Platform Authorization Current Surface Validation — 2026-08-08¶
- Status:
STATIC VALIDATION PASS / CURRENT ENVIRONMENT EVIDENCE NOT RUN - Review ref:
qa/master@2c0dd0bfadde7633337ec4357be1cbf9835c5c8b - Source refresh:
PLATFORM_AUTHORIZATION_CURRENT_SURFACE_REFRESH_2026-08-08.md - Action matrix:
PLATFORM_AUTHORIZATION_CURRENT_ACTION_MATRIX_2026-08-08.md - Read-only package:
RBR-ACCESS-001-READONLY-CURRENT-SURFACE-PREFLIGHT.md - Effects: static source and documentation review only
1. Validation Purpose¶
This document validates:
- that the access refresh is supported by current source;
- that the action matrix preserves route, actor, tenant, record, state and effect layers;
- that the preflight remains read-only and bounded;
- that the documentation does not convert a source observation into an unapproved role policy.
It does not validate current database rows, current browser behavior, current role assignments or any write action.
2. Baseline And Core Infrastructure¶
Previous access baseline:
3c084671c034f8f5136b02dce990ecff6c66d107
Current review ref:
2c0dd0bfadde7633337ec4357be1cbf9835c5c8b
Current is 63 commits ahead of the previous access baseline.
The core access owner blobs remain unchanged:
| File | Blob SHA | Result |
|---|---|---|
config/config.php |
b49bdf04441c2fe09ba1b53bd7cccc576f260d00 |
unchanged |
index.php |
c24892da7013978b9917b451eacbec3c27f25eff |
unchanged |
api/index.php |
f2b9fb459363ca7fe7c852d1f5c1928ee0e90e24 |
unchanged |
app/shared/api/router.php |
42acecbf14278a99708fb342ef0b200d00dc9bff |
unchanged |
config/modules.php |
5c9f0b332158d066dcb1b49ef94a2ef3c0c39b4b |
unchanged |
Result:
FOUNDATIONAL ACCESS MODEL REMAINS CURRENT
OPERATIONAL ACTION SURFACE REQUIRES ADDENDUM
3. Current Operational Source Evidence¶
| Surface | Source blob | Validated finding |
|---|---|---|
| TMS Work Assignment routes | 58b702a9a90ecb109cc72ca63a7b9fddb43026ea |
module-only route metadata; handler manager/self predicates |
| Staff Time role helper | 405ee6988c7955535016bddff0ad2fb059620f71 |
manager permission uses role-name substring |
| Inbound Planning page | b344e198bf7dde09ef6cd70af51ecdb1a0a02f24 |
numeric Client 1/role compatibility inputs |
| Inbound Loader page | f32a616dc44b465cf88b60d5b3eb9e39ac31155b |
numeric Forklift role compatibility and self workflow UI |
| Street Turn create | 56658282d5e76f367f1d1fc3fc80af8a544ed78e |
module-only route plus strong record/state predicates |
| Street Turn revert | fe3cd37710d570273c7c8d4a2b95236196f308c8 plus BMS helper |
different module owner; no dedicated action-role metadata |
| WMS Final Review routes | ac35d2c2b34eda63c5fdc04f694bf89965175d9a |
module-only routes; Client 1 numeric write-role helper |
| Final Review page | 5213d3cfc76fcdb2f36d884c5f3e68092c9366d8 |
controls rendered in page; API remains enforcement boundary |
| AR Billing routes | a4c0d3a21babddd41efd0a8aa175f53e3a039a4b |
module-only read/write/provider routes |
| Booking/Packing routes | fe3cd37710d570273c7c8d4a2b95236196f308c8 |
Packing send module-only; equipment/rate updates roles 1–6 |
| Page route registry | fdad545231d9fefb0c54c34305aed41c1f5cfe20 |
reviewed page slugs registered |
Result: PASS.
4. Layer Separation Validation¶
The matrix keeps the following independent:
route module
route role metadata
page/menu access
handler actor predicate
tenant/record relation
record state
provider or irreversible effect
Examples:
Work Assignment¶
module = tms.transload
manager actor = role-name helper
Loader actor = assigned self or manager
record = tenant + planner + Work Assignment discriminator
state = SCHEDULED / STARTED prerequisites
Street Turn¶
create module = yms.container-tracking
revert module = tms.booking
actor role = not explicitly declared at route/handler level
record/state = strongly constrained by owner helpers
Final Review¶
module = wms.inventory
Client 1 actor = numeric role 1/2/3
other tenant actor = no equivalent helper restriction
record/state = WMS review owner
AR/QBO/Mail¶
module-only route metadata
+ business/provider validation
+ no accepted action-role matrix in source
Result: PASS.
5. Overclaim Review¶
The refresh does not claim:
- anonymous access;
- cross-tenant access;
- a confirmed security incident;
- that every role is over-permitted;
- that every role is under-permitted;
- that a global restriction is safe;
- that role-name or numeric-role behavior is approved target policy;
- that a semantic capability registry is implemented.
It classifies the source as distributed and current environment evidence as required.
Result: PASS.
6. Preflight Construction Validation¶
6.1 SQL inventory¶
The preflight contains 17 read-only SQL templates.
Allowed statement forms:
SELECT
SHOW
information_schema read
No template contains:
INSERT
UPDATE
DELETE
REPLACE
ALTER
CREATE
DROP
TRUNCATE
FOR UPDATE
LOCK TABLES
GET_LOCK
RELEASE_LOCK
mutating CALL
Result: PASS.
6.2 Schema-first behavior¶
The package begins with:
- DB identity;
- table existence;
- column inventory;
- index inventory;
- constraint inventory.
Later templates explicitly require installed-column confirmation.
Result: PASS.
6.3 Tenant scope¶
Business access-table queries require a verified <CLIENT_ID>. Controlled account queries require approved user IDs. Client 1/Client 2 comparison is limited to named tenants.
Result: PASS.
6.4 Browser scope¶
The browser portion is restricted to:
normal menu observation
GET page observation
GET initial API observation
control visibility observation
Consequential verbs and actions are prohibited.
Result: PASS.
6.5 Result bounds¶
Broad queries return access metadata rather than business payloads. GET APIs must be bounded by page size, date or approved record IDs. Shared evidence excludes session cookies, credentials, broad user directories and customer payloads.
Result: PASS.
6.6 No-mutation proof¶
The package requires browser-network and selected-row observation showing that the preflight caused no write or provider effect.
Result: PASS.
7. Current Findings Validation¶
| Finding | Result |
|---|---|
| Core access infrastructure unchanged | supported |
| Work Assignment route registration is module-only | supported |
| Work Assignment manager predicate is role-name based | supported |
| Loader self/manager relation is handler-owned | supported |
| UI uses numeric tenant/role compatibility | supported |
| Street Turn create/revert use different module keys | supported |
| Street Turn actor role is not explicitly defined in reviewed routes | supported |
| Final Review Client 1 writes use numeric roles 1–3 | supported |
| Final Review helper returns without equivalent role restriction for other tenants | supported |
| AR Billing/QBO actions lack dedicated route-role metadata | supported |
| BOL/Packing send lacks dedicated route-role metadata | supported |
| Packing equipment/rate updates declare roles 1–6 | supported |
8. Remaining Evidence¶
Static validation cannot answer:
current menu rows
current role IDs/names
current controlled-account assignments
current tenant-module rows
normal-menu findability
page/direct-route results
initial API results
actual control visibility
actual expected denial
foreign-tenant negative result
Client 1 non-regression
selected Client 2 expected behavior
These remain owned by RBR-ACCESS-001.
9. Final Static Disposition¶
Source refresh support:
PASS
Action matrix support:
PASS
Read-only preflight construction:
PASS
Current DB/menu/role evidence:
NOT RUN
Current authenticated GET evidence:
NOT RUN
Current write-action evidence:
NOT AUTHORIZED / NOT RUN
Policy acceptance:
OPEN
M3:
NO
M4:
NO
---¶
Source:
docs/reconstruction/PLATFORM_AUTHORIZATION_CURRENT_SURFACE_VALIDATION_2026-08-08.md— ctc repository · This page is an English translation of the source document. Identifiers, file paths and code symbols are unchanged.