Define concrete client offboarding scope and retained data boundaries

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a18e2d-f513-7742-b8e7-12af0b744ff3

docs/release/client-data-export-review-2026-10-30.md

@@ -96,3 +96,19 @@ session revocation, process-log disposition and primary/mirror/protected-kit bac
 expiry. The existing independent-kit no-expiry protection must not be silently
 overridden. No client offboarding or productive deletion is authorized by this
 implementation or its tests.
+
+## October31 deployed return and offboarding scope
+
+Revision19 has since deployed the reviewed exporter. Its packaged current-point
+proof verifies85selected local files and four record sets, no selected external
+bindings and unchanged source data; the temporary ZIP was removed afterward.
+See `identity-export-release-client-export-2026-10-31.json`. The earlier source-only
+and81file statements above retain their original dated scope.
+
+The subsequent native scope check finds a second space outside the accepted
+export tenant, with an external binding under the deployment default tenant.
+Zero external bindings in the selected tenant must not be promoted to complete
+instance attribution. The retained content PVC, five isolated database restores,
+sessions, root journals and protected backup holds also need explicit disposition.
+T12's concrete review is `client-offboarding-scope-review-2026-10-31.md`; it does
+not authorize teardown or deletion of this active service.

docs/release/client-offboarding-scope-2026-10-31.json

@@ -0,0 +1,157 @@
+{
+  "schema": "coulomb.client-offboarding-scope.v1",
+  "recorded_at": "2026-10-31T14:55:21.318848+00:00",
+  "task": "CSOC-WP-0012-T12",
+  "task_status": "progress",
+  "current_application_scope": {
+    "observed_at": "2026-10-31T14:51:29.215499+00:00",
+    "scope": "accepted tenant:platform only; canonical client binding unresolved",
+    "database_name": "coulomb_social_db",
+    "record_counts": {
+      "members.user": 1,
+      "members.member": 1,
+      "spaces.space": 1,
+      "spaces.spacemembership": 1
+    },
+    "selected_local_content_files": 85,
+    "external_binding_count": 0,
+    "all_spaces_count": 2,
+    "selected_spaces_count": 1,
+    "session_row_count": 43,
+    "export_ownership_checks_passed": true,
+    "read_only_repeatable_read_transaction": true,
+    "external_writer_fence": false,
+    "coherent_export_created": false,
+    "source_changed": false
+  },
+  "unselected_scope": {
+    "unselected_spaces": 1,
+    "unselected_external_bindings": 1,
+    "unselected_tenant_count": 1,
+    "unselected_tenants_match_deployment_default": true,
+    "unselected_spaces_with_creator": 0,
+    "canonical_client_assignment_inferred": false
+  },
+  "native_content_storage": {
+    "observed_at": "2026-10-31T14:49:42.586579+00:00",
+    "deployment_uid": "2dbe661a-d232-4477-bbd1-833813077fbe",
+    "persistent_claims": [
+      {
+        "name": "coulomb-social-content",
+        "uid": "9888abeb-9d52-4c70-a23d-b5494780d9c3",
+        "phase": "Bound",
+        "storage_class": "local-path",
+        "capacity": {
+          "storage": "2Gi"
+        },
+        "helm_resource_policy": "keep",
+        "pv_name": "pvc-9888abeb-9d52-4c70-a23d-b5494780d9c3",
+        "pv_uid": "ac1aa73c-08d9-4561-995b-41060468e506",
+        "pv_reclaim_policy": "Delete",
+        "claim_uid_matches": true
+      }
+    ],
+    "configuration_changed": false
+  },
+  "retained_local_restores": {
+    "containers": 5,
+    "running": 5,
+    "backing_database_volumes": 5,
+    "all_networks_internal": true,
+    "all_networks_single_container": true,
+    "published_ports": 0,
+    "public_receipt_linked_containers": 4,
+    "additional_private_receipt_sha256": "cc1d1be94da22756b52a00cc743ecd72b5cf8e956a7fd91288174dbb4499902b",
+    "additional_public_binding": "docs/release/identity-export-release-client-export-2026-10-31.json",
+    "all_five_have_receipt_bindings": true,
+    "stopped_or_deleted": false
+  },
+  "scope_limits": {
+    "canonical_client_assignment_resolved": false,
+    "unselected_external_content_resolved": false,
+    "fresh_coherent_export_created": false,
+    "client_delivery_or_acceptance": false,
+    "sessions_decoded_or_revoked": false,
+    "instance_or_data_deleted": false,
+    "backup_hold_released": false,
+    "provider_expiry_performed": false,
+    "disposable_offboarding_rehearsal_performed": false,
+    "offboarding_accepted": false
+  },
+  "private_inventory_files": [
+    {
+      "name": "accepted-point-link.json",
+      "sha256": "eb54af2fe49bf90a02680d68c8f69335e8a591042479faa0367dc9c925f6f097"
+    },
+    {
+      "name": "current-application-scope.json",
+      "sha256": "e24c3112c52e8ffd80a146c4dec8bd00e187ca0de14661644dd58206ebc535a6"
+    },
+    {
+      "name": "native-storage.json",
+      "sha256": "e8f4c32462ffb9869ceaf8991874d14858705ebe59978eb9fc2743daa0135efc"
+    },
+    {
+      "name": "restore-scope-linked.json",
+      "sha256": "8f2af25c9c80c69319bd6b61cf96094fe4054ed27fc1c63ae586962987971111"
+    },
+    {
+      "name": "restore-scope-summary.json",
+      "sha256": "6d24beb8739c34eaa6c34b9d5829b161ba5e863eea1376103598b7a2f04822a5"
+    },
+    {
+      "name": "retained-restores.json",
+      "sha256": "5b24822d8025c83011a286f097ca7f88125e42979864660ec5613e5b83a1323d"
+    },
+    {
+      "name": "unselected-scope.json",
+      "sha256": "33df8b171bfc31713118b216f1fb3b113c716d42560a00585eaee0fa91dcd56d"
+    }
+  ],
+  "evidence_sources": [
+    {
+      "path": "docs/release/identity-export-release-client-export-2026-10-31.json",
+      "sha256": "d1b9d88b850a5aed19159bee867c4b0723a7a1df9e13c179d57a3de9e9cb67af"
+    },
+    {
+      "path": "docs/release/provider-kit-recovery-post-date-2026-10-31.json",
+      "sha256": "b7191972f4e4f7d0b74ae7bbdeb93aabdb79e2baf27ccb49108f6f30f417182c"
+    },
+    {
+      "path": "docs/release/generation-retention-post-date-2026-10-31.json",
+      "sha256": "10c78d8a69c02f28f9ad5f126c4daac89f6988516e3234ea67eaee6c0b5be6df"
+    },
+    {
+      "path": "coulomb_social/apps/members/client_export.py",
+      "sha256": "223a9ee42af6f17829aa263abcae595626e292b887de85820f48fdfa4a6363fa"
+    },
+    {
+      "path": "/home/worsch/railiance-apps/helm/coulomb-social-values.yaml",
+      "sha256": "63a45d1cfb395eff7cfdf21ed2100fb9562b7a2ab6b896afecbebfaabacae547"
+    },
+    {
+      "path": "/home/worsch/railiance-apps/charts/coulomb-social/templates/content-pvc.yaml",
+      "sha256": "5c4ddcaee2b3dcdf17da061b1a7a2cb1e0398d2f56f4ef31790cfaaf648b0fee"
+    },
+    {
+      "path": "/home/worsch/the-custodian/canon/standards/business-app-service-contract_v0.1.md",
+      "sha256": "83d2799d39f957d88aa1d71c3f04f7c2a0e168390249dc409ce149128d44e80c"
+    }
+  ],
+  "statehub_readback": {
+    "task_id": "54af74b0-3212-537e-a02c-d2d8a091caf9",
+    "status": "progress",
+    "scope_review_synced": true,
+    "fix_consistency_exit_code": 0,
+    "automation_errors": 0,
+    "assessment_failures": 0,
+    "warnings": 8
+  },
+  "validation": {
+    "native_scope_assertions_passed": true,
+    "private_modes_and_hashes_verified": true,
+    "source_hashes_verified": true,
+    "json_round_trip_checked": true,
+    "application_code_changed": false
+  }
+}

docs/release/client-offboarding-scope-review-2026-10-31.md

@@ -0,0 +1,81 @@
+# Client offboarding scope review — 2026-10-31
+
+CSOC-WP-0012-T12 now has a concrete, non-destructive scope review. It remains
+**progress**, not accepted or executable. This review neither closes the active
+service nor authorizes deletion, session revocation, expiry or credential changes.
+
+The governing [service contract §6.2](/home/worsch/the-custodian/canon/standards/business-app-service-contract_v0.1.md)
+requires support for complete client export and deletion: export, instance
+teardown and backup expiry. Demonstrating that capability does not require
+tearing down this active client now. T12 still needs its agreed scope, private
+export delivery/acceptance and independently verified teardown/expiry procedure.
+
+## Verified scope and unresolved attribution
+
+The packaged revision19 export proof covers the accepted `tenant:platform`:
+one User, Member, Space and SpaceMembership and85local files. Its coherent
+07:13recovery point had no external bindings in that selected tenant. The temporary
+export was removed after validation; this is not a delivered client archive.
+
+A fresh read-only application transaction at14:51Z repeats the ownership checks
+and finds the same four record counts and85selected local files, with no selected
+external binding. It also finds **two spaces in the instance**, one outside the
+selected tenant. A separate bounded read confirms that unselected space has an
+external binding and belongs to the configured default tenant (`tenant:coulomb`),
+with no creator link. These facts do not establish its legal client, whether it
+is dispensable, or whether its remote content has been preserved. T11's canonical
+client/app/instance mapping and the disposition of this unselected binding must
+precede any proposal to tear down the whole database or instance.
+
+The live read observed43session rows. Those rows were counted, not decoded or
+attributed to the selected client. The read used a read-only transaction; app
+writers were not fenced and no new coherent export was created. Do not combine
+its counts with the older export hash to claim a newly verified deliverable.
+
+## Stores and owner returns
+
+| Store or boundary | Established evidence | Required offboarding return |
+| --- | --- | --- |
+| App SQL data, local principals, grants and admin history | Database `coulomb_social_db`; schema-derived inventory and selected-tenant export guards; one unselected externally bound space | Resolve client/tenant scope, produce and privately deliver a final coherent export, obtain acceptance, then review the database/role action through the deployment/database owners. Preserve the shared apps-pg cluster and other databases. |
+| Local pages, assets, aliases and all revisions |85selected local files; deployed content PVC `coulomb-social-content`, UID9888abeb-9d52-4c70-a23d-b5494780d9c3, Bound2Gi/local-path | Export all assigned content, including deleted-page revisions. A future teardown must separately identify the claim/PV and verify its storage outcome. The PVC has `helm.sh/resource-policy: keep`; uninstalling the release alone is not content deletion. |
+| App sessions and transient OIDC state |43current session rows; intentionally excluded from the client ZIP | Establish the approved app/tenant scope and revoke its sessions through a reviewed action. A count does not attribute anonymous/transient sessions; do not infer authority to revoke shared identity-provider sessions. |
+| External content and identity links | One unselected externally bound space; OIDC/NetKingdom and user-engine are shared owners | Resolve the remote content and client assignment. Review only application-specific links/grants with their owners; do not delete shared human identities, provider clients or services based on local Member removal. |
+| Node backup and release state | Existing paired archives, release capsules and date-operation journals; date journals can retain original index bytes outside CONTENT_ROOT | Include all assigned private bytes and journal/preimage copies in the exact retained/deleted set. T04's custody repair changes ownership/modes only and is not a disposition or expiry approval. |
+| Local retained restores | Five running PostgreSQL recovery containers, five volume-backed stores; internal networks, one container each, no published ports | Preserve them pending disposition. The private inventory records container IDs, volume/mount identities, networks and links to existing restore receipts. Future cleanup must bind exact identities and verify both database volumes and corresponding plaintext content directories; stopping a container is not deletion. |
+| Private source captures, review bundles and local archives | Source inventory spans71spaces and several source principals; private review/export copies are outside the live app | Classify ownership before deleting any directory. The whole source capture is not automatically the selected tenant's dataset. Preserve originals, accepted evidence and unresolved source records until explicit disposition. |
+| Primary provider copies | Dedicated Coulomb application-archive prefix in shared `railiance-platform-pg-backup` | Provider owner must inventory exact versions, retain the final accepted export/recovery point as agreed, then execute admitted expiry. Do not delete the shared bucket or other applications' prefixes. |
+| Mirrored generations and public receipts | Existing dated generation selection and exact-version readback; expiry remains separately admitted | Recompute the current exact keep/expiry set at execution. Rolling retention is not full client offboarding; deleting one mirror does not remove primary or protected copies. |
+| Protected kits, proofs and separate recovery-key custody | Latest provider kit4166eb8b/version1793432303941465 is explicitly outside automatic expiry | Obtain explicit owner disposition for all client-bearing kit versions, proofs and associated recovery custody. Existing no-expiry protection remains in force; destroying a key alone is not a demonstrated complete offboarding procedure. |
+| Logs, telemetry and notification ledgers | App/process logs and operator state are outside the ZIP; email-connect is a shared owner | Establish attribution and the permitted retention/expiry outcome with each owner. No log, mail-ledger or telemetry payload inventory or removal is claimed here. Preserve unrelated applications and required retained records. |
+| Deployment, endpoint and credential projections | Revision19 and its declared resource/identity boundaries remain active | After accepted export and explicit teardown admission, remove only the bound instance resources/projections and verify routing, workloads, data stores and owner returns. Keep shared cluster, forge, identity, mail, telemetry and provider services. |
+
+The PVC's native PV reclaim policy is `Delete`, and its claim UID matches the
+bound PVC. That policy is a configuration fact, not proof of deletion: the claim
+has not been removed, and no storage teardown has been exercised.
+
+## Evidence and closure sequence
+
+The public aggregate proof is `client-offboarding-scope-2026-10-31.json`. Exact
+local restore volume/path metadata stays in the private
+`~/.config/coulomb-social/auth/exports/offboarding-review-20261031/` inventory.
+Four restore containers link directly to public recovery receipts; the fifth
+links through the private receipt whose SHA matches the published revision19
+client-export proof. All five remain running and untouched.
+
+1. Bind the canonical client to the actual tenant/instance scope and resolve the
+   unselected external binding; do not substitute the deployment default tenant.
+2. Agree the complete store list and retention/expiry outcomes, including the
+   protected-kit hold, shared-owner stores and retained private copies.
+3. Prepare the exact teardown/expiry procedure and demonstrate it on a disposable
+   scoped instance and provider-owner test resources. Keep production identities,
+   data and held backups out of that destructive rehearsal.
+4. Produce a fresh coherent export for private delivery and obtain the required
+   client acceptance. The existing rehearsal archive no longer exists.
+5. If actual offboarding is later requested, bind the then-current identities,
+   object versions, writer fence, accepted export and approvals before execution;
+   retain independent completion/exception receipts for every included store.
+
+This review does not choose retention durations, release holds, infer a client ID
+or claim that steps3–5 have been performed. It supplies the missing concrete
+scope for T12 while preserving T04 retention, T11 attribution, WP-0013 portability
+and WP-0014 source/grant obligations.

docs/release/goal-progress-audit-2026-10-31.md

@@ -172,3 +172,15 @@ admission does not establish all-space identity or role mappings. The task remai
 progress: this closes an evidence gap inside the task, not productive permission
 reconciliation. The checklist stays 14 of 33 done, and the remaining-effort
 estimate is unchanged. Evidence: `bubble-access-audit-2026-10-31.json`.
+
+## Offboarding scope checkpoint
+
+WP-0012-T12 moves from todo to progress with a concrete non-destructive scope
+review. Fresh native evidence distinguishes the accepted85file tenant export from
+the second, externally bound space; confirms the Helm-retained content PVC; and
+accounts for five still-running isolated recovery databases and their receipts.
+The review includes sessions, root journals, private copies and protected backup
+holds. No teardown, deletion, revocation or expiry occurred. Canonical client
+scope, agreed retention, procedure proof and private delivery/acceptance remain
+open. The checklist stays14of33done; the effort estimate is unchanged. Evidence:
+`client-offboarding-scope-2026-10-31.json` and its human-readable scope review.