W18 Product Enable)¶

Item	Value
Gate	QG-11 Security and privacy
Status	PASS bounded (engineering re-run)
Executed (UTC)	2026-09-01
Mode	Server development @ `/home/scola/odoo`
FE tip	`develop` (uncommitted — RC1 reopen W08/W18)
BE tip	`main@a951b8b` + uncommitted W08/W18/STAB patches
SSOT	09-release-quality-gate.md §4 QG-11

Scope accepted (this run)¶

Area	Change	Evidence	Verdict
W08 promotion	STAB-009: capability guard replaces containment; model maker-checker unchanged	`promotion_admin_api.py`; structure test `test_w08_promotion_admin_*`	PASS bounded
W18 messaging	Routes delegate to base controllers; STAB-006 batch membership filter + attachment scope	`general_messaging_api.py`; `test_messaging_structure_unit.py`	PASS bounded
W17 complaint	STAB-001: all endpoints fail-closed + audit log on deny	`public_complaint_api.py`; `test_w17_containment_structure_unit.py`	CONTAINMENT PASS
Controller sudo budget	No new `.sudo()`	`sudo_budget_check --strict`	PASS
Route budget	No new route files	`controller_route_budget_check`	PASS
Backend unit suites	7/7 PASS (topology manifest pins updated)	`scola_core/tests/*` + `scola_cbt/tests/test_runner_admission_unit.py`	PASS
FE RC1 policy	Promotion + messaging removed from fail-closed; complaint retained	`rc1CoreSurfacePolicy.spec.js`	PASS

Explicit exclusions (unchanged)¶

Item	Track
W17 full product surface (DG-W17-01)	Out of V1 until product decision
Independent DPO audit of production tenants	Required before per-tenant rollout
QG-17 two full-matrix runs @ new tip	Pending commit + manifest refresh

Verdict¶

QG-11 → PASS bounded after W08/W18 product enable and W17 fail-closed hardening with engineering QC green. Production promotion still requires immutable manifest, QG-17, and explicit authorization per release-environment-promotion.md.