Chris TonjesandClaude Opus 5.5
98b783b6b5
26 stub entities (every matrix entity except Registrant, User, Role, AuditLog) get a router from framework/stub_router.py: one route per matrix action (List, Search, Create, View, Edit, Delete, Restore, VersionHistory). Each route runs the real RBAC check, writes an audit row, then returns 501. Source RFP C.5.7.27. - Registry in src/ypms/stubs.py; test fails if a matrix entity is neither real nor stubbed. - tests/test_stubs.py sweeps entity x role x route against the matrix JSON: 501 + exactly one audit row when granted, 403 + none when not. FERPA/CFSA stubs pinned closed to non-examiner roles. - Registrant restore now gated on the matrix's Restore action (was Edit, the vendored-factory convention); only the super-role holds it. - Test fixtures (roles, make_user, api) lifted to conftest; one app per session (route construction dominated runtime) and a shared password hash for minted-token users. 138 tests passing, ruff + mypy clean. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>