Final Tranche-0 Reconciliation and T1 Entry Decision¶
Audit date: 2026-08-10 UTC
Mode: independent read-only reconciliation; no application source changes.
Decision¶
T0 CLOSED — APPROVED FOR T1
The prior blocker was current-tip evidence drift. It is resolved by the current
E1.2 rebind T0-E1.2-REBIND-CURRENT-20260810T0853Z: matrix 29/29 PASS and the
identity validator PASS against the actual FE/BE trees and Golden runtime.
DEC-003 is now formalized for bounded Core V1 in the machine-readable decision
record. Optional business workflows remain separately gated and uncertified.
Exact baseline¶
| Item | Observed value |
|---|---|
| FE branch / HEAD | develop / d87607f6 |
| FE origin/develop | d87607f6 |
| BE branch / HEAD | main / 95468e5e5bd46157adff044c6004e343bb9c5c5c |
| BE origin/main | 95468e5e5bd46157adff044c6004e343bb9c5c5c |
| E1.2 manifest identity | FE manifest git SHA b3785228d4c84fd6c37c8c488973cecd5ee9f75e; FE 2fad31c5... and current d87607f6 are docs/evidence-only descendants with unchanged application tree, accepted by --allow-docs-tip; BE 95468e5e5bd46157adff044c6004e343bb9c5c5c |
| E1.2 run/evidence | T0-E1.2-REBIND-CURRENT-20260810T0853Z, matrix 29/29 |
| Golden DB | scola_golden, UUID 2bf5fd27-9390-11f1-9617-28e8d4be73f5, fixture gt-core-b1.1 |
| Certified installed modules | 14-module set recorded in manifest; includes scola_hr with entitlement false |
| Working tree | Application trees clean; governed recon spreadsheet remains untracked and excluded from release evidence |
| Served identity | Manifest records FE served build 295fad05ceed+msmzg5n2; BE runtime identity 95468e5e... |
The current FE LMS change and BE attendance role/group allowlist change were included in the new rebind; neither was silently excluded as a docs descendant. The validator now passes against the current trees, served FE, BE runtime, Golden DB/fixture, module set, entitlements, route checksum, and matrix denominator.
Reconciled finding status¶
| Finding | Original severity | Current reconciliation | Evidence basis | Verdict now |
|---|---|---|---|---|
| T0F-001 | S0 | Current-tip active-role residual probe passes after rebind | current E1.2 finding observation | CLOSED_BY_INDEPENDENT_REBIND |
| T0F-002 | S0 | Current-tip direct/RPC denial remains covered by rebind and route checks | independent RPC probes + current manifest | CLOSED_BY_INDEPENDENT_REBIND |
| T0F-003 | S0 | Current-tip rebind binds application trees, runtime, served FE and matrix | current manifest + validator PASS | CLOSED_BY_INDEPENDENT_REBIND |
| T0F-004 | S0 | Current-tip entitlement residual probe passes after rebind | current E1.2 finding observation | CLOSED_BY_INDEPENDENT_REBIND |
| T0F-005 | S0 | Current-tip cross-tenant reset denial passes | current E1.2 matrix | CLOSED_BY_INDEPENDENT_REBIND |
| T0F-006 | S0 | Provisioning/default-password controls pass current matrix | current E1.2 matrix | CLOSED_BY_INDEPENDENT_REBIND |
| T0F-007 | S0 | Current-tip API/RPC must-change denial passes | current E1.2 finding observation | CLOSED_BY_INDEPENDENT_REBIND |
| T0F-008 | S0 | Native reset/signup denial passes current matrix | current E1.2 matrix | CLOSED_BY_INDEPENDENT_REBIND |
| T0F-009 | S1 | Atomicity/revoke/audit cases pass current 29-case matrix | current E1.2 matrix | CLOSED_BY_INDEPENDENT_REBIND |
| T0F-010 | S1 | Core/optional suite separation independently closed | selectors/manifests | CLOSED_BY_INDEPENDENT_AUDIT |
| T0F-011 | S1 | Unknown catalog SKU fails; topology and consistency checks pass | current topology checks + mutation audit | CLOSED_BY_INDEPENDENT_AUDIT |
| T0F-012 | S1 | DEC-001 and DEC-014 approved by requesting-user conversation | current decision inventory and DEC-014 record | RESOLVED_BY_APPROVED_DECISION |
| T0F-013 | S1 | Route denominator has 0 unknown protected routes and route check passes | current route coverage check + manifest checksum | CLOSED_BY_INDEPENDENT_REBIND |
| T0F-014 | S1 | Expanded 29-case credential denominator executed current-tip | current E1.2 matrix | CLOSED_BY_INDEPENDENT_REBIND |
| T0F-015 | S0 | Current-tip tenant/RPC residual probe passes | current E1.2 finding observation | CLOSED_BY_INDEPENDENT_REBIND |
The current rebind is the evidence identity for this entry decision. Subsequent application changes require a new rebind; docs-only descendants may use the validator's explicit docs-tip allowance.
Decision and product contract reconciliation¶
| Decision / unit | Current disposition | T0 effect |
|---|---|---|
| DEC-001 | Approved by requesting-user conversation: bounded Core V1; optional/pilot gated; ATTEND+ split; FOUND uses scola_bundle_foundation |
T0 contract decision resolved |
| DEC-014 | Approved by requesting-user conversation: server-generated temporary secret + must_change; native Odoo denied; expiry/lockout excluded from V1 |
T0 credential policy resolved |
| DEC-002 | Active-role architecture closed | T0 architecture closed |
| DEC-003 | Core V1 action/scope taxonomy formalized in T0-E2-DEC-003-capability-taxonomy.md/.json |
CLOSED_FOR_CORE_T1; optional extensions downstream |
| DEC-012 | Current-tip E1.2 rebind + Golden fixture | CLOSED_FOR_T1_ENTRY; manifest and validator PASS |
| DEC-013 | Certified jenjang/timezone profiles | PRE_OPTIONAL_EXPOSURE_REQUIRED; not Core exposure evidence |
| U01 product/package surface | Approved bounded Core contract | PASS |
| U02 active-role/session authority | Implemented and current-tip residual probe passes | PASS |
| U03 protected authorization/tenant isolation | Implemented and current-tip probes pass | PASS |
| U04 Golden/runtime evidence | Current-tip manifest, runtime and matrix bound | PASS |
| U05 release-suite separation | Core selector separated from optional business suites | PASS |
| U06 package/install topology | Core closure and unknown-SKU fail-closed checks pass | PASS |
| U07 credential lifecycle | Current-tip DEC-014 matrix 29/29 | PASS |
The product-contract wording now distinguishes the approved bounded Core boundary from package/workflow rows that remain proposed or blocked until their own gates.
Residual classification¶
| Residual | Classification | Boundary |
|---|---|---|
| DEC-003 capability taxonomy | CLOSED_FOR_CORE_T1 | Core action/scope matrix formalized; optional extensions remain downstream |
| DEC-013 jenjang/timezone profiles | PRE_OPTIONAL_EXPOSURE_REQUIRED | Keep optional profiles unexposed until certified |
| ATTEND+ split; REPORT/LEARN/ASSESS/DAP/BOS peer remediation | DOWNSTREAM / PRE_OPTIONAL_EXPOSURE_REQUIRED | Fail closed; does not certify optional workflows |
| Leadership commercial naming / internal hub | DOWNSTREAM_ONLY | Must remain gated and non-commercial by installation alone |
| W01/W02/W05 business workflows and T1 navigation/UX | NOT_APPLICABLE_TO_T0 | Explicitly outside this audit |
| Multi-role organizational signatures | ORGANIZATIONAL_GOVERNANCE_CONTROL | User conversation is the recorded approval authority here; any separate company policy may still govern production release, but is not invented as an engineering blocker |
Quality-gate reconciliation¶
| Gate | Current status | Reason |
|---|---|---|
| Product/package boundary | PASS_WITH_EXPLICIT_DOWNSTREAM_RESIDUAL | DEC-001 approved; optional surfaces remain gated |
| Authorization and tenant isolation | PASS | Current-tip residual probes and rebind evidence pass |
| Golden Tenant fixture | PASS_WITH_EXPLICIT_DOWNSTREAM_RESIDUAL | DB identity unchanged in manifest |
| Runtime/immutable evidence | PASS | Current FE/BE application trees, served FE, runtime, DB, route checksum and matrix are bound; validator PASS |
| Core/package topology | PASS | Topology and consistency checks pass; T0F-011 mutation closure recorded |
| Suite separation | PASS | Core selector excludes optional business tests |
| Credential lifecycle | PASS | Current-tip E1.2 matrix is 29/29 with zero skips/failures |
| Critical decisions | PASS | DEC-001/014 approved; DEC-003 Core taxonomy formalized |
| Reproducible release evidence | PASS | Current-tip rebind 29/29 and validator PASS |
Required disposition before T1¶
- Keep the current E1.2 manifest/matrix immutable and rerun the validator on every subsequent application tip.
- Use DEC-003 JSON as the Core navigation/authorization SSOT; optional domains require separate decisions before exposure.
- Preserve historical audits and do not treat optional workflow suites as green.
Adversarial answers at this baseline¶
- Inactive-role widening: No, current E1.2 residual probe passes.
/web/datasetbypass: No, current rebind and RPC evidence remain green.- GT-T1 to GT-T2 Core access: No, current tenant-isolation evidence remains green.
- Installed-unentitled optional data: No, current entitlement residual probe passes.
- Cross-tenant reset: No, current DEC-014 case passes.
- Predictable/shared credentials: No, current provisioning/default case passes.
- Server-side must-change bypass: No, current API/RPC cases pass.
- Native Odoo reset lifecycle: No, current native reset/signup cases pass.
- Concurrent token double mutation: No, current concurrent consume case passes.
- Revoke/audit fail-open: No, current revoke/audit fail-closed cases pass.
- Public-prefix child bypass: No, current route denominator has zero unknown protected routes.
- Evidence validator against current additions: Yes — current rebind PASS.
- New E1 authorization/elevation regression: no new one identified in the two changed files by static diff; both changes were included in the current rebind.
- Results tied to exact serving source: Yes; manifest, served FE, BE runtime, DB and matrix agree.
Final entry decision¶
T0 CLOSED — APPROVED FOR T1
No open T0 S0/S1 blocker remains for bounded Core/platform entry. DEC-003 is formalized for Core T1; optional/pilot workflows remain explicitly downstream, gated, and uncertified.