T3-W02 Validation Matrix¶
Runtime PASS/FAIL from w02_runtime_certify.py. HTTP-only PASS is forbidden.
Bound run: T3-W02-20260811T205934Z (T3.1) · BE 7e2f17f8… · overlay gt-w02-1.0 · 33/33.
Prior T3-W02-20260811T202759Z (32/32) superseded after T3-C audit remediation.
| case_id | actor | action | expected_response | expected_db | status |
|---|---|---|---|---|---|
| W02-CREATE-OK | school_admin_t1 | import 1 student+parent+batch_id | success | 1 student co20; enrollment; parent link; no forced user | PASS |
| W02-CREATE-FOREIGN-BATCH | school_admin_t1 | import batch_id t2 | validation fail | 0 new student | PASS |
| W02-CREATE-DUP-NSN | school_admin_t1 | import duplicate nsn | fail | still 1 student | PASS |
| W02-IMPORT-MIXED-ROW | school_admin_t1 | valid+invalid+valid, strict_mode false | partial counts | invalid row no partial graph | PASS |
| W02-SIBLING-PARENT-REUSE | school_admin_t1 | 2 rows same parent key | success | 1 parent / 1 partner; 2 students | PASS |
| W02-ADMIN-FOREIGN-DETAIL | school_admin_t1 | detail t2 student | not_found/denied | unchanged | PASS |
| W02-ADMIN-LIST-OWN | school_admin_t1 | students/list | only T1 | T2 id absent | PASS |
| W02-TEACHER-IMPORT-DENIED | teacher | import | denied | 0 writes | PASS |
| W02-UPDATE-ATOMIC | school_admin_t1 | save with dup nsn | fail | original fields intact | PASS |
| W02-UPDATE-PARENT-BOUNDARY | school_admin_t1 | save then bad relation/save | relation denied | student profile intact | PASS |
| W02-PARENT-FOREIGN-PARTNER-NO-EXISTING | school_admin_t1 | relation/save T2 partner without op.parent | scope_error | 0 Parent.create; links unchanged | PASS |
| W02-DOUBLE-SUBMIT | school_admin_t1 | same payload ×2 | 2nd rejected | unique nsn holds (1 row) | PASS |
| W02-RPC-TEACHER-CREATE | teacher | call_kw create | denied | 0 rows | PASS |
| W02-RPC-STUDENT-CREATE | student | call_kw create | denied | 0 rows | PASS |
| W02-RPC-PARENT-CREATE | parent | call_kw create | denied | 0 rows | PASS |
| W02-RPC-ADMIN-CREATE | school_admin | call_kw create | denied/no row (product API policy) | 0 rows | PASS |
| W02-RPC-*-WRITE/UNLINK | teacher/student/parent | call_kw mutate | no mutation | row retained | PASS |
| W02-RPC-TEACHER-*-T2 | teacher | search/read/count T2 | no exposure | — | PASS |
| W02-PARENT-SCOPE | parent_a | attendance children + daily B | A only; B denied | — | PASS |
| W02-PARENT-SCOPE-DASHBOARD | parent_a | /api/v1/parent/dashboard |
children=[A] | B absent | PASS |
| W02-PARENT-SCOPE-DIRECT | parent_a | /api/v1/parent/child/* B id |
Child not found | — | PASS |
| W02-PARENT-NIK-GLOBAL-UNIQUE | shell | dup NIK same+cross tenant | rejected | count=1; no name leak | PASS |
| W02-PARENT-NIK-NO-LEAK-LIST | school_admin_t1 | parents/list by NIK | no T2 leak | — | PASS |
| W02-ARCHIVE-DEACTIVATE | school_admin_t1 | set-active false | success | active=false; name intact | PASS |
| W02-STUDENT-SELF-SCOPE | disposable student | peer detail/list/RPC | denied/empty | disposable deactivated | PASS |
Portal endpoints of record: /api/v1/parent/dashboard, /api/v1/parent/child/*, plus attendance parent children on Golden Core tip (LMS not installed).