coulomb-social/workplans/CSOC-WP-0008-production-transfer-acceptance.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	origin	origin_ref	depends_on	state_hub_workstream_id
CSOC-WP-0008	workplan	First user-reviewed use-case transfer off Bubble	communication	coulomb-social	active	codex	coulomb-social	2026-10-06	2026-10-07	residual	CSOC-WP-0007	CSOC-WP-0007	0ee96868-875c-536e-a661-07198c07a8ce

CSOC-WP-0008 — First user-reviewed use-case transfer

Success is a recoverable, accepted community transfer under the existing stage-1 cut. Local migration tooling is implemented by WP-0007; that is not live parity or a production readiness claim. Existing CSOC-IN-0003 and CSOC-IN-0004 remain open until the corresponding acceptance below is evidenced. This record does not assign or authorize changes in platform-owner repositories.

User milestone — Ready to review the first use-case transfer

At completion, you can sign into the new app, open a nominated migrated space, recognize its pages and visuals, continue writing and organizing that work, copy or move a page, and share it with a reader who cannot alter it. Your changes survive an application restart, and the team can recover the content and access from a tested backup. You can inspect/export your app-local information and review how leaving the app handles owned content before any deletion.

A side-by-side walkthrough describes the original Bubble steps, equivalent new steps, expected results and remaining differences. You review this as a user and accept or reject each use case for productive transfer. Completion means the first nominated cohort is ready for this review; it does not pre-approve all use cases or retire Bubble. Apex retirement remains an explicit later decision.

The main goal is now a continuing off-ramp: find and describe actual Bubble use cases, rebuild them within our ecosystem, compare behavior and transfer approved use cases incrementally. The historical feature inventory supplies candidate journeys, not proof that each is used or works in the current Bubble product. Marketplace/social features stay candidates for subsequent cohorts until actual use and user priority justify their implementation.

Execution and review order

1. Capture candidate journeys from existing evidence; confirm real examples with the user during review. Keep evidence confidence and unanswered questions.
2. Build and test the missing sharing/access, content, portability and recovery behavior required for the nominated cohort (T04/T05/T02/T07).
3. Prepare a concrete release and representative content rehearsal; obtain the exact live change authorization required by the estate before deploying (T01).
4. Reconcile the first nominated corpus/cohort and demonstrate end-to-end user journeys and recovery (T03/T08/T09).
5. User accepts individual journeys or records gaps as follow-up work. Transfer those accepted use cases; keep Bubble available for remaining cases (T06).

The earlier 71-space/109-article capture remains an inventory to reconcile, not an instruction to bulk-move every space before the first user review.

T01 — Prepare persistence and deployment acceptance

id: CSOC-WP-0008-T01
status: progress
priority: high
state_hub_task_id: "6adce69f-9011-5ada-a920-b2228aa15218"

Dependencies: railiance-apps owner and founder approval of the exact live change, exercising ADMINISTER @ realm:kubernetes/railiance01, activation=APPROVED. Prepare pinned image, migration 0002, persistent CONTENT_ROOT, single writer / paused-write maintenance procedure, volume capacity and node headroom review. Dry-run/diff deployment in its owning repo. On app host verify space creation, page CRUD, Visual delivery (or explicitly accepted metadata-only limitation), copy/move, restart durability and source+destination denied-access cases. Record immutable release and receipts; only then close CSOC-IN-0004.

T02 — Prove paired metadata/content recovery

id: CSOC-WP-0008-T02
status: progress
priority: high
state_hub_task_id: "04795cd7-1248-57df-9822-da8fa1471559"

Implement a reviewed backup/restore automation entrypoint after runtime storage and DB owner lanes are known. Baseline protocol is in docs/migration/corpus-import.md. Pause writers, capture DB and CONTENT_ROOT at one recovery point, record hashes, image/migration version and tenant without secrets. Restore into an isolated instance with no outgoing integration writes; compare Space/Member/membership counts, markdown/asset hashes, rendering and denied cross-member reads. Record RPO/RTO, retention, custody and a rollback drill. No acceptance from DB-only snapshots; no private archive in git or State Hub.

T03 — Rehearse and reconcile the actual transfer cohort

id: CSOC-WP-0008-T03
status: progress
priority: high
state_hub_task_id: "0615eff2-bf2b-503b-8f15-0591d4666446"

Dependencies: founder-nominated first-use-case corpus/cohort, reviewed identity membership map, T01/T02 acceptance, local access to private prepared trees. Use the new corpus manifest and dry-run; resolve every unmapped/inactive identity by NetKingdom onboarding rather than password/email matching. Rehearse separately, reconcile all 71 known spaces and 109 captured articles against actual expected inventory, report omitted/thin trees, missing assets and parent/privacy lossiness. Execute the first nominated representative cohort; disposition other spaces explicitly as subsequent transfers rather than silently excluding them. Approve role assignments and additional pre-existing grants before real import; content replacement is additive for membership and does not revoke old grants. Close CSOC-IN-0003 only after real cohort receipts and exception disposition.

Personal account pre-import prerequisite (2026-10-06): successful verified sign-in records tenant:platform, whereas app fallback/demo records used tenant:coulomb. Reconcile target-space tenancy and explicit memberships with the issuer owner before real ReichelAg transfer; verify isolation/denial. Do not rewrite the signed tenant claim or grant broad access to bridge the difference.

T04 — Close access and member-portability gaps

id: CSOC-WP-0008-T04
status: progress
priority: high
state_hub_task_id: "eb4da28e-ea04-52fa-92d6-f78296348b83"

Remove or explicitly isolate tenant-wide bootstrap visibility for private cohorts. Enforce viewer versus write roles, validate cross-tenant memberships in all mutation paths, and decide tenant-keyed content directories versus a strict single-tenant instance invariant (including admin/import concurrency). Implement app-local member export/delete with ownership/content retention and platform identity boundaries explicitly defined. Test private-space denial, viewer mutation denial, deletion with owned content and export tenant isolation. Do not equate migration grants with full Bubble privacy fidelity.

T05 — Content durability and link fidelity

id: CSOC-WP-0008-T05
status: todo
priority: medium
state_hub_task_id: "3fdb685c-9670-516a-a65b-6f9a2eac0ee0"

Define content git commit/push or an accepted durable revision mechanism; concurrent-write conflict policy; body-linked asset copying and link rewriting; authenticated Visual delivery. Test transfers with embedded images and incoming links, failed destination writes and concurrent edits. Keep outline/include/lazy projection work separate unless stage-1 acceptance explicitly requires it.

T06 — Close service contract and founder cutover gate

id: CSOC-WP-0008-T06
status: wait
priority: high
state_hub_task_id: "f842f9cc-6863-50d0-aac7-a7dcc2ca36e7"

Pending State Hub decision: 186be722-e2c7-4109-a1e6-d120fe8fca5b. Depends on T01–T04 and founder acceptance. Link current ops-hub registration, backup/restore receipts, cost attribution, SLO observations and immutable image provenance to the business-app service contract §§1–6. Recheck historical public registration Case B. CSOC-IN-0002 is already closed by WP-0007 synthetic identity replay/email separation tests; retain those checks in release validation. Present cohort lossiness and access acceptance for a human decision; retain parallel hosts until that explicit cutover. Production and apex retirement are not authorized by a local test suite.

T07 — Restore a clean repository-wide lint gate

id: CSOC-WP-0008-T07
status: todo
priority: medium
state_hub_task_id: "e2dadb93-f069-54b3-b7e2-c4e921f27d5e"

Resolve the pre-existing Ruff findings recorded by the WP-0007 assessment, without changing generated schema semantics or weakening checks. Full lint and tests must pass; prioritize meaningful unused-fixture/test cleanup over silencing rules. This task is quality debt rather than a claim of broken runtime behavior.

T08 — Describe Bubble use cases and rebuild acceptance

id: CSOC-WP-0008-T08
status: progress
priority: high
state_hub_task_id: "fca49f28-a959-51e2-ad24-5fd73b1e5316"

Create docs/usecases/catalog.md with stable journey IDs, actors, user goals, original/rebuild steps, expected results, evidence confidence, gaps, owner tasks and transfer status. Start from captured Bubble inventory; mark inferred steps and uncertain semantics. User confirmation is required before calling a journey observed/accepted. Prioritize working in spaces/pages and sharing access; retain research/chunks, discovery, social and marketplace candidates for later cohorts.

T09 — User review walkthrough and per-use-case off-ramp receipts

id: CSOC-WP-0008-T09
status: progress
priority: high
state_hub_task_id: "648acce6-21cd-540f-b3b0-c2fcb8eacc60"

Write docs/usecases/first-transfer-review.md with a realistic example space and writer, reader and outsider checks; original/new steps; expected visible results; restart and restore checks; pass/gap/accepted-for-transfer fields. Record actual release/host, corpus reconciliation and recovery receipts before asking the user to execute review. Local tests do not mark this milestone done. Capture the user's acceptance per journey and remaining gaps as live work records, then prepare the next cohort. The user's review is the transfer gate, not a proxy for blanket Bubble retirement.

Implementation started — 2026-10-06

T04 first slice implemented: explicit membership/creator visibility; removed tenant-wide bootstrap reads; enforced viewer read-only access in product routes and service writes, exact tenant/space checks, and source/destination write checks for copy/move. Read-only controls reflect those permissions. Seed/admin spaces now need explicit grants; deploy/import docs reflect this behavior.

T08/T09 initial catalogue and review walkthrough prepared under docs/usecases/. Original Bubble journeys remain inferred pending observation/user confirmation; real cohort and release evidence remain pending. T04 continues for sharing UI, member export/delete, tenant filesystem invariant and original privacy parity. The milestone is not reached by this local implementation slice.

Validation: 86 tests passed; Ruff passes changed service/view/test files; git diff --check passes for edited files. Existing 19 repository-wide lint findings remain T07 debt; no production change made.

T10 — ReichelAg weekly call: duplicate protocol and copy for email

id: CSOC-WP-0008-T10
status: done
priority: high
state_hub_task_id: "41334b54-0c99-5c61-9cdf-16231516882b"

User-confirmed first cohort: ReichelAg weekly founder calls. The user confirmed copying the full protocol and editing the new entry by hand. Duplicate the latest entry to prepare the next call's bullet-list agenda; maintain the new protocol; copy rendered content to the clipboard and paste/send manually in an external email client. Email sending is not an app feature requested by this workflow.

Implement a distinct “Copy content to clipboard” action (not page duplication), with rich HTML + plain text, preserved bullet structure, visible success/failure and selectable manual fallback. Verify synthetic old/new protocol independence, copy/paste payload, private-space access and failure handling. User review uses a nominated real latest protocol, privately reconciled with the historical reichelag rehearsal. Do not infer AI recording/transcription, automatic dates, open-item extraction or email delivery. Those behaviors remain unspecified.

T10 implementation evidence: user-confirmed full-copy/manual-edit workflow recorded as UC-008 in docs/usecases/reichelag-weekly-call.md. Distinct Duplicate page and Copy content to clipboard actions implemented. Rich HTML/plain-text clipboard and blocked/manual fallback pass Chromium checks with synthetic data. Full application suite: 87 passed; new test Ruff clean. Real latest protocol reconciliation and actual mail-client/user review remain T03/T09, not completed by these tests. No live deploy, private-data import or mail sending performed.

Live orientation and personal account — 2026-10-06

Fresh checks confirm a healthy 1/1 coulomb-social Helm workload on railiance01 (92.205.62.239), image 7fcd0cf, revision 9. app.coulomb.social landing and health return 200; KeyCape discovery is live. No content PVC/CONTENT_ROOT exists in that old release. One live Member links the user-selected tegwick identity to KeyCape and tenant:coulomb; one demo space exists. No new password/account is needed. The user tried sign-in and received invalid_profile_usage / unknown client_id. Guarded issuer inspection confirms the coulomb-social client is absent; the stored Member and healthy discovery did not prove interactive login worked.

T01 now progresses by preparing the latest tested app image with collected static assets and an owning-chart persistent CONTENT_ROOT upgrade. Single-writer Recreate avoids concurrent filesystem writers and rolling CPU surge. Exact live change approval follows the prepared diff/dry-run and immutable image receipt. Node CPU requests observed 3455m/4000m; disk has 123G available. No deployment or credential change was made by these read-only checks.

T11 — Restore personal OIDC sign-in

id: CSOC-WP-0008-T11
status: done
priority: high
state_hub_task_id: "3a6bdbfb-975e-5c3e-b34f-6eeede402521"

Restore the historical NetKingdom public coulomb-social authorization-code/PKCE client through the owning guarded helper; refuse differing existing registrations, preserve unrelated configuration bytes and Secret data, pin cluster identity and Secret UID/resourceVersion. Inspection and server dry-run passed on 2026-10-06; no live change made. Existing historical ordinary AAL1 behavior (mfaRequired: false) is explicit in the review packet; shared issuer restart requires exact founder approval. User tegwick must then confirm interactive login. Do not mark this task done on an HTTP redirect or discovery-only check.

Knowledge receipt: emergent-security 0.2.6 identity, verified-files, orientation-only; digest 8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02.

Prepared review: docs/release/personal-account-2026-10-06.md. Pending exact live decision: 8bbce691-a787-4140-9cd4-df06e8635a27. Published image and owning chart prep complete; live approval and user acceptance remain pending. No productive data transferred.

Deployment execution — 2026-10-06

Founder approved exact live changes (decision 8bbce691-a787-4140-9cd4-df06e8635a27). T11 registration restored through guarded CAS; shared KeyCape restart succeeded; authorization now hands off to Authelia. Interactive tegwick login confirmation still pending, so T11 remains wait. T01 app upgrade succeeded as Helm revision10, chart0.2.0/digest-pinned source ac7bac1852; retained2Gi content PVC bound, UID/GID10001 writable, zero pending migrations. Public health/clipboard/login handoff and dedicated synthetic-marker restart durability passed. Fresh apps-pg backup csoc-preupgrade-20261006145351 completed before migration.

Receipt: docs/release/personal-account-deployed-2026-10-06.md. T01 stays progress for live product/Visual/permission acceptance; T02 paired restore, T03 real cohort and T09 user/email walkthrough remain open. No real-data import or apex cutover. RAPPS-WP-0015 T03 deployment completes; T04 user acceptance remains open.

User sign-in result — 2026-10-06

The user reaches auth.coulomb.social but tegwick is rejected as wrong username or password. Read-only directory query through the existing provisioner confirms tegwick is present. Live Authelia username attribute is uid; its lookup supports uid or mail. Contained recent-log inspection records a tegwick LDAP invalid- credentials failure, without backend connection error or regulation-ban evidence in that entry. This does not establish why the entered credential is rejected.

The app and client restoration are deployed, but personal sign-in is not accepted. CSOC-WP-0008-T11 remains wait for human credential confirmation/recovery and a successful fresh sign-in. The user was asked whether the same password works on another service. No password was requested/read/exported or reset. Authelia's current notifier is filesystem rather than SMTP: do not promise emailed recovery or expose reset tokens from notification files. Any credential reset must use the owning attended recovery/setup lane under a separate exact approved change.

Password-reset email dependency now has live successor CSOC-WP-0010, NK-WP-0047 and RPF-WP-0052/CCR-2026-0035. Existing platform mailbox custody found; native reset-mail connection prepared and dry-run only. T11 still waits activation and actual user receipt/recovery/sign-in.

Platform reset mail is now active through native Authelia SMTP from platform@. CSOC-WP-0010-T02 completed; T11 remains wait until user receives a fresh reset, changes the password privately and completes actual app login. See docs/release/platform-email-active-2026-10-06.md.

Personal sign-in HTTP500 diagnosis — 2026-10-06

User confirmed fresh reset mail arrival, then reported app500 after authentication. Contained in-pod HTTP probes with empty verified-claims envelopes create no identity: old user-engine address returns302 redirect, canonical endpoint400 missing claims using the existing credential. Application httpx rejects302; identity-linking failure occurs before local session creation. Owning RAPPS-WP-0015 corrects only USER_ENGINE_BASE_URL with the same immutable image and existing approval8bbce691-a787-4140-9cd4-df06e8635a27. T11 remains wait for fresh successful personal app sign-in. See docs/release/personal-login-500-2026-10-06.md.

Final personal acceptance — 2026-10-06

User confirmed fresh reset-email receipt, then after revision11 URL correction confirmed: “I reach my workspace.” Personal sign-in acceptance is complete. No password/reset token/private protocol was requested or recorded.

User review: empty Spaces — 2026-10-06

After successful tegwick sign-in, user reports No spaces yet. Read-only live inspection confirms zero visible/current-tenant spaces, memberships and created spaces; total database has one demo row and no ReichelAg. No Bubble content has been imported on the new workload. August private rehearsal tree still exists (30pages/29assets), freshness unproven. This is T03 real migration and T09 user acceptance work, not a reason to reopen completed login or widen access.

First visible-data milestone: ReichelAg appears for tegwick with the expected latest real weekly protocol, full duplication/edit/reload and native clipboard mail-client paste accepted. Confirm fresh Bubble capture versus August rehearsal; keep provenance separate from old seed data. T02 paired restore remains an import prerequisite. Diagnostic receipt: history/20261006T190725Z-empty-personal-spaces-assessment.md.

Fresh ReichelAg transfer execution — 2026-10-06

Founder answered “yes go on” to current Bubble capture and first ReichelAg transfer. Saved browser session probed; expired signature cookie prevents private protocol access. Old exporter selects largest captured space and assumes title click sets active space; neither proves target selection. Fresh source capture must explicitly select ReichelAG in Pages filter and apply Search, with old network seed disabled. Retain source-ID provenance, reconcile latest expected weekly protocol and capture coverage before import.

T02 progress: node snapshot helper scripts/snapshot-content-and-db.py prepared, server dry-run passed. Quiesce app, scope pg_dump to coulomb_social_db, read-only PVC archive, restore app even on failure; isolated PostgreSQL restore must pass before real import. Four focused safety tests pass (dry-run/no writes, corrupt dump/app-resume, cleanup failure/app-resume, private paired artifacts).

Paired production snapshot completed; app resumed/healthy. Isolated PostgreSQL restore matches13tables/102rows with empty content. A second synthetic populated pair restores13tables/111rows and4files; full-protocol copy/independent edit, asset/render fidelity, viewer validCSRF write denial and outsider read denial pass after recovery.96tests pass. T02 remains progress for retained backup custody/retention and real corpus/rollback review.

T03 wait: Bubble signature cookie expired; public-only captures are not accepted source. User must privately renew via scripts/capture-auth-state.sh and open actual ReichelAg protocols. Targeted exporter now fails before output on expired session, uses explicit target/Space filter/Search, excludes old seeds, merges partial fresh records and rejects missing protocol bodies. Source receipt: docs/release/reichelag-transfer-2026-10-06.md. No productive import performed.

User confirmed the old journey: Spaces -> ReichelAg -> Pages, ordered by latest changes. Capture defaults to /vw_pages. Prioritize current content migration; UI framework architecture is a separate next phase (CSOC-WP-0011), before broad UX rebuilding. Existing browser session renewal or a dedicated Bubble account with read access can provide the source; never accept password/session contents in chat. User renewal remains the next input needed for private protocol capture.

Attended source access renewed: founder confirmed signed in and ReichelAg protocols visible in the local browser. Session saved privately (4cookies, no expired signature). T03 resumes authenticated capture and import rehearsal; needs_human login requirement cleared. Browser capture now scopes actual link roles and waits for native filter options before applying Search.

Authenticated capture completed: explicit ReichelAG target, no old seed;36source articles/36assets and37markdown files including the space index. All29August article IDs present plus7new articles; latest dated protocol2026-10-02. Source home metadata/visual and source article creation/modification timestamps retained. Reviewed owner map: only existing tegwick identity in tenant:platform, owner for new reichelag space; no other membership grants or data replacement.

Isolated real-content import rehearsal:37pages/36assets, every source file hash matches, every page renders, owner-only explicit access. Fresh pre-import paired snapshot started20:21:30Z, app resumed after53.36seconds. Source package a0ab5085e63a93fd351a1ffb85a092555cb340d72f9f5f3f510e43952388fbbc. Bounded node import helper scripts/apply-approved-content-import.py server dry-run passed, checks source/snapshot hashes and refuses replacements. It compares metadata row/sequence fingerprints and content hashes with the paired point after pausing writers, before import, then always resumes the deployment.

First real ReichelAG cohort imported — 2026-10-06

37markdown files/36assets (36source articles plus index), latest dated protocol 2026-10-02; all29August source IDs present plus7new. Only existing tegwick owner grant in tenant:platform. Final server dry-run and isolated source hash/render rehearsal passed; fresh20:21:30Z paired point checked against live DB/content after pausing writers, then exact reviewed package imported without replacement. App resumed after52.97seconds; new-pod verification: visible spaces1, pages37, assets36, grants1; public health200.

Real-content paired rehearsal restored13tables/104rows/73files with complete row/sequence/file hash agreement and all37pages rendered; owner read and an ungranted same-tenant actor denial verified.96tests pass. T02 stays progress for retained custody/retention and operational production rollback; T03 stays progress for whole inventory/identity/later-cohort disposition; T09 waits user content and full duplicate/edit/clipboard/mail-client walkthrough. T05 retains Visual delivery and parent/privacy fidelity. UI latest-change ordering/framework work is explicitly CSOC-WP-0011, not an assumed parity feature. Receipt: docs/release/reichelag-imported-2026-10-06.md.

Clipboard fidelity correction — 2026-10-07

User review found missing original protocol content. Authenticated observation of the Bubble copy action confirms title + two newlines + italic abstractor + two newlines + unchanged Markdown body + \n\nxxx legacy footer. T10 reopened to preserve that exact plain payload, including fallback, while retaining sanitized rich HTML for email. Private notes are not regression fixtures. T09 remains pending the user's clipboard/mail-client review.

Correction deployed as Helm revision12, immutable source d521ddc / digest sha256:9e7d1c2cc5248a3fd92ab48b4c4edf077c3ee7fb9149e7adb78c29101c60b745. Server dry-run and parsed manifest comparison prove only the app image changed. Live export and template JSON payload match the observed original exactly. All74content-file hashes match the fresh paired pre-upgrade snapshot; existing owner access remains valid. Public health/static delivery200, actual deployed JavaScript equals tested source. make check97passed; rich/plain/denied fallback checks pass. T10 implementation done; T09 remains pending user email-client review. The snapshot helper's expected image pin follows this release.

T12 — Protocol title and filename naming

id: CSOC-WP-0008-T12
status: done
priority: high
state_hub_task_id: "95d06724-0c8e-5e5c-8f50-0954c920e104"

Founder review confirms editing and clipboard copy work. Duplication leaves the old default filename when only the title changes; rename controls are hard to discover. Derive duplicate filenames from the entered title when no explicit slug is chosen. Keep explicit filename override and reject collisions. Add a visible Rename page entry to existing title/filename controls. Preserve notes, subtitle, Visual and source metadata during rename and subsequent editing. Protect index filename and deny viewer/outsider writes. Extend UC-008's mandatory fast/browser regressions and deploy within the approved personal-app upgrade. User milestone: I name the next weekly call once while duplicating, then can correct its title and file name later without losing notes or changing the previous call. Existing manual email distribution remains unchanged.

T12 implementation validation: make check98passed, including mandatory real-browser title-only duplication, visible Rename page route, file/address rename, edit/reopen/clipboard and viewer-denied rename. Fast regression also protects explicit filename override, copy/rename collisions, fixed index, source independence and preserved metadata/assets. Targeted Ruff and diff check pass. Founder confirms edit and content-copy behavior; naming correction acceptance remains pending after deployment.

T12 deployed as Helm revision13: source b13ba9c581, immutable digest sha256:dbeaeda1a03622a91683f8db3c1f498e8bf43417cdb077ec740c56f0489baff6. Guarded parsed server manifest comparison: app image only. Fresh paired DB/content capture56.93seconds; app resumed. Read-only live checks confirm visible Rename page, editable title/file, title-derived copy filename logic, unchanged exact clipboard payload and personal owner access. All75stored file hashes match the pre-upgrade pair. Public health/static200. Implementation done; T09 awaits founder naming/workflow review. Existing duplicated files are not automatically renamed; the user chooses the filename in Rename page.