T0-E1.2 final independent runtime evidence¶

Validator¶

The shipped validator was run against the frozen manifest and latest 29-case result with --allow-docs-tip.

Result: E12 VALIDATOR PASS.

The validator now re-probes /api/public/certification-identity and confirms the live application tree equals the certified BE tree. It also confirms live DB identity, fixture checksum/version, installed modules, entitlement map/checksum, route checksum, FE build identity, and case-set equality.

Targeted live checks¶

Active-role conflict: teacher session carrying an admin group was denied calendar-admin save and cross-tenant reset.
Cross-tenant reset: GT-T1 admin could not alter GT-T2 user; target write date and audit count were unchanged.
Must-change: normal API and native dataset access denied.
Native credential lifecycle: valid shell-issued signup/reset tokens could not establish a password; GET/POST were blocked and password unchanged.
Entitlement boundary: HR enabled route opened while finance remained denied; optional native HR model probes returned AccessError/empty results with entitlement off.
Provisioning: missing password causes immediate failure; no predictable default or secret printing.

The only local test limitation was that two Odoo unit suites could not import under system Python because PyPDF2 is absent; the live targeted probes and validator completed successfully. This is test-environment hygiene, not a release finding.