coulomb-social/workplans/CSOC-WP-0008-production-transfer-acceptance.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	origin	origin_ref	depends_on	state_hub_workstream_id
CSOC-WP-0008	workplan	First user-reviewed use-case transfer off Bubble	communication	coulomb-social	finished	codex	coulomb-social	2026-10-06	2026-10-08	residual	CSOC-WP-0007	CSOC-WP-0007	0ee96868-875c-536e-a661-07198c07a8ce

Closed 2026-10-08 at the user's explicit instruction. Completed releases and productive acceptance retain their receipts. Remaining acceptance is owned by the registered follow-up workplans below; this record is no longer a tracker. Transferred tasks are canceled as superseded, preserving their implementation evidence without claiming the remaining requirements passed. Dated narrative below is historical; the final closure section is the current disposition.

CSOC-WP-0008 — First user-reviewed use-case transfer

Success is a recoverable, accepted community transfer under the existing stage-1 cut. Local migration tooling is implemented by WP-0007; that is not live parity or a production readiness claim. Existing CSOC-IN-0003 and CSOC-IN-0004 remain open until the corresponding acceptance below is evidenced. This record does not assign or authorize changes in platform-owner repositories.

User milestone — Ready to review the first use-case transfer

At completion, you can sign into the new app, open a nominated migrated space, recognize its pages and visuals, continue writing and organizing that work, copy or move a page, and share it with a reader who cannot alter it. Your changes survive an application restart, and the team can recover the content and access from a tested backup. You can inspect/export your app-local information and review how leaving the app handles owned content before any deletion.

A side-by-side walkthrough describes the original Bubble steps, equivalent new steps, expected results and remaining differences. You review this as a user and accept or reject each use case for productive transfer. Completion means the first nominated cohort is ready for this review; it does not pre-approve all use cases or retire Bubble. Apex retirement remains an explicit later decision.

The main goal is now a continuing off-ramp: find and describe actual Bubble use cases, rebuild them within our ecosystem, compare behavior and transfer approved use cases incrementally. The historical feature inventory supplies candidate journeys, not proof that each is used or works in the current Bubble product. Marketplace/social features stay candidates for subsequent cohorts until actual use and user priority justify their implementation.

Execution and review order

1. Capture candidate journeys from existing evidence; confirm real examples with the user during review. Keep evidence confidence and unanswered questions.
2. Build and test the missing sharing/access, content, portability and recovery behavior required for the nominated cohort (T04/T05/T02/T07).
3. Prepare a concrete release and representative content rehearsal; obtain the exact live change authorization required by the estate before deploying (T01).
4. Reconcile the first nominated corpus/cohort and demonstrate end-to-end user journeys and recovery (T03/T08/T09).
5. User accepts individual journeys or records gaps as follow-up work. Transfer those accepted use cases; keep Bubble available for remaining cases (T06).

The earlier 71-space/109-article capture remains an inventory to reconcile, not an instruction to bulk-move every space before the first user review.

T01 — Prepare persistence and deployment acceptance

id: CSOC-WP-0008-T01
status: cancel
priority: high
state_hub_task_id: "6adce69f-9011-5ada-a920-b2228aa15218"

Closure: Superseded at user-requested closure; remaining work is owned by CSOC-WP-0012-T03.

Dependencies: railiance-apps owner and founder approval of the exact live change, exercising ADMINISTER @ realm:kubernetes/railiance01, activation=APPROVED. Prepare pinned image, migration 0002, persistent CONTENT_ROOT, single writer / paused-write maintenance procedure, volume capacity and node headroom review. Dry-run/diff deployment in its owning repo. On app host verify space creation, page CRUD, Visual delivery (or explicitly accepted metadata-only limitation), copy/move, restart durability and source+destination denied-access cases. Record immutable release and receipts; only then close CSOC-IN-0004.

T02 — Prove paired metadata/content recovery

id: CSOC-WP-0008-T02
status: cancel
priority: high
state_hub_task_id: "04795cd7-1248-57df-9822-da8fa1471559"

Closure: Superseded at user-requested closure; remaining work is owned by CSOC-WP-0012-T01/T02/T03.

Implement a reviewed backup/restore automation entrypoint after runtime storage and DB owner lanes are known. Baseline protocol is in docs/migration/corpus-import.md. Pause writers, capture DB and CONTENT_ROOT at one recovery point, record hashes, image/migration version and tenant without secrets. Restore into an isolated instance with no outgoing integration writes; compare Space/Member/membership counts, markdown/asset hashes, rendering and denied cross-member reads. Record RPO/RTO, retention, custody and a rollback drill. No acceptance from DB-only snapshots; no private archive in git or State Hub.

2026-10-07 operations increment: the initial WebDAV rotating-slot candidate was never activated and is withdrawn after checking the current create-only Nextcloud contract. The revised consumer packages one stable age-encrypted pair, uses the platform immutable Scaleway primary helper, and advances success only after version-pinned GET/length/hash verification. Failed publication retains one private pending pair; reviewed retry does not recapture or re-encrypt. Public version/hash/size receipts support independent retrieval after node loss. scripts/recover-paired-backup.py adds attended private decryption, whole-packet inspection, exactly-three-regular-file extraction and inner pair/capture/image binding. No escrow key is placed in the scheduled worker.

Full make check: Ruff and 150 tests, including required Chromium journeys. New consumer backup/recovery 19 cases include a real age synthetic roundtrip; platform primary/retention plus existing archive regression 53 cases pass. All four units verify. The platform has a hash-locked dedicated SDK runtime and a separate non-mutating 14-daily/4-weekly retention preview protecting the last proven application-recovered version; it does not claim activated deletion/retention. See docs/release/paired-backup-operations-2026-10-07.md, proposed RPF-WP-0053 and its docs/credential-lane-designs/coulomb-paired-backup-primary.md. Metadata-only node check: /etc/coulomb-social-backup/primary.env absent. Historical backup-object-storage routing id is unknown locally; custody owner must reconcile that front door and deliver a scoped caller. No secret fetched/copied, timer enabled or production offsite write performed. Technical source correction decision 87c9905c-914c-4e1c-867e-6c0d0cffd8c7 records withdrawal of the inactive slot candidate; it does not confer admission/activation authority. T02 stays progress for owner admission, capacity/retention, actual offsite/application recovery and monitoring.

T03 — Rehearse and reconcile the actual transfer cohort

id: CSOC-WP-0008-T03
status: cancel
priority: high
state_hub_task_id: "0615eff2-bf2b-503b-8f15-0591d4666446"

Closure: Superseded at user-requested closure; remaining work is owned by CSOC-WP-0014-T01.

Dependencies: founder-nominated first-use-case corpus/cohort, reviewed identity membership map, T01/T02 acceptance, local access to private prepared trees. Use the new corpus manifest and dry-run; resolve every unmapped/inactive identity by NetKingdom onboarding rather than password/email matching. Rehearse separately, reconcile all 71 known spaces and 109 captured articles against actual expected inventory, report omitted/thin trees, missing assets and parent/privacy lossiness. Execute the first nominated representative cohort; disposition other spaces explicitly as subsequent transfers rather than silently excluding them. Approve role assignments and additional pre-existing grants before real import; content replacement is additive for membership and does not revoke old grants. Close CSOC-IN-0003 only after real cohort receipts and exception disposition.

Personal account pre-import prerequisite (2026-10-06): successful verified sign-in records tenant:platform, whereas app fallback/demo records used tenant:coulomb. Reconcile target-space tenancy and explicit memberships with the issuer owner before real ReichelAg transfer; verify isolation/denial. Do not rewrite the signed tenant claim or grant broad access to bridge the difference.

T04 — Close access and member-portability gaps

id: CSOC-WP-0008-T04
status: cancel
priority: high
state_hub_task_id: "eb4da28e-ea04-52fa-92d6-f78296348b83"

Closure: Superseded at user-requested closure; remaining work is owned by CSOC-WP-0013-T01/T03.

Remove or explicitly isolate tenant-wide bootstrap visibility for private cohorts. Enforce viewer versus write roles, validate cross-tenant memberships in all mutation paths, and decide tenant-keyed content directories versus a strict single-tenant instance invariant (including admin/import concurrency). Implement app-local member export/delete with ownership/content retention and platform identity boundaries explicitly defined. Test private-space denial, viewer mutation denial, deletion with owned content and export tenant isolation. Do not equate migration grants with full Bubble privacy fidelity.

T05 — Content durability and link fidelity

id: CSOC-WP-0008-T05
status: cancel
priority: medium
state_hub_task_id: "3fdb685c-9670-516a-a65b-6f9a2eac0ee0"

Closure: Superseded at user-requested closure; remaining work is owned by CSOC-WP-0013-T02.

Define content git commit/push or an accepted durable revision mechanism; concurrent-write conflict policy; body-linked asset copying and link rewriting; authenticated Visual delivery. Test transfers with embedded images and incoming links, failed destination writes and concurrent edits. Keep outline/include/lazy projection work separate unless stage-1 acceptance explicitly requires it.

2026-10-07 local implementation: authenticated CONTENT_ROOT raster delivery, space/page covers and rendered local body image links. Owner/viewer reads use the existing tenant/membership checks; outsiders, revoked/archived grants and ambiguous same-slug tenant rows fail closed. Directory-descriptor reads refuse symlinks/traversal; raster extension/signature checks and private no-store responses prevent active-file serving. Visual copy uses the same bounded file access and refuses destination asset overwrite. Clipboard Markdown/HTML payloads remain unchanged. UC-008 mandatory fast/browser regressions now protect actual image loading after duplication and reader/outsider access. make check129passed. Revision15 adds Spaces-list covers after founder confirms page Visual visibility but reports missing list previews. List-preview/user acceptance is pending. T05 remains open for revision/concurrency policy, cross-space body-linked assets/incoming links, and original hierarchy/privacy fidelity; T04 tenant-storage work remains.

Release prepared/published at source017b917, digest sha256:0e235abc33a1c5613c0e2c9a0f767c871d0fbed6695973ae17cfdcb2dedaaafa. Packaged non-root/network-disabled smoke passes. Live Helm comparison proves app image only; pinned cluster identity/server dry-run pass. Read-only live inventory:37JPEG assets, zero unsupported/signature mismatches or ambiguous slugs. No productive content disclosed or changed. Concrete review packet: docs/release/private-visuals-2026-10-07.md. Exact live decision: 3f959ed2-4163-4fa5-9f88-f80b2a3d1b89 was explicitly approved by the founder. This initial image deployed as revision14. Current runtime is the Spaces-list correction881a61d/digest91673ba7 at revision15; receipts below.

T06 — Close service contract and founder cutover gate

id: CSOC-WP-0008-T06
status: cancel
priority: high
state_hub_task_id: "f842f9cc-6863-50d0-aac7-a7dcc2ca36e7"

Closure: Superseded at user-requested closure; remaining work is owned by CSOC-WP-0014-T03.

Pending State Hub decision: 186be722-e2c7-4109-a1e6-d120fe8fca5b. Depends on T01–T04 and founder acceptance. Link current ops-hub registration, backup/restore receipts, cost attribution, SLO observations and immutable image provenance to the business-app service contract §§1–6. Recheck historical public registration Case B. CSOC-IN-0002 is already closed by WP-0007 synthetic identity replay/email separation tests; retain those checks in release validation. Present cohort lossiness and access acceptance for a human decision; retain parallel hosts until that explicit cutover. Production and apex retirement are not authorized by a local test suite.

T07 — Restore a clean repository-wide lint gate

id: CSOC-WP-0008-T07
status: done
priority: medium
state_hub_task_id: "e2dadb93-f069-54b3-b7e2-c4e921f27d5e"

Resolve the pre-existing Ruff findings recorded by the WP-0007 assessment, without changing generated schema semantics or weakening checks. Full lint and tests must pass; prioritize meaningful unused-fixture/test cleanup over silencing rules. This task is quality debt rather than a claim of broken runtime behavior.

Completed 2026-10-07: all 19 repository-wide Ruff findings resolved by removing unused imports/dead fixture setup, sorting imports and wrapping long expressions. Generated migration help-text values/schema semantics are unchanged. make check now requires lint, keeping this debt from silently returning. Full Ruff clean; 98 tests pass, including mandatory real-browser UC-008 coverage. No deployment or user-transfer acceptance is inferred from this gate.

T08 — Describe Bubble use cases and rebuild acceptance

id: CSOC-WP-0008-T08
status: done
priority: high
state_hub_task_id: "fca49f28-a959-51e2-ad24-5fd73b1e5316"

Closure: Initial catalogue delivered; continuing discovery is owned by CSOC-WP-0014-T02.

Create docs/usecases/catalog.md with stable journey IDs, actors, user goals, original/rebuild steps, expected results, evidence confidence, gaps, owner tasks and transfer status. Start from captured Bubble inventory; mark inferred steps and uncertain semantics. User confirmation is required before calling a journey observed/accepted. Prioritize working in spaces/pages and sharing access; retain research/chunks, discovery, social and marketplace candidates for later cohorts.

T09 — User review walkthrough and per-use-case off-ramp receipts

id: CSOC-WP-0008-T09
status: cancel
priority: high
state_hub_task_id: "648acce6-21cd-540f-b3b0-c2fcb8eacc60"

Closure: Superseded at user-requested closure; remaining work is owned by CSOC-WP-0014-T02.

Write docs/usecases/first-transfer-review.md with a realistic example space and writer, reader and outsider checks; original/new steps; expected visible results; restart and restore checks; pass/gap/accepted-for-transfer fields. Record actual release/host, corpus reconciliation and recovery receipts before asking the user to execute review. Local tests do not mark this milestone done. Capture the user's acceptance per journey and remaining gaps as live work records, then prepare the next cohort. The user's review is the transfer gate, not a proxy for blanket Bubble retirement.

Implementation started — 2026-10-06

T04 first slice implemented: explicit membership/creator visibility; removed tenant-wide bootstrap reads; enforced viewer read-only access in product routes and service writes, exact tenant/space checks, and source/destination write checks for copy/move. Read-only controls reflect those permissions. Seed/admin spaces now need explicit grants; deploy/import docs reflect this behavior.

T08/T09 initial catalogue and review walkthrough prepared under docs/usecases/. Original Bubble journeys remain inferred pending observation/user confirmation; real cohort and release evidence remain pending. T04 continues for sharing UI, member export/delete, tenant filesystem invariant and original privacy parity. The milestone is not reached by this local implementation slice.

Validation: 86 tests passed; Ruff passes changed service/view/test files; git diff --check passes for edited files. Existing 19 repository-wide lint findings remain T07 debt; no production change made.

T10 — ReichelAg weekly call: duplicate protocol and copy for email

id: CSOC-WP-0008-T10
status: done
priority: high
state_hub_task_id: "41334b54-0c99-5c61-9cdf-16231516882b"

User-confirmed first cohort: ReichelAg weekly founder calls. The user confirmed copying the full protocol and editing the new entry by hand. Duplicate the latest entry to prepare the next call's bullet-list agenda; maintain the new protocol; copy rendered content to the clipboard and paste/send manually in an external email client. Email sending is not an app feature requested by this workflow.

Implement a distinct “Copy content to clipboard” action (not page duplication), with rich HTML + plain text, preserved bullet structure, visible success/failure and selectable manual fallback. Verify synthetic old/new protocol independence, copy/paste payload, private-space access and failure handling. User review uses a nominated real latest protocol, privately reconciled with the historical reichelag rehearsal. Do not infer AI recording/transcription, automatic dates, open-item extraction or email delivery. Those behaviors remain unspecified.

T10 implementation evidence: user-confirmed full-copy/manual-edit workflow recorded as UC-008 in docs/usecases/reichelag-weekly-call.md. Distinct Duplicate page and Copy content to clipboard actions implemented. Rich HTML/plain-text clipboard and blocked/manual fallback pass Chromium checks with synthetic data. Full application suite: 87 passed; new test Ruff clean. Real latest protocol reconciliation and actual mail-client/user review remain T03/T09, not completed by these tests. No live deploy, private-data import or mail sending performed.

Live orientation and personal account — 2026-10-06

Fresh checks confirm a healthy 1/1 coulomb-social Helm workload on railiance01 (92.205.62.239), image 7fcd0cf, revision 9. app.coulomb.social landing and health return 200; KeyCape discovery is live. No content PVC/CONTENT_ROOT exists in that old release. One live Member links the user-selected tegwick identity to KeyCape and tenant:coulomb; one demo space exists. No new password/account is needed. The user tried sign-in and received invalid_profile_usage / unknown client_id. Guarded issuer inspection confirms the coulomb-social client is absent; the stored Member and healthy discovery did not prove interactive login worked.

T01 now progresses by preparing the latest tested app image with collected static assets and an owning-chart persistent CONTENT_ROOT upgrade. Single-writer Recreate avoids concurrent filesystem writers and rolling CPU surge. Exact live change approval follows the prepared diff/dry-run and immutable image receipt. Node CPU requests observed 3455m/4000m; disk has 123G available. No deployment or credential change was made by these read-only checks.

T11 — Restore personal OIDC sign-in

id: CSOC-WP-0008-T11
status: done
priority: high
state_hub_task_id: "3a6bdbfb-975e-5c3e-b34f-6eeede402521"

Restore the historical NetKingdom public coulomb-social authorization-code/PKCE client through the owning guarded helper; refuse differing existing registrations, preserve unrelated configuration bytes and Secret data, pin cluster identity and Secret UID/resourceVersion. Inspection and server dry-run passed on 2026-10-06; no live change made. Existing historical ordinary AAL1 behavior (mfaRequired: false) is explicit in the review packet; shared issuer restart requires exact founder approval. User tegwick must then confirm interactive login. Do not mark this task done on an HTTP redirect or discovery-only check.

Knowledge receipt: emergent-security 0.2.6 identity, verified-files, orientation-only; digest 8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02.

Prepared review: docs/release/personal-account-2026-10-06.md. Pending exact live decision: 8bbce691-a787-4140-9cd4-df06e8635a27. Published image and owning chart prep complete; live approval and user acceptance remain pending. No productive data transferred.

Deployment execution — 2026-10-06

Founder approved exact live changes (decision 8bbce691-a787-4140-9cd4-df06e8635a27). T11 registration restored through guarded CAS; shared KeyCape restart succeeded; authorization now hands off to Authelia. Interactive tegwick login confirmation still pending, so T11 remains wait. T01 app upgrade succeeded as Helm revision10, chart0.2.0/digest-pinned source ac7bac1852; retained2Gi content PVC bound, UID/GID10001 writable, zero pending migrations. Public health/clipboard/login handoff and dedicated synthetic-marker restart durability passed. Fresh apps-pg backup csoc-preupgrade-20261006145351 completed before migration.

Receipt: docs/release/personal-account-deployed-2026-10-06.md. T01 stays progress for live product/Visual/permission acceptance; T02 paired restore, T03 real cohort and T09 user/email walkthrough remain open. No real-data import or apex cutover. RAPPS-WP-0015 T03 deployment completes; T04 user acceptance remains open.

User sign-in result — 2026-10-06

The user reaches auth.coulomb.social but tegwick is rejected as wrong username or password. Read-only directory query through the existing provisioner confirms tegwick is present. Live Authelia username attribute is uid; its lookup supports uid or mail. Contained recent-log inspection records a tegwick LDAP invalid- credentials failure, without backend connection error or regulation-ban evidence in that entry. This does not establish why the entered credential is rejected.

The app and client restoration are deployed, but personal sign-in is not accepted. CSOC-WP-0008-T11 remains wait for human credential confirmation/recovery and a successful fresh sign-in. The user was asked whether the same password works on another service. No password was requested/read/exported or reset. Authelia's current notifier is filesystem rather than SMTP: do not promise emailed recovery or expose reset tokens from notification files. Any credential reset must use the owning attended recovery/setup lane under a separate exact approved change.

Password-reset email dependency now has live successor CSOC-WP-0010, NK-WP-0047 and RPF-WP-0052/CCR-2026-0035. Existing platform mailbox custody found; native reset-mail connection prepared and dry-run only. T11 still waits activation and actual user receipt/recovery/sign-in.

Platform reset mail is now active through native Authelia SMTP from platform@. CSOC-WP-0010-T02 completed; T11 remains wait until user receives a fresh reset, changes the password privately and completes actual app login. See docs/release/platform-email-active-2026-10-06.md.

Personal sign-in HTTP500 diagnosis — 2026-10-06

User confirmed fresh reset mail arrival, then reported app500 after authentication. Contained in-pod HTTP probes with empty verified-claims envelopes create no identity: old user-engine address returns302 redirect, canonical endpoint400 missing claims using the existing credential. Application httpx rejects302; identity-linking failure occurs before local session creation. Owning RAPPS-WP-0015 corrects only USER_ENGINE_BASE_URL with the same immutable image and existing approval8bbce691-a787-4140-9cd4-df06e8635a27. T11 remains wait for fresh successful personal app sign-in. See docs/release/personal-login-500-2026-10-06.md.

Final personal acceptance — 2026-10-06

User confirmed fresh reset-email receipt, then after revision11 URL correction confirmed: “I reach my workspace.” Personal sign-in acceptance is complete. No password/reset token/private protocol was requested or recorded.

User review: empty Spaces — 2026-10-06

After successful tegwick sign-in, user reports No spaces yet. Read-only live inspection confirms zero visible/current-tenant spaces, memberships and created spaces; total database has one demo row and no ReichelAg. No Bubble content has been imported on the new workload. August private rehearsal tree still exists (30pages/29assets), freshness unproven. This is T03 real migration and T09 user acceptance work, not a reason to reopen completed login or widen access.

First visible-data milestone: ReichelAg appears for tegwick with the expected latest real weekly protocol, full duplication/edit/reload and native clipboard mail-client paste accepted. Confirm fresh Bubble capture versus August rehearsal; keep provenance separate from old seed data. T02 paired restore remains an import prerequisite. Diagnostic receipt: history/20261006T190725Z-empty-personal-spaces-assessment.md.

Fresh ReichelAg transfer execution — 2026-10-06

Founder answered “yes go on” to current Bubble capture and first ReichelAg transfer. Saved browser session probed; expired signature cookie prevents private protocol access. Old exporter selects largest captured space and assumes title click sets active space; neither proves target selection. Fresh source capture must explicitly select ReichelAG in Pages filter and apply Search, with old network seed disabled. Retain source-ID provenance, reconcile latest expected weekly protocol and capture coverage before import.

T02 progress: node snapshot helper scripts/snapshot-content-and-db.py prepared, server dry-run passed. Quiesce app, scope pg_dump to coulomb_social_db, read-only PVC archive, restore app even on failure; isolated PostgreSQL restore must pass before real import. Four focused safety tests pass (dry-run/no writes, corrupt dump/app-resume, cleanup failure/app-resume, private paired artifacts).

Paired production snapshot completed; app resumed/healthy. Isolated PostgreSQL restore matches13tables/102rows with empty content. A second synthetic populated pair restores13tables/111rows and4files; full-protocol copy/independent edit, asset/render fidelity, viewer validCSRF write denial and outsider read denial pass after recovery.96tests pass. T02 remains progress for retained backup custody/retention and real corpus/rollback review.

T03 wait: Bubble signature cookie expired; public-only captures are not accepted source. User must privately renew via scripts/capture-auth-state.sh and open actual ReichelAg protocols. Targeted exporter now fails before output on expired session, uses explicit target/Space filter/Search, excludes old seeds, merges partial fresh records and rejects missing protocol bodies. Source receipt: docs/release/reichelag-transfer-2026-10-06.md. No productive import performed.

User confirmed the old journey: Spaces -> ReichelAg -> Pages, ordered by latest changes. Capture defaults to /vw_pages. Prioritize current content migration; UI framework architecture is a separate next phase (CSOC-WP-0011), before broad UX rebuilding. Existing browser session renewal or a dedicated Bubble account with read access can provide the source; never accept password/session contents in chat. User renewal remains the next input needed for private protocol capture.

Attended source access renewed: founder confirmed signed in and ReichelAg protocols visible in the local browser. Session saved privately (4cookies, no expired signature). T03 resumes authenticated capture and import rehearsal; needs_human login requirement cleared. Browser capture now scopes actual link roles and waits for native filter options before applying Search.

Authenticated capture completed: explicit ReichelAG target, no old seed;36source articles/36assets and37markdown files including the space index. All29August article IDs present plus7new articles; latest dated protocol2026-10-02. Source home metadata/visual and source article creation/modification timestamps retained. Reviewed owner map: only existing tegwick identity in tenant:platform, owner for new reichelag space; no other membership grants or data replacement.

Isolated real-content import rehearsal:37pages/36assets, every source file hash matches, every page renders, owner-only explicit access. Fresh pre-import paired snapshot started20:21:30Z, app resumed after53.36seconds. Source package a0ab5085e63a93fd351a1ffb85a092555cb340d72f9f5f3f510e43952388fbbc. Bounded node import helper scripts/apply-approved-content-import.py server dry-run passed, checks source/snapshot hashes and refuses replacements. It compares metadata row/sequence fingerprints and content hashes with the paired point after pausing writers, before import, then always resumes the deployment.

First real ReichelAG cohort imported — 2026-10-06

37markdown files/36assets (36source articles plus index), latest dated protocol 2026-10-02; all29August source IDs present plus7new. Only existing tegwick owner grant in tenant:platform. Final server dry-run and isolated source hash/render rehearsal passed; fresh20:21:30Z paired point checked against live DB/content after pausing writers, then exact reviewed package imported without replacement. App resumed after52.97seconds; new-pod verification: visible spaces1, pages37, assets36, grants1; public health200.

Real-content paired rehearsal restored13tables/104rows/73files with complete row/sequence/file hash agreement and all37pages rendered; owner read and an ungranted same-tenant actor denial verified.96tests pass. T02 stays progress for retained custody/retention and operational production rollback; T03 stays progress for whole inventory/identity/later-cohort disposition; T09 waits user content and full duplicate/edit/clipboard/mail-client walkthrough. T05 retains Visual delivery and parent/privacy fidelity. UI latest-change ordering/framework work is explicitly CSOC-WP-0011, not an assumed parity feature. Receipt: docs/release/reichelag-imported-2026-10-06.md.

Clipboard fidelity correction — 2026-10-07

User review found missing original protocol content. Authenticated observation of the Bubble copy action confirms title + two newlines + italic abstractor + two newlines + unchanged Markdown body + \n\nxxx legacy footer. T10 reopened to preserve that exact plain payload, including fallback, while retaining sanitized rich HTML for email. Private notes are not regression fixtures. T09 remains pending the user's clipboard/mail-client review.

Correction deployed as Helm revision12, immutable source d521ddc / digest sha256:9e7d1c2cc5248a3fd92ab48b4c4edf077c3ee7fb9149e7adb78c29101c60b745. Server dry-run and parsed manifest comparison prove only the app image changed. Live export and template JSON payload match the observed original exactly. All74content-file hashes match the fresh paired pre-upgrade snapshot; existing owner access remains valid. Public health/static delivery200, actual deployed JavaScript equals tested source. make check97passed; rich/plain/denied fallback checks pass. T10 implementation done; T09 remains pending user email-client review. The snapshot helper's expected image pin follows this release.

T12 — Protocol title and filename naming

id: CSOC-WP-0008-T12
status: done
priority: high
state_hub_task_id: "95d06724-0c8e-5e5c-8f50-0954c920e104"

Founder review confirms editing and clipboard copy work. Duplication leaves the old default filename when only the title changes; rename controls are hard to discover. Derive duplicate filenames from the entered title when no explicit slug is chosen. Keep explicit filename override and reject collisions. Add a visible Rename page entry to existing title/filename controls. Preserve notes, subtitle, Visual and source metadata during rename and subsequent editing. Protect index filename and deny viewer/outsider writes. Extend UC-008's mandatory fast/browser regressions and deploy within the approved personal-app upgrade. User milestone: I name the next weekly call once while duplicating, then can correct its title and file name later without losing notes or changing the previous call. Existing manual email distribution remains unchanged.

T12 implementation validation: make check98passed, including mandatory real-browser title-only duplication, visible Rename page route, file/address rename, edit/reopen/clipboard and viewer-denied rename. Fast regression also protects explicit filename override, copy/rename collisions, fixed index, source independence and preserved metadata/assets. Targeted Ruff and diff check pass. Founder confirms edit and content-copy behavior; naming correction acceptance remains pending after deployment.

T12 deployed as Helm revision13: source b13ba9c581, immutable digest sha256:dbeaeda1a03622a91683f8db3c1f498e8bf43417cdb077ec740c56f0489baff6. Guarded parsed server manifest comparison: app image only. Fresh paired DB/content capture56.93seconds; app resumed. Read-only live checks confirm visible Rename page, editable title/file, title-derived copy filename logic, unchanged exact clipboard payload and personal owner access. All75stored file hashes match the pre-upgrade pair. Public health/static200. Implementation done; T09 awaits founder naming/workflow review. Existing duplicated files are not automatically renamed; the user chooses the filename in Rename page.

Private Visual deployment and actual production-pair recovery — 2026-10-07

Founder approved exact review3f959ed2; owning pin2e95944. Fresh paired capture 57.74seconds, app resumed. This actual production pair restored with13tables, 104rows/sequences and 75content hashes matching; restore4.23seconds. New image renders38restored pages/38cover references; synthetic viewer read/write denial and outsider page/image denial pass on the isolated internal network. Private restored mode0640 files use workstation non-root ownerUID1000 for that check; production ownership/UID10001 remains in place. Restore containers/network removed.

Fresh owner chart/live-manifest comparison proves image only; server/Helm dry-run pass; all75files match the paired point. Helm atomic/wait revision14 deployed in20.66seconds, app1/1. Read-only live owner views verify38cover references/template and single owner grant; unsaved outsider image404. All75stored file hashes unchanged; anonymous image redirects to login302; public health/static200 and clipboard script matches tested source. No real protocols, metadata/grants, Secrets, issuer or mailbox changed. Snapshot helper pin follows this release;7focused recovery tests and new server dry-run pass.

T02 gains actual production-pair restore proof; retained custody/retention and operational production rollback remain open. T05 implementation slice is live; revision/concurrency, cross-space body/incoming links and broader fidelity remain. T09 still awaits founder Visual and complete workflow acceptance; user asked to refresh ReichelAG. No task/workplan completion or Bubble retirement inferred. Receipt: docs/release/private-visuals-2026-10-07.md.

User Visual review: missing Spaces-list preview — 2026-10-07

Founder confirms the Visual appears on the page, but not in Spaces-list entries. T05/T09 retain this concrete review gap. Add the space cover to its existing list entry using the same private route and membership-filtered query. Extend UC-008 fast and real-browser checks for writer/viewer list-preview loading and outsider exclusion. Preserve page/clipboard/content/access behavior. This is a correction within the approved private-Visual image-only upgrade scope, not acceptance of the complete use case. No wider UI framework work included.

Correction deployed as revision15: source881a61d10798, owner pinf5fc9ea, digest sha256:91673ba7625f905c7a4d0c3d52b45ccc7e7746f387d1e84aab331d68994c5df9. Full129-test lint/browser gate passes with mandatory writer/viewer list-preview loading and outsider exclusion. Temporary file-backed test DB resolves concurrent SQLite request-cursor races without serializing or skipping browser requests; streaming tests follow Django Client's close lifecycle. Gate passed before build. Fresh paired capture56.03seconds/app resumed; isolated13tables/104rows/sequences/ 75files recovery4.14seconds matches. New-image actual restored list cover reads pass for owner/viewer; outsider excluded. Rehearsal DB/network removed. Fresh image-only/cluster/content guards and server/Helm dry-run pass. Atomic/wait upgrade20.58seconds, app1/1. Read-only live list preview/image bytes, outsider exclusion, owner grant and all75stored hashes verified. Health/static200, clipboard unchanged. Snapshot-helper pin/7tests/server dry-run pass. T09 awaits founder list-preview/full workflow review; other T02/T04/T05 requirements stay open.

Sharing, portability and content revision increment — 2026-10-08

T04 local implementation now provides owner-only Share space grants/revocation by exact same-tenant member ID, with viewer/member/owner roles, creator/last-owner protection and immediate subsequent-read denial. Your app data exports only the requesting member's local records; explicit DELETE removes local Member/User and grants, invalidates old sessions and retains shared content with another active same-tenant owner. Archived spaces still require a successor. Platform identity is separate. Corrupt foreign ownership blocks removal without disclosing names. Lists/pages/service writes now deny duplicate slug-keyed storage, and serialized app/import/admin writes plus admin validation reject ordinary collisions and cross-tenant grants. Production tenancy/privacy and privileged maintenance reconciliation remain T04; no database-wide global constraint is claimed.

T05 local implementation adds immutable content-addressed previous/new versions, atomic fsync-backed publication, stale page/space form rejection with retained input, and cooperating thread/process writer locks. Blank imported pages remain editable; original source metadata survives renaming/index edits. Visual and Markdown body-linked attachments copy with rewritten destinations and failure cleanup; old incoming page addresses survive rename/move with source/destination permission checks and reserved-address reuse denial. Replacing an imported tree with retained addresses now requires reconciliation. Existing archives are never overwritten silently. Raw HTML/custom Markdown, actual corpus fidelity, revision retention/capacity acceptance and crash/operational recovery remain open.

Full make check: 182 passed, Ruff clean, mandatory UC-008 and new sharing/ concurrent-edit/account-exit Chromium journeys pass. New failure, parallel thread/process, tenant, ownership, CSRF, blank-page, attachment and incoming-link checks pass. Django system check passes; no schema changes detected. Review: docs/release/sharing-portability-review-2026-10-08.md. Source implementation choice: decision9ffb5125-5551-4101-9025-5b6f72f40940. This is not acceptance of a durable retention policy or authority for deployment/cutover. No private corpus, member profile, live image, offsite archive or timer changed. T01/T02/T03/T04/T05/ T06/T08/T09 remain live for their existing admission, deployment, reconciliation and productive user acceptance gates; this workplan remains active.

Approved release and sync — 2026-10-08

Founder explicitly requested deployment/commit/sync; decision8e692284-6289-4594- bb21-88346f174806 records ADMINISTER @ realm:kubernetes/railiance01, activation=APPROVED for this image-only release. Source dd83c90, owner pin2202e69, published digest9a646d8e01a61ba5316d3c2eb0273064e17f2d0300ad07af766ccedda65ecb18. Full182-test/Ruff/browser gate passes. Packaged UID10001/read-only/no-network synthetic sharing/portability/conflict smoke passes. Paired capture56.21s, app resumed; actual isolated13tables/104rows/sequences/75file recovery4.31s matches. New-image actual38page/38Visual rendering and owner controls/export/restored viewer/outsider denial pass; isolated DB/network removed, private pair retained.

Fresh cluster/PVC/image/node-pressure and exact three-resource image-only checks, namespace-correct kubectl/Helm server dry-run and all75content hashes pass. CPU quantities1/1000m were normalized after strict preflight stopped; no upgrade occurred on either failed guard. Atomic/wait rollout18.64s deploys revision16, app1/1 at the immutable digest. All75stored hashes and single existing owner grant remain unchanged. Live UID10001 read-only owner sharing/data/export, 38page/Visual and unsaved outsider-denial checks pass; no production probe user, session, grant, page edit or account removal. Public health/static200; clipboard source hash matches. Snapshot pin updated;9focused recovery tests and fresh node server dry-run pass. Receipt: docs/release/sharing-portability-review-2026-10-08.md.

Production deployment of this increment is complete. T01/T02/T03/T04/T05/T06/ T08/T09 remain open for their broader service/cohort/privacy/custody/retention/ operational rollback and productive user acceptance obligations. No task is closed on deployment alone; no mail/issuer/Secret/caller/schedule/offsite/Bubble change occurred. Temporary private backup custody is explicitly retained for owner disposition, not inferred to be durable.

Productive weekly-call acceptance — 2026-10-08

User explicitly answered “Accepted for weekly calls” for the deployed ReichelAg duplication/naming, editing, usual mail-client paste and page/list visuals. UC-008 transfer status is accepted with receipt history/20261008T084657Z-weekly-call-acceptance.md. Its protected fast/browser contract remains unchanged. T09's first nominated productive-use review closes; T09 remains progress for the other listed use cases. Wider T03 cohort/identity reconciliation, T04 sharing/portability review, T02 recovery custody/retention and remaining WP-0008 gates stay live. No Bubble retirement or new productive communication flow is implied; WP-0008/WP-0010 remain active.

Remaining acceptance split into independent workplans — 2026-10-08

User requested distinct workplans for the remaining work. These residual records are live source files with origin: residual and origin_ref: CSOC-WP-0008. The accepted personal-account/weekly-call milestones and completed releases retain their original receipts. This workplan remains active as the acceptance umbrella; unfinished criteria are not marked done merely because they moved. Execute and record new work in the owning follow-up below, then close each original task against its corresponding return. No duplicate implementation or new credential/protocol authority is created by this split.

• CSOC-WP-0008-T01: CSOC-WP-0012-T03 (service evidence; current app deployment remains complete).
• CSOC-WP-0008-T02: CSOC-WP-0012-T01/T02/T03 (offsite admission, actual first recovery and monitoring).
• CSOC-WP-0008-T03: CSOC-WP-0014-T01 (further inventory/cohort reconciliation).
• CSOC-WP-0008-T04: CSOC-WP-0013-T01/T03 (storage enforcement and productive sharing/portability review).
• CSOC-WP-0008-T05: CSOC-WP-0013-T02 (corpus fidelity, revision retention and crash recovery).
• CSOC-WP-0008-T06: CSOC-WP-0014-T03 (service/cohort/apex cutover).
• CSOC-WP-0008-T08: CSOC-WP-0014-T02 (ongoing original-use-case discovery; initial catalogue is delivered).
• CSOC-WP-0008-T09: CSOC-WP-0014-T02 (remaining per-journey reviews; UC-008 is accepted).

The remaining scope is substantive: custody/first offsite recovery, broader privacy/content/cohort review, or mail operations and isolated owner browser journeys. These are independent deliverables rather than a final tidy-up.

Final closure and residual ownership — 2026-10-08

The user explicitly requested closing this workplan after the follow-up records were registered, removing the acceptance-tracker role. Status is finished. Completed work and user acceptance remain evidenced; unfinished task scopes are canceled here as superseded, with their remaining outputs live below. No remaining productive acceptance, custody, cutover or caller admission is inferred from administrative closure. Original task IDs are retained as history.

Accepted result: ReichelAg weekly calls on app revision16; duplication/naming, editing, usual mail-client paste and page/list visuals accepted by the user. Release/persistence and actual paired isolated recovery are evidenced; broader recovery custody, sharing/portability and further cohorts have separate owners. T08 initial catalogue is done; ongoing discovery is transferred.

• CSOC-WP-0008-T01 → CSOC-WP-0012-T03.
• CSOC-WP-0008-T02 → CSOC-WP-0012-T01/T02/T03.
• CSOC-WP-0008-T03 → CSOC-WP-0014-T01.
• CSOC-WP-0008-T04 → CSOC-WP-0013-T01/T03.
• CSOC-WP-0008-T05 → CSOC-WP-0013-T02.
• CSOC-WP-0008-T06 → CSOC-WP-0014-T03.
• CSOC-WP-0008-T08 → CSOC-WP-0014-T02.
• CSOC-WP-0008-T09 → CSOC-WP-0014-T02.

Follow-ups are live with origin: residual and this workplan as origin_ref. Their registered UUIDs, task IDs and completion criteria are in their canonical files. Historical references to this workplan mean provenance, not a remaining execution or approval gate. No further work is waiting in this record.