{
  "run_id": "T0-E1.2-20260829T034521Z",
  "schema_version": "t0-e1.2-security-matrix-v1",
  "golden_base": "http://127.0.0.1:8090",
  "database": "scola_golden",
  "generated_at": "2026-08-29T03:47:49.287105+00:00",
  "live_certification_probe": {
    "success": true,
    "missing_mandatory_fields": [],
    "source_identity": {
      "success": true,
      "backend_git_commit_sha": "5e6be85291fd9c2827d92e964957c76634956e2b",
      "backend_runtime_identity_source": "env:SCOLA_BACKEND_GIT_COMMIT_SHA",
      "runtime_source_path": "/home/scola/odoo/custom_addons_scola/gcgscola",
      "runtime_application_tree_hash": "e890d376cd5340f4c492c9e8dd71f0c67d03cb7485b1d5106bedfd8273f8399d",
      "loaded_controller_path": "/home/scola/odoo/custom_addons_scola/gcgscola/scola_core/controllers/source_identity_api.py",
      "content_fingerprints": {
        "scola_core/services/mail_tracking_access.py": "625b83dbb72926dfda5d073ce4f846e9b8107267af03aa10a4e4e08478e14659",
        "scola_core/controllers/core_reference_api.py": "15c173694ff32369a73120f198e70a419980f62951ec1d3e6e5c5ec6f6200bc9",
        "scola_core/services/session_active_role.py": "1702375aa62c9bb3347d4d1837d7215917281872dd6ebb25e9a8b28d545b6fcf",
        "scola_core/models/ir_http.py": "4e8c31b58325d76f78c7b5ce8fef5ae0f3c20b991d4be2501befe8c47e06ccde",
        "scola_core/controllers/source_identity_api.py": "b3ba087ba00d88d03240d86bd41a579ee169aad2c79aa82ccf04cee9febbbd7e"
      },
      "repo_path_hint": "/home/scola/odoo/custom_addons_scola/gcgscola",
      "temporary_unregistered_fixture_present": false,
      "live_certification": {
        "database_name": "scola_golden",
        "database_uuid": "2bf5fd27-9390-11f1-9617-28e8d4be73f5",
        "golden_fixture_version": "gt-core-b1.1",
        "installed_modules": [
          "scola_attendance",
          "scola_bundle_core",
          "scola_core",
          "scola_hr",
          "scola_identity_admin",
          "scola_leadership_hub",
          "scola_lesson_hours",
          "scola_news",
          "scola_observability",
          "scola_parent",
          "scola_platform",
          "scola_platform_support",
          "scola_portal",
          "scola_timetable"
        ],
        "installed_modules_checksum": "8574e33e50628d6eb942018a017d6dd6c8bab4667b2b9587729b2c69b799a0d2",
        "entitlements_feature_flags": {
          "scola_account": false,
          "scola_admission": false,
          "scola_advanced_transport": false,
          "scola_bos_rkas": false,
          "scola_cbt": false,
          "scola_dapodik": false,
          "scola_fees": false,
          "scola_foundation_analytics": false,
          "scola_foundation_hr_management": false,
          "scola_hr": false,
          "scola_hr_attendance": false,
          "scola_inventory": false,
          "scola_library": false,
          "scola_lms": false,
          "scola_news": true,
          "scola_payroll": false,
          "scola_report_card": false,
          "scola_smart_attendance": false,
          "scola_student_services": false,
          "scola_transport_route_management": false
        },
        "entitlements_checksum": "9ba52910fb29cae334c51a704d303baac7ec8996a7158b258b0e42059bad9a6c",
        "entitlements_company_id": 20,
        "entitlements_company_name": "Scola Golden School"
      }
    },
    "live_certification": {
      "database_name": "scola_golden",
      "database_uuid": "2bf5fd27-9390-11f1-9617-28e8d4be73f5",
      "golden_fixture_version": "gt-core-b1.1",
      "installed_modules": [
        "scola_attendance",
        "scola_bundle_core",
        "scola_core",
        "scola_hr",
        "scola_identity_admin",
        "scola_leadership_hub",
        "scola_lesson_hours",
        "scola_news",
        "scola_observability",
        "scola_parent",
        "scola_platform",
        "scola_platform_support",
        "scola_portal",
        "scola_timetable"
      ],
      "installed_modules_checksum": "8574e33e50628d6eb942018a017d6dd6c8bab4667b2b9587729b2c69b799a0d2",
      "entitlements_feature_flags": {
        "scola_account": false,
        "scola_admission": false,
        "scola_advanced_transport": false,
        "scola_bos_rkas": false,
        "scola_cbt": false,
        "scola_dapodik": false,
        "scola_fees": false,
        "scola_foundation_analytics": false,
        "scola_foundation_hr_management": false,
        "scola_hr": false,
        "scola_hr_attendance": false,
        "scola_inventory": false,
        "scola_library": false,
        "scola_lms": false,
        "scola_news": true,
        "scola_payroll": false,
        "scola_report_card": false,
        "scola_smart_attendance": false,
        "scola_student_services": false,
        "scola_transport_route_management": false
      },
      "entitlements_checksum": "9ba52910fb29cae334c51a704d303baac7ec8996a7158b258b0e42059bad9a6c",
      "entitlements_company_id": 20,
      "entitlements_company_name": "Scola Golden School"
    }
  },
  "property_ids": [
    "provision_lifecycle",
    "activation_not_v1",
    "public_reset",
    "authenticated_change",
    "admin_reset",
    "deactivate",
    "cross_tenant_isolation",
    "session_revoke_reset",
    "session_revoke_change",
    "session_revoke_admin_reset",
    "session_revoke_deactivate",
    "must_change_api",
    "must_change_rpc",
    "token_negatives",
    "concurrent_consume",
    "concurrent_issue",
    "native_reset_signup",
    "bulk_alternate_path",
    "no_plaintext",
    "audit_success",
    "revoke_failclosed",
    "audit_failclosed",
    "provision_script_no_default_password"
  ],
  "required_case_ids": [
    "DEC014-CREATE-01",
    "DEC014-ACTIVATE-01",
    "DEC014-RESET-OK-01",
    "DEC014-CHANGE-OK-01",
    "DEC014-ADMIN-RESET-OK-01",
    "DEC014-DEACTIVATE-01",
    "DEC014-XTENANT-ADMIN-RESET-01",
    "DEC014-RESET-REVOKE-01",
    "DEC014-CHANGE-SESSION-01",
    "DEC014-ADMIN-RESET-REVOKE-01",
    "DEC014-DEACTIVATE-KILL-01",
    "DEC014-MUSTCHANGE-API-01",
    "DEC014-MUSTCHANGE-RPC-01",
    "DEC014-TOKEN-INVALID-01",
    "DEC014-TOKEN-EXPIRED-01",
    "DEC014-TOKEN-REPLAY-01",
    "DEC014-TOKEN-SUPERSEDED-01",
    "DEC014-TOKEN-CONCURRENT-CONSUME-01",
    "DEC014-TOKEN-CONCURRENT-ISSUE-01",
    "DEC014-TOKEN-WRONG-USER-01",
    "DEC014-TOKEN-WRONG-PURPOSE-01",
    "DEC014-NATIVE-RESET-UNAVAIL-01",
    "DEC014-NATIVE-SIGNUP-UNAVAIL-01",
    "DEC014-BULK-ALT-UNAVAIL-01",
    "DEC014-NO-PLAINTEXT-DEFAULT-01",
    "DEC014-AUDIT-SUCCESS-01",
    "DEC014-REVOKE-FAILCLOSED-01",
    "DEC014-AUDIT-FAILCLOSED-01",
    "DEC014-PROVISION-SCRIPT-NO-DEFAULT-01"
  ],
  "executed_case_ids": [
    "DEC014-CREATE-01",
    "DEC014-ACTIVATE-01",
    "DEC014-RESET-OK-01",
    "DEC014-CHANGE-OK-01",
    "DEC014-ADMIN-RESET-OK-01",
    "DEC014-DEACTIVATE-01",
    "DEC014-XTENANT-ADMIN-RESET-01",
    "DEC014-RESET-REVOKE-01",
    "DEC014-CHANGE-SESSION-01",
    "DEC014-ADMIN-RESET-REVOKE-01",
    "DEC014-DEACTIVATE-KILL-01",
    "DEC014-MUSTCHANGE-API-01",
    "DEC014-MUSTCHANGE-RPC-01",
    "DEC014-TOKEN-INVALID-01",
    "DEC014-TOKEN-EXPIRED-01",
    "DEC014-TOKEN-REPLAY-01",
    "DEC014-TOKEN-SUPERSEDED-01",
    "DEC014-TOKEN-CONCURRENT-CONSUME-01",
    "DEC014-TOKEN-CONCURRENT-ISSUE-01",
    "DEC014-TOKEN-WRONG-USER-01",
    "DEC014-TOKEN-WRONG-PURPOSE-01",
    "DEC014-NATIVE-RESET-UNAVAIL-01",
    "DEC014-NATIVE-SIGNUP-UNAVAIL-01",
    "DEC014-BULK-ALT-UNAVAIL-01",
    "DEC014-NO-PLAINTEXT-DEFAULT-01",
    "DEC014-AUDIT-SUCCESS-01",
    "DEC014-REVOKE-FAILCLOSED-01",
    "DEC014-AUDIT-FAILCLOSED-01",
    "DEC014-PROVISION-SCRIPT-NO-DEFAULT-01"
  ],
  "totals": {
    "total": 29,
    "pass": 29,
    "fail": 0,
    "skip": 0,
    "required": 29,
    "executed_set_matches_required": true,
    "finding_observation_fail": 0
  },
  "cases": [
    {
      "case_id": "DEC014-CREATE-01",
      "status": "PASS",
      "required": true,
      "notes": "caller password ignored; response has no password; must_change verified",
      "endpoint": "/api/v1/users",
      "before": {},
      "actual": {
        "http": 200,
        "success": true,
        "uid": 405,
        "must_change": true,
        "caller_password_ignored": true,
        "plaintext_credential_field": false
      },
      "after": {}
    },
    {
      "case_id": "DEC014-ACTIVATE-01",
      "status": "PASS",
      "required": true,
      "notes": "Activation token is NOT V1; V1 is temporary+must_change",
      "endpoint": "credential_contract_cases.json + res.users",
      "before": {},
      "actual": {
        "v1_provision": "temporary_password_plus_must_change",
        "created_user_must_change": true
      },
      "after": {}
    },
    {
      "case_id": "DEC014-RESET-OK-01",
      "status": "PASS",
      "required": true,
      "notes": "public request followed by controlled shell token retrieval; hash-at-rest preserved",
      "endpoint": "/api/auth/password-reset/request + /confirm + /login",
      "before": {},
      "actual": {
        "request": true,
        "confirm": true,
        "new_login": true
      },
      "after": {}
    },
    {
      "case_id": "DEC014-CHANGE-OK-01",
      "status": "PASS",
      "required": true,
      "notes": "authenticated change clears must_change",
      "endpoint": "/api/auth/change-password",
      "before": {},
      "actual": {
        "login": true,
        "change": true,
        "cleared": true
      },
      "after": {}
    },
    {
      "case_id": "DEC014-ADMIN-RESET-OK-01",
      "status": "PASS",
      "required": true,
      "notes": "authorized same-tenant reset; server-generated temp revealed once; caller-chosen rejected",
      "endpoint": "/api/v1/users/373/reset-password",
      "before": {},
      "actual": {
        "success": true,
        "caller_password_denied": true,
        "fixture_password_unchanged_before_generate": true,
        "temporary_revealed": true,
        "must_change": true,
        "server_generated_applied": true,
        "admin_provided_applied": false
      },
      "after": {}
    },
    {
      "case_id": "DEC014-DEACTIVATE-01",
      "status": "PASS",
      "required": true,
      "notes": "same-tenant disposable user soft-deactivated",
      "endpoint": "/api/v1/users/406",
      "before": {},
      "actual": {
        "success": true,
        "active": false
      },
      "after": {}
    },
    {
      "case_id": "DEC014-XTENANT-ADMIN-RESET-01",
      "status": "PASS",
      "required": true,
      "notes": "GT-T1 school_admin cannot reset GT-T2 school_admin",
      "endpoint": "/api/v1/users/379/reset-password",
      "before": {},
      "actual": {
        "http": 200,
        "denied": true
      },
      "after": {}
    },
    {
      "case_id": "DEC014-RESET-REVOKE-01",
      "status": "PASS",
      "required": true,
      "notes": "public reset revokes pre-existing session",
      "endpoint": "/api/auth/password-reset/confirm",
      "before": {},
      "actual": {
        "old_login": true,
        "confirm": true,
        "old_session_denied": true
      },
      "after": {}
    },
    {
      "case_id": "DEC014-CHANGE-SESSION-01",
      "status": "PASS",
      "required": true,
      "notes": "other session revoked; current session retained per DEC-014",
      "endpoint": "/api/auth/change-password",
      "before": {},
      "actual": {
        "change": true,
        "other_denied": true,
        "current_alive": true
      },
      "after": {}
    },
    {
      "case_id": "DEC014-ADMIN-RESET-REVOKE-01",
      "status": "PASS",
      "required": true,
      "notes": "admin reset revokes all target sessions",
      "endpoint": "/api/v1/users/373/reset-password",
      "before": {},
      "actual": {
        "reset": true,
        "target_session_denied": true
      },
      "after": {}
    },
    {
      "case_id": "DEC014-DEACTIVATE-KILL-01",
      "status": "PASS",
      "required": true,
      "notes": "deactivate kills disposable user session",
      "endpoint": "/api/v1/users/407",
      "before": {},
      "actual": {
        "login": true,
        "deactivate": true,
        "session_denied": true
      },
      "after": {}
    },
    {
      "case_id": "DEC014-MUSTCHANGE-API-01",
      "status": "PASS",
      "required": true,
      "notes": "must_change principal denied through error channel",
      "endpoint": "/api/v1/teacher/dashboard",
      "before": {},
      "actual": {
        "login": true,
        "denied": true,
        "http": 200,
        "error_channel": true
      },
      "after": {}
    },
    {
      "case_id": "DEC014-MUSTCHANGE-RPC-01",
      "status": "PASS",
      "required": true,
      "notes": "must_change principal denied through error channel",
      "endpoint": "/web/dataset/call_kw",
      "before": {},
      "actual": {
        "login": true,
        "denied": true,
        "http": 200,
        "error_channel": true
      },
      "after": {}
    },
    {
      "case_id": "DEC014-TOKEN-INVALID-01",
      "status": "PASS",
      "required": true,
      "notes": "invalid token denied generically",
      "endpoint": "/api/auth/password-reset/confirm",
      "before": {},
      "actual": {
        "denied": true
      },
      "after": {}
    },
    {
      "case_id": "DEC014-TOKEN-EXPIRED-01",
      "status": "PASS",
      "required": true,
      "notes": "expired token denied",
      "endpoint": "/api/auth/password-reset/confirm",
      "before": {},
      "actual": {
        "denied": true,
        "force_expired": true,
        "expire_before": "2026-08-29 03:56:36",
        "expire_after": "2026-08-29 03:46:08.138836"
      },
      "after": {}
    },
    {
      "case_id": "DEC014-TOKEN-REPLAY-01",
      "status": "PASS",
      "required": true,
      "notes": "consumed token cannot be replayed",
      "endpoint": "/api/auth/password-reset/confirm",
      "before": {},
      "actual": {
        "first_success": true,
        "replay_denied": true
      },
      "after": {}
    },
    {
      "case_id": "DEC014-TOKEN-SUPERSEDED-01",
      "status": "PASS",
      "required": true,
      "notes": "prior token denied after re-issue",
      "endpoint": "/api/auth/password-reset/confirm",
      "before": {},
      "actual": {
        "superseded_denied": true
      },
      "after": {}
    },
    {
      "case_id": "DEC014-TOKEN-CONCURRENT-CONSUME-01",
      "status": "PASS",
      "required": true,
      "notes": "two parallel confirms; exactly one succeeds",
      "endpoint": "/api/auth/password-reset/confirm x2",
      "before": {},
      "actual": {
        "success_count": 1
      },
      "after": {}
    },
    {
      "case_id": "DEC014-TOKEN-CONCURRENT-ISSUE-01",
      "status": "PASS",
      "required": true,
      "notes": "two parallel issuances leave at most one open token",
      "endpoint": "/api/auth/password-reset/request x2",
      "before": {},
      "actual": {
        "issued_count": 2,
        "open_count": 1
      },
      "after": {}
    },
    {
      "case_id": "DEC014-TOKEN-WRONG-USER-01",
      "status": "PASS",
      "required": true,
      "notes": "token binding rejects a different expected user",
      "endpoint": "validate_consume(expected_user_id)",
      "before": {},
      "actual": {
        "denied": true
      },
      "after": {}
    },
    {
      "case_id": "DEC014-TOKEN-WRONG-PURPOSE-01",
      "status": "PASS",
      "required": true,
      "notes": "activation-purpose token rejected by reset confirm",
      "endpoint": "/api/auth/password-reset/confirm",
      "before": {},
      "actual": {
        "denied": true
      },
      "after": {}
    },
    {
      "case_id": "DEC014-NATIVE-RESET-UNAVAIL-01",
      "status": "PASS",
      "required": true,
      "notes": "native credential surface unavailable; valid token cannot set password",
      "endpoint": "/web/reset_password",
      "before": {
        "path": "/web/reset_password",
        "session": "anonymous"
      },
      "actual": {
        "http_status": 404,
        "post_http_status": 400,
        "shell_token_issued": true,
        "shell_signup_token_issued": false,
        "get_blocked": true,
        "post_blocked": true,
        "password_unchanged": true
      },
      "after": {
        "native_surface_opened": false
      }
    },
    {
      "case_id": "DEC014-NATIVE-SIGNUP-UNAVAIL-01",
      "status": "PASS",
      "required": true,
      "notes": "native credential surface unavailable; valid token cannot set password",
      "endpoint": "/web/signup?token=<shell-issued>",
      "before": {
        "path": "/web/signup?token=<redacted>",
        "session": "anonymous"
      },
      "actual": {
        "http_status": 404,
        "post_http_status": 400,
        "shell_token_issued": true,
        "shell_signup_token_issued": true,
        "get_blocked": true,
        "post_blocked": true,
        "password_unchanged": true
      },
      "after": {
        "native_surface_opened": false
      }
    },
    {
      "case_id": "DEC014-BULK-ALT-UNAVAIL-01",
      "status": "PASS",
      "required": true,
      "notes": "retired bulk parent reset returns 410 without credentials",
      "endpoint": "/api/v1/admin/accounts/reset-parent-passwords",
      "before": {},
      "actual": {
        "gone": true,
        "credentials_returned": false
      },
      "after": {}
    },
    {
      "case_id": "DEC014-NO-PLAINTEXT-DEFAULT-01",
      "status": "PASS",
      "required": true,
      "notes": "default create/provision response contains no credential value",
      "endpoint": "/api/v1/users",
      "before": {},
      "actual": {
        "success": true,
        "credential_value_returned": false
      },
      "after": {}
    },
    {
      "case_id": "DEC014-AUDIT-SUCCESS-01",
      "status": "PASS",
      "required": true,
      "notes": "successful admin reset persists credential audit event",
      "endpoint": "scola.credential.audit.event",
      "before": {},
      "actual": {
        "reset": true,
        "audit_found": true
      },
      "after": {}
    },
    {
      "case_id": "DEC014-REVOKE-FAILCLOSED-01",
      "status": "PASS",
      "required": true,
      "notes": "unavailable session store raises instead of silent success",
      "endpoint": "revoke_user_sessions_or_raise",
      "before": {},
      "actual": {
        "raised": true
      },
      "after": {}
    },
    {
      "case_id": "DEC014-AUDIT-FAILCLOSED-01",
      "status": "PASS",
      "required": true,
      "notes": "mandatory audit write failure raises",
      "endpoint": "record_credential_event(mandatory=True)",
      "before": {},
      "actual": {
        "raised": true
      },
      "after": {}
    },
    {
      "case_id": "DEC014-PROVISION-SCRIPT-NO-DEFAULT-01",
      "status": "PASS",
      "required": true,
      "notes": "provision script requires an explicit secret and has no default",
      "endpoint": "/home/scola/odoo/custom_addons_scola/gcgscola/scripts/maintenance/provision_clean_tenant.sh",
      "before": {
        "script_exists": true
      },
      "actual": {
        "empty_default": true,
        "missing_secret_guard": true,
        "predictable_assignment": false,
        "prints_password_value": false
      },
      "after": {
        "runtime_secret_created": false
      }
    }
  ],
  "finding_observations": [
    {
      "finding_ids": [
        "T0F-001",
        "T0F-005"
      ],
      "case_id": "DEC014-XTENANT-ADMIN-RESET-01",
      "status": "PASS",
      "before": {
        "login": "gt2.school_admin",
        "uid": 379,
        "active": true,
        "write_date": "2026-08-26 05:54:24.047501",
        "admin_reset_audit_count": 0
      },
      "actual": {
        "http_status": 200,
        "denied": true,
        "login_field": "login",
        "target_login": "gt2.school_admin"
      },
      "after": {
        "login": "gt2.school_admin",
        "uid": 379,
        "active": true,
        "write_date": "2026-08-26 05:54:24.047501",
        "admin_reset_audit_count": 0
      }
    },
    {
      "finding_ids": [
        "T0F-007"
      ],
      "case_ids": [
        "DEC014-MUSTCHANGE-API-01",
        "DEC014-MUSTCHANGE-RPC-01"
      ],
      "status": "PASS",
      "before": {
        "must_change": true,
        "login": "gt.teacher.assigned"
      },
      "actual": {
        "api": {
          "login": true,
          "denied": true,
          "http": 200,
          "error_channel": true
        },
        "rpc": {
          "login": true,
          "denied": true,
          "http": 200,
          "error_channel": true
        }
      },
      "after": {
        "fixture_restored_must_change": false
      }
    },
    {
      "finding_ids": [
        "T0F-015"
      ],
      "status": "PASS",
      "before": {
        "target_login": "gt2.school_admin",
        "target_uid": 379,
        "partner_id": 910,
        "partner_name": "GT2 School Admin",
        "company_id": 22
      },
      "actual": {
        "partner_search_read": {
          "denied_or_filtered": true,
          "error_present": true,
          "returned_record_count": null
        },
        "partner_name_search": {
          "denied_or_filtered": true,
          "error_present": true,
          "returned_record_count": null
        },
        "res_users_search_read": {
          "denied_or_filtered": true,
          "error_present": true,
          "returned_record_count": null
        },
        "relation_users_read": {
          "denied_or_filtered": true,
          "error_present": true,
          "returned_record_count": null
        }
      },
      "after": {
        "mutation_attempted": false
      }
    },
    {
      "finding_ids": [
        "T0F-001"
      ],
      "status": "PASS",
      "before": {
        "active_role": "teacher",
        "admin_group": true
      },
      "actual": {
        "login_ok": true,
        "active_role": "teacher",
        "admin_group_assigned": true,
        "calendar_save_denied": true,
        "http_status": 200,
        "result_success": false,
        "error": "access_denied"
      },
      "after": {
        "admin_group_removed": true,
        "probe_event_cleaned": true
      }
    },
    {
      "finding_ids": [
        "T0F-004"
      ],
      "status": "PASS",
      "before": {
        "installed_optional_modules": [
          "scola_hr",
          "scola_leadership_hub"
        ],
        "admin_login": true,
        "hr_denied": true,
        "finance_denied": true
      },
      "actual": {
        "enabled_module": "scola_hr",
        "enabled_feature": "scola_hr",
        "enabled_endpoint": "/api/v1/hr/admin/overview/",
        "enabled_boundary_not_feature_disabled": true,
        "finance_still_denied": true
      },
      "after": {
        "optional_entitlements_restored_to_off": true
      }
    }
  ]
}