T6A Residuals¶
Historical T6A-B residuals (source at T6A-B; do not treat as current source)¶
Findings from T6A-B source + read-only runtime. No T6A application patch was applied in that tranche.
| ID | Severity | Contract | Source evidence | Runtime evidence | Impact | Disposition |
|---|---|---|---|---|---|---|
| T6A-F001 | S1 | DEC-014; item 15 | Dual @http.route('/api/SPMB/account/register') in spmb_account_api.py and spmb_lifecycle_api.py; load order lifecycle last |
Not dispatched live (T6A-B) | Two credential lifecycles on one path | PRODUCT_DECISION_REQUIRED / LEGACY_REMOVE |
| T6A-F002 | S1 | DEC-014 “no link-to-existing-account-by-email” | check_existing_parent + _create_linked_applicant skips verification; returns sibling student PII |
Not dispatched live | Account hijack / PII leak / skip OTP | OPEN — do not invent replacement flow |
| T6A-F003 | S1 | DEC-014 server-generated temp / must_change | register_account requires caller password (spmb_api.py) |
Not dispatched live | Customer-chosen initial password | OPEN |
| T6A-F004 | S1 | Exact public allowlist | PUBLIC_API_ROUTE_ALLOWLIST includes /api/SPMB/public/ prefix |
is_public_api_route('/api/SPMB/public/anything-new') is True |
Future child routes inherit public | OPEN |
| T6A-F005 | S1 | STAB-013 / DEC-003 | Config save/delete use VIEW capabilities | Dev installed+unentitled not probed | Viewer may configure/delete | OPEN — Phase 3 blocked |
| T6A-F006 | S1 | Items 2,4,6,7 | No signed transition table; admission_transition writes caller state; enroll_student creates op.student |
Not run | Implementing current code would fake an approved lifecycle | GATE FAIL |
| T6A-F007 | S2 | Item 1 / IDM | Email unique constraint commented out; search-then-create | Not run | Duplicate applicants | OPEN |
| T6A-F008 | S2 | Item 5 / concurrent last-seat | Advisory lock released in finally before student create |
Not run | Two students / over-quota | OPEN |
| T6A-F009 | S2 | Item 8/9 | No idempotency key; per-record ir.cron.sudo().create |
Not run | Duplicate handoff; sudo cron sprawl | OPEN |
| T6A-F010 | S2 | Item 14 / STAB-024 | scola_admission_fees_bridge auto_install=True; payment APIs in base |
Demo: fees entitled, bridge uninstalled; GBN: bridge installed (excluded) | Peer SKU pulled or fees API without entitlement | OPEN |
| T6A-F011 | S2 | QG-14 | Core smoke SM-T1-001A admissions dashboard |
Source only | Core suite not isolated from W03 | LEGACY_REMOVE from Core smoke |
| T6A-F012 | S2 | PKG-ADM-W03 | adm_topology_smoke.spec.ts assertion-free |
Source only | False green | not PASS |
| T6A-F013 | S2 | DEC-014 / canonical UI | Native /my/admission* website portal |
Source only | Alternate customer lifecycle | LEGACY_REMOVE |
| T6A-F014 | S2 | W17 | Complaints leaves/APIs/models inside scola_admission |
FE launcher still shows Keluhan | Excluded domain in SC-ADM shell | EXPLICITLY_EXCLUDED_FAIL_CLOSED |
| T6A-F015 | S2 | Pathless JSON routes | @http.route(type='json') without URL |
Source only | RPC-name invocation | LEGACY_REMOVE |
| T6A-F016 | S3 | Identity hygiene | Dev source-identity env SHA 3d7a213 vs worktree fe40da6 |
Live probe | Dev served-identity reporting stale | note; not a T6A code change |
| T6A-F017 | S3 | Isolation | scoladev and scoladev_demo share UUID fad7c305-… |
psql + certification-identity | Clone lineage; isolation still PASS by name/port | note |
| T6A-F018 | S2 | /web/dataset bypass |
Admission models remain Odoo models | Not run | API policy may be skipped | OPEN |
| T6A-F019 | S2 | Item 12 | Public status + quota-monitor | Prefix public True | Enumeration / capacity leak | OPEN |
| T6A-F020 | S2 | sudo budget | Multiple _sudo_model in SPMB controllers |
Not measured this tranche | Superuser browsing risk | OPEN — no new sudo added |
| T6A-F021 | S2 | STAB-013 company | Staff transition/list company filter unproven | RT-W03-TEN-01 NOT RUN |
GT-T1/T2 leakage possible | OPEN |
| T6A-F022 | S1 | Phase 2 contract | 15 W03 properties lack signed immutable approval | Decision ledger / catalog / matrix all BLOCKED | Cannot enter Phases 3–10 | T6A-B |
Descendant engineering 2026-08-16 (source patches; runtime still open)¶
| ID | After source patch | Runtime | Residual |
|---|---|---|---|
| T6A-F001 | Lifecycle register route removed; account API is canonical | Not live | Need live dispatch proof |
| T6A-F002 | check_existing_parent always empty; linked-create path gone |
Not live | Need denied DB before/after |
| T6A-F003 | Register rejects password; activation chooses password after token | Not live | Need API + /web/dataset bypass probe |
| T6A-F004 | Exact /api/SPMB/public/quota-monitor; unit proves nested path False |
Unit only | Need live nested 401/403 |
| T6A-F005 | Config mutation caps split from view; archive instead of unlink | Not live | Viewer mutate DB proof |
| T6A-F006 | action_w03_transition + SoD; staff transition no longer writes free state |
Not live | STA/SoD runtime |
| T6A-F008 | Quota reserved at accept with FOR UPDATE; enroll requires officer |
Not live | Concurrent last-seat |
| T6A-F009 | Outbox + batched cron; enroll idempotency model | Not live | Retry same/different payload |
| T6A-F010 | Payment/test/scholarship feature_disabled without peer flag |
Not live | Installed bridge + peer OFF |
| T6A-F011 | Core smoke no longer opens admissions dashboard | Source | Core E2E not re-run |
| T6A-F012 | PKG-ADM-W03 unit + package identity | Not a full suite | Need dedicated runtime suite |
| T6A-F013 | Portal GET redirect /spmb; POST 410 |
Not live | Live 410 proof |
| T6A-F014 | Complaint APIs return feature_disabled |
Not live | Menu still present if capability granted; V1 grants none |
| T6A-F015 | Pathless JSON stubs remain | Open | LEGACY_REMOVE still open |
| T6A-F018 | /web/dataset still unprobed |
Open | Mandatory negative |
| T6A-F022 | Product contract approved | Closed as product blocker | Engineering runtime remains |
New residual: T6A-F023 — mandatory RT-W03 runtime matrix, E1.2 rebind, Core regression, module upgrade, and immutable demo candidate are not done. This is why the engineering label is not complete.
Current independent disposition (2026-08-17)¶
The OPEN and not done labels in the historical sections describe the 2026-08-16 checkpoint and are not current-tip status. Current evidence closes T6A-F001–F015, F018, F021, F022, and F023 for the approved W03/SC-ADM surface. See T6A-independent-findings.md.
Remaining boundaries are explicit downstream exclusions: optional Fees/CBT/Foundation and other non-SC-ADM workflows are not certified; demo/production promotion requires its own immutable-candidate and authorization gate; GBN remains excluded and frozen.