coulomb-social/workplans/CSOC-WP-0015-communication-runtime-acceptance.md

---
id: CSOC-WP-0015
type: workplan
title: "Communication runtime, inbox operations and flow acceptance"
domain: communication
repo: coulomb-social
status: active
owner: codex
topic_slug: coulomb-social
created: "2026-10-08"
updated: "2026-10-30"
origin: residual
origin_ref: CSOC-WP-0010
state_hub_workstream_id: "38208f72-c285-56fa-be44-de9b59a4e031"
---

Residual acceptance from CSOC-WP-0010, split at the user's request. Existing implementation/release/acceptance evidence remains in the originating workplan; these tasks own the remaining concrete outputs. Source checks never grant runtime or productive acceptance.

## T01 — Admit and activate explicit transactional caller policies

```task
id: CSOC-WP-0015-T01
status: done
priority: high
state_hub_task_id: "e87ea643-7bee-5427-b4f5-b32f20dc2f29"
```

Receiver source is implemented and image deployment recorded in EMAIL-WP-0008. EMAIL-WP-0008-T03 owns actual caller/binding/template/operation/quotas, separate token custody/delivery and original-caller transition. Product acceptance verifies the admitted integration; avoid duplicating receiver implementation or granting arbitrary app notifications.

2026-10-27: EMAIL-WP-0008 completed scoped caller custody and coordinated activation
on October 9. Current receiver policy/projection and user-engine tenant/client
bindings are present, both deployments Ready. Owner no-send denial/replay receipts
and the expanded 103-test isolated gate verify the admitted integration. Productive
flow verdicts remain T04. See docs/release/acceptance-audit-2026-10-27.md.

## T02 — Establish platform sender and monitored reply/bounce ownership

```task
id: CSOC-WP-0015-T02
status: todo
priority: high
state_hub_task_id: "0604cb15-72c7-5d15-bb42-0335d4ec80df"
```

Review replacing the receiver forgejo sender with platform identity through its credential owner, then name reply/inbox/support owner and prove authorized inbound access, DNS MX/SPF/DKIM/DMARC, correlated bounce/suppression and retention. No unsolicited scans or auto responses. Existing native personal reset is accepted and stays separately evidenced.

## T03 — Complete independent ledger recovery and copy custody

```task
id: CSOC-WP-0015-T03
status: done
priority: high
state_hub_task_id: "286e60bf-76a1-5a18-bd2c-edd9d1400c41"
```

EMAIL-WP-0007-T03/T04 and RPF-WP-0053-T05/T06 own primary archive admission/atomic credential pair, first encrypted capture/retrieval/rehearsal and monitoring. Require image/schema-bound six-table recovery, restored accepted/unknown/consumed/cancelled/suppressed/quota continuity and post-capture reconciliation; govern temporary pre-release copies.

2026-10-27: EMAIL-WP-0007 completed independent provider escrow, separately bound
recovery reader, nonexpiring image/tools/receipt kit, six-table offline recovery,
mirrored rolling archives and monitored schedules on October 10. Fresh checks show
both timers active and today's backup/freshness successful, with verified mirror.
The app gate now binds real encryption/recovery and scoped quota continuity tests;
103 owner cases pass with zero skips. Historical private copies remain retained
pending explicit owner disposition, with no inferred expiry/deletion. Production
restore still requires fencing and post-capture reconciliation. See the audit.

## T04 — Establish owner-spanning browser journeys and productive flow verdicts

```task
id: CSOC-WP-0015-T04
status: progress
priority: high
state_hub_task_id: "7c718d86-8f0d-5cb2-a765-b0c07116005c"
```

Use isolated issuer/directory/local mail sink/app for UC-009/010/011. Bind exact mandatory browser nodes without production URLs/accounts or SMTP provider sends; test expired/replayed handles and tenant/client/caller denials. Future UC-012 needs a user-selected product template/caller. Preserve UC-008 manual mail distribution and UC-009 existing personal reset acceptance.

2026-10-11: the checkout has a loopback issuer, directory and mailbox double. The browser node is bound on UC-009/010/011 and still `established: false`. It covers reset-to-local-mailbox, sign-in, callback replay, expired and reused handles, tenant and client refusal, registration verify/cancel, and caller/suppression invitation counts. No SMTP, production account, or live issuer is contacted. Real user-engine/email-connect admission, DNS and productive per-flow verdicts remain open. UC-012 stays deferred. Gate for this slice: `make check` 200 passed.

2026-10-30: added an explicit real-owner-source browser gate for UC-010/011.
Private snapshots run the actual user-engine portal, registration/outbox HTTP
adapters and email-connect scoped receiver/SQLite ledger, with synthetic session,
authorization, directory, activity sink and mail provider. Actual forms cover
verify/cancel/expiry/replay, fresh-handle cross-caller denial, tenant/client/token
denials, cross-tenant admin refusal, invitation/resend, duplicate delivery and
suppression. Python only permits fixture ports; browser routes/API redirects are
bounded to fixture origins. No production configuration, account, SMTP provider,
mailbox scan or original note body is used. Exact node is linked in the candidate
registry and the invocation is in docs/usecases/platform-communication.md.
Proof: docs/release/owner-communication-browser-2026-10-30.json. This completes
the owner-source UC-010/011 browser integration slice, not native issuer/directory/
app-login coverage or productive per-flow verdicts. T04 remains progress; T02
sender/inbound/bounce ownership and UC-012 nomination remain separate gates.

## Completion

Finish when every task above has its stated evidence and acceptance, or hand off any newly discovered residual to a live work record first. Cross-owner dependencies remain their existing canonical records.