coulomb-social/workplans/CSOC-WP-0008-production-transfer-acceptance.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	origin	origin_ref	depends_on	state_hub_workstream_id
CSOC-WP-0008	workplan	First user-reviewed use-case transfer off Bubble	communication	coulomb-social	active	codex	coulomb-social	2026-10-06	2026-10-06	residual	CSOC-WP-0007	CSOC-WP-0007	0ee96868-875c-536e-a661-07198c07a8ce

CSOC-WP-0008 — First user-reviewed use-case transfer

Success is a recoverable, accepted community transfer under the existing stage-1 cut. Local migration tooling is implemented by WP-0007; that is not live parity or a production readiness claim. Existing CSOC-IN-0003 and CSOC-IN-0004 remain open until the corresponding acceptance below is evidenced. This record does not assign or authorize changes in platform-owner repositories.

User milestone — Ready to review the first use-case transfer

At completion, you can sign into the new app, open a nominated migrated space, recognize its pages and visuals, continue writing and organizing that work, copy or move a page, and share it with a reader who cannot alter it. Your changes survive an application restart, and the team can recover the content and access from a tested backup. You can inspect/export your app-local information and review how leaving the app handles owned content before any deletion.

A side-by-side walkthrough describes the original Bubble steps, equivalent new steps, expected results and remaining differences. You review this as a user and accept or reject each use case for productive transfer. Completion means the first nominated cohort is ready for this review; it does not pre-approve all use cases or retire Bubble. Apex retirement remains an explicit later decision.

The main goal is now a continuing off-ramp: find and describe actual Bubble use cases, rebuild them within our ecosystem, compare behavior and transfer approved use cases incrementally. The historical feature inventory supplies candidate journeys, not proof that each is used or works in the current Bubble product. Marketplace/social features stay candidates for subsequent cohorts until actual use and user priority justify their implementation.

Execution and review order

1. Capture candidate journeys from existing evidence; confirm real examples with the user during review. Keep evidence confidence and unanswered questions.
2. Build and test the missing sharing/access, content, portability and recovery behavior required for the nominated cohort (T04/T05/T02/T07).
3. Prepare a concrete release and representative content rehearsal; obtain the exact live change authorization required by the estate before deploying (T01).
4. Reconcile the first nominated corpus/cohort and demonstrate end-to-end user journeys and recovery (T03/T08/T09).
5. User accepts individual journeys or records gaps as follow-up work. Transfer those accepted use cases; keep Bubble available for remaining cases (T06).

The earlier 71-space/109-article capture remains an inventory to reconcile, not an instruction to bulk-move every space before the first user review.

T01 — Prepare persistence and deployment acceptance

id: CSOC-WP-0008-T01
status: progress
priority: high
state_hub_task_id: "6adce69f-9011-5ada-a920-b2228aa15218"

Dependencies: railiance-apps owner and founder approval of the exact live change, exercising ADMINISTER @ realm:kubernetes/railiance01, activation=APPROVED. Prepare pinned image, migration 0002, persistent CONTENT_ROOT, single writer / paused-write maintenance procedure, volume capacity and node headroom review. Dry-run/diff deployment in its owning repo. On app host verify space creation, page CRUD, Visual delivery (or explicitly accepted metadata-only limitation), copy/move, restart durability and source+destination denied-access cases. Record immutable release and receipts; only then close CSOC-IN-0004.

T02 — Prove paired metadata/content recovery

id: CSOC-WP-0008-T02
status: todo
priority: high
state_hub_task_id: "04795cd7-1248-57df-9822-da8fa1471559"

Implement a reviewed backup/restore automation entrypoint after runtime storage and DB owner lanes are known. Baseline protocol is in docs/migration/corpus-import.md. Pause writers, capture DB and CONTENT_ROOT at one recovery point, record hashes, image/migration version and tenant without secrets. Restore into an isolated instance with no outgoing integration writes; compare Space/Member/membership counts, markdown/asset hashes, rendering and denied cross-member reads. Record RPO/RTO, retention, custody and a rollback drill. No acceptance from DB-only snapshots; no private archive in git or State Hub.

T03 — Rehearse and reconcile the actual transfer cohort

id: CSOC-WP-0008-T03
status: wait
priority: high
state_hub_task_id: "0615eff2-bf2b-503b-8f15-0591d4666446"

Dependencies: founder-nominated first-use-case corpus/cohort, reviewed identity membership map, T01/T02 acceptance, local access to private prepared trees. Use the new corpus manifest and dry-run; resolve every unmapped/inactive identity by NetKingdom onboarding rather than password/email matching. Rehearse separately, reconcile all 71 known spaces and 109 captured articles against actual expected inventory, report omitted/thin trees, missing assets and parent/privacy lossiness. Execute the first nominated representative cohort; disposition other spaces explicitly as subsequent transfers rather than silently excluding them. Approve role assignments and additional pre-existing grants before real import; content replacement is additive for membership and does not revoke old grants. Close CSOC-IN-0003 only after real cohort receipts and exception disposition.

T04 — Close access and member-portability gaps

id: CSOC-WP-0008-T04
status: progress
priority: high
state_hub_task_id: "eb4da28e-ea04-52fa-92d6-f78296348b83"

Remove or explicitly isolate tenant-wide bootstrap visibility for private cohorts. Enforce viewer versus write roles, validate cross-tenant memberships in all mutation paths, and decide tenant-keyed content directories versus a strict single-tenant instance invariant (including admin/import concurrency). Implement app-local member export/delete with ownership/content retention and platform identity boundaries explicitly defined. Test private-space denial, viewer mutation denial, deletion with owned content and export tenant isolation. Do not equate migration grants with full Bubble privacy fidelity.

T05 — Content durability and link fidelity

id: CSOC-WP-0008-T05
status: todo
priority: medium
state_hub_task_id: "3fdb685c-9670-516a-a65b-6f9a2eac0ee0"

Define content git commit/push or an accepted durable revision mechanism; concurrent-write conflict policy; body-linked asset copying and link rewriting; authenticated Visual delivery. Test transfers with embedded images and incoming links, failed destination writes and concurrent edits. Keep outline/include/lazy projection work separate unless stage-1 acceptance explicitly requires it.

T06 — Close service contract and founder cutover gate

id: CSOC-WP-0008-T06
status: wait
priority: high
state_hub_task_id: "f842f9cc-6863-50d0-aac7-a7dcc2ca36e7"

Pending State Hub decision: 186be722-e2c7-4109-a1e6-d120fe8fca5b. Depends on T01–T04 and founder acceptance. Link current ops-hub registration, backup/restore receipts, cost attribution, SLO observations and immutable image provenance to the business-app service contract §§1–6. Recheck historical public registration Case B. CSOC-IN-0002 is already closed by WP-0007 synthetic identity replay/email separation tests; retain those checks in release validation. Present cohort lossiness and access acceptance for a human decision; retain parallel hosts until that explicit cutover. Production and apex retirement are not authorized by a local test suite.

T07 — Restore a clean repository-wide lint gate

id: CSOC-WP-0008-T07
status: todo
priority: medium
state_hub_task_id: "e2dadb93-f069-54b3-b7e2-c4e921f27d5e"

Resolve the pre-existing Ruff findings recorded by the WP-0007 assessment, without changing generated schema semantics or weakening checks. Full lint and tests must pass; prioritize meaningful unused-fixture/test cleanup over silencing rules. This task is quality debt rather than a claim of broken runtime behavior.

T08 — Describe Bubble use cases and rebuild acceptance

id: CSOC-WP-0008-T08
status: progress
priority: high
state_hub_task_id: "fca49f28-a959-51e2-ad24-5fd73b1e5316"

Create docs/usecases/catalog.md with stable journey IDs, actors, user goals, original/rebuild steps, expected results, evidence confidence, gaps, owner tasks and transfer status. Start from captured Bubble inventory; mark inferred steps and uncertain semantics. User confirmation is required before calling a journey observed/accepted. Prioritize working in spaces/pages and sharing access; retain research/chunks, discovery, social and marketplace candidates for later cohorts.

T09 — User review walkthrough and per-use-case off-ramp receipts

id: CSOC-WP-0008-T09
status: progress
priority: high
state_hub_task_id: "648acce6-21cd-540f-b3b0-c2fcb8eacc60"

Write docs/usecases/first-transfer-review.md with a realistic example space and writer, reader and outsider checks; original/new steps; expected visible results; restart and restore checks; pass/gap/accepted-for-transfer fields. Record actual release/host, corpus reconciliation and recovery receipts before asking the user to execute review. Local tests do not mark this milestone done. Capture the user's acceptance per journey and remaining gaps as live work records, then prepare the next cohort. The user's review is the transfer gate, not a proxy for blanket Bubble retirement.

Implementation started — 2026-10-06

T04 first slice implemented: explicit membership/creator visibility; removed tenant-wide bootstrap reads; enforced viewer read-only access in product routes and service writes, exact tenant/space checks, and source/destination write checks for copy/move. Read-only controls reflect those permissions. Seed/admin spaces now need explicit grants; deploy/import docs reflect this behavior.

T08/T09 initial catalogue and review walkthrough prepared under docs/usecases/. Original Bubble journeys remain inferred pending observation/user confirmation; real cohort and release evidence remain pending. T04 continues for sharing UI, member export/delete, tenant filesystem invariant and original privacy parity. The milestone is not reached by this local implementation slice.

Validation: 86 tests passed; Ruff passes changed service/view/test files; git diff --check passes for edited files. Existing 19 repository-wide lint findings remain T07 debt; no production change made.

T10 — ReichelAg weekly call: duplicate protocol and copy for email

id: CSOC-WP-0008-T10
status: done
priority: high
state_hub_task_id: "41334b54-0c99-5c61-9cdf-16231516882b"

User-confirmed first cohort: ReichelAg weekly founder calls. The user confirmed copying the full protocol and editing the new entry by hand. Duplicate the latest entry to prepare the next call's bullet-list agenda; maintain the new protocol; copy rendered content to the clipboard and paste/send manually in an external email client. Email sending is not an app feature requested by this workflow.

Implement a distinct “Copy content to clipboard” action (not page duplication), with rich HTML + plain text, preserved bullet structure, visible success/failure and selectable manual fallback. Verify synthetic old/new protocol independence, copy/paste payload, private-space access and failure handling. User review uses a nominated real latest protocol, privately reconciled with the historical reichelag rehearsal. Do not infer AI recording/transcription, automatic dates, open-item extraction or email delivery. Those behaviors remain unspecified.

T10 implementation evidence: user-confirmed full-copy/manual-edit workflow recorded as UC-008 in docs/usecases/reichelag-weekly-call.md. Distinct Duplicate page and Copy content to clipboard actions implemented. Rich HTML/plain-text clipboard and blocked/manual fallback pass Chromium checks with synthetic data. Full application suite: 87 passed; new test Ruff clean. Real latest protocol reconciliation and actual mail-client/user review remain T03/T09, not completed by these tests. No live deploy, private-data import or mail sending performed.

Live orientation and personal account — 2026-10-06

Fresh checks confirm a healthy 1/1 coulomb-social Helm workload on railiance01 (92.205.62.239), image 7fcd0cf, revision 9. app.coulomb.social landing and health return 200; KeyCape discovery is live. No content PVC/CONTENT_ROOT exists in that old release. One live Member links the user-selected tegwick identity to KeyCape and tenant:coulomb; one demo space exists. No new password/account is needed. The user tried sign-in and received invalid_profile_usage / unknown client_id. Guarded issuer inspection confirms the coulomb-social client is absent; the stored Member and healthy discovery did not prove interactive login worked.

T01 now progresses by preparing the latest tested app image with collected static assets and an owning-chart persistent CONTENT_ROOT upgrade. Single-writer Recreate avoids concurrent filesystem writers and rolling CPU surge. Exact live change approval follows the prepared diff/dry-run and immutable image receipt. Node CPU requests observed 3455m/4000m; disk has 123G available. No deployment or credential change was made by these read-only checks.

T11 — Restore personal OIDC sign-in

id: CSOC-WP-0008-T11
status: progress
priority: high

Restore the historical NetKingdom public coulomb-social authorization-code/PKCE client through the owning guarded helper; refuse differing existing registrations, preserve unrelated configuration bytes and Secret data, pin cluster identity and Secret UID/resourceVersion. Inspection and server dry-run passed on 2026-10-06; no live change made. Existing historical ordinary AAL1 behavior (mfaRequired: false) is explicit in the review packet; shared issuer restart requires exact founder approval. User tegwick must then confirm interactive login. Do not mark this task done on an HTTP redirect or discovery-only check.

Knowledge receipt: emergent-security 0.2.6 identity, verified-files, orientation-only; digest 8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02.