Platform Tenant / Capability — Dual-Ref Validation — 2026-08-09¶
- Status:
STATIC VALIDATION PASS WITH ONE DOCUMENT COUNT CORRECTION - Release source:
master@baff406d964b9f785bf98d2ae84cfb262e26f4b2 - QA integration source:
qa@1dfed7d5c827f992e763c63bfca95324a60af387 - Authority:
PLATFORM_TENANT_CAPABILITY_DUAL_REF_CURRENT_AUTHORITY_2026-08-09.md - Matrix:
PLATFORM_TENANT_CAPABILITY_RELEASE_QA_DELTA_MATRIX_2026-08-09.md - Preflight:
RBR-TENANT-CAPABILITY-002-READONLY-DUAL-REF-PREFLIGHT.md - Effects: source inspection and documentation only
1. Validation Purpose¶
This document validates:
- current Release and QA source authority;
- the original candidate's current ancestry;
- registry/effective diagnostics presence and absence by lane;
- strict versus non-strict resolver separation;
- process-capability compatibility defaults;
- safe secret result behavior;
- config cache scope;
- read-only preflight construction;
- absence of implementation/M3/M4 overclaim.
It does not validate current DB rows, deployed environments, admin sessions, page rendering or provider state.
2. Branch And Candidate Validation¶
Current documentation refs inspected:
master@9d285d34488aa0554ed56a721dbda4ff60c10ae0
qa@4f8a9c2ff4d6ed9aab5e5f4b8593574de3bc7c83
Their source parents are intentionally different:
release source = baff406d964b9f785bf98d2ae84cfb262e26f4b2
QA source = 1dfed7d5c827f992e763c63bfca95324a60af387
Candidate ancestry check:
base = db306fbb5b698daf92e88ab0db70f0c22c4e8ea2
head = current QA
result = candidate is an ancestor; QA is ahead
Result:
CAPABILITY-DISCREPANCY-001 CONFIRMED
The historical 2026-08-07 handoff remains valid chronology but not current QA status.
3. Source Presence Validation¶
| Source | Candidate | Release | QA | Result |
|---|---|---|---|---|
CapabilityResolution.php |
present/shared foundation | present | present | pass |
capability_resolver.php |
present/shared foundation | present | present | pass |
CapabilityDefinitionRegistry.php |
present | absent | present | pass |
effective_capability_diagnostics.php |
present | absent | present | pass |
| strict registry module decision | candidate | absent | present | pass |
| effective-capabilities GET route | candidate | absent | present | pass |
| Admin Effective projection | candidate | absent | present | pass |
Core candidate/QA blob identity:
CapabilityDefinitionRegistry.php
= df457c1c895b9d5f56598406179f5f74dfd56328
effective_capability_diagnostics.php
= fe6a9b852d5eeafc0ab03d1f2fcc517bd3c5871c
Result: PASS.
4. Registry Semantics Validation¶
The registry preserves the existing resolver schema and does not define a second result type.
Validated concern families:
MODULE_ENABLEMENT
PROCESS_CAPABILITY
CONFIG_VALUE
SECRET
Validated source boundaries:
- modules use tenant-module observations;
- process capabilities use tenant config or published snapshot definitions;
- ordinary config uses tenant config or published snapshot definitions;
- secret definitions can describe tenant config, published snapshot, deployment environment or external reference;
- definition typing includes scalar, JSON, file and secret families;
- a secret observation is represented as configured metadata before safe serialization.
Result: PASS.
5. Safe Result Validation¶
CapabilityResolution::toSafeArray() returns:
schemaVersion
concern
subjectKey
moduleKey
decision
valueType
hasValue
source
validity
policyState
compatibilityFallback
reason
credentialOwnerRef
It does not return the Runtime value field.
Result:
secret literal in safe diagnostics: NOT PRESENT BY CONTRACT
This source fact does not replace an environment/network/rendered-output check.
6. Effective Projection Validation¶
Validated QA projection output:
- schema
tenant-effective-capabilities/v1; - local tenant identity;
- module/capability/config arrays;
- fallback and invalid/error counts;
- relationship section;
- explicit limitations.
Validated relationship semantics:
profile = UNBOUND
package = UNBOUND / LEGACY_DERIVED / INVALID
capability = REGISTERED_SUBSET
entitlement = UNKNOWN
role/menu = EXTERNAL_AUTHORITY
terminology = UNBOUND
document template = UNBOUND
provider effect authority = UNKNOWN
hardware = UNBOUND
Result: PASS.
7. Hybrid Resolver Validation¶
QA moduleGuardStrictModuleDecision() uses the registry and resolver. QA moduleGuardModuleDecision() and page/config decisions remain current legacy paths.
Therefore:
strict typed path present
+ non-strict legacy path present
= hybrid integration
No source evidence supports a universal caller cutover claim.
Result:
CAPABILITY-DISCREPANCY-002 CONFIRMED
8. Process Capability Default Validation¶
QA registers:
MK_DOCUMENT_WORKFLOW_ENABLED
EXPORT_BROKERAGE_WORKFLOW_ENABLED
Validated defaults:
MK_DOCUMENT_WORKFLOW_ENABLED
-> COMPATIBILITY
-> Client 2 legacy default on
EXPORT_BROKERAGE_WORKFLOW_ENABLED
-> COMPATIBILITY
-> legacy default off
These can appear as resolved capability decisions without an explicit row. The source and fallback metadata distinguish them.
Result:
CAPABILITY-DISCREPANCY-004 CONFIRMED
9. Cache Validation¶
Static source result:
| Reader | Release | QA |
|---|---|---|
tenant_config_get() |
tenant+key cache | DB-object+tenant+key cache |
tenant_config_get_many() |
tenant+key cache | tenant+key cache |
tenant_provider_config() |
multi-key reader | multi-key reader |
The historical statement that config caches are generally isolated by DB identity/object is not fully true for current QA.
Result:
CAPABILITY-DISCREPANCY-003 CONFIRMED
No cross-DB Runtime failure is claimed without synthetic or environment evidence.
10. Release/QA Endpoint Validation¶
Static source result:
Release effective endpoint: absent
QA effective endpoint: present
Result:
CAPABILITY-DISCREPANCY-005 CONFIRMED
The endpoint's Runtime authorization, response headers, secret redaction and no-mutation behavior remain evidence items.
11. Preflight Construction Validation¶
11.1 SQL block count correction¶
The preflight contains 24 SQL blocks.
Its initial completion summary says 22 read-only statements. That summary count is incorrect and is superseded by this validation.
PRE-FLIGHT-COUNT-CORRECTION-001
actual SQL blocks = 24
initial summary label = 22
current authority = 24
This does not affect statement safety or scenario coverage.
11.2 Statement class¶
Permitted forms:
SELECT
SHOW
information_schema reads
No block is designed to contain:
INSERT
UPDATE
DELETE
REPLACE
ALTER
CREATE
DROP
TRUNCATE
FOR UPDATE
LOCK TABLES
advisory lock
mutating CALL
Result: PASS.
11.3 Schema-first behavior¶
The package begins with:
- environment identity;
- table existence;
- column inventory;
- index inventory;
- constraints.
Optional-column queries are explicitly conditional.
Result: PASS.
11.4 Tenant scope¶
Business metadata queries use one or two named tenant placeholders. Controlled-account queries require exact IDs. Broad cross-tenant exports are not part of the package.
Result: PASS.
11.5 Secret safety¶
Safe config queries omit secret values or reduce them to configured booleans. Direct/secret companion comparison never returns value content.
Result: PASS.
11.6 GET-only scope¶
The browser section permits only page/endpoint GET and visibility observation. It explicitly prohibits Save, Reveal, Update, Remove and provider actions.
Result: PASS.
11.7 Cache evidence¶
The cache test is synthetic, non-Production and separately authorized. It uses synthetic markers, not real credentials or customer config.
Result: PASS.
12. Overclaim Review¶
The package does not claim:
- P4 activation or completion;
- Release availability of QA diagnostics;
- Production deployment;
- DB parity seed;
- explicit policy where only a legacy default exists;
- entitlement from package tier;
- role authorization from capability state;
- provider connectivity from credential presence;
- universal caller cutover;
- full cache isolation;
- M3 or M4.
Result: PASS.
13. Documentation Integrity¶
Required current precedence:
this dual-ref authority
-> branch-specific current source
-> original platform source authority/rebuild packet
-> historical P4 candidate chronology
Historical documents remain preserved. Current branch status is not copied back into the historical timestamped narrative.
Result: PASS.
14. Validation Summary¶
Branch/source authority: PASS
Candidate ancestry: PASS
Release absence / QA presence: PASS
Registry semantics: PASS
Safe secret result contract: PASS
Hybrid resolver classification: PASS
Process default classification: PASS
Cache discrepancy classification: PASS
Preflight statement safety: PASS
Preflight SQL count: 24
Environment evidence: NOT RUN
M3/M4: NO CHANGE
---¶
Source:
docs/reconstruction/PLATFORM_TENANT_CAPABILITY_DUAL_REF_VALIDATION_2026-08-09.md— ctc repository · This page is an English translation of the source document. Identifiers, file paths and code symbols are unchanged.