coulomb-social/history/20261006T144400Z-personal-account-release-assessment.md

# Personal Coulomb account release — 2026-10-06

CSOC-WP-0008 · RAPPS-WP-0015 · pending founder decision `8bbce691-a787-4140-9cd4-df06e8635a27`.
No live mutation has been performed. Prepared code, image and review branch are
ready; the personal account is not yet usable through this app.

## What is running

There is a replacement workload on railiance01 (92.205.62.239): Helm revision 9,
image 7fcd0cf, 1/1 available. Landing and /healthz return 200. This is the old
August shell; it has no content PVC and lacks the latest tested workspace flows.
The user-selected tegwick Member already exists in tenant:coulomb, bound to
issuer https://kc.coulomb.social and directory subject
uid=tegwick,ou=people,dc=netkingdom,dc=local. No password or new identity is required.
One demo space has no membership grants; a stored Member alone grants no access.

The user's actual login returns invalid_profile_usage / unknown client_id.
Guarded read-only inspection confirms the coulomb-social client is absent from
KeyCape. Discovery health and stored identity did not establish working login.

## Exact proposed change

1. Restore NetKingdom's historical public coulomb-social client. Authorization
   code + PKCE; scopes openid/profile/email/groups; exact callbacks:
   http://127.0.0.1:8008/auth/callback/, http://localhost:8008/auth/callback/,
   https://app.coulomb.social/auth/callback/ and
   https://coulomb.social/auth/callback/. No wildcards or client secret.
   Preserve historical mfaRequired=false (ordinary AAL1; explicit AAL2 remains
   available), as recorded in docs/security-close-down-checklist.md.
2. Restart only sso/keycape to load that registration. This shared issuer restart
   can interrupt in-flight sign-ins. Issued tokens remain valid. No other client
   registrations or credentials are changed.
3. Complete a fresh apps-pg barmanObjectStore Backup before app migration. A daily
   Backup apps-pg-daily-20261006021500 was completed at 02:15:19 UTC today; that
   establishes an existing DB recovery point, not paired application recovery.
4. Upgrade only the coulomb-social Helm release using chart 0.2.0 and --atomic.
   Source image ac7bac1852c9 is published and pinned to immutable digest
   sha256:bf975939e22b9b0a5d9ac05584ae6265ba201169df6dc48e506ec684b30a9c58.
   Add retained 2Gi local-path RWO coulomb-social-content PVC at /app/var/content;
   CONTENT_ROOT matches. One replica, Recreate, fsGroup/runAsUser 10001. Brief app
   interruption; no rolling surge. Existing PostgreSQL and env Secret references
   remain. Entrypoint runs Django migrations; Helm rollback does not undo them.

Node requests observed 3455m/4000m CPU (86%); host disk free 123G. Refresh before
execution. Coulomb-social is Helm-managed and not among current ArgoCD apps.

## Verification completed

- make check: 88 tests passed, including Chromium ReichelAg duplicate/edit/copy,
  rich HTML/plain text payloads, reader-write denial and outsider privacy.
- Guarded repair: synthetic insertion/idempotence and differing/duplicate refusal
  checks pass; owner helper preserves unrelated config bytes and other Secret data.
- Live safe inspect and server dry-run through SSH pass, with no Secret values or
  raw errors emitted. Observed UID 2e94519d-1550-41c7-9701-2efe47fe1fd3,
  resourceVersion 67716615. Refresh both before apply; CAS refuses stale receipts.
- Production container serves /static/spaces/copy-content.js HTTP 200, 2909 bytes,
  with ClipboardItem code. Static assets are collected into the release image.
- Helm lint/server dry-run pass; diff shows image/digest, content volume/mount,
  CONTENT_ROOT, Recreate and chart label change. Chart rejects multiple replicas,
  RollingUpdate and content-root mismatch.

## Execution and recovery after approval

Record the founder's exact go as ADMINISTER @ realm:kubernetes/railiance01,
activation=APPROVED. Freeze the reviewed owner branch before moving its changes
into main; re-render and repeat diff/dry-run if the live state has changed.

Run scripts/register-keycape-client.sh inspect, then dry-run with its fresh
--expected-uid/--expected-resource-version; apply with the same receipt. The
wrapper executes Kubernetes operations on railiance01 through SSH and suppresses
Secret output/errors. It does not restart anything. Only after readback succeeds,
restart sso/keycape from the node and wait for rollout readiness. Check discovery
and authorization handoff; ask the user to complete their own interactive login.
If issuer readiness fails, stop: never replay a stale Secret or reset other
clients. Any inverse repair needs fresh revision checks and owner review.

Before the app upgrade, create a scoped CNPG Backup in databases with
spec.cluster.name=apps-pg and method=barmanObjectStore; wait for completed status.
Use a timestamped csoc-preupgrade name and record non-secret completion metadata.
Copy the reviewed chart/production values to a private node staging directory.
From SSH on railiance01 with KUBECONFIG=/etc/rancher/k3s/k3s.yaml, run Helm upgrade
coulomb-social in namespace coulomb-social with the reviewed values, --atomic,
--wait and a bounded timeout. No env Secret reconstruction or legacy registration
apply script. Verify readiness, image digest, static asset, mounted content write
ownership and database migrations before exposing productive content.

Application rollout failure: Helm atomic rollback returns to the previous release
(revision 9 baseline). Retain the content PVC; never delete it for a retry.
Investigate migrations separately; restore the private pre-upgrade DB backup only
through the owning PostgreSQL lane and a separately confirmed destructive restore.

## User milestone and remaining acceptance

The immediate milestone is: tegwick signs in at app.coulomb.social and can use a
personal private workspace on the new infrastructure. Then demonstrate the first
ReichelAg journey: retain the original full protocol, duplicate it for the next
call, edit agenda/protocol by hand, and copy rich/plain content for manual email.

Successful rollout does not finish WP0008. Prove content restart durability and
paired DB/content restore (T02); privately reconcile the real nominated latest
ReichelAg protocol (T03); complete user review and actual email-client paste
(T09). Sharing/export/delete and content fidelity remain tracked tasks. No
Bubble exit/apex cutover or real-data import is included in this live approval.

## Review artifacts

Application source is committed to coulomb-social main. Deployment changes are on
railiance-apps branch csoc-wp-0008-personal-app (RAPPS-WP-0015), pending live go:
https://forgejo.coulomb.social/coulomb/railiance-apps/src/branch/csoc-wp-0008-personal-app

Credential owner routing: key-cape-oidc-login; SSH access uses existing routed
certificate access. No secrets were fetched into chat, logs, Git or State Hub.
Owner helper source reviewed: net-kingdom 8f368679cdda1df699d52ad496bed77c59064f61;
portal-client-rollout.py SHA256
158e1d36eb881cdd0a2eda91b472adea5e8fde5061e00d26dda368580aeb871f.
Changes to the owner helper require fresh review/dry-run before live execution.