coulomb-social/SCOPE.md

SCOPE — implemented capability and boundaries

Reviewed 2026-10-06 against application source, tests and dated repository records. This describes what the checkout can do; historical live evidence is identified separately. It is not a current production acceptance certificate.

What this repository is

A standalone Django co-creation application rebuilding coulomb.social on Railiance / NetKingdom / HelixForge. Today it implements an authenticated spaces and markdown-pages product plus local content migration tools. It is not yet the complete social network or marketplace described by INTENT.md.

The accepted stage-1 cut prioritizes onboarding and productive spaces/pages transfer; marketplace, favorites, payments and real-time collaboration are later capabilities.

Implemented in this checkout

Capability	Actual behavior and evidence
Identity	OIDC/PKCE login, logout, JIT local Member linked to user-engine; issuer+subject identity, session diagnostics and assurance handling. Development claims login is restricted to DEBUG with OIDC disabled. apps/identity/, identity tests.
Registration entry	Configured NetKingdom registration redirect; this app does not issue passwords or send verification mail. CSOC-IN-0001 is closed with 2026-08-14 Case B evidence.
Spaces	Tenant-filtered list/detail, member-facing create/update/archive, Title, Abstractor (description) and Visual metadata. apps/spaces/services.py, tests/test_space_crud.py.
Pages	Markdown/frontmatter list, render, create/update/delete, independent copy and transfer with source/destination access checks. Index cannot be deleted or transferred. Separate clipboard copy exports rendered HTML/plain text for manual email distribution. pageops.py, PageOps tests.
Content sources	Local CONTENT_ROOT/spaces/<slug>/pages and assets; optional Forgejo read/edit fallback, cache refresh and push webhook. Markdown is sanitized on render. Local writes do not automatically commit/push to Forgejo.
Import	import_content_tree for one ADR-0004 tree; import_content_corpus for a preflighted JSON batch with explicit existing tenant+issuer+subject membership mappings. Dry-run, replacement opt-in, per-space staging/rollback and aggregate counts. Synthetic multi-space regression coverage; one historical private-space rehearsal.
Delivery preparation	Docker/Gunicorn packaging, SQLite development / PostgreSQL URL support, migrations, health endpoint and deployment/runbook docs. Actual Helm values and cluster hosting belong to railiance-apps.
Evidence and coordination	Bubble surface/capability inventory, authenticated export scripts, design extraction, schema sketch, accepted cut decision, resource-demand/SLO/labor evidence and file-backed State Hub work records.

Source paths above are under coulomb_social/. Member and Space metadata are tenant-keyed, but filesystem paths are slug-keyed. Deployment is instance-per-client: do not reuse a content root across tenants. Normal creation and imports reject existing cross-tenant slug collisions; this is not a full filesystem tenant namespace or a database-wide concurrency guarantee.

Practical limits

• Space reads now require explicit membership or a creator grant. Viewer memberships are read-only across product mutation routes and service writes; owner/member grants permit writes. Sharing-management UI and exact Bubble privacy parity remain incomplete. Imported mappings add/update grants; replacement does not revoke old grants. Review access before a real cohort import.
• Copy/transfer handles relative Visual files, not arbitrary body-linked assets, incoming page links, graph identity or Bubble parent/chunk semantics. Visual metadata and copied files do not establish an authenticated asset-serving or upload pipeline.
• Import requires local prepared trees and existing active identities. It does not create platform accounts, import passwords, scrape missing Bubble content, or certify corpus completeness. It runs with writers paused; the batch is restartable per space, not globally atomic or crash-transactional.
• No app-local member export/delete product, paired DB/content restore drill, automatic content git versioning, outline/include/projection authoring or marketplace/social/payment product is implemented here.
• Historical health/auth evidence does not prove current image, persistence, runtime SLOs, backup success or complete service-contract compliance.

Recorded deployment state

The host strategy is rebuild on app.coulomb.social with Bubble on apex until an explicit cutover. Historical identity/app-shell evidence is in identity smoke. Public registration was evidenced on 2026-08-14. CSOC-IN-0004 remains open for PageOps deployment, migration, persistent CONTENT_ROOT and live smoke. Read-only checks on 2026-10-06 confirm an old 7fcd0cf Helm workload (revision 9), 1/1 healthy, without content persistence. Personal sign-in is broken: the user reports unknown client_id, and guarded inspection confirms the public coulomb-social OIDC client is absent. The latest 88-test app image and persistent chart upgrade are prepared, not deployed; release assessment documents the exact pending repair/upgrade and user acceptance. All six original numbered workplans are finished; their residual intakes remain the source of unfinished work.

Ownership boundaries

This repo owns product behavior, local identity integration, application models, content/migration tooling, packaging and acceptance evidence. It does not own Railiance infrastructure/charts, NetKingdom issuer/mail/secrets services, HelixForge standards, or fleet improvement loops. Core Hub embedding and Bubble as the long-term development surface remain out of scope.

Next work and orientation

Read INTENT.md, the timestamped assessment, CSOC-WP-0007, and CSOC-WP-0008. The local transfer tool closes a preparation gap; persistence/restore, private cohort migration, access acceptance and founder cutover are live successor work.

Development: README.md, docs/dev.md, make test, make lint. Content architecture: ADR-0003/0004 and docs/architecture/. Migration: docs/migration/, including corpus-import.md. Delivery: docs/deploy.md; residual records: docs/intakes/csoc-residuals.md.

First user-confirmed review case: ReichelAg weekly founder-call protocols (UC-008), full duplication and manual editing plus clipboard copy for external email. See docs/usecases/reichelag-weekly-call.md; live transfer is pending.

Established use-case regression protection is in docs/usecases/registry.json and tests/usecases/, starting with ReichelAg. make check runs fast/application and actual-browser journeys with mandatory test coverage validation and JUnit reports. Forgejo workflow is configured; remote runner/required-merge-check acceptance remains CSOC-IN-0005. User transfer acceptance stays separate.