T0-A.1 Core V1 Mutation Capability Audit

Item	Value
Mode	Server development
Workspace	/home/scola/odoo
Scope	Core / platform prerequisite surfaces only — no optional-domain migration
Docs read	T0-A-implementation-plan.md, T0-A-capability-inventory.md, T0-A-result.md, 04-authorization-readiness.md, T0-A1-preflight.md

Method

Controller source was inspected. Route naming was not treated as proof of mutation semantics.

Classification enum (exact):

• CORRECT_ATOMIC_CAPABILITY
• TRANSITIONAL_MUTATION_CAPABILITY
• CONTROLLER_HAS_STRONGER_DOMAIN_GUARD
• BLOCKER_BEFORE_T0_B
• DEFER_TO_NAMED_DOMAIN_TRANCHE

Findings

Route	Controller	Mutating?	Prior capability	Current capability	Classification	Notes
/api/v1/core/attachments/create	core_attachments_create → ir.attachment.create	Yes (creates attachment)	users.profile.view (contradiction)	users.attachments.create (+ POST/create)	CORRECT_ATOMIC_CAPABILITY	Fixed in T0-A.1. Model allowlist _ATTACHMENT_MODELS remains controller guard (CONTROLLER_HAS_STRONGER_DOMAIN_GUARD as secondary).
/api/v1/core/attachments/read	search_read on ir.attachment	No (read)	users.profile.view	unchanged	TRANSITIONAL_MUTATION_CAPABILITY N/A — read path	Transitional read gate via profile; deeper attachment ACL/scope = downstream if needed. Not a mutation contradiction.
/api/v1/core/mail-tracking/list	list after allowlist + ACL + company	No (read)	users.profile.view	unchanged	CONTROLLER_HAS_STRONGER_DOMAIN_GUARD	STAB-005 code path; elevation only after proof. Runtime still PENDING T0-B.
/api/v1/core/students/search	student search	No	students.list.view	unchanged	CORRECT_ATOMIC_CAPABILITY	Read capability matches search.
/api/auth/change-password	password mutation	Yes	users.profile.view	users.profile.view + POST	TRANSITIONAL_MUTATION_CAPABILITY	Self-service password change; atomic users.password.change not introduced (would expand vocabulary). Method-scoped.
/api/auth/switch-role	writes scola_role	Yes	users.profile.view	unchanged	TRANSITIONAL_MUTATION_CAPABILITY	Role switch is eligibility-gated in controller; not a silent read→mutate domain write. Session semantics: see active-role decision.
/api/auth/profile	profile read/update surface	Mixed	users.profile.view	unchanged	TRANSITIONAL_MUTATION_CAPABILITY	Path-level; method split deferred (not Core blocker if controller scopes self).
/api/portal/notification-config/save	config save	Yes	settings.school.view	same + POST/save	TRANSITIONAL_MUTATION_CAPABILITY	Heuristic “view on /save” flagged; school settings view currently gates config ops. Atomic settings.school.edit deferred to settings tranche — not silently granted.
/api/complaint*	operator complaint APIs	Mixed	communication.complaints.view	registered, not granted to normal roles	BLOCKER_BEFORE_T0_B for product use; platform containment OK	Deny until STAB-001 / complaint tranche. Registry presence ≠ grant.

Explicit non-goals

• No finance/payroll/counseling/admissions/CBT/library capability migrations.
• No new broad capability grants beyond users.attachments.create (already mirrored to staff/self-service/student/parent on BE + FE).

T0-B impact

Item	Gate
Attachments create positive/negative	Runtime prove create denied without users.attachments.create; allowed models only
Mail-tracking	STAB-005 Golden Tenant matrix
Complaint operator	Must remain denied for normal Core roles until STAB-001

Verdict

Obvious Core mutation/read contradiction on attachments/create is fixed. Remaining Core mutations are transitional or controller-guarded and explicitly not runtime-certified.