Lewati ke isi

T0-A.1 Preflight

Item Value
Mode Server development
Workspace /home/scola/odoo
Captured 2026-08-08 (local server clock)
Purpose Re-verify dirty T0-A trees before T0-A.1 edits

Exact tree state

Repo Branch HEAD SHA Working tree
scola-fe-v2 develop b48ca63859d3d822f22572dc76a08afbe4f2f653 dirty (T0-A uncommitted)
custom_addons_scola/gcgscola main 2ff6ac7cb41810bbc3b66821cdad004b52d1658a dirty (T0-A uncommitted)

Matches T0-A-result.md base SHAs. No intervening commits on either branch.

T0-A modified / untracked (expected)

Frontend (modified)

  • docs/release-readiness/04-authorization-readiness.md
  • docs/release-readiness/08-stabilization-backlog.md
  • src/access/accessContract.js
  • src/access/apiRouteAccessRegistry.js
  • src/stores/auth.store.js
  • tests/unit/access/feBackendApiRouteAccessParity.spec.js

Frontend (untracked)

  • docs/release-readiness/execution/T0-A-capability-inventory.md
  • docs/release-readiness/execution/T0-A-implementation-plan.md
  • docs/release-readiness/execution/T0-A-result.md
  • docs/recon/template_upload_siswa_SD REJIS Kelas 1.xlsx — unrelated; exclude from T0-A/T0-A.1 checkpoint

Backend (modified)

  • scola_core/controllers/auth.py
  • scola_core/controllers/core_reference_api.py
  • scola_core/models/ir_http.py
  • scola_core/services/auth_capabilities.py
  • scola_core/tests/test_auth_capabilities_unit.py
  • scola_core/tests/test_auth_payload_contract_unit.py
  • scola_platform_support/api_route_access.py
  • scola_platform_support/tests/test_api_route_access_unit.py

Backend (untracked)

  • scola_core/services/mail_tracking_access.py
  • scola_core/tests/test_active_role_enforcement_unit.py
  • scola_core/tests/test_mail_tracking_access_unit.py

No unrelated code changes beyond the excel recon artifact.

Mandatory T0-A suite re-run (preflight)

Suite Result
test_active_role_enforcement_unit.py PASS (12)
test_auth_capabilities_unit.py PASS (73)
test_auth_payload_contract_unit.py PASS (6)
test_mail_tracking_access_unit.py PASS (10)
test_api_route_access_unit.py PASS (53)
scripts/modular/api_route_registry_gap_check.py PASS (0 unregistered /api/v1/* vs budget 5)

Comparison vs T0-A.1 findings to close

Finding Still true at preflight? Evidence
AUTH-004: unregistered protected can skip capability gate Yes ir.http._resolve_capability_gate: if resolve_api_route_access(path) is None, returns None → request proceeds
Gap check only audits /api/v1/* Yes api_route_registry_gap_check.py _should_audit + ignores /api/auth/
Inventory only lists registered prefixes Yes T0-A-capability-inventory.md scope note
Method/action rules not supported Yes Rules are 4-tuples; resolver ignores HTTP method
Core attachments/create gated by .view Yes Registry line + controller creates ir.attachment
Active role is user-global (res.users.scola_role) Yes action_switch_active_scola_role writes user field

Preflight conclusion

Safe to proceed with T0-A.1 on the same dirty trees. Checkpoint must include T0-A + T0-A.1 together (or sequential commits) and exclude the unrelated xlsx recon file.