T0 final requirement-to-evidence traceability¶
Status is independent auditor status; a passing narrow test does not promote a broader contract.
Reconstructed contract before result documents¶
| Requirement | Required evidence | Intended tranche |
|---|---|---|
| T0-U01 product/package boundary | signed vocabulary, SKU/status/owner/role decisions | T0 |
| T0-U02 active role | approved session-scoped acting-role decision and conflict tests | T0 |
| T0-U03 authorization | capability + method/action + entitlement + tenant/record predicate | T0 |
| T0-U04 runtime | reproducible Golden, source/build/served identities | T0 |
| T0-U05 suites | Core selector excludes optional business tests; named optional selectors | T0 |
| T0-U06 topology | fresh closure, peer/bridge rules, unentitled denial, CI mutation failure | T0 |
| T0-U07 credentials | signed DEC-014, all lifecycle/revocation/anti-enumeration cases | T0 |
| STAB-005/007/008/024/028 | implementation plus live regression evidence and gate mapping | T0 |
| DEC-001/002/003/012/013/014 | explicit approved decisions and signed closure | T0 |
| AUTH-001/003/004/005/009/012/014 | active-role, route registry, elevation/mail, Core tenant isolation | T0 |
Trace matrix¶
| ID | Contract | Code | Static/unit test | Runtime evidence | Immutable identity | Current status | Auditor verdict |
|---|---|---|---|---|---|---|---|
| T0-U01 | 01-product-contract.md remains PROPOSED; approvals blank |
T0-C reclassified leadership/bridges without approval | package tests narrow | no signed product review | none | OPEN | FAIL; PRODUCT_DECISION |
| T0-U02 / AUTH-001 | active role contract exists | session store is scoped, but global scola_role and union groups remain in actor paths |
active-role suites pass only isolated cases | no conflicting-role live case | B2.1 role evidence | CLAIMED CLOSED | FAIL, S0 |
| T0-U03 / AUTH-003 | four-part predicate | capability resolver exists; /web RPC and optional routes bypass it |
resolver/route tests pass | direct attachment mutation returned [742] while marked PASS |
B2.1 result | CLOSED claim | FAIL, S0 |
| AUTH-004 | registry denominator | 1,715 routes; SPMB public-prefix collision | checker passes; negative /api/v1 fixture fails |
no live full denominator | current checksum differs cert | PASS claim | FAIL/S1 |
| AUTH-005 Core | tenant/record scope | student/parent/admin paths use global role and sudo; mutation probe used disallowed model | narrow B2 tests pass | no valid cross-tenant mutation proof; bulk reset crosses scope | B2.1 manifest | CLOSED claim | FAIL, S0 |
| STAB-005 | mail-tracking allowlist and company proof | implementation has allowlist/ACL/rule | mail tests 10 pass | narrow deny evidence | current source not certified | PASS narrow | PASS_WITH_RESIDUAL; acting-role attribution unproven |
| T0-U04 / STAB-007/008/024/028 | Golden/source/build/runtime identity | validator hashes limited historical files and seed JSON | validator current FAIL; controlled descendant false-green PASS | served FE old, BE current | no combined T0-D identity | CLOSED claim | FAIL, S0 |
| T0-U05 | Core-only suite separation | Core selector pure; ADM selector contains Assess/Fees bridge tests | 5/5 test checks are tautological | Core execution blocked at login | T0-C docs | CLOSED claim | FAIL, S1 |
| T0-U06 | deterministic closures and entitlement denial | fresh Core/ADM closures good; CI evaluates only Core and missing baselines auto-pass | topology unit 7 failures | optional data exposed with flags false | B2.1 had HR installed/false | CLOSED claim | FAIL, S0/S1 |
| T0-U07 / DEC-014 | signed complete lifecycle | bulk reset, user-create, native Odoo reset, FE-only must-change, concurrency gaps | 11/11 runner omits required denominator; unit 8 pass is narrow | no cross-tenant reset/deactivate evidence; native reset 200 | DEC-014 signoff blank | CLOSED claim | FAIL, S0 |
| DEC-001/002/003/012/013 | approved decision records | implementation contains unresolved classifications | no approval tests | no signed approval | records unsigned | OPEN | FAIL; PRODUCT_DECISION |
| DEC-014 | signed credential contract | see U0-U07 | matrix incomplete | public native reset reveals missing-account message | no immutable T0-D evidence | FROZEN claim | FAIL, S0 |
| AUTH-009 | elevation/mail safety | mail helper scoped; other sudo/global-role paths remain | narrow tests pass | direct RPC mutation | B2.1 invalid | PASS claim | FAIL overall |
| AUTH-012/014 | critical route and entitlement protection | leadership and SPMB routes have no effective feature gate | feature tests pass on resolver, not mixed routes | optional HR/finance data returned with flags false | certified mixed manifest | CLOSED claim | FAIL, S0 |
Authority call-site result¶
The repository still contains Core actor/scope reads of res.users.scola_role and calls to compute_permissions without a session. This includes student/parent admin, school context, identity admin, attendance, portal, news, and leadership paths. They are not covered by the isolated active-role tests and are therefore not certified.