HIPAA/marketing compliance document: correct or withdraw pending admin-scoping fix verification (omnibioai-lims#30/#49/#50)

[man4ish]

What needs to change

Codex produced a HIPAA-compliance / marketing-facing document tonight claiming "Zero cross-organization data leakage (verified via automated tests)." That claim is true, narrowly, for the customer-facing DRF API/app layer in omnibioai-lims (57 real, passing tests: tests/test_org_isolation.py, tests/test_org_isolation_enforcement.py). It does not extend to Django's /admin/ interface, which had zero organization scoping on Project/Sample/SampleAuditLog until tonight — confirmed by live reproduction, not just code-reading.

Status as of tonight:

• The admin-layer gap is now fixed: omnibioai-lims#49 (branch security/hipaa-django-admin-org-scoping, resolves omnibioai-lims#30), org-scopes ordinary Django staff on Project/Sample/SampleAuditLog, superuser platform-admin access unchanged (documented as intentional). 172 tests passing; live re-verification confirms org-scoped staff blocked from another organization's data, superuser unaffected.
• omnibioai-lims#50 tracks whether the same gap exists in omnibioai-workbench, omnibioai-studio, and omnibioai-auth's own Django admin surfaces — not yet checked.

The document must not go out to any partner or customer as-is. Whoever holds the actual document (not found as an editable file in this session — it wasn't located in any repo or on the local filesystem despite a full search) needs to either:

1. Withdraw it until security: enforce model-registry auth in release compose #50's ecosystem-wide sweep is complete, or
2. Correct it to state explicitly, not silently:
   • The app/API-layer isolation claim, and exactly what it covers (which tests, which routes).
   • That Django admin's data-scoping was found broken tonight (specific models, specific evidence) and has now been fixed in omnibioai-lims (PR feat: publish security audit worker in release compose #49), separately from the API-layer claim above.
   • That the same class of gap has not yet been ruled out in the rest of the ecosystem (omnibioai-lims#50).

Action needed

Point me to the actual document (or paste it) if you want the correction drafted directly; I can't locate or edit a document I never had access to as a file in this session.