005	S0	Reset scope uses active-role/company checks in the changed path.	Recorded denial is not independently certifiable because the manifest points to a different fixture/module state.	No trustworthy live before/after proof for the current certified identity.	PARTIALLY_FIXED	Re-run cross-tenant reset on a correctly bound runtime.
T0F-006	S0	Canonical create and account-generation responses no longer return plaintext passwords; school-unit admin ignores caller password. A production-capable provisioning shell still defaults ADMIN_PASSWORD to admin and prints/uses it.	Source review confirms reachable maintenance provisioning path; matrix does not exercise it.	Denominator omits this path.	NOT_FIXED	Predictable/default credential production remains possible.
T0F-007	S0	Must-change gate now covers /web/dataset and sensitive paths.	Matrix reports denial, but only its own runtime evidence exists; no independently bound live result was accepted.	Runtime binding failure prevents closure.	PARTIALLY_FIXED	Re-run direct API/RPC read and mutation on exact served identity.
T0F-008	S0	Native reset/signup blocking controller exists.	Matrix checks invalid signup token only; no legitimate token establishment proof. Current config is reset_password=False, but manifest/runtime mismatch remains.	Required valid-token property is not demonstrated.	PARTIALLY_FIXED	Prove valid native token cannot establish credentials.
T0F-009	S1	Token consume and issue paths claim locking; revoke/audit helpers claim fail-closed behavior.	Matrix records synthetic raise/one-success outcomes, but no independent failure-injection evidence is bound to the served runtime.	Results are not independently trusted.	PARTIALLY_FIXED	Verify genuine issue/consume concurrency and revoke/audit failure semantics.
T0F-014	S1	Denominator expanded to 28 IDs and set equality is implemented.	Credential result is 28/28, but several cases are assertion summaries and the validator does not prove underlying runtime payloads; security matrix is only 12 cases.	Completeness is syntactically checked, not substantively certified.	PARTIALLY_FIXED	Independent runtime assertions and contract review remain required.
T0F-015	S0	Sensitive-model native RPC gate covers listed models and methods.	E11-RPC-01 reports an error, but evidence is bound to the inconsistent manifest and does not cover all alternate methods/models/relations required by the audit.	No trusted exact-runtime proof.	PARTIALLY_FIXED	Re-run real T2 partner/user/relation and sensitive-model probes after identity repair.
T0F-002	S0	Dataset mutation gate remains present.	Regression evidence reports mutation denied and unchanged DB state.	No contradictory regression found; identity caveat applies.	CLOSED_BY_INDEPENDENT_AUDIT	Keep regression coverage.
T0F-013	S1	Route exact/prefix matching and CI invocation remain present.	Existing denominator checksum reports zero unknown/ambiguous; child public-prefix route is protected.	No regression found.	CLOSED_BY_INDEPENDENT_AUDIT	Keep denominator CI gate.

T0F-010, T0F-011, and T0F-012 remain outside this audit and open for T0-E2.