| T3W02-F-001 parent tenant scope |
S0 |
No-existing-parent branch in parent_admin_api.py:437-482 omits partner scope validation before Parent.create |
Company-20 admin successfully linked company-22 partner to company-20 student; relation and response were observed, then fixture was removed |
Bound live request and DB-created relation |
NOT_FIXED |
Cross-tenant parent/identity mutation remains possible |
| T3W02-F-002 served FE identity binding |
S1 |
E1.2 validator checks manifest versus dist version but not served commit versus certified FE application commit |
dist/version.json served a333a8f2...; certified W02 FE application commit is b144cf78...; app files changed between these commits |
Validator PASS is false-green for this mismatch |
NOT_FIXED |
Rebuild/rebind and strengthen validator binding before relying on FE evidence |
| T3W02-F-003 W02 denominator gap |
S2 |
Existing matrix covers existing relation updates but not creation with a foreign partner lacking op.parent |
Independent probe exposed the missing case |
32/32 does not cover this adversarial branch |
NOT_FIXED |
Add explicit foreign-partner/no-existing-parent case after remediation |