Lewati ke isi

T0 final independent verdict

Verdict

VERDICT C — T0 NOT CLOSED

T1 must not start. This is not a documentation-only gap: authorization, entitlement, immutable evidence, and credential paths have material S0 failures or false-green evidence.

Quality-gate reconciliation

Gate Status
Product contract boundary / QG-01 FAIL
Authorization contract / QG-03 FAIL
Golden Tenant fixture PASS_WITH_EXPLICIT_DOWNSTREAM_RESIDUAL (fixture checksum alone is insufficient)
Runtime identity / QG-04, QG-17 FAIL
Core fresh install PASS_WITH_EXPLICIT_DOWNSTREAM_RESIDUAL
Package topology / QG-14 FAIL
Suite separation FAIL
Credential lifecycle / QG-16, DEC-014 FAIL
Critical decision closure FAIL / PRODUCT_DECISION
Reproducible release evidence FAIL

Required adversarial answers

  1. Yes. Inactive/global role and union-group paths can widen authority.
  2. Yes. Native /web RPC is outside the registry, and the SPMB public-prefix collision bypasses the central gate.
  3. Yes. Core global-role/sudo paths and the bulk reset path permit or leave cross-tenant access unproven.
  4. Yes. Bulk parent reset accepts arbitrary IDs without tenant scope.
  5. Not proven; the bulk reset path does not revoke sessions. Therefore the contract fails evidence closure.
  6. Yes: Core user-create, bulk reset, native Odoo reset, and optional SPMB registration.
  7. Yes: historical Core migration/provisioning paths contain predictable passwords; live Golden includes source-known active accounts.
  8. Fresh Core install: no. Historic certified Golden: scola_hr is installed despite false entitlement; topology CI is incomplete.
  9. Yes. Leadership/People endpoints returned optional HR/finance data while all optional flags were false.
  10. Core selector: no. ADM selector: yes, it contains Assess and Fees bridge tests.
  11. Yes. A controlled application descendant produced validator PASS; current validator also fails on its own checksum.
  12. Yes. Activation, user-create, bulk revoke, unsigned decisions, topology CI, suite manifests, and entitlement exposure are hidden T0 blockers.
  13. Yes. Leadership and bridge classifications were coded while the original product contract remained decision-required and unsigned.
  14. No. Navigation work would rely on contracts that are demonstrably wrong or unproven.

Safe residuals

Optional business workflows, password expiry/lockout, and customer impersonation remain downstream only where the surface is absent/denied and not exposed. They do not soften the S0 findings above.

Audit boundary

This report intentionally does not implement fixes and does not certify W01/W02/W05 or T1 navigation cleanup.