coulomb-social/docs/release/private-visuals-2026-10-07.md

Authenticated space and page visuals — release review

CSOC-WP-0008-T05. Current Helm revision 15, including Spaces-list previews; user review pending. Original private-image delivery deployed as revision14. Exact live decision: 3f959ed2-4163-4fa5-9f88-f80b2a3d1b89 (founder approved).

User-visible behavior

Imported space and page covers render from the local content volume. Markdown image/link references beginning assets/, ./assets/ or ../assets/ use the same authenticated image route. The stored Markdown and existing rich/plain clipboard payloads remain unchanged; private app images are not automatically embedded in external email messages.

Space owners and viewers can read those images. Login, existing authorization and exact tenant/membership checks run on every image request; outsiders, cross-tenant grants, revoked members and archived spaces cannot read them. Images are not public static files and responses use private, no-store.

The route accepts PNG, JPEG, GIF and WebP with matching file signatures. It rejects SVG/HTML, unsupported formats, path traversal, symlinks and special files. No remote image proxy or image upload is introduced. External cover references remain metadata rather than triggering new remote requests. Existing body URLs and the original clipboard export retain their previous behavior.

Visual duplication copies a regular file only from the source space's assets. It refuses unsafe paths, symlinks and destination asset overwrite. Source notes and covers remain intact. Cross-space body-linked asset copying, incoming-link rewriting, content revisions/concurrency and tenant-keyed directories remain open T04/T05 work. Ambiguous same-slug database rows fail closed for image reads until that storage work is complete; this is not a multi-tenant storage claim.

Immutable artifact and validation

• Source, committed and pushed: 017b917e2158330889c3efd744cf4523105bd546.
• Published image: forgejo.coulomb.social/coulomb/coulomb-social@sha256:0e235abc33a1c5613c0e2c9a0f767c871d0fbed6695973ae17cfdcb2dedaaafa.
• make check: 129 passed, full Ruff and mandatory UC-008 browser coverage. Protected fast tests verify image bytes/access denial. Browser checks load a synthetic one-pixel Visual before and after duplication and for the reader; an outsider's direct image request returns 404. Existing edit/rename/reopen and exact rich/plain/fallback clipboard tests still pass.
• Packaged image smoke: non-root UID10001, read-only root, temporary synthetic content/database and disabled network; authenticated exact image bytes match.
• Owning Helm chart lint passes. Parsed comparison of live release manifests against the proposed render finds exactly the app container image change, across the same three resources. Cluster UID verified: a553c742-0115-43d4-99a4-a5ca56fe0786. Server dry-run accepts the proposal.
• Read-only live inspection: previous digest sha256:dbeaeda1a03622a91683f8db3c1f498e8bf43417cdb077ec740c56f0489baff6, one configured/available replica; 37 local JPEG assets, zero unsupported or mismatched signatures and zero ambiguous space slugs. No private file names, bodies, images or account data emitted into this receipt.

Temporary local review manifests: /tmp/csoc-private-visual-release-x5la6gi7/{previous,proposed}.yaml. No owner repository configuration or live runtime was changed during preparation.

Exact rollout and rollback

WP-0008-T01 requires founder approval of the exact live change, ADMINISTER @ realm:kubernetes/railiance01, activation=APPROVED. This packet is the concrete image-only proposal for that gate.

After approval, recheck the current release, cluster identity, PVC and headroom; take a fresh paired database/content snapshot with paused writers and resume the app. The existing snapshot helper is pinned to the current old image and must refuse unexpected runtime drift. Preserve artifact hashes privately and verify the pair before proceeding.

Fold the new source tag/digest into the owning railiance-apps values file, repeat server dry-run and parsed image-only comparison, then use the existing atomic, waited Helm upgrade under single-writer Recreate. Expect a brief app interruption; no issuer/mailbox restart, schema migration, content edit or grant change is included. Snapshot custody/retention remains T02 work.

Verify health, immutable running image, authenticated space/page covers and viewer/outsider denial through synthetic or read-only checks; compare stored file hashes with the paired point. Do not alter productive protocols for tests. If rollout/read checks fail, restore the prior image and confirm health; retain the paired recovery point without restoring production data automatically.

After successful rollout, the founder reviews imported cover/body-image display and duplicate/reopen behavior on app.coulomb.social. Local browser/image success does not mark T05/T09 transfer accepted or authorize Bubble retirement.

Approved deployment receipt

Founder explicitly approved: “I approve, go on please.” The decision is resolved for the exact image, paired backup and brief single-writer upgrade. Fresh preflight confirms the old image, one available replica, Bound retained PVC, Recreate, pinned cluster identity and Ready node without pressure. CPU requests 3455m/4000m; memory requests 9440Mi (59%).

Paired capture started 2026-10-07T10:43:30Z with writers paused; took 57.74 seconds and resumed the app. Database archive 50087 bytes SHA256 8906abccf35b2ae8de66d7c9b6ee77b8341e90a2d1a1e57623e815e610b9c40d; content archive 2001238 bytes SHA256 ef9f4c85d2257486666adb1e2d01fc601ad9ae809af5e05f40919e5f9dd2231d. Both artifact hashes verified after private transfer. Node/workstation temporary custody remains a T02 retention/scheduling gap, not durable backup acceptance.

This actual production pair restored into isolated Docker PostgreSQL on an internal network with no published ports: 13 tables, 104 rows, sequence state and all 75 content hashes match; measured restore 4.23 seconds. The new image renders all 38 restored pages and serves all 38 cover references with matching bytes. Synthetic viewer image reads pass, viewer writes are denied, and outsider page/image reads are denied. Private restored files retain mode0640 under the workstation UID1000; the isolated check uses that non-root file owner. This does not change production UID10001 or ownership. Rehearsal database/network removed afterward; private artifacts/restore receipt retained for T02 custody.

Owning railiance-apps commit 2e95944 pins tag 017b917e2158 and the approved digest; the tag is published with that same digest. Its reviewed source archive was staged on the node. Fresh live-manifest parsed comparison, pinned cluster identity, kubectl server dry-run and Helm server dry-run passed. All 75 content files still matched the paired point immediately before upgrade.

Node Helm atomic/wait upgrade completed as revision 14, status deployed, one available replica and exact approved digest; measured upgrade 20.66 seconds. The prior image remains available for rollback. No rollback, production data restore, schema, Secret, issuer, mailbox, PVC, grant or content change occurred.

Read-only in-pod checks through the deployed views verify the existing owner's 38 cover references, rendered cover template and unchanged single owner grant. An unsaved in-memory same-tenant outsider gets image404; no production identity, session or grant is created for the probe. Production UID10001 reads each image with private/no-store and matching bytes. All 75 stored file hashes match the paired point. Anonymous public image access redirects to login302; public health/static200 and served clipboard JavaScript equals tested source.

The snapshot helper now pins this live digest: seven focused snapshot/restore safety tests pass and its fresh server dry-run succeeds without pausing writers. Original full release gate:129passed including actual browser Visual loading, duplication/edit/rename/clipboard and reader/outsider denial. T01/T02/T04/T05/T09 remain open for their broader requirements and interactive user acceptance.

Founder review and Spaces-list correction

Founder reports: “The visual shows on the page itself but not in the spaces list entries.” Page Visual visibility is confirmed; the list preview remained a concrete T05/T09 gap. Correct that omitted rendering within the already approved private-Visual image-only upgrade scope and this direct founder review.

The Spaces list now renders each visible space's local cover in its existing entry, using the same private image URL and membership-filtered query. The underlying space metadata, stored content, clipboard and image access policy remain in use. Broader UI framework work is not part of this correction.

Source 881a61d10798, owning pin f5fc9ea, published digest sha256:91673ba7625f905c7a4d0c3d52b45ccc7e7746f387d1e84aab331d68994c5df9. Full make check:129passed, including writer/viewer Spaces-list image loading and outsider exclusion. Parallel cover requests exposed the live-test server's shared in-memory SQLite cursor race; the isolated test database is now a temporary file per run/worker with separate request connections. Fast streaming tests consume Django Client's closing iterator once rather than calling close again. No regression check is skipped, disabled or serialized. The staged commit preceded inspection of one failed run; all fixes and the complete passing gate were in place before this image was built, published or deployed.

Fresh paired capture started2026-10-07T11:56:43Z, took56.03seconds, app resumed. Database archive50087bytes SHA256 72ee616dc1d5375e0c48100c89697aad15c15cef9c3b7c9f4f3208b8ac96c5a0; content archive2001238bytes SHA256 f5edb609db9fe4feb6e81f4e73ee97ab8040502f561b285391ce3a926dadd6ed. Private copied artifacts hash-match. Isolated restore13tables/104rows/sequences/ 75files match, measured4.14seconds. New packaged image renders the actual restored space cover in owner and synthetic viewer list entries; image reads pass and outsider list excludes it. Isolated internal network has no published ports; rehearsal DB/network removed afterward. Temporary backup custody remains T02.

Reviewed owner source archive staged on node; fresh cluster/image/readiness and pressure checks, exact parsed image-only manifest comparison, kubectl/Helm server dry-run and all75pre-upgrade file hashes pass. Helm atomic/wait revision15 completed20.58seconds, app1/1 at the exact new digest. No rollback required.

Read-only deployed core view verifies owner list preview and its route; private preview bytes match the stored space Visual. An unsaved same-tenant outsider's list has no preview/URL. Production UID10001, single explicit owner grant and all75file hashes unchanged; no production probe identities/sessions/grants created. Public health/static200; served clipboard JavaScript unchanged. Snapshot-helper pin follows this release;7focused recovery tests and fresh server dry-run pass. User list-preview confirmation remains T09; no complete workflow acceptance, durable backup closure or Bubble retirement inferred.