T0-B1 Result — Session-Scoped Identity and Golden Tenant Runtime Foundation¶
| Item | Value |
|---|---|
| Mode | Server development |
| Workspace | /home/scola/odoo |
| Scope | DEC-002 session-scoped active role; route-coverage traceability; GT-T1/GT-T2 fixture foundation; runtime manifest; B2 matrix |
| Out of scope | Full STAB-005/007/008 Closed certification; W01/W02/W05; optional-domain migration; nav redesign; user docs |
| Completed (UTC) | 2026-08-08 |
Starting clean SHAs (T0-A.1 checkpoint)¶
| Repo | Branch | SHA |
|---|---|---|
| FE | develop |
d46fea0adcc9f08d54d716f082d82a8b79f5bbe7 |
| BE | main |
50e904e2a12c238d1d78199a1325af85b8f1a134 |
Preflight: T0-B1-preflight.md. Recon XLSX excluded.
Ending tree¶
Working trees dirty with T0-B1 implementation until explicit commit/push. Record post-commit SHAs here after push:
| Repo | Ending SHA |
|---|---|
| FE | 115d8ccab529286e13443b984d778c23a4a8b1e4 |
| BE | 7c119835085c18011db8e56d31cd4c09f06275b1 |
Architecture implemented (DEC-002)¶
- Acting role stored in Odoo HTTP session key
scola_active_role. res.users.scola_role= preferred/default for new sessions only.- Login →
establish_session_active_role. - Switch →
switch_session_active_role(current session only; preferred field updated optionally). - Request gates (
ir.http, auth payload) resolve viaresolve_request_active_role. - Revoked/stale session role → recover to deterministic default (documented policy).
- No client-controlled role authority; no inactive-role union.
Primary module: scola_core/services/session_active_role.py.
Route coverage reconciliation¶
| Metric | Value |
|---|---|
| Ambiguous capability rows | 0 |
| UNREGISTERED_PROTECTED_BLOCKER | 0 |
| Extracted routes | 1712 |
| Capability status fields | REGISTERED_CAPABILITY / REGISTERED_DENY / public / internal / … |
Artifact: T0-B1-route-coverage.md (+ JSON twin). Consistency tests: test_route_coverage_consistency_unit.py.
Prior sample None displays were report-generation ambiguity (feature_flag / incomplete columns), not live PROTECTED_REGISTERED capability misses (verified 0 at T0-A.1 and T0-B1).
Golden Tenant foundation¶
| Item | Value |
|---|---|
| Fixture version | gt-core-b1.1 |
| Checksum | 98667e8e1ede0160cd2a9af4b433e4cee65c7eeeb9fdcc02ae9e1a19803bea84 |
| Reference clock | 2026-01-15T00:00:00+07:00 |
| Tenants | GT-T1, GT-T1-U2, GT-T2 |
| Accounts | school admin, teacher, homeroom/multi, student, parent, T2 admin/teacher |
| Commands | python3 scripts/golden/repro_check.py; python3 scripts/golden/seed_core.py --dry-run; odoo-shell seed via seed_core.py |
| 3-cycle logical repro | PASS (identical checksums) |
Live Odoo DB scola_golden install/seed |
PENDING — DB not provisioned in this environment (scola_test absent; prod DBs not used) |
Files: custom_addons_scola/gcgscola/scripts/golden/{fixture_contract,seed_core,repro_check,runtime_smoke}.py.
PASS / FAIL / PENDING¶
| Bucket | Items |
|---|---|
| PASS | Session unit suite (8); route coverage consistency (3); auth004; active-role enforcement; logical GT 3-cycle repro; ambiguous rows 0; blockers 0; B2 matrix authored |
| FAIL | 0 required suite failures |
| PENDING T0-B2 / ops | Live dual-session HTTP smoke on Golden DB; served FE build checksum; full STAB-005/007/008 acceptance; cross-tenant live probe; parent/student portal login on seeded DB |
Runtime smoke (minimum)¶
Harness: scripts/golden/runtime_smoke.py (requires GT_BASE_URL + GT_E2E_*).
Not executed green in this environment — no dedicated Golden HTTP DB with seeded gt.* accounts. Do not treat as PASS.
Runtime manifest¶
T0-B1-runtime-manifest.md / .json — FE/BE SHAs + fixture/route checksums filled; served-build/DB identity PENDING until Golden instance exists.
Defect status (honest)¶
| ID | Status after T0-B1 |
|---|---|
| STAB-007 / AUTH-001 | Code upgraded to session-scoped; runtime certification pending T0-B2 — not Closed |
| STAB-008 / AUTH-003/004 | Coverage traceability improved; still runtime pending |
| STAB-005 | Unchanged — runtime pending |
| DEC-002 | Approved and implemented in code |
Remaining risks¶
- Cross-session leakage if any code path still reads only
user.scola_rolewithout session (inventory remaining call sites in B2). - Golden DB not yet isolated from production tenants.
- Placeholder local secrets in seed when env unset — release runs must inject
GT_E2E_*or FAIL. - Served-build mismatch until FE build fingerprint is probed.
- Portal student/parent groups may need additional OpenEduCat links on live seed.
Ready for T0-B2¶
- Session-scoped role unit evidence + switch/login contract.
- Executable T0-B2-security-matrix.md.
- Zero ambiguous route-capability rows + zero unregistered blockers.
- Deterministic GT fixture contract + checksum.
- Remaining: provision
scola_golden, seed, fill manifest served-build/DB fields, execute matrix.
Adversarial self-review¶
| Risk | Mitigation / status |
|---|---|
| Cross-session role leakage | Unit-proven independent FakeSession isolation; live HTTP pending |
| Stale role after revocation | Recovery-to-default tested |
| Session fixation | Login uses Odoo authenticate rotation; correlation id is non-secret |
| Forged acting role | Switch validates assigned/authoritative set |
| Cross-company | Fixture defines GT-T2; live probe pending B2 |
| Capability bypass | Fail-closed registry retained |
| Coverage false-green | Explicit capability_status; CI fails on ambiguous |
| Fixture nondeterminism | 3-cycle checksum PASS |
| Superadmin contamination | Fixture excludes base.group_system for normal actors |
| Served-build mismatch | Manifest field PENDING until smoke |
Exit gate assessment¶
Foundation delivered for B2. Full T0-B1 exit checklist requiring live Golden HTTP smoke / served-build identity remains open until scola_golden is provisioned — recorded as PENDING, not greenwashed.