tegwick
7b4b75089c
Some checks failed
Use-case regression gate / usecase-regressions (push) Has been cancelled
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a18e2d-f513-7742-b8e7-12af0b744ff3
145 lines
9.1 KiB
Markdown
145 lines
9.1 KiB
Markdown
---
|
|
id: CSOC-WP-0015
|
|
type: workplan
|
|
title: "Communication runtime, inbox operations and flow acceptance"
|
|
domain: communication
|
|
repo: coulomb-social
|
|
status: active
|
|
owner: codex
|
|
topic_slug: coulomb-social
|
|
created: "2026-10-08"
|
|
updated: "2026-10-31"
|
|
origin: residual
|
|
origin_ref: CSOC-WP-0010
|
|
state_hub_workstream_id: "38208f72-c285-56fa-be44-de9b59a4e031"
|
|
---
|
|
|
|
Residual acceptance from CSOC-WP-0010, split at the user's request. Existing implementation/release/acceptance evidence remains in the originating workplan; these tasks own the remaining concrete outputs. Source checks never grant runtime or productive acceptance.
|
|
|
|
## T01 — Admit and activate explicit transactional caller policies
|
|
|
|
```task
|
|
id: CSOC-WP-0015-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "e87ea643-7bee-5427-b4f5-b32f20dc2f29"
|
|
```
|
|
|
|
Receiver source is implemented and image deployment recorded in EMAIL-WP-0008. EMAIL-WP-0008-T03 owns actual caller/binding/template/operation/quotas, separate token custody/delivery and original-caller transition. Product acceptance verifies the admitted integration; avoid duplicating receiver implementation or granting arbitrary app notifications.
|
|
|
|
2026-10-27: EMAIL-WP-0008 completed scoped caller custody and coordinated activation
|
|
on October 9. Current receiver policy/projection and user-engine tenant/client
|
|
bindings are present, both deployments Ready. Owner no-send denial/replay receipts
|
|
and the expanded 103-test isolated gate verify the admitted integration. Productive
|
|
flow verdicts remain T04. See docs/release/acceptance-audit-2026-10-27.md.
|
|
|
|
## T02 — Establish platform sender and monitored reply/bounce ownership
|
|
|
|
```task
|
|
id: CSOC-WP-0015-T02
|
|
status: todo
|
|
priority: high
|
|
state_hub_task_id: "0604cb15-72c7-5d15-bb42-0335d4ec80df"
|
|
```
|
|
|
|
Review replacing the receiver forgejo sender with platform identity through its credential owner, then name reply/inbox/support owner and prove authorized inbound access, DNS MX/SPF/DKIM/DMARC, correlated bounce/suppression and retention. No unsolicited scans or auto responses. Existing native personal reset is accepted and stays separately evidenced.
|
|
|
|
## T03 — Complete independent ledger recovery and copy custody
|
|
|
|
```task
|
|
id: CSOC-WP-0015-T03
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "286e60bf-76a1-5a18-bd2c-edd9d1400c41"
|
|
```
|
|
|
|
EMAIL-WP-0007-T03/T04 and RPF-WP-0053-T05/T06 own primary archive admission/atomic credential pair, first encrypted capture/retrieval/rehearsal and monitoring. Require image/schema-bound six-table recovery, restored accepted/unknown/consumed/cancelled/suppressed/quota continuity and post-capture reconciliation; govern temporary pre-release copies.
|
|
|
|
2026-10-27: EMAIL-WP-0007 completed independent provider escrow, separately bound
|
|
recovery reader, nonexpiring image/tools/receipt kit, six-table offline recovery,
|
|
mirrored rolling archives and monitored schedules on October 10. Fresh checks show
|
|
both timers active and today's backup/freshness successful, with verified mirror.
|
|
The app gate now binds real encryption/recovery and scoped quota continuity tests;
|
|
103 owner cases pass with zero skips. Historical private copies remain retained
|
|
pending explicit owner disposition, with no inferred expiry/deletion. Production
|
|
restore still requires fencing and post-capture reconciliation. See the audit.
|
|
|
|
## T04 — Establish owner-spanning browser journeys and productive flow verdicts
|
|
|
|
```task
|
|
id: CSOC-WP-0015-T04
|
|
status: progress
|
|
priority: high
|
|
state_hub_task_id: "7c718d86-8f0d-5cb2-a765-b0c07116005c"
|
|
```
|
|
|
|
Use isolated issuer/directory/local mail sink/app for UC-009/010/011. Bind exact mandatory browser nodes without production URLs/accounts or SMTP provider sends; test expired/replayed handles and tenant/client/caller denials. Future UC-012 needs a user-selected product template/caller. Preserve UC-008 manual mail distribution and UC-009 existing personal reset acceptance.
|
|
|
|
2026-10-11: the checkout has a loopback issuer, directory and mailbox double. The browser node is bound on UC-009/010/011 and still `established: false`. It covers reset-to-local-mailbox, sign-in, callback replay, expired and reused handles, tenant and client refusal, registration verify/cancel, and caller/suppression invitation counts. No SMTP, production account, or live issuer is contacted. Real user-engine/email-connect admission, DNS and productive per-flow verdicts remain open. UC-012 stays deferred. Gate for this slice: `make check` 200 passed.
|
|
|
|
2026-10-30: added an explicit real-owner-source browser gate for UC-010/011.
|
|
Private snapshots run the actual user-engine portal, registration/outbox HTTP
|
|
adapters and email-connect scoped receiver/SQLite ledger, with synthetic session,
|
|
authorization, directory, activity sink and mail provider. Actual forms cover
|
|
verify/cancel/expiry/replay, fresh-handle cross-caller denial, tenant/client/token
|
|
denials, cross-tenant admin refusal, invitation/resend, duplicate delivery and
|
|
suppression. Python only permits fixture ports; browser routes/API redirects are
|
|
bounded to fixture origins. No production configuration, account, SMTP provider,
|
|
mailbox scan or original note body is used. Exact node is linked in the candidate
|
|
registry and the invocation is in docs/usecases/platform-communication.md.
|
|
Proof: docs/release/owner-communication-browser-2026-10-30.json. This completes
|
|
the owner-source UC-010/011 browser integration slice, not native issuer/directory/
|
|
app-login coverage or productive per-flow verdicts. T04 remains progress; T02
|
|
sender/inbound/bounce ownership and UC-012 nomination remain separate gates.
|
|
|
|
2026-10-30 UC-009 callback follow-through: signed-token reproduction found that
|
|
optional UserInfo could replace verified identity/tenant/assurance claims and a
|
|
token-response userinfo object could bypass the ID-token requirement. Corrected
|
|
the app assembler to require the verified token, exact UserInfo subject equality
|
|
and profile-only enrichment.13 real RSA/JWKS callback cases cover refusal,
|
|
authority preservation, step-up denial and optional-UserInfo fallback;20 focused
|
|
identity cases pass. Candidate registry links added without promoting UC-009.
|
|
Review: docs/release/oidc-userinfo-binding-review-2026-10-30.md. This source is
|
|
not in the sealed17d0eb6storage image; a subsequent reviewed release is required.
|
|
Full native reset/directory/inbox/app browser coverage and productive verdicts
|
|
remain open. No production login, issuer change, mail or deployment performed.
|
|
Full `make check`:396 passed, zero skips; all newly linked UC-009 fast node IDs
|
|
are present in its JUnit report. Bounded proof and source hashes are retained in
|
|
docs/release/oidc-userinfo-binding-review-2026-10-30.json.
|
|
|
|
2026-10-30 native recovery prerequisite: added an isolated pinned Authelia4.39.28/
|
|
LLDAP0.6.2 rehearsal with no ports, host mounts or external routes. The strict
|
|
read-only bind from NetKingdom's source permits first factor and reset-link
|
|
verification but refuses password update (HTTP200/KO); the synthetic password-
|
|
manager bind succeeds and actual old/new directory authentication switches.
|
|
Both refuse consumed-link replay, unverified reset, interactive service sign-in
|
|
and directory group creation. All containers removed; generated fixture values
|
|
remain private. Review/evidence: docs/release/native-password-reset-review-2026-10-30.md
|
|
and native-password-reset-2026-10-30.{json,sources.txt}. Retain the supported narrow
|
|
reset-authority review on the existing NK-WP-0054-T05 owner boundary; no live
|
|
grant, installed-role conclusion or provider task duplication. Full browser/
|
|
expiry/mail-sink/KeyCape/app coverage and productive release remain open here.
|
|
Final source-bound native proof includes verified cleanup and three CLI refusal
|
|
cases. Full `make check` rerun:396 passed, zero skips, mandatory browsers included.
|
|
|
|
2026-10-31 native browser follow-through: the exact explicit node
|
|
scripts/native_recovery/test_journey.py::test_native_reset_directory_smtp_issuer_and_app
|
|
passes with zero skips. Real Authelia UI/LLDAP/SMTP-to-local-sink exercise read-only
|
|
refusal, successful password replacement, expired and replayed native links.
|
|
Real KeyCape PKCE/JWT plus the current app source and actual user-engine HTTP
|
|
claims service establish the app session; old-password and callback replay,
|
|
unknown-client, wrong-redirect and explicit directory/client tenant-conflict
|
|
controls refuse. One owner user/Member and unusable local password are verified.
|
|
Kernel network-none/loopback, scoped browser requests and all-container cleanup
|
|
are verified. Owner storage/PDP are fixtures; no productive grant, MFA or TLS
|
|
trust-store acceptance. Review/proof: docs/release/native-recovery-browser-review-2026-10-31.md
|
|
and native-recovery-browser-2026-10-31.{json,sources.txt}. Candidate registry binds
|
|
the node without promotion. Existing NK-WP-0054-T05 reset-authority return,
|
|
productive UC-010/011 verdicts and deployment/runtime acceptance remain open.
|
|
Full `make check`:396 passed, zero skips. Four separate synthetic JUnit-envelope
|
|
checks refuse wrong/skipped/failed/extra nodes without publishing a proof; the
|
|
real native gate itself passes its exact one node with zero skips.
|
|
|
|
## Completion
|
|
|
|
Finish when every task above has its stated evidence and acceptance, or hand off any newly discovered residual to a live work record first. Cross-owner dependencies remain their existing canonical records.
|