coulomb-social/history/20261006T144400Z-personal-account-release-assessment.md

Personal Coulomb account release — 2026-10-06

CSOC-WP-0008 · RAPPS-WP-0015 · pending founder decision 8bbce691-a787-4140-9cd4-df06e8635a27. No live mutation has been performed. Prepared code, image and review branch are ready; the personal account is not yet usable through this app.

What is running

There is a replacement workload on railiance01 (92.205.62.239): Helm revision 9, image 7fcd0cf, 1/1 available. Landing and /healthz return 200. This is the old August shell; it has no content PVC and lacks the latest tested workspace flows. The user-selected tegwick Member already exists in tenant:coulomb, bound to issuer https://kc.coulomb.social and directory subject uid=tegwick,ou=people,dc=netkingdom,dc=local. No password or new identity is required. One demo space has no membership grants; a stored Member alone grants no access.

The user's actual login returns invalid_profile_usage / unknown client_id. Guarded read-only inspection confirms the coulomb-social client is absent from KeyCape. Discovery health and stored identity did not establish working login.

Exact proposed change

1. Restore NetKingdom's historical public coulomb-social client. Authorization code + PKCE; scopes openid/profile/email/groups; exact callbacks: http://127.0.0.1:8008/auth/callback/, http://localhost:8008/auth/callback/, https://app.coulomb.social/auth/callback/ and https://coulomb.social/auth/callback/. No wildcards or client secret. Preserve historical mfaRequired=false (ordinary AAL1; explicit AAL2 remains available), as recorded in docs/security-close-down-checklist.md.
2. Restart only sso/keycape to load that registration. This shared issuer restart can interrupt in-flight sign-ins. Issued tokens remain valid. No other client registrations or credentials are changed.
3. Complete a fresh apps-pg barmanObjectStore Backup before app migration. A daily Backup apps-pg-daily-20261006021500 was completed at 02:15:19 UTC today; that establishes an existing DB recovery point, not paired application recovery.
4. Upgrade only the coulomb-social Helm release using chart 0.2.0 and --atomic. Source image ac7bac1852 is published and pinned to immutable digest sha256:bf975939e22b9b0a5d9ac05584ae6265ba201169df6dc48e506ec684b30a9c58. Add retained 2Gi local-path RWO coulomb-social-content PVC at /app/var/content; CONTENT_ROOT matches. One replica, Recreate, fsGroup/runAsUser 10001. Brief app interruption; no rolling surge. Existing PostgreSQL and env Secret references remain. Entrypoint runs Django migrations; Helm rollback does not undo them.

Node requests observed 3455m/4000m CPU (86%); host disk free 123G. Refresh before execution. Coulomb-social is Helm-managed and not among current ArgoCD apps.

Verification completed

• make check: 88 tests passed, including Chromium ReichelAg duplicate/edit/copy, rich HTML/plain text payloads, reader-write denial and outsider privacy.
• Guarded repair: synthetic insertion/idempotence and differing/duplicate refusal checks pass; owner helper preserves unrelated config bytes and other Secret data.
• Live safe inspect and server dry-run through SSH pass, with no Secret values or raw errors emitted. Observed UID 2e94519d-1550-41c7-9701-2efe47fe1fd3, resourceVersion 67716615. Refresh both before apply; CAS refuses stale receipts.
• Production container serves /static/spaces/copy-content.js HTTP 200, 2909 bytes, with ClipboardItem code. Static assets are collected into the release image.
• Helm lint/server dry-run pass; diff shows image/digest, content volume/mount, CONTENT_ROOT, Recreate and chart label change. Chart rejects multiple replicas, RollingUpdate and content-root mismatch.

Execution and recovery after approval

Record the founder's exact go as ADMINISTER @ realm:kubernetes/railiance01, activation=APPROVED. Freeze the reviewed owner branch before moving its changes into main; re-render and repeat diff/dry-run if the live state has changed.

Run scripts/register-keycape-client.sh inspect, then dry-run with its fresh --expected-uid/--expected-resource-version; apply with the same receipt. The wrapper executes Kubernetes operations on railiance01 through SSH and suppresses Secret output/errors. It does not restart anything. Only after readback succeeds, restart sso/keycape from the node and wait for rollout readiness. Check discovery and authorization handoff; ask the user to complete their own interactive login. If issuer readiness fails, stop: never replay a stale Secret or reset other clients. Any inverse repair needs fresh revision checks and owner review.

Before the app upgrade, create a scoped CNPG Backup in databases with spec.cluster.name=apps-pg and method=barmanObjectStore; wait for completed status. Use a timestamped csoc-preupgrade name and record non-secret completion metadata. Copy the reviewed chart/production values to a private node staging directory. From SSH on railiance01 with KUBECONFIG=/etc/rancher/k3s/k3s.yaml, run Helm upgrade coulomb-social in namespace coulomb-social with the reviewed values, --atomic, --wait and a bounded timeout. No env Secret reconstruction or legacy registration apply script. Verify readiness, image digest, static asset, mounted content write ownership and database migrations before exposing productive content.

Application rollout failure: Helm atomic rollback returns to the previous release (revision 9 baseline). Retain the content PVC; never delete it for a retry. Investigate migrations separately; restore the private pre-upgrade DB backup only through the owning PostgreSQL lane and a separately confirmed destructive restore.

User milestone and remaining acceptance

The immediate milestone is: tegwick signs in at app.coulomb.social and can use a personal private workspace on the new infrastructure. Then demonstrate the first ReichelAg journey: retain the original full protocol, duplicate it for the next call, edit agenda/protocol by hand, and copy rich/plain content for manual email.

Successful rollout does not finish WP0008. Prove content restart durability and paired DB/content restore (T02); privately reconcile the real nominated latest ReichelAg protocol (T03); complete user review and actual email-client paste (T09). Sharing/export/delete and content fidelity remain tracked tasks. No Bubble exit/apex cutover or real-data import is included in this live approval.

Review artifacts

Application source is committed to coulomb-social main. Deployment changes are on railiance-apps branch csoc-wp-0008-personal-app (RAPPS-WP-0015), pending live go: https://forgejo.coulomb.social/coulomb/railiance-apps/src/branch/csoc-wp-0008-personal-app

Credential owner routing: key-cape-oidc-login; SSH access uses existing routed certificate access. No secrets were fetched into chat, logs, Git or State Hub. Owner helper source reviewed: net-kingdom 8f368679cdda1df699d52ad496bed77c59064f61; portal-client-rollout.py SHA256 158e1d36eb881cdd0a2eda91b472adea5e8fde5061e00d26dda368580aeb871f. Changes to the owner helper require fresh review/dry-run before live execution.