T6A Result¶

Mode: server · workspace /home/scola/odoo
Docs read: AGENTS.md, AI_AGENT_MASTER_GUIDE, development-guide, workspace-governance, architecture-api, release-environment-promotion, environment-isolation-and-promotion, testing-guidelines, W03 approved product contract, T6A-B artefacts, DEC-001/003/004/008/014.

RC1-A remains:

CORE RC1 CERTIFIED — BOUNDED CORE V1 — GOLDEN/DEV/DEMO — GBN EXCLUDED — PRODUCTION NOT AUTHORIZED

This file preserves the historical T6A-B outcome, then records the descendant engineering tranche after product approval.

Historical T6A-B (do not rewrite)¶

Engineering label at issue: T6A ENTRY BLOCKED — NAMED PRODUCT DECISIONS REQUIRED

That label was correct when issued. Product decisions 1–15 were unsigned. Phases 3–10 were not entered. Original T6A-B evidence remains in this file's first committed version and in T6A-W03-product-decision-gate.md.

Historical descendant engineering checkpoint (2026-08-16, after requesting-user approval)¶

Current engineering label:

T6A NOT COMPLETE — NAMED ENGINEERING OR SECURITY FAILURES REMAIN

This is not an independent certification. Production is not authorized. No demo candidate was created. GBN and all production tenants remained unchanged.

Why not T6A ENGINEERING COMPLETE¶

Source implementation for the approved W03 contract was started and unit-tested, but the mandatory runtime adversarial matrix was not executed on a disposable DB / Golden overlay / entitled-dev profile. Without bound runtime evidence (DB before/after, concurrent last-seat, package-off, GT-T1/T2, E1.2 rebind, Core W01/W02/W05 regression on the new tip), the candidate is not ready for independent audit.

What was implemented in source (uncommitted application tree)¶

Priority	Source change
1 Credentials	Dual lifecycle register removed; caller password denied; no public email-link; OTP → DEC-014 activation token → first password; `/my/admission*` GET redirects `/spmb`, POST 410
2 Public allowlist	`/api/SPMB/public/` prefix replaced by exact `/api/SPMB/public/quota-monitor`; nested `/anything-new` is not public (unit)
3–4 Auth	Acting-role already in `compute_permissions`; `admissions.*` wildcards split to viewer/verifier+enroll/approver/manager; config save/delete no longer use `.view`
5–7 State/quota/enroll	Canonical W03 machine + SoD helpers; quota `FOR UPDATE` at accept; `enroll_student` denied unless `w03_enroll`; applicant CTA cannot enroll
8 Recovery	Per-record cron replaced by unique outbox + batched cron
9 Bridges	Payment/invoice/scholarship/test routes return `feature_disabled` without peer entitlement; complaints fail-closed
10 Suites	Core smoke `SM-T1-001A` no longer opens admissions dashboard; `PKG-ADM-W03` unit + package identity tests added

Unit evidence (file-based, not Odoo runtime): W03 PKG 25 OK; structure 7 OK; auth capabilities 75 OK; route access 56 OK; gap01 8 OK; portal 15 OK; dashboard 13 OK; FE capability/parity 12 OK; sudo budget PASS (admission still 1); route budget PASS; isolation --live PASS.

Named remaining failures¶

No disposable-DB / Golden-overlay runtime for RT-W03-* POS/NEG/SCP/TEN/VAL/STA/IDM/REC/XRP/XMD/UIA with DB before/after.
Module not upgraded (scola_admission 17.0.1.2.0 + new models) on any allowed runtime.
E1.2 rebind + validator not run after auth/route/credential application changes.
Core W01/W02/W05 regression not re-run on the new tip.
No immutable demo candidate; application FE/BE changes are dirty worktrees, not committed/pushed exact SHAs.
Concurrent last-seat and concurrent enroll remain source-only.
Package OFF / installed-unentitled / GT-T1 vs GT-T2 remain not runtime-proven.
/web/dataset bypass still not probed.
Pathless @http.route(type='json') stubs remain in ranking/applicants controllers.
Fees bridge auto_install=True unchanged (runtime still requires both entitlements).

Identities (this tranche)¶

Side	Tip	Notes
FE	`447889e6…` (docs checkpoint) + dirty application tree	ahead 1 vs `origin/develop` (docs-only); application files uncommitted
BE	`fe40da69…` + dirty application tree	`main` clean at tip; W03 application files uncommitted
Isolation	PASS	GBN/production not mutated

GBN and production¶

GBN and all production tenants (Spansa, Al-Jabbar, Rejis, SDN 1 PGT) remained unchanged. No production service, database, docroot, or entitlement was written.

Artefacts¶

Historical T6A-B set preserved
T6A-W03-approved-product-contract.md (immutable approval)
This descendant result
T6A-residuals.md updated with source-closed vs runtime-open split

Independent completion (2026-08-17)¶

T6A COMPLETE — W03 / SC-ADM CERTIFIED FOR DEV AND GOLDEN — DEMO/PRODUCTION NOT PROMOTED

The checkpoint residuals above are historical. They were closed by the exact runtime and identity evidence in T6A-independent-verdict.md: W03 31/31 on clean and mixed installs, E1.2 29/29 with validator PASS, W01 64/64, W02 33/33, and W05 16/16. The application identities are FE 533725cb… and BE d23c2c6…; the FE docs descendant is explicitly covered by --allow-docs-tip.

This is bounded to the approved W03/SC-ADM contract. It does not certify optional business workflows and does not authorize demo or production promotion. GBN remains excluded/frozen.