coulomb-social/workplans/CSOC-WP-0010-platform-email-facilities.md

---
id: CSOC-WP-0010
type: workplan
title: "Platform email communication and personal account recovery"
domain: communication
repo: coulomb-social
status: finished
owner: codex
topic_slug: coulomb-social
created: "2026-10-06"
updated: "2026-10-08"
state_hub_workstream_id: "c0aa46eb-8266-58d4-92a7-3e4e78f5c90b"
---

**Closed 2026-10-08 at the user's explicit instruction.** Completed releases
and productive acceptance retain their receipts. Remaining acceptance is owned
by the registered follow-up workplans below; this record is no longer a tracker.
Transferred tasks are canceled as superseded, preserving their implementation
evidence without claiming the remaining requirements passed. Dated narrative
below is historical; the final closure section is the current disposition.


# User milestone

You receive a requested password-reset message from platform@coulomb.social,
recover your existing tegwick account privately, and sign in to the new app.
Platform invitation/notification flows then have a governed reusable sender,
observable failures and a clearly owned reply inbox. Each flow gets explicit
user acceptance before productive use. This is not a campaign-mail system.

First dependency: CSOC-WP-0008-T11. Deployment and mailbox-provider changes belong
to NetKingdom, email-connect and railiance-platform, not this product repo.
Current evidence: docs/release/platform-email-2026-10-06.md.

## Establish mailbox and reusable delivery evidence

```task
id: CSOC-WP-0010-T01
status: done
priority: high
state_hub_task_id: "dff23ff3-e07d-5221-bb4d-52a15becf7f2"
```

Fresh read-only inspection: email-connect1/1 healthy, /healthz200, runtime SecretSynced, sender forgejo@coulomb.social. platform@coulomb.social existing owner custody has recorded September28 native SMTP/auth and provider-accepted test; telemetry projection currently SecretSynced. This does not prove a fresh inbox receipt or inbound operation.

## Connect password reset to platform mailbox

```task
id: CSOC-WP-0010-T02
status: done
priority: high
state_hub_task_id: "caae9504-25e7-583a-8f62-c5d604f11b71"
```

NK-WP-0047 and RPF-WP-0052/CCR-2026-0035 prepare native Authelia SMTP, TLS verification, scoped ESO password-file mount and fixed consumer admission. Implement and test without credentials in code. Obtain exact founder live go/attended owner admission; validate runtime and deploy. Existing deployment approval does not authorize mailbox-access changes.

## Prove personal recovery and sign-in

```task
id: CSOC-WP-0010-T03
status: done
priority: high
state_hub_task_id: "929d6200-f060-5fa0-a324-f15da252b2ca"
```

User requests a NEW reset for tegwick after SMTP activation, receives mail at the existing directory email, sets a password privately, and completes app.coulomb.social login. Confirm inbox receipt separately from provider acceptance; keep reset URLs, tokens, passwords and private mail content out of Git/Hub/chat. Close CSOC-WP-0008-T11 only after user acceptance.

## Establish shared platform notification delivery

```task
id: CSOC-WP-0010-T04
status: cancel
priority: high
state_hub_task_id: "ca41be06-3611-5647-b469-4f89f56f77f9"
```

**Closure:** Superseded at user-requested closure; remaining work is owned by CSOC-WP-0015-T01/T03 and EMAIL-WP-0008-T03.

Extend existing email-connect with explicit caller identities, approved templates, per-caller limits, idempotent retries, suppression/bounce handling and redacted delivery states. Replace forgejo sender with platform identity only through reviewed custody and rollout. Reuse native SMTP for authentication messages, HTTP notification API for supported application templates; do not widen current user-engine-only ingress globally.

2026-10-07 retry correction implemented in email-connect under EMAIL-WP-0006.
Durable tenant/client/registration reservations prevent duplicate challenge mail
across retries, changed tracing IDs, restart and concurrent connections. Unknown
outcomes block automatic resend; definitive retryable refusal cancels the failed
challenge before retry. Existing challenge links remain usable, with legacy
retries conservative. All 39 transactional tests and all 101 repository tests
passed with the synthetic GreenMail SMTP/IMAP harness; the real verification
journey confirms one message after restart/retry. Static ESO bootstrap retired
in source per platform handoff, without a live custody change. Candidate release
is reviewed in email-connect/docs/verification-retry-review-2026-10-07.md.
T04 stays progress for caller/sender/limits and ledger recovery admission.
2026-10-07 founder-approved release complete: source7258505 / digest1e613d43
is live with one Ready replica. Private quiesced SQLite backup40960 bytes,
SHA2563b4651064fa7dd7bd5073ed8567480ea1f4cb527dbe6c7462cc778182e7da1f8,
passes integrity and isolated UID10001/no-network migration rehearsal: all four
existing tables retain their rows and the reservation table is added. Health200,
unauth401, authenticated template/invalid verification400; no mail sent. Initial
probe used an unnormalized mounted token and failed locally; corrected probe
matches service normalization. Receiver was held stopped during correction;
final Ready20:33:16Z, release window227s from20:29:29Z. No helper remains.
Decision8da41538-8482-4c72-b83d-e0fce1b662f0 resolved by founder's Ok, go ahead.
EMAIL-WP-0006-T03 (fcf55c0a-49b5-53a8-9497-3dfcc18c3828) release is complete.

Residual handoff from EMAIL-WP-0006 to this live T04: caller/tenant/template
admission, per-caller limits, platform sender custody and durable recovery of
email-connect's reservation ledger remain open. Its SQLite is not covered by
the proposed application DB/content pair; admit its own recovery contract.

2026-10-08 ledger increment: EMAIL-WP-0007-T01/T02 implement coherent quiesced
SQLite capture, stable encrypted publication, independent retrieval and guarded
attended recovery. Full owner suite 120 passed (zero skips, including 19 new ledger
cases); packaged UID10001/no-network rehearsal preserves all five tables/schema/
rows and accepted/unknown/consumed/cancelled/suppressed states with no provider
call. Node server dry-run and all four units pass; no live receiver change,
capture, upload or timer activation. EMAIL-WP-0007-T03/T04 and RPF-WP-0053-T05
remain live custody/admission/offsite/monitoring handoffs. Recovery must reconcile
post-capture submissions/challenge consumption before traffic release. See
email-connect/docs/ledger-backup-review-2026-10-08.md. T04 stays progress for those
and caller/sender/limit admission.

## Establish reply and mailbox operations

```task
id: CSOC-WP-0010-T05
status: cancel
priority: high
state_hub_task_id: "d9e165d9-dd0b-54c2-bda1-bd314b999b5b"
```

**Closure:** Superseded at user-requested closure; remaining work is owned by CSOC-WP-0015-T02/T03.

Confirm who owns/reads platform inbox, reply routing, monitored bounces, inbound IMAP/provider access, retention and support procedure. Verify domain MX/SPF/DKIM/DMARC and actual inbox receipt with the provider owner. Mailbox existence or SMTP AUTH is not inbox access proof. No unsolicited mailbox scans or automatic response sends.

Residual handoff from EMAIL-WP-0006 to this live T05: custody/retention and
expiry of the private pre-release SQLite copies remain part of mailbox/evidence
operations. Node root0700 directory /tmp/email-connect-preverification-20261007T202924Z
and workstation0700 /tmp/csoc-email-private-hkt09g6u hold matching mode0600
backups. Never infer durable governed custody from these temporary copies.

## Register communication use cases and regression checks

```task
id: CSOC-WP-0010-T06
status: cancel
priority: high
state_hub_task_id: "97a2da91-debe-5ce2-9b68-1965a5c5abfe"
```

**Closure:** Superseded at user-requested closure; remaining work is owned by CSOC-WP-0015-T04.

Catalogue password reset, verification/invitation, and future user-approved notifications. Use synthetic transport fixtures; test authorized caller, invalid recipient/template, retry/idempotency, provider failure and token redaction. ReichelAg protocol distribution remains manual clipboard/email unless the user separately chooses app sending.

Exact live activation decision: d95b4c9f-30a3-4ed6-b18f-d1b9fa20d84e; no runtime activation/mail send.

Activation approved and infrastructure objects applied on2026-10-06. Backup
Job csoc-authelia-pre-smtp-20261006 succeeded. Attended OpenBao owner admission
receipt absent; SecretStore reports missing role. Authelia notifier/mount not
changed and server healthy. T02 remains progress, not awaiting permission.
Receipt: docs/release/platform-email-activation-2026-10-06.md.

SMTP activation completed on 2026-10-06: attended helper verified/authenticated,
scoped store/projectionReady, native configuration Job succeeded18:31:49Z,
reviewed notifier/mount rollout generation 28 healthy1/1; public auth/app/issuer
and full authorization handoff pass. T02 done; T03 waits actual reset inbox/recovery
and personal signin. Receipt: docs/release/platform-email-active-2026-10-06.md.

User acceptance update: fresh reset email arrived (user confirmation). Login
then reaches app HTTP500. Inbox delivery is accepted; full personal app sign-in
remains open. See docs/release/personal-login-500-2026-10-06.md. T03 stays wait
for post-correction interactive acceptance, not mail-provider readiness.

## Final personal acceptance — 2026-10-06

User confirmed fresh reset-email receipt, then after revision11 URL correction
confirmed: “I reach my workspace.” Personal sign-in acceptance is complete.
No password/reset token/private protocol was requested or recorded.

## Shared-delivery review and communication catalogue — 2026-10-07

Prepared docs/release/platform-notifications-review-2026-10-07.md against clean
email-connect source73702b7e. Current 27 transactional tests pass with synthetic
providers; no network/provider sends. Invitation uncertain-outcome reservations
survive restart. A network-forbidden in-memory verification probe demonstrates
identical retries create two provider submissions/two challenge rows, including
two persisted challenges after provider failures. T04 requires verification
idempotency, independent caller authentication/scope, rate limits and redacted
caller-scoped status before shared caller admission. Existing shared bearer and
user-engine-only ingress remain in place; no external owner work claimed accepted.

T05 progress: fresh DNS observes IONOS MX/SPF and provider DMARC alias with p=none.
DKIM alignment, inbound access, named reply/bounce monitor and retention/support
returns remain explicit owner requirements in the packet. No mailbox scan,
credential retrieval, automatic reply or live configuration change performed.

T06 progress: docs/usecases/platform-communication.md records stable UC-009–012,
the accepted personal recovery receipt, invitation/verification candidates and
future notification scope, exact existing owner test references and missing
cross-owner browser coverage. These are not falsely registered as fully protected
end-to-end journeys: T06 remains open until isolated issuer/mailbox/app browser
coverage and owner regression bindings are delivered. UC-008 stays protected by
make check; protocol distribution remains manual. WP-0008-T07 lint debt closed;
full application gate98passed. No Bubble/apex cutover or new notification send.


## Executable communication regression increment — 2026-10-08

T06 registers UC-009–012 with synthetic fixture references and explicit
established:false/browser gaps. UC-009 retains its existing personal recovery
acceptance; the remaining flows are candidates. The UC-008 protected registry
and manual email distribution remain intact. communication-regressions.json
binds21 exact owner functions; make check-communication snapshots Python source
and the synthetic transactional test into a private temporary tree, denies all
socket connects/DNS, strips inherited credentials, disables plugin autoload,
refuses skipped/xfail or missing contract tests and produces redacted source/
test/contract-hash receipts. The owner checkout is not changed.

Actual current owner gate: **39 passed, zero skips**, including verification
restart/uncertain/concurrent retry safety. Local runner failure tests prove
network denial, environment isolation and missing/disabled-coverage refusal.
Application gate: **182 passed**, Ruff and both real Chromium journeys pass.
Review: docs/release/sharing-portability-review-2026-10-08.md; public owner receipt:
docs/release/communication-regressions-2026-10-08.json. This closes stale baseline
reporting, not owner admission or full end-to-end automated protection.

T04/T05/T06 remain progress: independent caller/template/tenant admission, limits,
caller-scoped status, platform sender and independent ledger backup custody,
inbound/reply/bounce ownership, alignment/retention and isolated issuer/mailbox/app
browser journeys still need owner returns. EMAIL-WP-0007-T03/T04 and
RPF-WP-0053-T05 remain the live ledger custody/activation handoffs. No external
owner source/runtime, mailbox access, caller admission or email send changed;
no productive new communication flow was accepted or this workplan finished.


## Commit, application deployment and sync — 2026-10-08

The communication registry/isolated owner regression gate are committed with
source dd83c90 and pushed. The companion app sharing/portability increment is
live as Helm revision16 under the founder's explicit deployment instruction
and decision8e692284-6289-4594-bb21-88346f174806. App182-test/browser gate,
packaged isolated checks, actual paired recovery and live read-only checks pass;
owner mail gate remains39passed/zero skips. See combined release receipt.
No shared-mail runtime, sender, caller admission, mailbox access, SMTP send,
ledger capture/upload or timer changed. T04/T05/T06 remain progress for their
existing owner/custody and full browser/user acceptance returns.

## Independent transactional callers — 2026-10-08

T04 receiver source is implemented in its owner email-connect, commit f703bf6,
under live EMAIL-WP-0008. T01/T02 are done there: explicit separate token files,
operation/template/exact tenant-client bindings, per-caller invitation and
verification namespaces, durable concurrent request limits, bounded payloads,
scoped/redacted transport diagnostics and privileged suppression operations.
Explicit original-caller legacy adoption preserves accepted evidence. Permanent
invitation rejection now stays terminal; confirmed transient failures can retry;
uncertain outcomes remain terminal for automatic retry across restart.

Owner gate148passed/zero skips includes isolated loopback GreenMail and scoped
ledger rehearsal (caller identity, accepted/unknown reservations and quota rows
survive with no provider call). App network-denied owner gate66passed/zero skips
binds37 exact functions to two modules; wrong-module coverage cannot satisfy its
contract. App make check183passed, Ruff and both mandatory browser journeys pass.
Updated public receipt: docs/release/communication-regressions-2026-10-08.json.
Review: email-connect/docs/caller-admission-2026-10-08.md.

EMAIL-WP-0008-T03 is the live runtime-admission record: actual scopes/quotas,
separate credential custody/delivery, original-user-engine transition, platform
sender/reply/bounce responsibilities and exact schema rollout/rollback. Capture
and rehearsal helpers require coordinated immutable-image repinning before
activation. EMAIL-WP-0007-T03/T04 and RPF-WP-0053-T05/T06 retain independent
archive admission and atomic credential-pair custody. No live mail runtime,
sender, caller, mailbox access, upload, timer or production ledger changed.
T04/T05/T06 remain progress for their existing runtime/browser/productive gates;
UC-008 weekly-call acceptance does not accept these future mail flows.

## Remaining acceptance split into independent workplans — 2026-10-08

User requested distinct workplans for the remaining work. These residual
records are live source files with origin: residual and origin_ref: CSOC-WP-0010.
The accepted personal-account/weekly-call milestones and completed releases
retain their original receipts. This workplan remains active as the acceptance
umbrella; unfinished criteria are not marked done merely because they moved.
Execute and record new work in the owning follow-up below, then close each
original task against its corresponding return. No duplicate implementation or
new credential/protocol authority is created by this split.

- CSOC-WP-0010-T04: CSOC-WP-0015-T01/T03 (runtime caller policy and independent ledger acceptance), EMAIL-WP-0008-T03.
- CSOC-WP-0010-T05: CSOC-WP-0015-T02/T03 (sender/inbox/bounce/retention/copy custody).
- CSOC-WP-0010-T06: CSOC-WP-0015-T04 (owner-spanning browser journeys and future productive flow verdicts).

The remaining scope is substantive: custody/first offsite recovery, broader
privacy/content/cohort review, or mail operations and isolated owner browser
journeys. These are independent deliverables rather than a final tidy-up.

## Requested receiver deployment completed — 2026-10-08

Under the user's explicit deploy instruction, receiver sourcec9756b0 is live at
immutable eb3e7b68, Deploymentrevision7, one Ready replica. Decision
0ef49fde-5e92-4656-ac1e-8f945b4bba08. Guarded spec change is image only. Quiesced
private49152-byte SQLite backup SHA256
1c943f28517cb75f324f1b11ed2e24f9aaa9779992a8534ef85906c1ff09dcae
migrates in an isolated copy with all five existing tables/rows unchanged.
Additional packaged UID10001/network-none rehearsal of the actual backup passes.
Health/readiness200, unauth401, invalid-template/verification400, new caller schema
present and scoped policy unselected; no mail sent. Release62.79s, seven offline
failure fences pass. Capture/rehearsal source helpers are repinned together;
27 focused ledger/release tests pass. Complete owner receipt:
email-connect/docs/caller-deployment-2026-10-08.md and JSON.

Code is deployed in the existing admitted single-caller mode. Actual multi-caller
policy, caller credentials/limits and sender/inbox/backup/browser acceptance
remain CSOC-WP-0015 with EMAIL-WP-0008-T03/EMAIL-WP-0007 as owner dependencies.
No extra caller, sender, mailbox access, archive/timer activation or production
mail is granted by this release. WP-0010 remains the original acceptance umbrella.

## Final closure and residual ownership — 2026-10-08

The user explicitly requested closing this workplan after the follow-up records
were registered, removing the acceptance-tracker role. Status is finished.
Completed work and user acceptance remain evidenced; unfinished task scopes
are canceled here as superseded, with their remaining outputs live below.
No remaining productive acceptance, custody, cutover or caller admission is
inferred from administrative closure. Original task IDs are retained as history.

Accepted result: native platform password-reset receipt and personal workspace
sign-in. Tested receiver source is deployed at revision7 in its existing admitted
single-caller configuration; future scoped policies/flows have separate owners.

- CSOC-WP-0010-T04 → CSOC-WP-0015-T01/T03 and EMAIL-WP-0008-T03.
- CSOC-WP-0010-T05 → CSOC-WP-0015-T02/T03.
- CSOC-WP-0010-T06 → CSOC-WP-0015-T04.

Follow-ups are live with origin: residual and this workplan as origin_ref.
Their registered UUIDs, task IDs and completion criteria are in their canonical
files. Historical references to this workplan mean provenance, not a remaining
execution or approval gate. No further work is waiting in this record.