fred
501112d2a4
ci/woodpecker/pr/ci Pipeline was successful
- name the two shipped platform-admin bypass paths (command-authorization hasScope short-circuit, MCP tenant-admin scope derivation) as non-conformant; 7.4 retires them explicitly - suspend team grant subjects pending a team contract; command surface refuses team-subject grants; evaluation semantics pre-specified - no-self-escalation restated with future-decoupling rationale; observable is an audit invariant, not an unconstructible refusal test - bootstrap seeding scoped to top-level company creation; child nodes inherit via down-the-chain, resolving the 7.7/4.3 contradiction - exact A1 quote (not a bypass of workspace authorization) - subject/role audit fields attributed as this contract's addition - principal-position consequence named (1.3) with matrix cell - added observables: zero membership rows, fail-closed fault injection, no existence oracle - role-string namespacing rule (4.5) - ruling request names the PRD-admins interpretive resolution