Split remaining acceptance work and record email deployment

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a119cf-56d0-7fa3-840b-eb8732e1db0b

docs/release/email-caller-deployment-and-workplan-split-2026-10-08.md

@@ -0,0 +1,35 @@
+# Email deployment and remaining-work split — 2026-10-08
+
+The app's accepted weekly-call release remains Helmrevision16, digest9a646d8e,
+one Ready replica. New mail receiver sourcec9756b0 (runtimecode f703bf6) is now
+live at digesteb3e7b68, Deploymentrevision7, one Ready replica. Its existing
+single-caller mode remains selected; scoped caller-policy admission is a future
+operation. Exact approvaldecision0ef49fde-5e92-4656-ac1e-8f945b4bba08.
+
+Image-only Deployment comparison/server dry-run, quiesced private SQLite backup,
+actual-backup candidate migration and UID10001/network-none packaged rehearsal
+pass; all five previous tables/rows are preserved in six-table schema. Release
+62.79s. Health/readiness200; unauthorized401; disallowed-template/invalid
+verification400; zero capture helpers, no mail sent. Existing caller, sender,
+PVC, credential and network configuration remain the admitted ones. Capture and
+rehearsal source helpers are aligned to the immutable image;27 focused
+ledger/release tests pass, including seven failure fences. Detailed owner receipt:
+/home/worsch/email-connect/docs/caller-deployment-2026-10-08.md.
+
+The user's suggested separation is implemented as live residual workplans, with
+origin/parent links and explicit completion criteria:
+
+| Workplan | Remaining outcome | Origin |
+|---|---|---|
+| CSOC-WP-0012 | Durable app recovery, offsite custody/retention, first recovery and monitored service evidence | CSOC-WP-0008 |
+| CSOC-WP-0013 | Storage/revision hardening, broader corpus fidelity and productive sharing/portability review | CSOC-WP-0008 |
+| CSOC-WP-0014 | Further inventory/cohort reconciliation, per-journey transfer review and explicit Bubble/apex off-ramp | CSOC-WP-0008 |
+| CSOC-WP-0015 | Actual caller-policy/sender/inbox operations, independent mail ledger recovery and owner-spanning browser/productive flow acceptance | CSOC-WP-0010 |
+
+These are substantive remaining deliverables, not a final tidy-up. Original
+WP-0008/0010 remain active acceptance umbrellas, with each unfinished task mapped
+to its new owning record. They are not falsely marked done on transfer. Existing
+EMAIL-WP-0008-T03, EMAIL-WP-0007 and RPF-WP-0053 remain canonical owner/custody
+records; new product plans reference them rather than duplicating those lanes.
+UC-008 weekly calls and UC-009 personal account recovery retain their explicit
+productive acceptance. No other use case or Bubble retirement is inferred.

workplans/CSOC-WP-0008-production-transfer-acceptance.md

@@ -720,3 +720,27 @@ T09 remains progress for the other listed use cases. Wider T03 cohort/identity
 reconciliation, T04 sharing/portability review, T02 recovery custody/retention
 and remaining WP-0008 gates stay live. No Bubble retirement or new productive
 communication flow is implied; WP-0008/WP-0010 remain active.
+
+## Remaining acceptance split into independent workplans — 2026-10-08
+
+User requested distinct workplans for the remaining work. These residual
+records are live source files with origin: residual and origin_ref: CSOC-WP-0008.
+The accepted personal-account/weekly-call milestones and completed releases
+retain their original receipts. This workplan remains active as the acceptance
+umbrella; unfinished criteria are not marked done merely because they moved.
+Execute and record new work in the owning follow-up below, then close each
+original task against its corresponding return. No duplicate implementation or
+new credential/protocol authority is created by this split.
+
+- CSOC-WP-0008-T01: CSOC-WP-0012-T03 (service evidence; current app deployment remains complete).
+- CSOC-WP-0008-T02: CSOC-WP-0012-T01/T02/T03 (offsite admission, actual first recovery and monitoring).
+- CSOC-WP-0008-T03: CSOC-WP-0014-T01 (further inventory/cohort reconciliation).
+- CSOC-WP-0008-T04: CSOC-WP-0013-T01/T03 (storage enforcement and productive sharing/portability review).
+- CSOC-WP-0008-T05: CSOC-WP-0013-T02 (corpus fidelity, revision retention and crash recovery).
+- CSOC-WP-0008-T06: CSOC-WP-0014-T03 (service/cohort/apex cutover).
+- CSOC-WP-0008-T08: CSOC-WP-0014-T02 (ongoing original-use-case discovery; initial catalogue is delivered).
+- CSOC-WP-0008-T09: CSOC-WP-0014-T02 (remaining per-journey reviews; UC-008 is accepted).
+
+The remaining scope is substantive: custody/first offsite recovery, broader
+privacy/content/cohort review, or mail operations and isolated owner browser
+journeys. These are independent deliverables rather than a final tidy-up.

workplans/CSOC-WP-0010-platform-email-facilities.md

@@ -257,3 +257,43 @@ archive admission and atomic credential-pair custody. No live mail runtime,
 sender, caller, mailbox access, upload, timer or production ledger changed.
 T04/T05/T06 remain progress for their existing runtime/browser/productive gates;
 UC-008 weekly-call acceptance does not accept these future mail flows.
+
+## Remaining acceptance split into independent workplans — 2026-10-08
+
+User requested distinct workplans for the remaining work. These residual
+records are live source files with origin: residual and origin_ref: CSOC-WP-0010.
+The accepted personal-account/weekly-call milestones and completed releases
+retain their original receipts. This workplan remains active as the acceptance
+umbrella; unfinished criteria are not marked done merely because they moved.
+Execute and record new work in the owning follow-up below, then close each
+original task against its corresponding return. No duplicate implementation or
+new credential/protocol authority is created by this split.
+
+- CSOC-WP-0010-T04: CSOC-WP-0015-T01/T03 (runtime caller policy and independent ledger acceptance), EMAIL-WP-0008-T03.
+- CSOC-WP-0010-T05: CSOC-WP-0015-T02/T03 (sender/inbox/bounce/retention/copy custody).
+- CSOC-WP-0010-T06: CSOC-WP-0015-T04 (owner-spanning browser journeys and future productive flow verdicts).
+
+The remaining scope is substantive: custody/first offsite recovery, broader
+privacy/content/cohort review, or mail operations and isolated owner browser
+journeys. These are independent deliverables rather than a final tidy-up.
+
+## Requested receiver deployment completed — 2026-10-08
+
+Under the user's explicit deploy instruction, receiver sourcec9756b0 is live at
+immutable eb3e7b68, Deploymentrevision7, one Ready replica. Decision
+0ef49fde-5e92-4656-ac1e-8f945b4bba08. Guarded spec change is image only. Quiesced
+private49152-byte SQLite backup SHA256
+1c943f28517cb75f324f1b11ed2e24f9aaa9779992a8534ef85906c1ff09dcae
+migrates in an isolated copy with all five existing tables/rows unchanged.
+Additional packaged UID10001/network-none rehearsal of the actual backup passes.
+Health/readiness200, unauth401, invalid-template/verification400, new caller schema
+present and scoped policy unselected; no mail sent. Release62.79s, seven offline
+failure fences pass. Capture/rehearsal source helpers are repinned together;
+27 focused ledger/release tests pass. Complete owner receipt:
+email-connect/docs/caller-deployment-2026-10-08.md and JSON.
+
+Code is deployed in the existing admitted single-caller mode. Actual multi-caller
+policy, caller credentials/limits and sender/inbox/backup/browser acceptance
+remain CSOC-WP-0015 with EMAIL-WP-0008-T03/EMAIL-WP-0007 as owner dependencies.
+No extra caller, sender, mailbox access, archive/timer activation or production
+mail is granted by this release. WP-0010 remains the original acceptance umbrella.

workplans/CSOC-WP-0012-durable-recovery-service-readiness.md

@@ -0,0 +1,50 @@
+---
+id: CSOC-WP-0012
+type: workplan
+title: "Durable app recovery and service readiness"
+domain: communication
+repo: coulomb-social
+status: ready
+owner: codex
+topic_slug: coulomb-social
+created: "2026-10-08"
+updated: "2026-10-08"
+origin: residual
+origin_ref: CSOC-WP-0008
+---
+
+Residual acceptance from CSOC-WP-0008, split at the user's request. Existing implementation/release/acceptance evidence remains in the originating workplan; these tasks own the remaining concrete outputs. Source checks never grant runtime or productive acceptance.
+
+## T01 — Admit independent offsite custody and retention
+
+```task
+id: CSOC-WP-0012-T01
+status: wait
+priority: high
+```
+
+Use existing RPF-WP-0053-T02/T03/T06 credential-pair/prefix/escrow admission. Own the coulomb-social consumer acceptance, not another credential provisioning lane. Record capacity, retained independent retrieval receipts, RPO/RTO and expiry of temporary production-pair copies; no secrets in records.
+
+## T02 — Activate and prove the first encrypted paired recovery point
+
+```task
+id: CSOC-WP-0012-T02
+status: todo
+priority: high
+```
+
+After admission, run scripts/paired-backup.py consumer, retrieve the exact immutable version independently, decrypt privately and rehearse application recovery with content/hash/membership/denied-read checks. Reconcile post-capture writes before any production restore. Do not call local temporary copies offsite coverage.
+
+## T03 — Establish scheduled backup, monitoring and service evidence
+
+```task
+id: CSOC-WP-0012-T03
+status: todo
+priority: high
+```
+
+Enable reviewed backup/freshness units only after the exact first-run return. Verify failed-run/pending retry, stale alert, recovery runbook, observed restore time, cost attribution, SLO and business-app service-contract evidence. Keep apex/Bubble retirement in WP-0014.
+
+## Completion
+
+Finish when every task above has its stated evidence and acceptance, or hand off any newly discovered residual to a live work record first. Cross-owner dependencies remain their existing canonical records.

workplans/CSOC-WP-0013-sharing-content-hardening.md

@@ -0,0 +1,50 @@
+---
+id: CSOC-WP-0013
+type: workplan
+title: "Sharing, portability and content-storage acceptance"
+domain: communication
+repo: coulomb-social
+status: ready
+owner: codex
+topic_slug: coulomb-social
+created: "2026-10-08"
+updated: "2026-10-08"
+origin: residual
+origin_ref: CSOC-WP-0008
+---
+
+Residual acceptance from CSOC-WP-0008, split at the user's request. Existing implementation/release/acceptance evidence remains in the originating workplan; these tasks own the remaining concrete outputs. Source checks never grant runtime or productive acceptance.
+
+## T01 — Finish unambiguous storage enforcement
+
+```task
+id: CSOC-WP-0013-T01
+status: todo
+priority: high
+```
+
+Decide and enforce the existing global-slug invariant at SQL/storage boundaries, including admin/import concurrency and legacy collision migration refusal. Preserve tenant/member denial and protected journeys. Prepare migration/rollback proof before a guarded rollout.
+
+## T02 — Complete content fidelity and revision lifecycle
+
+```task
+id: CSOC-WP-0013-T02
+status: todo
+priority: high
+```
+
+Review custom Markdown/raw HTML and body-linked assets with privately nominated corpus examples. Define revision retention/purge and failed multi-file copy/move crash recovery without losing source or incoming-address authorization. Current immutable revisions, stale-edit refusal, supported Markdown attachments and aliases are deployed; preserve them.
+
+## T03 — Review productive sharing and personal portability
+
+```task
+id: CSOC-WP-0013-T03
+status: todo
+priority: high
+```
+
+Review owner Share space/revocation, reader/outsider denial, account-local export, successor ownership and local exit semantics with the user. Keep platform identity outside app deletion. Record UC-003/004/005/006 verdicts independently; weekly-call acceptance is UC-008 only.
+
+## Completion
+
+Finish when every task above has its stated evidence and acceptance, or hand off any newly discovered residual to a live work record first. Cross-owner dependencies remain their existing canonical records.

workplans/CSOC-WP-0014-cohort-transfer-bubble-offramp.md

@@ -0,0 +1,50 @@
+---
+id: CSOC-WP-0014
+type: workplan
+title: "Further cohort reconciliation and Bubble off-ramp"
+domain: communication
+repo: coulomb-social
+status: ready
+owner: codex
+topic_slug: coulomb-social
+created: "2026-10-08"
+updated: "2026-10-08"
+origin: residual
+origin_ref: CSOC-WP-0008
+---
+
+Residual acceptance from CSOC-WP-0008, split at the user's request. Existing implementation/release/acceptance evidence remains in the originating workplan; these tasks own the remaining concrete outputs. Source checks never grant runtime or productive acceptance.
+
+## T01 — Reconcile retained inventory and nominate the next cohort
+
+```task
+id: CSOC-WP-0014-T01
+status: todo
+priority: high
+```
+
+Treat 71-space/109-article capture as inventory, not bulk-import authorization. Reconcile fresh/private source, identity and explicit grants, retained/discontinued workflows and assets/links. ReichelAg weekly-call cohort is already live and accepted. Record exact next nominated cohort and non-secret lossiness evidence.
+
+## T02 — Review remaining journeys and record transfer decisions
+
+```task
+id: CSOC-WP-0014-T02
+status: todo
+priority: high
+```
+
+Maintain docs/usecases/catalog.md confidence and stable UC IDs. Privately compare original/rebuild actor steps for UC-001–007 and user-prioritized hierarchy/discovery/social/marketplace candidates; register synthetic regression contracts when established. Each productive transfer needs a user verdict; reject/gap/defer becomes live work.
+
+## T03 — Decide service and host cutover for accepted cohorts
+
+```task
+id: CSOC-WP-0014-T03
+status: wait
+priority: high
+```
+
+Depends on WP-0012 service/recovery and WP-0013 privacy/content returns. Link service contract §§1–6, current registration Case B, cost/SLO/provenance and accepted differences. Retain parallel hosts until an explicit cohort/apex decision; Bubble retirement requires all retained use cases transferred or explicitly discontinued.
+
+## Completion
+
+Finish when every task above has its stated evidence and acceptance, or hand off any newly discovered residual to a live work record first. Cross-owner dependencies remain their existing canonical records.

workplans/CSOC-WP-0015-communication-runtime-acceptance.md

@@ -0,0 +1,60 @@
+---
+id: CSOC-WP-0015
+type: workplan
+title: "Communication runtime, inbox operations and flow acceptance"
+domain: communication
+repo: coulomb-social
+status: ready
+owner: codex
+topic_slug: coulomb-social
+created: "2026-10-08"
+updated: "2026-10-08"
+origin: residual
+origin_ref: CSOC-WP-0010
+---
+
+Residual acceptance from CSOC-WP-0010, split at the user's request. Existing implementation/release/acceptance evidence remains in the originating workplan; these tasks own the remaining concrete outputs. Source checks never grant runtime or productive acceptance.
+
+## T01 — Admit and activate explicit transactional caller policies
+
+```task
+id: CSOC-WP-0015-T01
+status: wait
+priority: high
+```
+
+Receiver source is implemented and image deployment recorded in EMAIL-WP-0008. EMAIL-WP-0008-T03 owns actual caller/binding/template/operation/quotas, separate token custody/delivery and original-caller transition. Product acceptance verifies the admitted integration; avoid duplicating receiver implementation or granting arbitrary app notifications.
+
+## T02 — Establish platform sender and monitored reply/bounce ownership
+
+```task
+id: CSOC-WP-0015-T02
+status: todo
+priority: high
+```
+
+Review replacing the receiver forgejo sender with platform identity through its credential owner, then name reply/inbox/support owner and prove authorized inbound access, DNS MX/SPF/DKIM/DMARC, correlated bounce/suppression and retention. No unsolicited scans or auto responses. Existing native personal reset is accepted and stays separately evidenced.
+
+## T03 — Complete independent ledger recovery and copy custody
+
+```task
+id: CSOC-WP-0015-T03
+status: wait
+priority: high
+```
+
+EMAIL-WP-0007-T03/T04 and RPF-WP-0053-T05/T06 own primary archive admission/atomic credential pair, first encrypted capture/retrieval/rehearsal and monitoring. Require image/schema-bound six-table recovery, restored accepted/unknown/consumed/cancelled/suppressed/quota continuity and post-capture reconciliation; govern temporary pre-release copies.
+
+## T04 — Establish owner-spanning browser journeys and productive flow verdicts
+
+```task
+id: CSOC-WP-0015-T04
+status: todo
+priority: high
+```
+
+Use isolated issuer/directory/local mail sink/app for UC-009/010/011. Bind exact mandatory browser nodes without production URLs/accounts or SMTP provider sends; test expired/replayed handles and tenant/client/caller denials. Future UC-012 needs a user-selected product template/caller. Preserve UC-008 manual mail distribution and UC-009 existing personal reset acceptance.
+
+## Completion
+
+Finish when every task above has its stated evidence and acceptance, or hand off any newly discovered residual to a live work record first. Cross-owner dependencies remain their existing canonical records.