coulomb-social/docs/intakes/csoc-residuals.md

coulomb-social residual intakes

File-backed intakes for leftovers from finished workplans. Canon: work-record types § Residuals (origin: residual, origin_ref: <WP-id>).

---

CSOC-IN-0001 — Enable public Create account + Case B smoke

id: CSOC-IN-0001
kind: intake
title: "Enable Create account and Case B registration smoke on app.coulomb.social"
lane: blue
status: closed
priority: medium
owner: coulomb-social
repo: coulomb-social
origin: residual
origin_ref: CSOC-WP-0003
description: |
  App entry for Create account is implemented (NETKINGDOM_REGISTRATION_URL,
  /auth/register/, landing button). Public enablement waits on NetKingdom
  mailbox verification and published registration URL (NK-WP-0025 / USER-WP-0022).

  When the platform registration URL is live:

  1. Set NETKINGDOM_REGISTRATION_URL on coulomb-social-env (names only in git;
     example shape in .env.example).
  2. Confirm landing shows Create account and /auth/register/ redirects only to
     that URL (no open redirect via ?next=).
  3. Run Case B: brand-new public registration → verified mail → OIDC → first
     Member JIT on app.coulomb.social.
  4. Record evidence under docs/identity/smoke.md.

  DoC-Ok: residual of finished CSOC-WP-0003; platform dependency explicit.
notes: |
  Closed 2026-08-14. NK-WP-0025 published the registration URL and completed
  disposable mailbox verification, KeyCape PKCE, Member JIT, and repeat-login
  evidence. The live app redirect uses the configured URL only.
  Related: narrowed CSOC-IN-0002 for two focused regression checks.
state_hub_intake_id: "019ff532-3694-7868-a3a7-f4b4f28a647a"

---

CSOC-IN-0002 — Identity negative matrix after Case B

id: CSOC-IN-0002
kind: intake
title: "Add callback replay and email-only takeover regressions"
lane: green
status: closed
priority: low
owner: coulomb-social
repo: coulomb-social
origin: residual
origin_ref: CSOC-WP-0003
description: |
  Case B, repeat-login issuer+subject idempotency, registration redirect
  confinement, and AAL1/AAL2 isolation are now proven. Add direct application
  regressions for the two checks not yet independently covered:

  - a consumed/replayed OIDC callback state fails closed; and
  - the same email with a different issuer+subject cannot take over a Member.

  Capture the results in docs/identity/smoke.md and close this intake.
notes: |
  Closed 2026-10-06 by CSOC-WP-0007. Independent application regressions in
  tests/test_identity_regressions.py prove consumed callback replay rejection
  before a second token exchange and same-email/different-identity separation.
  Narrowed 2026-08-14 after NK-WP-0025 completed live Case B. No longer blocked
  on the registration or mailbox path.
state_hub_intake_id: "019ff532-3ade-7d75-acb7-2bbfa264fcb8"

---

CSOC-IN-0003 — Multi-space Bubble corpus import + membership map

id: CSOC-IN-0003
kind: intake
title: "Bulk-import Bubble corpus trees; map members to NetKingdom"
lane: blue
status: open
priority: medium
owner: coulomb-social
repo: coulomb-social
origin: residual
origin_ref: CSOC-WP-0001
description: |
  Single-space rehearsal (reichelag) is done via import_content_tree.
  Residuals from finished CSOC-WP-0001:

  1. Generate ADR-0004 trees for more of the 71-space corpus (optional deeper
     crawl for thin spaces — export-progress-2026-08-13).
  2. Bulk import into CONTENT_ROOT with tenant + replace policy.
  3. Map Bubble members_list_user → NetKingdom/Member + SpaceMembership
     (no password import; assisted transfer only).
  4. Keep private trees out of git; document additional lossiness.

  Prefer a dedicated workplan if bulk import + identity map spans multiple
  sessions; otherwise close this intake when (1)–(3) are evidenced.
notes: |
  Local tooling prepared by CSOC-WP-0007; actual corpus/cohort acceptance
  continues in CSOC-WP-0014-T01 after WP-0008 closure. Intake remains open
  until real receipts.
  Pickup: docs/session-pickup.md · rehearsal: docs/migration/rehearsal-reichelag-2026-08-13.md
  Code: coulomb_social/apps/spaces/import_tree.py
state_hub_intake_id: "019ffac3-f894-707a-9fdb-75c8ea14497d"

---

CSOC-IN-0004 — Deploy stage-1 PageOps to app.coulomb.social

id: CSOC-IN-0004
kind: intake
title: "Deploy PageOps CONTENT_ROOT + space visual migration to app host"
lane: green
status: open
priority: high
owner: coulomb-social
repo: coulomb-social
origin: residual
origin_ref: CSOC-WP-0006
description: |
  Member UI and content plane land on main; production host still needs:

  1. Image/release with spaces.0002_space_visual + PageOps views.
  2. CONTENT_ROOT persistent volume (or agreed path) on the workload.
  3. migrate + smoke: New space, page CRUD, copy/transfer on app.coulomb.social.
  4. Extend docs/identity/smoke.md live results.

  Local default CONTENT_ROOT is var/content (gitignored). Cluster must not
  rely on empty ephemeral disk without a volume decision.
notes: |
  Current app revision16 and persistent storage are deployed. Remaining
  stage-1 live-smoke/receipt reconciliation is owned by CSOC-WP-0012-T03
  after WP-0008 closure; this intake stays open until its stated receipts.
  Runbook docs/deploy.md · capability model docs/capability/model-v0.yaml
  Pickup: docs/session-pickup.md
state_hub_intake_id: "019ffac3-fc7d-7850-93b6-b0d289881ec7"

---

CSOC-IN-0005 — Activate required Forgejo use-case regression check

id: CSOC-IN-0005
kind: intake
title: "Verify Forgejo use-case runner, retain reports and require the regression check"
lane: green
status: open
priority: high
owner: coulomb-social
repo: coulomb-social
origin: residual
origin_ref: CSOC-WP-0009
description: |
  Local make check and the ReichelAg fast/real-browser contract pass.
  .forgejo/workflows/usecases.yaml configures main push, PR and manual runs
  on the existing ubuntu-latest container label. The source SHA archive is
  publicly readable (HTTP 200 checked 2026-10-06); no credential embedded.

  Through the Forgejo/railiance-forge owner lane, verify repo Actions and
  runner admission, Python/Node/browser dependency bootstrap and the exact
  usecase-regressions job on a triggering commit. Record a successful remote
  run with the commit SHA, make check result and JUnit report receipt.
  Configure report retention/artifacts and make the named job a required
  merge check. Confirm a failing journey prevents merge and a passing repair
  unblocks it. Do not claim branch enforcement from the local gate alone.
notes: |
  Infrastructure home: docs/usecases/README.md.
  Runner/profile changes and protected-branch administration require the
  appropriate owner path; no shared runner or production change made here.
state_hub_intake_id: "01a1110f-e2ec-736f-8209-e14425b62373"