T6B.1 Independent Findings

ID	Severity	Finding	Independent evidence	Verdict	Required disposition
T6B1-AUD-001	S2 closed	Historical Core regression files were bound to an older BE/FE SHA.	Fresh current-tip W01 64/64, W02 33/33, W05 16/16 evidence in T6B-evidence/.	CLOSED_BY_INDEPENDENT_AUDIT	Keep the new identity-bound evidence; do not use the stale files as current proof.
T6B1-AUD-002	S1	Approved contract item 14 requires antivirus scanning. classify_proof() enforces only extension, size, MIME, and magic bytes; no clamscan/equivalent is called by the W10 proof path. The separate /api/v1/payment/manual/<id>/proof path validates only base64/size and stores the attachment without even the magic-byte check.	Source review of scola_fees/services/w10_state.py, w10_billing.py, and manual_payment_api.py; unit/runtime matrix only tests malformed proof, not malware scanning. Host clamscan availability is not invocation evidence.	NOT_FIXED	Wire fail-closed antivirus scanning into every proof-ingest path and add a runtime infected-file denial plus persistence check.
T6B1-AUD-003	S2	Disposable clone inherited Golden's database UUID.	Clone database name and exact source identity were recorded; UUID equals canonical Golden UUID.	PARTIALLY_FIXED	Generate a unique disposable DB identity or explicitly bind clone lineage and UUID collision in validator schema.
T6B1-AUD-004	S2	FE role-capability metadata drift and accounting dependency are documented residuals.	T6B1 result/residual documents; W10 backend negative cases pass.	PARTIALLY_FIXED	Resolve before role UX or accounting/bridge surfaces are certified; no T6B.1 scope expansion.
T6B1-AUD-005	S2	T6B.2 bridge and T6B.3 gateway are not implemented or certified.	Scope and runtime denominator explicitly exclude them.	CLOSED_AS_EXPLICIT_SCOPE	Keep them outside T6B.1 and open for their named tranches.

The S1 antivirus finding prevents a full T6B.1 closure against the approved product contract. It does not justify any demo or production promotion.