coulomb-social/docs/usecases/platform-communication.md

Platform communication use cases

CSOC-WP-0010-T06, reviewed 2026-10-07. Authentication uses native Authelia SMTP; application invitation/verification delivery uses the existing email-connect service. ReichelAg protocol distribution remains UC-008's manual clipboard/email workflow.

These stable IDs are registered in registry.json with synthetic fixture references, app-side fast checks and established: false. Owner-spanning browser coverage is still required under T06. Personal recovery retains its recorded user acceptance; it is not marked as an established automated journey until its full fast/browser contract can be protected. UC-010–012 remain candidates.

ID	Actor, goal and steps	Expected outcome / evidence	Status and owner
CSOC-UC-009	Existing member requests a new reset on the identity portal, receives email, sets a password privately, then signs into the app	Fresh inbox receipt and personal workspace reached; reset URL/password never enter app logs, Git or Hub	User-confirmed and accepted 2026-10-06 for the existing personal account; WP-0010-T02/T03 and WP-0008-T11 done
CSOC-UC-010	New member starts approved registration, receives the verification message, then consumes or cancels its link	Expiring, single-use, purpose-bound channel evidence; cancellation and consumption invalidate one another; account admission remains user-engine's decision	Candidate; implemented service behavior, current personal user workflow not reviewed; T04/T06 with user-engine/NetKingdom/email-connect
CSOC-UC-011	Authorized inviter invites a member; a deliberate resend creates a new event	Fixed invitation template, one provider submission per event, suppression respected; provider acceptance does not establish inbox receipt	Candidate; implemented service behavior, productive user acceptance pending; T04/T06 with user-engine/email-connect
CSOC-UC-012	Member receives a specifically approved application notification and can obtain help through its reply path	Caller/template/recipient authorization, bounded sending, redacted delivery state and monitored reply route	Future candidate; no product template/caller admitted; T04/T05/T06

Personal acceptance reference: workspace acceptance. Original Bubble reset/invitation semantics remain unobserved; UC-009 establishes the replacement's accepted recovery path rather than claiming Bubble parity.

Synthetic regression matrix

Only reserved example addresses, synthetic accounts and injected transports are allowed. Native recovery tests need an isolated issuer, directory, mailbox sink and application; never route a regression through the production mail provider. Do not record usable reset/verification URLs in reports. No mailbox scans or live sends are part of the gate.

Layer / contract	Existing coverage	Remaining gate
App identity boundary	tests/test_identity_regressions.py: consumed callback cannot replay; equal email cannot take over another issuer/subject	UC-009 real-browser issuer reset → local inbox → app login, expired/replayed reset denial, directory isolation
Registration handoff	tests/test_shell.py::test_registration_link_uses_only_configured_destination	UC-010 browser request/verify/cancel; preserve tenant/client binding through owner flow
Invitation auth/template/recipient/key/suppression	email-connect tests/test_transactional.py: test_rejects_auth_recipient_template_and_key, test_suppression_blocks_send	Separate caller identities, caller/template/tenant scope, request limits; no authority from payload source
Invitation retry / uncertain outcome	Owner tests test_sends_fixed_template_once, test_resend_is_separate_event_and_sends_again, test_lost_post_send_record_never_resends_after_restart, test_definitive_failure_retries_but_changed_payload_is_rejected, test_disconnect_after_smtp_acceptance_never_releases_reservation	Per-caller event namespace, bounded retry schedule and operator handling of unknown outcomes
Verification privacy and replay	Owner tests test_registration_verification_is_digest_only_and_single_use, test_registration_cancellation_is_single_use_and_prevents_verification, test_mailbox_evidence_is_not_authorization, plus retry/restart/concurrency functions bound below	Expired-handle and binding denials through an isolated owner-spanning browser journey
Provider failure / diagnostic redaction	Owner tests test_provider_timeout_temporary_and_permanent_are_redacted, test_status_authenticates_without_sending_and_redacts_errors	No tokens, recipient/body or provider details in diagnostic projections; caller-scoped status; provider acceptance and inbox receipt shown separately
Reply/bounce operations	Offline scanner fixtures exist in email-connect	Named monitored inbox, authorized inbound access, correlated bounce → suppression, bounded retention and support escalation

Historical owner baseline (2026-10-07): 27 transactional tests pass at source 73702b7e1a1671948b0545ef32d6e0de9cca9c65, clean checkout. This is local source evidence, not a deployed version or fresh inbox receipt. Reproduction from this repository's installed Python environment:

PYTHONDONTWRITEBYTECODE=1 PYTHONPATH=/home/worsch/email-connect/src \
  .venv/bin/python -m pytest -c /home/worsch/email-connect/pyproject.toml \
  /home/worsch/email-connect/tests/test_transactional.py -p no:cacheprovider \
  --basetemp=/tmp/csoc-email-owner-tests

Reproducible owner regression gate — 2026-10-08

Run make check-communication EMAIL_CONNECT_ROOT=/path/to/email-connect. communication-regressions.json binds 37 module-qualified required test functions covering authorization/template/recipient denial, suppression, provider failure and redaction, invitation uncertainty and verification restart/concurrency safety. The runner copies only Python source and the two declared synthetic test modules to a private temporary tree. It denies socket connects and DNS, strips inherited credentials, disables plugin autoload, and refuses removed or skipped/xfail contract coverage. It leaves the owner checkout untouched. Gate tests in make check prove those failure boundaries. No mailbox, SMTP, issuer or live account is contacted.

The redacted receipt at var/test-results/communication.json binds exact executed source/test/contract hashes and records counts, missing tests and outstanding acceptance. The current owner check passes 66 tests, zero skips. This closes the stale verification-retry baseline above: accepted and uncertain outcomes now retain their reservations across retries/restarts; definitive retryable refusals cancel the failed challenge before retry.

Before marking UC-009–012 as established protected journeys, bind the missing browser node IDs in their owners, arrange the isolated issuer/mailbox/application harness, and record owner admission. make check protects UC-008 and tests the new app UI; check-communication is a separate explicitly selected owner gate. Independent caller scopes, persisted limits and redacted status are implemented in owner source f703bf6 (EMAIL-WP-0008), with148 full tests including the isolated mail harness and scoped-ledger rehearsal. Runtime policy/credential, sender, ledger backup admission, inbox ownership, DNS alignment and productive per-flow user acceptance remain open. Owner review.

Current work ownership — 2026-10-08

WP-0010 is finished at the user's instruction. Existing personal reset acceptance and receiver deployment remain evidenced. Its unfinished T04/T05/T06 scopes are superseded by WP-0015-T01/T03, WP-0015-T02/T03 and WP-0015-T04 respectively. EMAIL-WP-0008-T03, EMAIL-WP-0007 and RPF-WP-0053 retain canonical owner/custody work. WP-0010 references above are historical provenance, not active gates.