T0-E1 Preflight — Security Boundary Remediation Baseline¶
| Item | Value |
|---|---|
| Mode | Server development /home/scola/odoo |
| Docs read | audit/T0-final-*.md, development-guide, workspace-governance, architecture-api, DEC-014, package catalog |
| Authority | Independent audit VERDICT C — T0 NOT CLOSED; T1 BLOCKED |
| This tranche | Remediation only — must not write T0 CLOSED |
Source identity (start)¶
| Repo | Branch | HEAD | origin |
|---|---|---|---|
| FE | develop |
dc7279aff2897790deb39a0b63294ffddb659ca0 |
synced |
| BE | main |
4f132a86c4e2abb661502af7929959384287fcb0 |
synced |
| Working tree | FE: untracked recon XLSX + untracked audit docs; BE: clean |
Audit artifacts under docs/release-readiness/audit/ are preserved as authoritative inputs (not rewritten).
Independent findings owned by E1¶
T0F-001, 002, 003, 004, 005, 006, 007, 008, 009, 013, 014, 015.
Out of scope: T0F-010/011/012 product/suite/topology-governance except fail-closed security necessity; W01/W02/W05; optional business certification.
Expected false-green / failure conditions (auditor)¶
| Finding | Expected failure mode before fix |
|---|---|
| T0F-001 | Controllers authorize via scola_role / group union, not session acting role |
| T0F-002 | B2-DIR-01 PASS with actual_result=[742] (list create ID) |
| T0F-003 | Validator accepts app descendants; narrow tree hash |
| T0F-004 | Leadership routes feature_flag=None; optional data while flags false |
| T0F-005 | Bulk parent reset SUPERUSER browse IDs, returns password |
| T0F-006 | /api/v1/users accepts caller password without must-change |
| T0F-007 | Must-change only FE-gated |
| T0F-008 | auth_signup.reset_password / /web/reset_password active |
| T0F-009 | Token consume race; revoke/audit swallow |
| T0F-013 | Public prefix /api/SPMB/registers classifies auth children public; CI unwired |
| T0F-014 | 11/11 credential matrix incomplete |
| T0F-015 | Tenant mutation proof used disallowed model / fabricated hashes |
Baseline checks (pre-fix)¶
Recorded for comparison; failures/false-greens are expected until E1 completes.
# Commands to re-run after fixes:
python3 scola_core/tests/test_session_active_role_unit.py
python3 scola_core/tests/test_active_role_enforcement_unit.py
python3 scripts/modular/api_route_surface_coverage_check.py
bash scripts/golden/run_evidence_identity_validator.sh
python3 scola_core/tests/test_credential_lifecycle_unit.py
python3 scripts/modular/package_topology_ci_check.py --gcgscola ... --baseline ... --fe-root ...
Proceed¶
Implement E1 security/enforcement fixes. Final label only:
T0-E1 IMPLEMENTATION COMPLETE — PENDING INDEPENDENT AUDIT