T0-E1.1 independent runtime probes

Runtime identity

The served FE identity is reproducible (5e1007d5..., build fe-build-5e1007d5da55-msljifbe). The backend source endpoint is POST-only and returns the expected commit, but its source is explicitly env:SCOLA_BACKEND_GIT_COMMIT_SHA; this is an environment assertion, not proof that the running process loaded the certified tree.

Golden mismatch

Independent SQL inspection of scola_golden found:

• fixture parameter gt-core-b1.1, not manifest gt-core-e11;
• 14 installed Scola modules, while manifest installed_modules is [];
• mixed optional installation including HR and leadership modules;
• auth_signup.invitation_scope=b2b and auth_signup.reset_password=False.

The manifest has a null fixture checksum and empty entitlement profile. These are not the live logical state.

Validator reproduction

Running the shipped validator against the 28-case credential result reports:

E11 VALIDATOR PASS

It does so without querying the live module set, entitlement profile, fixture checksum/state, or DB UUID. A deliberately mismatched 12-case security result correctly fails case-set equality, but that does not validate the omitted runtime bindings.

Targeted control observations

• E1.1 source contains the active-role and dataset sensitive-model gates.
• Canonical create/account-generation code removes plaintext password fields and uses temporary credentials with must_change.
• scripts/maintenance/provision_clean_tenant.sh still defaults ADMIN_PASSWORD to admin, writes it to the administrator, and prints it.
• Native signup/reset blocking routes exist, but the evidence only probes an invalid token; it does not prove a valid token cannot establish credentials.
• The entitlement evidence is negative-only; the “enable one package” positive boundary and native optional-model boundary are not demonstrated.

No application source was modified. Disposable runtime state was not changed by this audit.