T0-B2 Result — Golden Runtime Security Certification¶
| Item | Value |
|---|---|
| Mode | Server development (/home/scola/odoo) |
| Docs read | AGENTS.md, T0-B1 preflight/result/route-coverage/runtime-manifest, T0-B2 security-matrix, development-guide/workspace-governance/architecture-api (prior), QA testing guidelines referenced |
| Matrix run ID | T0-B2-20260809T015400Z |
| Prior run | T0-B2-20260809T015200Z (2 FAIL harness issues; superseded — do not reuse) |
| Golden DB | scola_golden @ http://127.0.0.1:8090 (config/odoo-golden.conf) |
| FE freeze SHA | 4faceb80a4eab6915a2476ca10193b54abe85708 |
| BE certified SHA | b668a4f595b6b64c5fd02ad687bd8464a030b934 |
| FE build checksum | 6967c75a2a8442594454cf8ac44e1020e743c0da34499d35095ea38548af0709 |
| Served identity | 68eca6754a72+t0b2 @ 2026-08-09T01:26:10.956Z |
| Evidence | T0-B2-evidence/ |
Seed / reset live reproducibility¶
Three independent seed→verify→reset cycles against live scola_golden:
| Cycle | logical checksum | database logical checksum | superadmin actors |
|---|---|---|---|
| 1–3 | 98667e8e…bea84 |
5571f175…e6ec |
[] |
ok: true (see T0-B2-evidence/seed_cycles.json).
Matrix totals¶
| Metric | Value |
|---|---|
| Total cases executed | 39 |
| PASS | 39 |
| FAIL | 0 |
| Required skips | 0 |
Machine evidence: T0-B2-evidence/T0-B2-results.json.
Fixes made during B2¶
- DB logical checksum determinism — exclude auto-increment IDs (
live_seed_verify.py). - STAB-005 runtime crash —
mail.tracking.valuesafe fields used nonexistentfield_descon Odoo 17; switched tofield_id+ FE alias (mail_tracking_access.py,core_reference_api.py, unit test). - AUTH-004 live fixture — temporary
/api/v1/t0b2-fixture-unregisteredintroduced, denied withroute_unregistered, detected by coverage extractor (1 blocker), then removed (coverage back to 0 blockers). - Company school codes — set
G00001/G00002for probe student creation on Golden.
Defect status (before → after)¶
| Defect / AUTH | Before B2 | After B2 |
|---|---|---|
| STAB-005 | Static/unit only | CLOSED_WITH_RUNTIME_EVIDENCE (after field_id fix + live cases) |
| STAB-007 / AUTH-001 | Static + session unit | CLOSED_WITH_RUNTIME_EVIDENCE (incl. S007-07..10, dual-session, revoke) |
| STAB-008 / AUTH-003 | Unit resolver | CLOSED_WITH_RUNTIME_EVIDENCE for Core method/action + fail-closed nested probe; longest-prefix breadth still relies on unit suite + live spot-check |
| AUTH-004 | Unit + CI extractor | CLOSED_WITH_RUNTIME_EVIDENCE (live unregistered deny + extractor detection + post-removal clean) |
| AUTH-005 | Logical claim | PARTIALLY_CERTIFIED — Core/platform scope only (students search/list, mail-tracking, attachment mutation). Optional domains not certified. |
Executive proof table¶
| Area | Static proof | Live proof | Status |
|---|---|---|---|
| Active role | Unit DEC-002 | Login/switch/logout/dual-session/revoke/browser | CLOSED_WITH_RUNTIME_EVIDENCE |
| Route fail-closed | Coverage CI | Unregistered fixture + nested path | CLOSED_WITH_RUNTIME_EVIDENCE |
| Method/action | Unit AUTH-003 | attachments create vs wrong action | CLOSED_WITH_RUNTIME_EVIDENCE |
| Mail tracking | Unit STAB-005 | Allowed/denied/leak compare | CLOSED_WITH_RUNTIME_EVIDENCE |
| Tenant isolation Core | Spec | T1↔T2 search/mail/attach | CLOSED_WITH_RUNTIME_EVIDENCE (Core only) |
| Attachment mutation | Registry | +/- create cases | CLOSED_WITH_RUNTIME_EVIDENCE |
| FE/backend authority parity | — | Browser smoke + version match | CLOSED_WITH_RUNTIME_EVIDENCE |
| Golden reproducibility | Logical dry-run | 3 live cycles | CLOSED_WITH_RUNTIME_EVIDENCE |
| Manifest integrity | B1 PENDING | B2 filled (no critical PENDING) | CLOSED_WITH_RUNTIME_EVIDENCE* |
*Caveat: runtime included an uncommitted BE mail-tracking fix while manifest still cites B1 git SHA b668a4f595b6….
Remaining AUTH risks / limitations¶
- Optional-domain authorization (fees/LMS/admission/etc.) not certified.
- Golden entitlements: all optional feature flags
false— Core auth still exercised; domain routes may be soft-absent. - Null-byte malformed paths can 500 at WSGI (harness used non-null unknown path → 404). Not counted as product bypass.
- Timing side-channels: recorded as observation only.
- BE/FE working trees dirty with B2 tooling/docs/fix until checkpoint commit.
Adversarial review (explicit)¶
| Challenge | Outcome |
|---|---|
| Session leakage | Dual-session independent roles PASS |
| Assignment revocation race | Revoke via scola_roles recovers both sessions to teacher; switch to revoked denied PASS |
| Forged active role | Denied PASS |
| Session reuse after logout | Expired PASS; peer session alive PASS |
| Cross-tenant object reference | Search empty / mail denied PASS |
| Cross-tenant FK mutation | Attachment create denied; no id PASS |
| Stale FE authority | Switch removes homeroom-only; API authority follows session PASS |
| Route registration bypass | Fixture denied; extractor flags; removed PASS |
| Method confusion | Wrong action fail-closed PASS |
| Read cap authorizing Core mutation | Wrong action/model denied PASS |
| Mail-tracking existence leak | Identical denials PASS |
| Attachment scope bypass | Unallowlisted model denied PASS |
| Superadmin contamination | superadmin_actors=[] PASS |
| Fixture drift | 3-cycle checksum converge PASS |
| Served-build mismatch | version.json + checksum match PASS |
| Evidence reuse after code change | New run ID after mail fix PASS |
| False-green missing modules/data | Probe students created; mail allowed path returns success with empty items PASS |
T0-B exit decision¶
T0-B may exit for Core/platform scope.
- BE
main@b668a4f595b6b64c5fd02ad687bd8464a030b934 - FE evidence @
4faceb80a4eab6915a2476ca10193b54abe85708(tipd3e6011b…records SHAs) - Post-commit re-smoke STAB-005 +
version.json: PASS (T0-B2-evidence/T0-B2-resmoke-stab005-version.json)
AUTH-005 remains Core-scoped PARTIALLY_CERTIFIED (optional domains not certified). Do not start T0-C / T1 / W01 / W02 / W05 from this exit alone without release planning.