T0 final findings

ID	Severity	Contract violated / questioned	Evidence	Impact	Required disposition
T0F-001	S0	Active-role isolation / AUTH-001	student_admin_api.py, school_context_api.py, and identity-admin scope read global role/union groups; conflict-role tests absent	Inactive role can widen tenant scope	Fix and live two-session conflict tests
T0F-002	S0	Direct protected authorization / AUTH-003	B2-DIR-01 expected denial but created attachment [742]; runner ignores list success	Claimed 39/39 evidence false; direct RPC boundary unproven	Define and enforce Scola RPC boundary; recertify
T0F-003	S0	Immutable evidence / T0-U04	Validator accepts arbitrary descendants as docs/tooling and hashes old source; controlled app descendant passed; current run fails	Different application source can certify PASS	Redesign validator and recertify served FE/BE/DB
T0F-004	S0	Entitlement != installation / U06/QG14	Leadership routes feature_flag=None; live optional HR/finance data returned with flags false	Installed but unentitled actor/data exposure	Gate or remove routes; mixed-install proof
T0F-005	S0	Credential tenant isolation / DEC-014	Bulk parent reset browses caller IDs as SUPERUSER, returns password, no tenant scope/revoke/audit	Cross-tenant reset path	Remove alternate path; authorized GT-T1→GT-T2 test
T0F-006	S0	Credential creation / DEC-014	/api/v1/users accepts arbitrary nonempty admin password, active user, no must-change; historical migration/provision scripts use predictable passwords	Alternate credential policy and reachable defaults	Canonicalize lifecycle; remove/rotate defaults; prove no active reuse
T0F-007	S0	Must-change enforcement	Backend only returns must_change_password; FE modal is the gate	Must-change account can call protected APIs	Enforce server-side and test direct API
T0F-008	S0	Public credential boundary / DEC-014	auth_signup.reset_password=True; /web/reset_password 200; missing login response says “No account found…”	Native reset path bypasses Scola audit/contract and enumerates	Disable or integrate and recertify
T0F-009	S1	Token/session/audit reliability	Token check/write has no concurrency lock; revoke/audit helpers swallow failures	Recovery can be non-atomic/unattributed	Add atomic tests and fail-closed behavior
T0F-010	S1	U05 suite separation	ADM selector includes Assess and Fees bridge tests; scripts/manifests disagree	Package evidence is contaminated	Separate selectors/manifests and rerun
T0F-011	S1	Topology CI	CI evaluates only Core; missing baseline auto-passes; modular unit 7/44 failed	Optional peer drift can pass CI	Validate every candidate bundle and fail missing baseline
T0F-012	S1	Product/decision closure	Product contract and DEC-014 signatures blank; leadership/bridge classifications changed in code	T1 would build on unapproved boundary	Obtain explicit approvals or restore decision-required status
T0F-013	S1	Route coverage	Denominator checker is not in CI; SPMB public prefix classifies authenticated descendants public	Registry/capability bypass	Correct matcher, wire CI, retest
T0F-014	S1	Credential evidence denominator	11/11 omits successful reset/change, cross-tenant reset, deactivate-session, activation, must-change, concurrency, audit	Closure claim unsupported	Expand runtime matrix with immutable identity
T0F-015	S0	Core tenant isolation evidence	B2 mutation used disallowed op.student and hashes fabricated responses	No valid cross-tenant mutation proof	Run real read/list/relation/mutation/attachment/mail probes

The findings are independent of prior CLOSED/PASS/CERTIFIED labels. No application fix was made in this audit.