coulomb-social/workplans/CSOC-WP-0013-sharing-content-hardening.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	origin	origin_ref	state_hub_workstream_id
CSOC-WP-0013	workplan	Sharing, portability and content-storage acceptance	communication	coulomb-social	active	codex	coulomb-social	2026-10-08	2026-10-31	residual	CSOC-WP-0008	70370f4e-7cba-5b0a-853b-fedcd2bd49a5

Residual acceptance from CSOC-WP-0008, split at the user's request. Existing implementation/release/acceptance evidence remains in the originating workplan; these tasks own the remaining concrete outputs. Source checks never grant runtime or productive acceptance.

Current execution map — 2026-10-31

T01 storage enforcement is complete. T04 now exposes completed fidelity-review preparation. T02 still owns actual corpus/assets fidelity verdicts and final content acceptance; its revision lifecycle detail is T05, now in progress with the retention policy accepted and a tested crash-recovery candidate published. T03 owns four separate UC-003/004/005/006 productive verdicts. No review verdict has been inferred from tests or weekly-call acceptance.

The user selected closure of this workplan as the active goal, completing its necessary WP-0012 prerequisites first. T07's route and T08's inactive installation are now founder-executed and independently verified, including local capacity admission. A newly verified ordered-list numbering fix under T02 must accompany the lifecycle fix in the next reviewed image. Original sealed packets remain historical evidence; the lifecycle-only image packet is not the final combined content release. The user also requested a plain attachment action menu with author add/remove; T06 owns this addition and its release/acceptance. Three custom-topic rendering cases are accepted for now (decision69ec9380). Two attachments are recovered; the four reviewed scrap cases are now intentionally omitted as obsolete legacy data under resolved decision6db14274. No further scrap capture/review is required. Then close fidelity/resource dispositions, lifecycle acceptance and the four productive journeys. Full migration/cutover and full WP-0012 service acceptance remain in their existing workplans.

The four-workplan assessment records the scope split and effort estimate. Task counts are not effort percentages. Historical notes retain the evidence trail; this map and the task blocks govern current status. No original acceptance requirement has been dropped.

2026-10-31 deployment return: Bernd approved and executed exact proposal e96752ec. Independent verification confirms Helm revision20/image7906f461, all79packaged source files, all23frozen capsule files, complete deployment/PVC identities and all helper hashes. All93business rows/86content files are unchanged; 40owner views and40outsider denials pass. The fresh20:21paired point was fetched back from primary storage. Snapshot pin is refreshed; timers remain inactive. Receipt and proof: docs/release/content-acceptance-{receipt,independent-postflight}-2026-10-31.json. Independent mirror retrieval/decryption now restores all13tables/115rows and 86files exactly. Deployed/previous image views and85-file client export pass; source SQL/files remain unchanged. Source release/helper pins match revision20. The execution gate is complete. T03 is now in progress with the attended acceptance session and harmless attachment fixtures. Actual user verdicts remain open; sharing uses the user-nominated testuser account after its sign-in; there was only one live member at preparation. Deployment and automated evidence do not supply those verdicts.

T01 — Finish unambiguous storage enforcement

id: CSOC-WP-0013-T01
status: done
priority: high
needs_human: false
decision_id: "9b320990-0688-4fa9-a947-4b54cf01f5c7"
intervention_note: "Founder executed proposal5fd7ccd8; durable node receipt, independent native postflight, revision18/image51281946, migration0003/global constraint and unchanged92rows/86files verified on 2026-10-31. No further execution is needed for T01."
state_hub_task_id: "4d18a390-c82a-5d6b-8509-1b1704975150"

Decide and enforce the existing global-slug invariant at SQL/storage boundaries, including admin/import concurrency and legacy collision migration refusal. Preserve tenant/member denial and protected journeys. Prepare migration/rollback proof before a guarded rollout.

2026-10-11: spaces_space_slug_global_uniq is in the model and migration 0003. The migration raises before adding the constraint when any slug is duplicated and does not rename, merge, or delete those rows. Admin save, space create and import map the constraint failure to the existing validation errors. Rollback is manage.py migrate spaces 0002, which drops only the global constraint. Tests cover parallel inserts, a missed import pre-check, an admin race, inactive slug reservation, migration refusal, and the legacy fail-closed reads. The live database has not been migrated.

2026-10-27: Added a real MigrationExecutor forward/refusal/reverse/reapply regression and rehearsed it on disposable PostgreSQL 16.14. Conflicting rows and grants stay unchanged; rollback retains tenant uniqueness. Current production has zero duplicate slug groups and still only migrations 0001/0002. Guarded release remains open. Proof: docs/release/storage-migration-rehearsal-2026-10-27.json.

2026-10-27 candidate: c11300a published at digest fb579adefa6e3e0c16fedeac134b2e05f4ed6216807cb25995fbc0da826c1167. Its actual packaged Django/source pass the PostgreSQL lifecycle proof, with only pytest tools injected. Migration drift check and server dry-run pass; Helm render comparison changes only the app image across three resources. Live rollout still requires a fresh paired rollback point/rehearsal. Proof: docs/release/storage-candidate-c11300a-2026-10-27.json.

2026-10-28: Refreshed candidate 17d0eb6 is published at OCI digest 512819463a1902b43a615beee14be7bf97e6a05e016385082b9380692ad1a8cd. Actual packaged source/Django pass PostgreSQL 16.14 forward/refusal/reverse/reapply proof. Packaged network-none checks reject missing Bubble index/chunk dates before writes and preserve original SQL space dates and exact chunk bytes/metadata. Packaged source hashes match the tested worktree; full source gate 231 passes. Migration drift is absent; current Helm comparison changes only the deployment image across three resources, and server dry-run passes. This supersedes c11300a as the prepared candidate and includes the strict source-date guard. No production migration or deployment; fresh paired rollback/recovery proof remains required. Evidence: docs/release/storage-candidate-17d0eb6-2026-10-28.json.

2026-10-29: The independently provider-recovered real pair now passes candidate forward/refusal/reverse/reapply while preserving all12business tables/91rows and 82files; all39pages/owner/viewer/ungranted checks pass. Old9a646d8e also reads the migrated copy and denies unsaved outsiders. Live data hashes exactly match that recovered point. Native live preflight proves revision17, one Ready Recreate replica, Bound PVC, no pressure and68%CPU/76%memory requests. Three-resource comparison changes only the app image. Exact sealed client/server/Helm dry-runs pass without app/schema changes. Full make check246passes; ten synthetic release safety cases and Helm lint pass.

The founder's new exact-action disposition is required by the deployment owner's standing supervision rules. Prepared rollout includes a fresh already-admitted paired capture/readback, data-drift refusals, atomic Helm rollout, read-only postflight, image rollback preserving writes and root-owned backup-helper image pin refresh. The packet and one attended command are in docs/release/storage-release-review-2026-10-29.md; proposal3389c506d86f1613c6567a2bba5c29ae22b812f19b011ebe454bb08af39a4132, pending decision05c9b00f-e4e4-4593-bdeb-c63fe6a4fe15. No new Scaleway login or credential delivery is needed. No live migration, rollout, SQL date correction, purge, grants, mail or timer change has been made. T01 waits only at that exact privileged execution gate; other workplan tasks remain active.

Evidence: storage-real-pair-rehearsal-2026-10-29.json, storage-rollback-compatibility-2026-10-29.json, storage-release-preflight-2026-10-29.json and storage-sealed-preflight-2026-10-29.json under docs/release/.

2026-10-31 current-point refresh: old proposal3389c506 correctly refused live data drift. Founder capture at23:50:40Z was verified on the node, mirrored and independently recovered. Candidate forward/refusal/reverse/reapply preserves 92 business rows/86 files; 40 owner pages and outsider denials pass, including old-image compatibility after migration. Corrected complete provider kit and separate protected proof recover in42.651s. New exact proposal5fd7ccd8 retains the same code/chart/image and passes native read-only preflight. Founder execution/postflight remains required; no live image/schema change occurred. Packet: docs/release/storage-release-review-2026-10-31.md. Pending replacement decision9b320990-0688-4fa9-a947-4b54cf01f5c7 replaces the stale proposal's review.

2026-10-31 founder execution completed: durable proposal5fd7ccd8 receipt reports storage_candidate_deployed_verified at00:29:28Z, Helm revision18 and99.527s. Independent fresh read-only postflight verifies current image51281946, applied migration0003/global and tenant constraints, zero duplicates, all92business rows and86files unchanged,40actual owner pages and40unsaved-outsider denials. Current snapshot helper hash matches the sealed replacement4ff81b79 and its server dry-run passes; paired worker43e119ac remains unchanged. All73packaged source files match source17d0eb6 exactly. Receipt and independent evidence are under docs/release/storage-release-{receipt,independent-postflight,source-provenance}-2026-10-31.json. T01 is done. Productive corpus/sharing/portability verdicts remain T02/T03.

T02 — Complete content fidelity and revision lifecycle

id: CSOC-WP-0013-T02
status: progress
priority: high
needs_human: false
decision_id: "6db14274-4450-4ae2-b77a-cd4c88369eaa"
intervention_note: "Source-resource disposition is settled: two attachments recovered and all four reviewed scraps explicitly omitted as obsolete legacy data by Bernd. No further scrap review is required. Combined release and productive acceptance remain separately required."
state_hub_task_id: "8d06cdee-e0ce-5c3e-bf98-705deed0ee62"

Review custom Markdown/raw HTML and body-linked assets with privately nominated corpus examples. Define revision retention/purge and failed multi-file copy/move crash recovery without losing source or incoming-address authorization. Current immutable revisions, stale-edit refusal, supported Markdown attachments and aliases are deployed; preserve them.

2026-10-11: Supported Markdown is fenced code, tables, newline breaks and sane lists. Raw HTML, script, event handlers and non-http(s)/mailto URLs are removed. Relative asset URLs stay. No private corpus has been nominated, so this is not corpus acceptance. Revisions are not purged on save. purge_revisions deletes only inactive revisions older than an explicit timezone-aware cutoff, keeps the live page bytes, and keeps every revision of a deleted page. A hash mismatch aborts the purge before any deletion. Copy and move write a journal under CONTENT_ROOT/.recovery. The next content write finishes a confirmed move or discards an unconfirmed destination. The source is deleted only when its bytes still match the journal. Alias changes do not grant destination access. The live content root has not been purged or recovered.

2026-10-28: The refreshed all-space capture supplies privately scoped corpus examples without sending note bodies to inference. Added deterministic audit/cards using the actual product renderer and the same intermediate Markdown path, with no renderer policy change. All 244 captured article records remain represented; 241 bodies render, three are missing. Six records have structural sanitizer changes: three removed custom tags and 17 removed attributes. Extracted text is unchanged between intermediate and sanitized HTML, which does not establish fidelity to Bubble. Private source/product cards prioritize those exceptions, disable sample resources/interaction and link explicitly to the original view. No productive verdict inferred. Hash/count-only receipt: docs/release/corpus-rendering-audit-2026-10-28.json. Exact review steps are appended to docs/usecases/sharing-portability-review.md. User comparison/verdicts remain open.

2026-10-31: Renewed source continuation added one article/body. Rebuilt private rendering cards cover 245 records/242 bodies, with the same six markup-change cases and three body-missing records. No source/product fidelity verdict is inferred. Cards: ~/.config/coulomb-social/auth/exports/rendering-review-20261031/index.html. The review guide now identifies the deployed revision 18/storage release instead of incorrectly describing storage hardening as unreleased. Source/capture proof: docs/release/bubble-source-continuation-2026-10-31.json. Productive UC-003–006 verdicts and remaining content/revision obligations are still open.

2026-10-31 body-resource check: 18 distinct captured link entries and all 28 occurrences preserve exact reference attributes through the current product renderer. Verification binds 242 source bodies and 236 prepared article pages; no remote link was fetched. The compiler now explicitly retains and blocks four deferred scrap relation fields in addition to the one attachment flag. This narrows lossiness uncertainty but does not resolve those records or accept the six markup-change cases, original Bubble appearance or productive content fidelity. Evidence: docs/release/bubble-body-resources-2026-10-31.json. T02 remains progress.

The subsequent bounded native read recovered fresh unchanged metadata for all five resource-affected articles, but no resource records. The visible resource control is Add attachment, not a demonstrated path to existing content, and was left untouched. The operator viewing/download-path question is pending under WP-0014-T01. docs/release/bubble-resource-capture-2026-10-31.json records the incomplete return and private review; neither resource absence nor fidelity is inferred. T02 remains progress.

2026-10-31 closure follow-through: audit found a concrete numbering defect: sanitization removed15ordered-list start attributes across4captured records. The bounded renderer correction permits ol.start while preserving event-handler, custom-tag and unsafe-URL denial. All650full-gate tests pass, including browser journeys. Refreshed private cards verify all242bodies unchanged and restore every start value; structural sanitizer cases fall from6to3, all custom topic fields. Three missing bodies and unresolved resource flags remain explicit. Evidence: docs/release/ordered-list-fidelity-2026-10-31.json; private review is ~/.config/coulomb-social/auth/exports/rendering-review-20261031-numbering/index.html. This source correction still requires packaged release and productive verdicts. It neither changes the original capture nor accepts the remaining custom fields.

2026-10-31 user return: “This is fine for now” accepts the displayed rendering of the three custom-topic cases in the refreshed numbering review. Decision 69ec9380-e5f6-41aa-af88-f697fc1c8a66 records that narrow disposition. The user suggested the original visual overlay may expose existing resources and requested a plain action menu in the replacement app; no original resource was waived.

The user-suggested visual-overlay check visited all5resource-affected pages and hovered42visible images. Its download link targets an already retained Visual; no typed scrap/attachment resource was found. No resource absence is inferred. Private evidence is resources-hover-20261031 alongside the original review; public receipt: docs/release/bubble-resource-hover-2026-10-31.json. The exact viewing-path or per-case disposition question remains pending.

2026-10-31 confirmed modal follow-through: the user identified Add attachment as both the add and download modal. Opening it and using Open file recovered two original files, one on the retained flagged page and one on the user-supplied example outside the original245article capture. Each UI download exactly matches an independent CDN fetch;2relations,2new attachment child records and original creation/modification timestamps are retained privately. All5previously flagged parent bodies/dates remain unchanged. The known parent draft now carries its attachment and date provenance; its body and existing metadata remain exact. The example stays separately retained pending source reconciliation. The4scrap relations remain unresolved; their empty attachment modals do not prove that scraps are absent. No source mutation, original-evidence overwrite, production import or productive verdict occurred. Capture and private preparation evidence: docs/release/bubble-attachment-recovery-2026-10-31.json. Private downloads/review: ~/.config/coulomb-social/auth/exports/attachment-bundle-20261031/attachments-index.html. All670full-gate checks and7synthetic resource guards pass. This clears the unknown attachment-modal navigation path; it does not waive the remaining source gaps.

2026-10-31 resumed audit: each of the4scrap-bearing pages opens its navigator, but none yields a typed resource record or a scrap control. The raw deferred references do not point to the parent or another captured article. This does not prove absence or obsolescence. A four-case private review now isolates the needed dispositions, under pending decision6db14274-4450-4ae2-b77a-cd4c88369eaa: ~/.config/coulomb-social/auth/exports/scrap-review-20261031/index.html. Public receipt: docs/release/bubble-scrap-navigation-2026-10-31.json. The additional example/attachment records are not referenced by the original reconciliation, so they cannot silently resolve its prior source graph exceptions. The exact image proposal still has no durable execution receipt; no live release or productive acceptance is inferred.

2026-10-31 explicit user disposition: “Lets ignore the scrap cases as they are legacy relicts that are no longer needed.” All four reviewed cases are accepted intentional omissions, under resolved decision6db14274-4450-4ae2-b77a-cd4c88369eaa. Their obsolete scrap content is outside migration/content acceptance scope; no further scrap capture or verdict is required. The exact four-case manifest and raw-reference hashes bind this disposition. Original source evidence, existing page bodies/dates and the two recovered attachments are retained. Other source exceptions, release delivery and productive acceptance are not waived. Public receipt: docs/release/bubble-scrap-disposition-2026-10-31.json; exact private mapping: ~/.config/coulomb-social/auth/exports/scrap-review-20261031/disposition.json. The earlier unresolved-scrap notes are historical and superseded by this return.

T03 — Review productive sharing and personal portability

id: CSOC-WP-0013-T03
status: progress
priority: high
state_hub_task_id: "8edd7661-17b0-5aa0-b177-6170aa159623"

Review owner Share space/revocation, reader/outsider denial, account-local export, successor ownership and local exit semantics with the user. Keep platform identity outside app deletion. Record UC-003/004/005/006 verdicts independently; weekly-call acceptance is UC-008 only.

2026-10-27: User requested prepared review steps rather than supplying verdicts. Prepared exact UC-003–006 steps in docs/usecases/sharing-portability-review.md; no acceptance inferred.

2026-10-31: Revision20 is independently verified and the user requested productive acceptance now. The focused session and sample attachments are prepared; owner authoring/attachments review has been requested. A second participant must sign in after deployment for ungranted/viewer/revoked checks. No verdict is inferred.

T04 — Prepare private corpus fidelity review evidence

id: CSOC-WP-0013-T04
status: done
priority: high
state_hub_task_id: "17a2e781-5e44-5e89-8b76-e357d32de7ab"

Captured-source audit and private source/product cards cover 245 records/242 bodies, explicitly retaining three missing bodies and six markup-change cases. Review steps identify source/product comparison and separate resource review. Evidence: docs/release/corpus-rendering-audit-2026-10-28.json, bubble-source-continuation-2026-10-31.json and docs/usecases/sharing-portability-review.md. This closes preparation only; the actual verdict belongs to T02.

T05 — Accept revision retention and interrupted copy or move recovery

id: CSOC-WP-0013-T05
status: progress
priority: high
state_hub_task_id: "c2986a84-4da2-5fb3-b021-7bbe5104fe47"

Explicit lifecycle portion of T02: review the existing revision purge/retention policy and failed multi-file copy/move recovery, preserve source/incoming-address authorization, and obtain the required operational/product acceptance. Reuse existing source and crash-recovery tests; investigate concrete gaps before adding implementation. No live purge is authorized by task creation. Close with the agreed policy and evidence for the intended lifecycle.

2026-10-31 lifecycle investigation: actual child-process termination reproduced an orphaned attachment in both copy and move: destination bytes were created before the cleanup journal recorded the filename. Corrected source persists intent before exclusive creation, refuses existing destination entries before recording cleanup authority, and flushes attachment/recovery directory entries before publication. Fourteen abrupt-exit scenarios exercise rollback/finish/retry across the multi-file operation; eight collision cases preserve existing entries. This advances T05 from todo to progress. Evidence: docs/release/content-lifecycle-validation-2026-10-31.json. The review guide separates retention-policy acceptance, exact purge authorization, release delivery and productive review. User accepted the retain-all/manual-cutoff policy; decision c3a191f2-ce06-483f-82d7-ef8c54ea0d5e. No cutoff, production purge, image deployment or user acceptance is inferred. The current verified release remains revision19/image522bcd7f until a new owner return.

The corrected source f306dbf is published as immutable candidate sha256:d3f2f5bb90f0ba79f4e1d8098d2eb06f8940b8789e5ecb851914bbab364597ec. All80 packaged source files match; runtime package/Python versions are unchanged, and no new migration is present. The previous image reproduces four interrupted- attachment failures; the candidate passes all29 lifecycle checks in a read-only, network-disabled container without an application overlay. Full make check passes 546 tests, including required browsers, with zero failures/errors/skips. Build, provenance and paired baseline/candidate test receipts are under docs/release/content-lifecycle-*-2026-10-31.json. RAPPS-WP-0015-T07 now owns the new exact release preparation/execution return. T05 remains progress until that return and productive acceptance; policy acceptance is settled and no live purge is authorized. No production image or release pin changed during this work.

Exact owner image packetc9c32316 is now prepared and RAPPS-WP-0015-T07 waits on WP-0012-T08. Its40controller cases pass; the separate values/snapshot paths retain historical capsules. Current native image preview is image-only at revision19. Candidate and rollback images preserve the retained13tables/86files and render40 owner pages/deny40outsiders. Live93-row baseline includes a new session and login timestamps since the92-row retained point; content/migrations match. The execution must capture a new exact paired point before Helm. Native full preflight refuses missing installation8f442bf0 before creating an execution journal. Existing backup packets retain their digests; image delivery follows inactive installation and precedes native recurring-service acceptance/activation. Details and later commands are in docs/usecases/sharing-portability-review.md. No image release or productive acceptance has occurred; T05 remains progress.

T06 — Deliver author-managed attachments through a plain action menu

id: CSOC-WP-0013-T06
status: progress
priority: high
state_hub_task_id: "ff59b908-2d56-5fa5-b1b9-556aee1bae14"

User requested a sensible action menu instead of a visual overlay, explicitly including author add/remove. Provide authenticated downloads for existing local resources, bounded uploads, revisioned attachment associations, and space-level read/write permissions. Removal detaches the current association while retaining bytes needed by old revisions. Copies and moves preserve independent attachments and incoming-address permissions. Preserve page body and original source dates.

Source implementation and synthetic browser journey pass. Main full gate670 and isolated release gate568 pass; all110 focused packaged checks pass with no app source overlay. Source1139a6d is published as immutable image7906f461. The release combines attachment actions, ordered-list starts and copy/move crash recovery. Evidence: docs/release/attachment-menu-validation-2026-10-31.json and content-acceptance-{build,provenance,tests}-2026-10-31.json. Packaged recovery/export checks now preserve all13tables/86files and verify 40owner/40outsider views plus85export files. The refreshed exact proposal is e96752ecfa7adef2fd1d9da48902c8e63de124ccfd272fe20ba79b758b3ca4a3; review is docs/release/content-acceptance-review-2026-10-31.md. Full native preflight passes at unchanged revision19/data fingerprints. Founder execution is requested under decisiond9b70cc5-e035-40ae-8d0d-020190581202. Attended release/independent return and productive user verdict remain required. Existing unresolved Bubble resources remain T02/WP-0014-T01; this UI does not establish their recovery or completeness.

Completion

Finish when every task above has its stated evidence and acceptance, or hand off any newly discovered residual to a live work record first. Cross-owner dependencies remain their existing canonical records.