26 stub entities (every matrix entity except Registrant, User, Role,
AuditLog) get a router from framework/stub_router.py: one route per
matrix action (List, Search, Create, View, Edit, Delete, Restore,
VersionHistory). Each route runs the real RBAC check, writes an audit
row, then returns 501. Source RFP C.5.7.27.
- Registry in src/ypms/stubs.py; test fails if a matrix entity is
neither real nor stubbed.
- tests/test_stubs.py sweeps entity x role x route against the matrix
JSON: 501 + exactly one audit row when granted, 403 + none when not.
FERPA/CFSA stubs pinned closed to non-examiner roles.
- Registrant restore now gated on the matrix's Restore action (was
Edit, the vendored-factory convention); only the super-role holds it.
- Test fixtures (roles, make_user, api) lifted to conftest; one app per
session (route construction dominated runtime) and a shared password
hash for minted-token users.
138 tests passing, ruff + mypy clean.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
