coulomb-social/docs/release/service-contract-conformance-2026-10-27.md

Business-app service contract evidence — 2026-10-27

Assessment against the accepted the-custodian/canon/standards/business-app-service-contract_v0.1.md §§1–6; updated with verified returns through October 31. Conformance is not yet established. Each row separates implemented evidence from the returns required to finish WP-0012/0014.

Section	Current evidence	Remaining proof
1: shape/tenancy	Standalone repo, coulomb_social_db, dedicated deployment/values in railiance-apps. Space/Member tenant keys and explicit membership joins; tests deny foreign tenant/member access. Revision 18 applied migration 0003; revision 19 preserved both slug constraints, content and migration history.	Reconcile all source grants and complete client attribution/export scope; global uniqueness alone does not certify a multi-client migration.
2: identity	OIDC/PKCE behind apps/identity; app-local users have unusable passwords. Accepted ADR-0001 specializes the local-account baseline. Historical Case B and personal recovery are recorded in docs/identity/smoke.md and the October 6 receipts.	Current registration Case B and source-cohort identity/grant return. The authentication choice is now bound to existing founder decision8bbce691 under §8.3 (T14); broader ADR implementation and current productive identity returns retain their own gates.
3: build/release	Founder image release verified at Helm revision 19, immutable digest 522bcd7f…, source 23ffe2c; all 80 packaged files match. Owner values, public health/static, 40 owner renders and 40 outsider denials are verified in identity-export-release-return-2026-10-31.md. Forgejo successor and identity-decision provenance are resolved under T14.	Content lifecycle candidate d3f2f5bb… and proposal c9c32316… still await their exact release after backup-source installation. Existing byte equality does not prove reproducible dependencies or later release acceptance.
4: operations	Revision 19 is Ready. Its 07:13 paired point was independently mirrored, retrieved and restored with 13 tables/114 rows/86 files. Existing Prometheus has Kubernetes readiness history; the October 31 read finds no Coulomb scrape target or probe/request metrics in the inspected families. Native retention is 10 days. Custody, route, installation and content-release receipts are still absent at 14:38Z.	Authenticated ops registration; admitted recurring paired backup, retention/headroom and received failed/stale signals; application-level availability/latency measurements over the required windows; post-release CRUD/copy/transfer smoke and CSOC-IN-0004 reconciliation. Kubernetes readiness and a point health check do not prove HTTPS availability or user latency. Provider-only recovery excludes operator-account recovery and a fresh Docker daemon.
5: cost	Resource inventory ID resource:tenant:coulomb:coulomb-social (not a valid fin-hub client attribution key), dated workload/demand/labor records in docs/resource-evidence; WP-0017 records current requests 15m/176Mi.	Obtain the authoritative client × app × instance mapping and demonstrate its canonical fin-hub key in current finance ingestion and per-instance infrastructure cost report. Planning labor rates and CPU requests are not booked costs.
6: protection	Platform instance isolation, explicit read/write denial, sanitized Markdown, private images, account-local JSON export and successor-aware local exit. Revision 19's packaged tenant export verifies 85 selected files and four record sets on the restored current release point without source mutation. No credentials copied into these records.	Resolve external/unattributed data, private delivery and client acceptance; agree instance teardown/session/log disposition plus primary/mirror/protected-kit backup expiry (§6.2). The coherent export proof does not establish productive offboarding. Productive sharing/portability verdicts remain WP-0013.

The August service-objectives record is historical. Its RPO ≤60min/RTO ≤4h and Forgejo content durability assumptions predate the persistent CONTENT_ROOT design. RPF-WP-0053 records the founder-approved paired schedule at 03:15 UTC, RPO target 24h, stale threshold 26h and attended RTO target 60min. This supersedes the old planning assumption, but no such Coulomb schedule is active yet. Availability 99.5%, health p99 500ms and page latency objectives remain planning targets, with no current measurement window proving attainment. Preserve dated observations; do not rewrite August measurements as current facts.

The October31 14:39–14:41 read of the existing private Prometheus service returns one current available replica and 20,160 readiness samples in the queried seven-day window, with observed available replicas ranging from zero to one. Sample counts do not prove uninterrupted coverage, and these values are not HTTP success or latency measurements. No exclusion of planned maintenance or dependency outages was applied. The inspected probe_, django_, traefik_, http_request and http_server metric families are absent, and up{namespace="coulomb-social"} has no series. Runtime retention is10days/10GiB, not the seven-day package default; no configuration was changed to reconcile that difference. No retained monthly application measurement or current percentile proof is established. T11 needs admitted application-level measurement and retained window evidence, alongside registration, finance and smoke. Native queries and limits: existing-telemetry-2026-10-31.json.

WP-0012 owns the operating/service returns above. WP-0013 owns privacy/content verdicts; WP-0014 owns all-space reconciliation and the separate cohort/apex cutover decision. Existing canonical cross-owner records remain in their owners; this assessment creates no credential grant or service acceptance.

October 30 source/attribution follow-through: actual retained image bytes match all69packaged files at dd83c90, while the release-unit's796a1557source differs in eight paths. Corrected that source pin without changing the image or live service. The actual finance parser rejects the legacy resource ID as a client attribution key. Resource/default tenant, retained cohort SQL tenant and financial entity are distinct identifiers; their client × app × instance mapping is still unproven. The local compatibility catalog has no matching service record; this does not prove absence on the ops-hub owner surface. Detailed bounded proof and next returns: service-provenance-reconciliation-2026-10-30.{md,json}.

October 31 operations-owner follow-through: the runtime is intentionally private pending HUB-WP-0012 access acceptance, not merely blocked on a broken public certificate. Native metadata shows no core-hub Ingress and three Ready deployments; anonymous candidate health/OpenAPI reads pass and protected hubs returns 401. The authenticated service record and finance mapping remain unverified. See service-owner-boundary-2026-10-31.json and the provenance reconciliation for existing owner gates; do not restore public exposure to satisfy this assessment.

October 31 07:15 image-release follow-through: verified revision19/image522bcd7f (source23ffe2c; all80packaged files match) supersedes revision18 as current state. The corrected-date07:13 point is independently mirrored/retrieved/restored with 13tables/114rows/86files, and actual packaged client export verifies85selected files and four record sets without source changes. This closes the release and coherent-export proof portions of §§3/6, not private delivery/offboarding, recurring service evidence, operator ownership, productive verdicts or successor provenance. Evidence: identity-export-release-return-2026-10-31.md.

October31 provenance reconciliation closes the two previously missing decision/ successor links under T14. See service-provenance-binding-2026-10-31.json and the latest section of service-provenance-reconciliation-2026-10-30.md. All remaining service registration, finance, operating and productive gates above remain open.