T6B.2 Authorization Traceability

Mode: server · workspace /home/scola/odoo

Requirement → contract → code → test → runtime.

Requirement	Contract	Code	Unit/static	Runtime
Dual-parent auto-install only	T6B2 contract §installation	scola_admission_fees_bridge/__manifest__.py auto_install=True, depends scola_admission+scola_fees, application=False	PKG-ADM-FEES-BRIDGE 01/02; topology unit test_admission_fees_bridge_is_dual_parent_auto_install; package_topology_ci_check composite	Phase 8 disposable ADM-only / FEES-only / both
Both entitlements at execution	T6B.1 item 25 + T6B2 matrix	t6b2_state.assert_both_entitlements; handoff process re-reads handoff company flags	unit 03	RT-T6B2-UIA-01, XINT-A, XINT-E
Enrollment Officer has no finance authority	W03 SoD + W10 maker-checker	W03 enrollment_officer only; W10 create_pending_from_bridge rejects missing processor context; w10_creator_id=SUPERUSER_ID	unit 08	RT-T6B2-NEG-01, XINT-D
Pending-only W10 enrollment	T6B2 §7	create_pending_from_bridge writes w10_state=pending; no bill	unit 07/12	RT-T6B2-POS-01, STA-01
Explicit templates; no global fallback	T6B2 §6	select_explicit_templates; no FeeTemplate.search	unit 04/05 + enroll path	RT-T6B2-VAL-01
Cross-company deny	W10 item 4 + T6B2 §11	assert_same_company; register write; register API FK	unit 06	RT-T6B2-TEN-01, XINT-C
Durable handoff; W03 not rolled back	T6B2 §9	commit before state=done; process in savepoint	enroll path unit	RT-T6B2-REC-01, XINT-F
Idempotent / concurrent	T6B2 §10	SQL unique + FOR UPDATE	unit 09/10	RT-T6B2-IDM-01, XINT-B
No scholarship amount change	T6B2 §8	no percentage copy; W10 rejects discount_amount	unit 13	VAL amount from rule only
Alternate SPMB invoice/payment fail-close	T6B2 §13	deny_pre_enrollment_billing	unit 14; W03 leftover; portal invoice	RT-T6B2-XMD-01, XINT-H
No second ledger on admission detail	T6B2 §5	_t6b2_handoff_projection; fees: []	source	RT-T6B2-XRP-01
No W03 auto-refund	T6B2 §12	enrolled terminal; cancel_if_unbilled → recovery_required if verified	unit 11	XINT-G
No /web/dataset bypass	T6B2 §13	W10 canonical write guard + no bridge controllers	unit 15	RT-T6B2-XMD-01
Processor uses source company entitlements	T6B2 §3	_entitlement_payload(env, handoff.company_id)	unit 16	UIA / REC
No standalone menu	catalog Internal Platform	views have no ir.ui.menu	unit no_standalone_menu	UIA / topology
Sudo/route budgets not raised	development-guide §10	no new controllers; no new .sudo() on bridge	sudo 15/21 fees; route budget	static QC

Enrollment Officer V1 binding remains W03 head_admin for accepted→enrolled only. Billing Manager V1 binding remains W10 treasurer with finance.billing.manage. These are not unified.