T3/W02 Independent Runtime Evidence

Independent parent-scope probe

An administrator authenticated in company/tenant 20 (gt.school_admin) was used against the live Golden runtime. A disposable res.partner was created with company_id=22, outside the actor's allowed company. The partner had no existing op.parent relation.

The request:

POST /api/v1/admin/parents/relation/save
partner_id=420 (company 22), relationship_id=3, student_ids=[1] (company 20)

returned HTTP 200 with success=true, created op.parent relation 66, and linked the foreign partner to the in-scope student. The source path at scola_core/controllers/parent_admin_api.py checks _check_parent_scope() only when an existing parent relation is found; the no-existing-parent branch calls Parent.create(..., name=partner.id) without checking the partner company scope.

The disposable partner, generated user, and relation were removed afterward through the Odoo shell. No application source was modified. This is a real cross-tenant parent-link mutation, not a fabricated response hash.

Identity observation

The current FE application history contains W02 runtime changes after served FE commit a333a8f2f9421b2feabbbbb59609a55b4b2290d2 (including src/router/studentDataAdminRoutes.js and src/views/AdminViews/StudentDatabase/TambahSiswa.vue). The current W02 manifest records certified FE application commit b144cf7840d5d4b200e4ea23ededf81d87579479, while dist/version.json and the served identity remain a333a8f2f942.... The validator passes because it compares the manifest to dist/version.json, but does not require served commit equality with the certified application commit.