| W05-F-001 session/day binding |
S0 |
Forged sheet is rejected unless session and local date match |
Independent matrix: W05-TEACHER-FORGED-SHEET and foreign-session cases PASS |
Current-tip matrix and E1.2 validator PASS |
CLOSED_BY_INDEPENDENT_AUDIT |
None observed |
| W05-F-002 roster/tenant scope |
S0 |
Student membership, company and session ownership are checked before writes |
Foreign student/session and cross-tenant cases PASS; DB persistence assertions unchanged |
Current Golden runtime bound to BE tip |
CLOSED_BY_INDEPENDENT_AUDIT |
None observed |
| W05-F-003 teacher ACL/elevation |
S0 |
Direct RPC remains normal ACL-denied; API elevation is scoped after authorization |
Independent W05-RPC-TEACHER-CREATE-LINE PASS with no row created; authorized save PASS |
Runtime matrix includes both paths |
CLOSED_BY_INDEPENDENT_AUDIT |
None observed |
| W05-F-004 portal peer isolation/proof privacy |
S0 |
Student-own-line rule and parent serializer stripping are present |
Parent peer denied; student peer RPC exposes no peer; own flows succeed |
Matrix plus source review |
CLOSED_BY_INDEPENDENT_AUDIT |
None observed |
| W05-F-005 concurrency/idempotency |
S1 |
Unique sheet constraint and session/date lookup prevent duplicate sheets |
Concurrent save produced one success, one uniqueness failure, one sheet/line |
DB state asserted |
CLOSED_BY_INDEPENDENT_AUDIT |
None observed |
| W05-F-006 operational upgrade |
S2 |
New rule requires module upgrade on non-Golden tenant DBs |
Golden is upgraded; other tenant upgrade not part of this audit |
Deployment prerequisite documented |
DOWNSTREAM_OPERATIONAL_PREREQUISITE |
Run -u scola_attendance per tenant before rollout |