# SCOPE — implemented capability and boundaries

Reviewed 2026-10-06 against application source, tests and dated repository
records. This describes what the checkout can do; historical live evidence is
identified separately. It is not a current production acceptance certificate.

## What this repository is

A standalone Django co-creation application rebuilding coulomb.social on
Railiance / NetKingdom / HelixForge. Today it implements an authenticated spaces
and markdown-pages product plus local content migration tools. It is not yet
the complete social network or marketplace described by INTENT.md.

The accepted [stage-1 cut](docs/decisions/2026-08-12-feature-cut-stage-1.md)
prioritizes onboarding and productive spaces/pages transfer; marketplace,
favorites, payments and real-time collaboration are later capabilities.

## Implemented in this checkout

| Capability | Actual behavior and evidence |
|---|---|
| Identity | OIDC/PKCE login, logout, JIT local Member linked to user-engine; issuer+subject identity, session diagnostics and assurance handling. Development claims login is restricted to DEBUG with OIDC disabled. `apps/identity/`, identity tests. |
| Registration entry | Configured NetKingdom registration redirect; this app does not issue passwords or send verification mail. CSOC-IN-0001 is closed with 2026-08-14 Case B evidence. |
| Spaces | Tenant-filtered list/detail, member-facing create/update/archive, Title, Abstractor (`description`) and Visual metadata. `apps/spaces/services.py`, `tests/test_space_crud.py`. |
| Pages | Markdown/frontmatter list, render, create/update/delete, independent copy and transfer with source/destination access checks. Index cannot be deleted or transferred. Separate clipboard copy exports rendered HTML/plain text for manual email distribution. `pageops.py`, PageOps tests. |
| Content sources | Local `CONTENT_ROOT/spaces/<slug>/pages` and assets; optional Forgejo read/edit fallback, cache refresh and push webhook. Markdown is sanitized on render. Local writes do not automatically commit/push to Forgejo. |
| Import | `import_content_tree` for one ADR-0004 tree; `import_content_corpus` for a preflighted JSON batch with explicit existing tenant+issuer+subject membership mappings. Dry-run, replacement opt-in, per-space staging/rollback and aggregate counts. Synthetic multi-space regression coverage; one historical private-space rehearsal. |
| Delivery preparation | Docker/Gunicorn packaging, SQLite development / PostgreSQL URL support, migrations, health endpoint and deployment/runbook docs. Actual Helm values and cluster hosting belong to railiance-apps. |
| Evidence and coordination | Bubble surface/capability inventory, authenticated export scripts, design extraction, schema sketch, accepted cut decision, resource-demand/SLO/labor evidence and file-backed State Hub work records. |

Source paths above are under `coulomb_social/`. Member and Space metadata are
tenant-keyed, but filesystem paths are **slug-keyed**. Deployment is
instance-per-client: do not reuse a content root across tenants. Normal creation
and imports reject existing cross-tenant slug collisions; this is not a full
filesystem tenant namespace or a database-wide concurrency guarantee.

## Practical limits

- Space reads now require explicit membership or a creator grant. Viewer
  memberships are read-only across product mutation routes and service writes;
  owner/member grants permit writes. Sharing-management UI and exact Bubble
  privacy parity remain incomplete. Imported mappings add/update grants;
  replacement does not revoke old grants. Review access before a real cohort import.
- Copy/transfer handles relative Visual files, not arbitrary body-linked assets,
  incoming page links, graph identity or Bubble parent/chunk semantics. Visual
  metadata and copied files do not establish an authenticated asset-serving or
  upload pipeline.
- Import requires local prepared trees and existing active identities. It does
  not create platform accounts, import passwords, scrape missing Bubble content,
  or certify corpus completeness. It runs with writers paused; the batch is
  restartable per space, not globally atomic or crash-transactional.
- No app-local member export/delete product, paired DB/content restore drill,
  automatic content git versioning, outline/include/projection authoring or
  marketplace/social/payment product is implemented here.
- Historical health/auth evidence does not prove current image, persistence,
  runtime SLOs, backup success or complete service-contract compliance.

## Recorded deployment state

The host strategy is rebuild on `app.coulomb.social` with Bubble on apex until
an explicit cutover. Historical identity/app-shell evidence is in
[identity smoke](docs/identity/smoke.md). Public registration was evidenced on
2026-08-14. **CSOC-IN-0004 remains open** for PageOps deployment, migration,
live product acceptance. On 2026-10-06, founder-approved Helm revision 10 deployed
the tested app (source ac7bac1852c9, chart 0.2.0, digest pinned) with a retained
2Gi CONTENT_ROOT PVC and one writer/Recreate. OIDC client registration was restored
and KeyCape restarted; authorization now hands off to Authelia. Public health,
clipboard asset delivery, zero pending migrations and content restart durability
passed. Interactive tegwick sign-in remains blocked: Authelia rejects the attempted
credentials although a read-only directory check confirms the account exists.
Real-use-case acceptance remains pending;
[deployment receipt](docs/release/personal-account-deployed-2026-10-06.md) records
exact evidence and gaps. All six original numbered workplans are finished;
their residual intakes remain the source of unfinished work.

## Ownership boundaries

This repo owns product behavior, local identity integration, application models,
content/migration tooling, packaging and acceptance evidence. It does not own
Railiance infrastructure/charts, NetKingdom issuer/mail/secrets services,
HelixForge standards, or fleet improvement loops. Core Hub embedding and Bubble
as the long-term development surface remain out of scope.

## Next work and orientation

Read [INTENT.md](INTENT.md), [the timestamped assessment](history/20261005T223104Z-scope-intent-assessment.md),
[CSOC-WP-0007](workplans/CSOC-WP-0007-safe-transfer-readiness.md), and
[CSOC-WP-0008](workplans/CSOC-WP-0008-production-transfer-acceptance.md).
The local transfer tool closes a preparation gap; persistence/restore, private
cohort migration, access acceptance and founder cutover are live successor work.

Development: `README.md`, `docs/dev.md`, `make test`, `make lint`.
Content architecture: ADR-0003/0004 and `docs/architecture/`.
Migration: `docs/migration/`, including `corpus-import.md`.
Delivery: `docs/deploy.md`; residual records: `docs/intakes/csoc-residuals.md`.

First user-confirmed review case: ReichelAg weekly founder-call protocols
(UC-008), full duplication and manual editing plus clipboard copy for external
email. See docs/usecases/reichelag-weekly-call.md; live transfer is pending.

Established use-case regression protection is in docs/usecases/registry.json
and tests/usecases/, starting with ReichelAg. `make check` runs fast/application
and actual-browser journeys with mandatory test coverage validation and JUnit
reports. Forgejo workflow is configured; remote runner/required-merge-check
acceptance remains CSOC-IN-0005. User transfer acceptance stays separate.