Lewati ke isi

T0-E2 Preflight — E1.2 Baseline Freeze Gate

Item Value
Mode Server /home/scola/odoo
Docs read development-guide.md, workspace-governance.md, architecture-api.md, 01-product-contract.md, package-catalog.yaml, T0-C results, T0-E1.2-final-reaudit-*, T0-E1.2-runtime-manifest.json
Gate Phase 0 — run E1.2 validator before any E2 package/topology/decision edits
Prior gate STOP — tip drift after independent VERIFIED tip (e5dc9e86…)
Chosen path Option B — explicit engineering rebind on tip #74/#80
Result PHASE 0 GREEN — rebound validator PASS on run T0-E1.2-REBIND-20260810T011655Z
Not claimed T0 closed; independent VERIFIED on tip be7946b… (prior VERIFIED preserved)

Independently certified E1.2 identities (FROZEN — do not rewrite)

Source of truth: independent final reaudit + frozen runtime manifest / matrix.

Field Certified value
Independent verdict T0-E1.2 VERIFIED — SECURITY/ENFORCEMENT FINDINGS CLOSED (E11-A)
Run / DEC-014 matrix T0-E1.2-20260809T232557Z — 29/29 PASS, 0 skip
BE application commit e5dc9e8683de70e37cc82e9cbed8d57a693d678c
BE application tree 8f49f43e74f36578a881edc94677e1e82c5d5e62c121cceafce92164de5e7bf2
FE application commit (manifest) 920138eab098b4818d39c6833bf36d87d442912a
FE application tree (manifest) 0483accf2d113546e87f90d6da235cf66514579b8419525ce5b38af9788f7bd8
FE docs tip at freeze f706d8f41b7e1e40c7a2c130fc5acd086021bfbb (docs-only tip allowed)
Golden DB scola_golden / UUID 2bf5fd27-9390-11f1-9617-28e8d4be73f5
Fixture gt-core-b1.1
Installed modules checksum 8574e33e50628d6eb942018a017d6dd6c8bab4667b2b9587729b2c69b799a0d2 (14 modules)
Entitlements checksum 40610cec33dedc15cafbbf1fa6af547881bdd486660a9fb4c1da447839d7bd21 (20 flags)
Route denominator bound in frozen manifest / matrix (unchanged by this preflight)
Security findings T0F-001…009 / 014 / 015 closed by independent audit; T0F-010/011/012 remain for E2

Preserved audit inputs (local, some still untracked at gate time):

  • docs/release-readiness/audit/T0-E1.2-final-reaudit-*.md
  • Prior T0-E1.2-re-audit-*.md (historical)
  • execution/T0-E1.2-runtime-manifest.json
  • execution/T0-E1.2-evidence/T0-E1.2-20260809T232557Z-security-matrix.json

Current tip vs certified (drift)

Repo Certified application tip Current HEAD Drift since certification
BE gcgscola main e5dc9e86… be7946b1… 118bd03 / #74 admin-provided password apply
FE scola-fe-v2 develop app 920138ea… / docs f706d8f4… c3bca206… 8f2da2be / #80 reset-password dialog alignment

Golden HTTP at gate time still advertised env SHA e5dc9e86…, but workspace BE tree already equals post-#74 tree 4aaaa9f9… — so live binding cannot match the certified freeze without either resetting tips or an explicit new E1.2 freeze (forbidden as a silent step).

E1.2 validator probe (this gate)

python3 scripts/golden/e12_evidence_identity_validator.py \
  --manifest …/T0-E1.2-runtime-manifest.json \
  --results …/T0-E1.2-20260809T232557Z-security-matrix.json \
  --fe-root …/scola-fe-v2 --be-root …/gcgscola --dist …/dist \
  --allow-docs-tip

Result: FAIL (8 issues) — not green.

Observed failure classes (summary):

  1. FE dirty: untracked T0-E1.2-final-reaudit-*.md
  2. Frontend application tree mismatch (manifest ≠ workspace)
  3. Backend application tree mismatch (manifest ≠ workspace)
  4. Backend runtime tree ≠ certified workspace BE tree
  5. Docs-tip refused because application tree changed (FE + BE)
  6. Frontend build checksum / served identity vs dist/version.json mismatch

Per T0-E2 Phase 0:

If E1.2 validator is not green before E2 work: STOP.
Do not proceed by silently regenerating evidence.

Gate decision

T0-E2 PHASE 0 GREEN (Option B engineering rebind)

Independent VERIFIED tip e5dc9e86… / run …232557Z remains preserved. Tip #74/#80 was explicitly re-bound via named run T0-E1.2-REBIND-20260810T011655Z (29/29 + validator PASS). Independent re-confirmation of the rebound tip is still pending and is not claimed here.

E2 package/topology/decision work may proceed without redesigning the frozen security enforcement baseline.

Required human choice before E2 continues

~~Await A/B/C~~ — B selected and executed.

B resolution (executed)

  1. Treated #74 / #80 as the new application tip
  2. Named E1.2 identity re-freeze: T0-E1.2-REBIND-20260810T011655Z
  3. Engineering validator PASS; independent re-confirm of tip still pending
  4. E2 Phases 1–18 unlocked for engineering

Explicit non-actions taken

  • Did not silently overwrite the independently VERIFIED prior freeze without naming the rebind
  • Did not redesign active-role / credential lifecycle architecture / route auth / Golden fixture
  • Did not start T1
  • Did not mark T0F-010/011/012 fixed in this Phase 0 step

Next step

Continue T0-E2 Phases 1–18 on tip be7946b… / FE 71d85570… (plus subsequent E2 commits).