Lewati ke isi

T0-E1.2 independent re-audit verdict

Verdict

E11-C — T0-E1.2 FAILED — MATERIAL SECURITY OR EVIDENCE FAILURE REMAINS

The corrective code is materially improved, and the predictable provisioning default is independently closed. The decisive blocker is evidence identity: the E1.2 manifest certifies BE commit a44b5d..., while the current BE contains application commit 5232370...; the served certification endpoint reports a different runtime tree. The independent validator correctly fails this mismatch.

Therefore the security findings cannot yet be certified against the exact runtime that would enter release. T0 is not closed, and T0F-010/011/012 remain open for T0-E2.

Adversarial answers

  1. Inactive-role widening is improved but not fully certified; preferred-role reads remain in calendar viewer logic.
  2. Native RPC denial is reported for tested sensitive models, but exact-runtime certification is stale.
  3. Must-change denial is reported for API/RPC, pending exact-runtime reproof.
  4. Cross-tenant reset denial is reported, pending exact-runtime reproof.
  5. The previous default-password path is closed by direct script invocation and source review.
  6. Invalid native signup is blocked; valid-token establishment remains unproven independently.
  7. Concurrent issue/consume is claimed by matrix, not independently accepted against current exact runtime.
  8. Revoke fail-closed is claimed; fresh failure injection is still required.
  9. Audit fail-closed is claimed; fresh failure injection is still required.
  10. Entitlement-OFF denial is evidenced; enable-one positive/native-RPC proof remains incomplete.
  11. Not independently proven.
  12. Live DB/module/entitlement state is now populated and truthful in the endpoint.
  13. Validator verifies runtime tree, but current manifest is stale and therefore fails rather than certifies.
  14. Current application change cannot leave validator green; it causes the observed fail.
  15. Case set equality is present, but substantive assertions remain implementation evidence.
  16. T0F-002 and T0F-013 remain closed by regression review.
  17. No—the current E1.2 results are not bound to the current BE application tip.