T0-E1.1 Result — Unified Authority, Native RPC, Credential Boundary, Certification¶

Item	Value
Mode	Server `/home/scola/odoo`
Prior E1	`IMPLEMENTED_BUT_INDEPENDENTLY_FAILED` (E1-C) — PASS matrices not reused
Label	`T0-E1.1 IMPLEMENTATION COMPLETE — PENDING INDEPENDENT AUDIT`
Not claimed	`T0 CLOSED`, `CLOSED_BY_INDEPENDENT_AUDIT`, T0-E2, T1
FE commit	`5e1007d5da55faddf06237e89a2550c2982cbde5` (`develop`)
BE commit	`d947ed9d5a1ef1541620123561590f19af188438` (`main`)
Frozen run	`T0-E1.1-20260809T083304Z`
Golden DB UUID	`2bf5fd27-9390-11f1-9617-28e8d4be73f5`
Credential matrix	28/28 PASS
Security smoke	12/12 PASS
Evidence validator	PASS

Finding matrix¶

Finding	Original audit exploit	Architectural fix	Independent-style local reproduction	Runtime case IDs	Evidence manifest	Implementation status
T0F-001	Inactive `platform_operator` group widened `school_admin`	Canonical `AuthorityContext`; active-role only; `compute_permissions` no `resolve_role_id`/group fallback; identity global scope + LMS/core gates cleaned	school_admin + platform_operator group → GT-T2 admin reset DENIED	`E11-AUTH-01/02`, `DEC014-XTENANT-ADMIN-RESET-01`	`T0-E1.1-runtime-manifest.json` + security/credential evidence	`FIXED_AWAITING_INDEPENDENT_AUDIT`
T0F-003	No E1 runtime manifest; incomplete validator	`generate_e11_manifest.py` + `e11_evidence_identity_validator.py` (set equality, served BE probe, tree/commit/build/route/DB)	Mutation suite 1–13 FAIL, docs-only may PASS	validator mutations	manifest + validator log	`FIXED_AWAITING_INDEPENDENT_AUDIT`
T0F-004	Installed-but-unentitled optional packages	Hard feature gate; matrix ENT OFF HR/finance	HR/finance OFF → deny	`E11-ENT-01/02`	security-matrix evidence	`PARTIALLY_FIXED` (enable-one positive + native RPC package proof still thin)
T0F-005	Cross-tenant admin reset via authority fallback	Same as T0F-001 + scope checks on reset	GT-T1 ↛ GT-T2 reset	`DEC014-XTENANT-ADMIN-RESET-01`	credential-contract	`FIXED_AWAITING_INDEPENDENT_AUDIT`
T0F-006	Plaintext/default credential paths	Server-generate; no API plaintext return; inventory classifications	create/admin-reset responses have no password fields	`DEC014-CREATE-01`, `DEC014-NO-PLAINTEXT-DEFAULT-01`, `DEC014-ADMIN-RESET-OK-01`	inventory + contract	`FIXED_AWAITING_INDEPENDENT_AUDIT`
T0F-007	Must-change only `/api`	Principal gate covers `/api` + `/web/dataset` (+ product `/web`); AccessError on dataset	must-change teacher API+dataset DENIED	`DEC014-MUSTCHANGE-API-01`, `DEC014-MUSTCHANGE-RPC-01`	credential-contract	`FIXED_AWAITING_INDEPENDENT_AUDIT`
T0F-008	`/web/signup?token=` parallel lifecycle	Native signup/reset blocked; ICP signup disabled	GET signup/reset → 404/403	`DEC014-NATIVE-SIGNUP-UNAVAIL-01`, `DEC014-NATIVE-RESET-UNAVAIL-01`	credential-contract	`FIXED_AWAITING_INDEPENDENT_AUDIT`
T0F-009	Issue race; revoke/audit fail-open	Token issue `FOR UPDATE` supersession; `revoke_user_sessions_or_raise`; mandatory audit fail-closed	concurrent issue/consume; revoke/audit raise	`DEC014-TOKEN-CONCURRENT-*`, `DEC014-REVOKE-FAILCLOSED-01`, `DEC014-AUDIT-FAILCLOSED-01`	credential-contract	`FIXED_AWAITING_INDEPENDENT_AUDIT`
T0F-014	Incomplete DEC-014 denominator	`credential_contract_cases.json` (28 IDs) + full matrix set equality	required_case_ids == executed (28/28 PASS)	all `DEC014-*`	credential-contract + manifest	`FIXED_AWAITING_INDEPENDENT_AUDIT`
T0F-015	GT-T1 `res.partner` via `call_kw`	Deny-by-default sensitive models for Scola product actors on dataset	partner `search_read` → JSON-RPC error	`E11-RPC-01`	security-matrix	`FIXED_AWAITING_INDEPENDENT_AUDIT`

Independently CLOSED (unchanged): T0F-002, T0F-013.

V1 credential contract¶

Provision: server temporary + must_change (no activation-token V1)
Recovery: password-reset tokens (DEC-014)
Native Odoo signup/reset: unavailable on customer surface

Adversarial self-review (local)¶

#	Question	Local answer
1	Inactive platform group widens school_admin?	No (matrix AUTH/XTENANT)
2	GT-T1 partner `search_read` GT-T2?	Denied (sensitive model gate)
3	GT-T1 read GT-T2 `res.users` via dataset?	Denied (same gate)
4	Must-change `/web/dataset`?	Denied
5	Valid Odoo signup token establishes password?	Surface 404/blocked
6	Production endpoint returns plaintext student/parent/admin password?	Create/reset paths stripped
7	Source-known default creates active user?	Fixture-only / server random
8	GT-T1 reset GT-T2?	Denied
9	Dual valid reset tokens after concurrent issue?	At most one open
10	Session-store failure + reset success?	Fail-closed raise
11	Audit failure + privileged reset success?	Fail-closed raise
12	Optional HR/finance via native RPC when entitlement false?	API OFF proven; native package RPC still PARTIAL
13	New BE controller leaves validator green?	Mutation test expects FAIL
14	Delete required case leaves validator green?	Mutation test expects FAIL
15	Manifest identifies served BE instance?	Yes (`/api/public/source-identity` probe)

Explicit non-goals respected¶

T0F-010/011/012, T0-E2, T1, W01/W02/W05, navigation redesign, optional workflow certification — not started.