coulomb-social/workplans/CSOC-WP-0015-communication-runtime-acceptance.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	origin	origin_ref	state_hub_workstream_id
CSOC-WP-0015	workplan	Communication runtime, inbox operations and flow acceptance	communication	coulomb-social	active	codex	coulomb-social	2026-10-08	2026-10-31	residual	CSOC-WP-0010	38208f72-c285-56fa-be44-de9b59a4e031

Residual acceptance from CSOC-WP-0010, split at the user's request. Existing implementation/release/acceptance evidence remains in the originating workplan; these tasks own the remaining concrete outputs. Source checks never grant runtime or productive acceptance.

T01 — Admit and activate explicit transactional caller policies

id: CSOC-WP-0015-T01
status: done
priority: high
state_hub_task_id: "e87ea643-7bee-5427-b4f5-b32f20dc2f29"

Receiver source is implemented and image deployment recorded in EMAIL-WP-0008. EMAIL-WP-0008-T03 owns actual caller/binding/template/operation/quotas, separate token custody/delivery and original-caller transition. Product acceptance verifies the admitted integration; avoid duplicating receiver implementation or granting arbitrary app notifications.

2026-10-27: EMAIL-WP-0008 completed scoped caller custody and coordinated activation on October 9. Current receiver policy/projection and user-engine tenant/client bindings are present, both deployments Ready. Owner no-send denial/replay receipts and the expanded 103-test isolated gate verify the admitted integration. Productive flow verdicts remain T04. See docs/release/acceptance-audit-2026-10-27.md.

T02 — Establish platform sender and monitored reply/bounce ownership

id: CSOC-WP-0015-T02
status: todo
priority: high
state_hub_task_id: "0604cb15-72c7-5d15-bb42-0335d4ec80df"

Review replacing the receiver forgejo sender with platform identity through its credential owner, then name reply/inbox/support owner and prove authorized inbound access, DNS MX/SPF/DKIM/DMARC, correlated bounce/suppression and retention. No unsolicited scans or auto responses. Existing native personal reset is accepted and stays separately evidenced.

T03 — Complete independent ledger recovery and copy custody

id: CSOC-WP-0015-T03
status: done
priority: high
state_hub_task_id: "286e60bf-76a1-5a18-bd2c-edd9d1400c41"

EMAIL-WP-0007-T03/T04 and RPF-WP-0053-T05/T06 own primary archive admission/atomic credential pair, first encrypted capture/retrieval/rehearsal and monitoring. Require image/schema-bound six-table recovery, restored accepted/unknown/consumed/cancelled/suppressed/quota continuity and post-capture reconciliation; govern temporary pre-release copies.

2026-10-27: EMAIL-WP-0007 completed independent provider escrow, separately bound recovery reader, nonexpiring image/tools/receipt kit, six-table offline recovery, mirrored rolling archives and monitored schedules on October 10. Fresh checks show both timers active and today's backup/freshness successful, with verified mirror. The app gate now binds real encryption/recovery and scoped quota continuity tests; 103 owner cases pass with zero skips. Historical private copies remain retained pending explicit owner disposition, with no inferred expiry/deletion. Production restore still requires fencing and post-capture reconciliation. See the audit.

T04 — Establish owner-spanning browser journeys and productive flow verdicts

id: CSOC-WP-0015-T04
status: progress
priority: high
state_hub_task_id: "7c718d86-8f0d-5cb2-a765-b0c07116005c"

Use isolated issuer/directory/local mail sink/app for UC-009/010/011. Bind exact mandatory browser nodes without production URLs/accounts or SMTP provider sends; test expired/replayed handles and tenant/client/caller denials. Future UC-012 needs a user-selected product template/caller. Preserve UC-008 manual mail distribution and UC-009 existing personal reset acceptance.

2026-10-11: the checkout has a loopback issuer, directory and mailbox double. The browser node is bound on UC-009/010/011 and still established: false. It covers reset-to-local-mailbox, sign-in, callback replay, expired and reused handles, tenant and client refusal, registration verify/cancel, and caller/suppression invitation counts. No SMTP, production account, or live issuer is contacted. Real user-engine/email-connect admission, DNS and productive per-flow verdicts remain open. UC-012 stays deferred. Gate for this slice: make check 200 passed.

2026-10-30: added an explicit real-owner-source browser gate for UC-010/011. Private snapshots run the actual user-engine portal, registration/outbox HTTP adapters and email-connect scoped receiver/SQLite ledger, with synthetic session, authorization, directory, activity sink and mail provider. Actual forms cover verify/cancel/expiry/replay, fresh-handle cross-caller denial, tenant/client/token denials, cross-tenant admin refusal, invitation/resend, duplicate delivery and suppression. Python only permits fixture ports; browser routes/API redirects are bounded to fixture origins. No production configuration, account, SMTP provider, mailbox scan or original note body is used. Exact node is linked in the candidate registry and the invocation is in docs/usecases/platform-communication.md. Proof: docs/release/owner-communication-browser-2026-10-30.json. This completes the owner-source UC-010/011 browser integration slice, not native issuer/directory/ app-login coverage or productive per-flow verdicts. T04 remains progress; T02 sender/inbound/bounce ownership and UC-012 nomination remain separate gates.

2026-10-30 UC-009 callback follow-through: signed-token reproduction found that optional UserInfo could replace verified identity/tenant/assurance claims and a token-response userinfo object could bypass the ID-token requirement. Corrected the app assembler to require the verified token, exact UserInfo subject equality and profile-only enrichment.13 real RSA/JWKS callback cases cover refusal, authority preservation, step-up denial and optional-UserInfo fallback;20 focused identity cases pass. Candidate registry links added without promoting UC-009. Review: docs/release/oidc-userinfo-binding-review-2026-10-30.md. This source is not in the sealed17d0eb6storage image; a subsequent reviewed release is required. Full native reset/directory/inbox/app browser coverage and productive verdicts remain open. No production login, issuer change, mail or deployment performed. Full make check:396 passed, zero skips; all newly linked UC-009 fast node IDs are present in its JUnit report. Bounded proof and source hashes are retained in docs/release/oidc-userinfo-binding-review-2026-10-30.json.

2026-10-30 native recovery prerequisite: added an isolated pinned Authelia4.39.28/ LLDAP0.6.2 rehearsal with no ports, host mounts or external routes. The strict read-only bind from NetKingdom's source permits first factor and reset-link verification but refuses password update (HTTP200/KO); the synthetic password- manager bind succeeds and actual old/new directory authentication switches. Both refuse consumed-link replay, unverified reset, interactive service sign-in and directory group creation. All containers removed; generated fixture values remain private. Review/evidence: docs/release/native-password-reset-review-2026-10-30.md and native-password-reset-2026-10-30.{json,sources.txt}. Retain the supported narrow reset-authority review on the existing NK-WP-0054-T05 owner boundary; no live grant, installed-role conclusion or provider task duplication. Full browser/ expiry/mail-sink/KeyCape/app coverage and productive release remain open here. Final source-bound native proof includes verified cleanup and three CLI refusal cases. Full make check rerun:396 passed, zero skips, mandatory browsers included.

2026-10-31 native browser follow-through: the exact explicit node scripts/native_recovery/test_journey.py::test_native_reset_directory_smtp_issuer_and_app passes with zero skips. Real Authelia UI/LLDAP/SMTP-to-local-sink exercise read-only refusal, successful password replacement, expired and replayed native links. Real KeyCape PKCE/JWT plus the current app source and actual user-engine HTTP claims service establish the app session; old-password and callback replay, unknown-client, wrong-redirect and explicit directory/client tenant-conflict controls refuse. One owner user/Member and unusable local password are verified. Kernel network-none/loopback, scoped browser requests and all-container cleanup are verified. Owner storage/PDP are fixtures; no productive grant, MFA or TLS trust-store acceptance. Review/proof: docs/release/native-recovery-browser-review-2026-10-31.md and native-recovery-browser-2026-10-31.{json,sources.txt}. Candidate registry binds the node without promotion. Existing NK-WP-0054-T05 reset-authority return, productive UC-010/011 verdicts and deployment/runtime acceptance remain open. Full make check:396 passed, zero skips. Four separate synthetic JUnit-envelope checks refuse wrong/skipped/failed/extra nodes without publishing a proof; the real native gate itself passes its exact one node with zero skips.

Completion

Finish when every task above has its stated evidence and acceptance, or hand off any newly discovered residual to a live work record first. Cross-owner dependencies remain their existing canonical records.