coulomb-social/docs/capability/stage-1-cutover.md

# Stage 1 cutover — productive transfer set

| Field | Value |
|-------|--------|
| Decision | [`../decisions/2026-08-12-feature-cut-stage-1.md`](../decisions/2026-08-12-feature-cut-stage-1.md) |
| Model | [`model-v0.yaml`](model-v0.yaml) |
| Date | Decision: 2026-08-12; checkout status reviewed: 2026-10-06 |
| Stance | **Partial rebuild is enough** for transfer; extend with later use cases after Bubble is reference-only |

## Goal of stage 1

Move members to **`app.coulomb.social`** as the **productive** home and retire
Bubble on apex as a **productive** system. After transfer:

- Bubble may remain online only as an **implementation reference** (read-only /
  archival / comparison), not as the place where new work happens.
- Additional capabilities (marketplace, social graph, monetization, …) ship
  **later** on the rebuild without blocking transfer.

Implementation statuses below describe this checkout, not fresh live acceptance.
CSOC-IN-0004 still owns PageOps persistence/deployment smoke; WP-0008 owns
transfer and recovery acceptance. Public registration has historical 2026-08-14
Case B evidence (CSOC-IN-0001 closed).

## Must capabilities (stage 1)

### 1. User onboarding — `cap.member-onboarding`

Members can obtain and use an account on the rebuild without depending on
Bubble for day-to-day login.

| Feature | Status | Notes |
|---------|--------|--------|
| OIDC sign-in (existing LLDAP/KeyCape users) | shipped | Case A proven |
| JIT Member + user-engine link | shipped | |
| Session / account diagnostics | shipped | `/account/session/` |
| Public Create account + verified mail | historically evidenced | CSOC-IN-0001 closed; NK owns mail/registration, recheck at transfer |
| Guided first landing on app home | shipped | post-login → Spaces |
| Bulk / assisted member transfer from Bubble | partial | Manifest maps existing tenant+issuer+subject members; actual cohort rehearsal pending |

**Stage-1 acceptance:** known operators and community members can sign in;
new members can register once NK path is live **or** operator-provisioned
LLDAP accounts cover the transfer cohort. No Bubble password import.

### 2. Spaces with markdown content — `cap.space-content`

Members work in **spaces** whose durable content is **markdown** (ADR-0002).

| Feature | Status | Notes |
|---------|--------|--------|
| Space list (tenant-scoped) | shipped | |
| Space detail + render page from Forgejo | shipped | |
| Edit in Forgejo + refresh / webhook | shipped | git SoR |
| **Space CRUD** (create/read/update/delete or archive) | implemented | Member create/update/archive (WP-0006) |
| **Title** on space | implemented | Model and member forms |
| **Abstract** on space | implemented | `description`, product label Abstractor |
| **Visual** on space (cover/image) | metadata implemented | Relative path; upload/authenticated asset delivery not accepted |
| Page list within space | implemented | Local pages sidebar |
| **Page CRUD** (create/update/delete markdown pages) | implemented | In-app metadata/body forms; index deletion prohibited |
| **Title** on page | implemented | Frontmatter and form |
| **Abstract** on page | implemented | Frontmatter and form |
| **Visual** on page | metadata implemented | Relative Visual copied; broader asset pipeline incomplete |
| Fail-closed missing binding | shipped | |

**Stage-1 acceptance:** members can create and maintain spaces and pages with
**Title, Abstract, Visual** as first-class fields (not only raw git for metadata),
content body in markdown, readable on app host. Exact UX (in-app editor vs
structured form + Forgejo body) can vary; **utility** must not require Bubble.

### 3. Move page between spaces — `cap.page-transfer`

| Feature | Status | Notes |
|---------|--------|--------|
| Transfer page to another space | implemented with limits | Markdown + Visual asset; arbitrary links/assets are not rewritten |
| Authz (source + destination membership) | implemented with limits | Tenant/membership visibility; viewer write roles still unenforced |

**Stage-1 acceptance:** a page can leave space A and appear in space B without
Bubble, with clear ownership after the move.

### 4. Duplicate page — `cap.page-copy`

| Feature | Status | Notes |
|---------|--------|--------|
| Generate copy of page (same or other space) | implemented | New slug/title; independent thereafter |
| Copy assets referenced by page | partial | Relative Visual copied; body-linked assets deferred |

**Stage-1 acceptance:** member can produce an independent copy without manual
git surgery as the only path (operator git escape hatch may exist but is not
the product path).

## Explicitly later (not stage-1 blockers)

Examples — full list in `model-v0.yaml`:

- Favorites / social graph  
- Marketplace (challenges, methods, solutions)  
- Monetization / payments  
- Full Bubble workflow automation parity  
- Pixel-perfect Research chrome parity  
- In-app collaborative real-time editing  

## Platform dependencies (not product features)

| Dependency | Stage-1 role |
|------------|----------------|
| NetKingdom OIDC + (eventually) registration mail | Onboarding |
| apps-pg | Space/member metadata |
| CONTENT_ROOT + optional Forgejo | Local PageOps SoR; Forgejo fallback, no automatic local commit/push |
| Railiance deploy | Host app.coulomb.social |

## Current acceptance backlog

WP-0006 implemented the member CRUD/metadata/copy/transfer path. WP-0007 added
validated single/bulk import with explicit membership mapping. Remaining
acceptance is tracked in WP-0008: persistence/live smoke, paired recovery,
private cohort reconciliation, access roles/privacy, member portability and
explicit founder cutover. Later authoring features remain in the machine model.

## Resolved choices and remaining product questions

- Visual: path metadata and relative-file copying today; upload, serving and
  full body-linked asset fidelity require acceptance work.
- Abstract: UI uses Abstractor; persisted Space field remains `description`.
- Body: markdown form implemented; no real-time editor or conflict protocol.
- Delete: Space archive; page delete except index.
- Cohort: explicit existing NetKingdom identity mappings; no password import.
  Actual cohort and lossiness acceptance are still required.
- Content: ADR-0004 thin local directory, optional Forgejo fallback. Git
  automation, authoring projections, live includes and outline operations remain
  future work, not prerequisites silently added to the accepted cut.