coulomb-social/workplans/CSOC-WP-0015-communication-runtime-acceptance.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	origin	origin_ref	state_hub_workstream_id
CSOC-WP-0015	workplan	Communication runtime, inbox operations and flow acceptance	communication	coulomb-social	active	codex	coulomb-social	2026-10-08	2026-10-30	residual	CSOC-WP-0010	38208f72-c285-56fa-be44-de9b59a4e031

Residual acceptance from CSOC-WP-0010, split at the user's request. Existing implementation/release/acceptance evidence remains in the originating workplan; these tasks own the remaining concrete outputs. Source checks never grant runtime or productive acceptance.

T01 — Admit and activate explicit transactional caller policies

id: CSOC-WP-0015-T01
status: done
priority: high
state_hub_task_id: "e87ea643-7bee-5427-b4f5-b32f20dc2f29"

Receiver source is implemented and image deployment recorded in EMAIL-WP-0008. EMAIL-WP-0008-T03 owns actual caller/binding/template/operation/quotas, separate token custody/delivery and original-caller transition. Product acceptance verifies the admitted integration; avoid duplicating receiver implementation or granting arbitrary app notifications.

2026-10-27: EMAIL-WP-0008 completed scoped caller custody and coordinated activation on October 9. Current receiver policy/projection and user-engine tenant/client bindings are present, both deployments Ready. Owner no-send denial/replay receipts and the expanded 103-test isolated gate verify the admitted integration. Productive flow verdicts remain T04. See docs/release/acceptance-audit-2026-10-27.md.

T02 — Establish platform sender and monitored reply/bounce ownership

id: CSOC-WP-0015-T02
status: todo
priority: high
state_hub_task_id: "0604cb15-72c7-5d15-bb42-0335d4ec80df"

Review replacing the receiver forgejo sender with platform identity through its credential owner, then name reply/inbox/support owner and prove authorized inbound access, DNS MX/SPF/DKIM/DMARC, correlated bounce/suppression and retention. No unsolicited scans or auto responses. Existing native personal reset is accepted and stays separately evidenced.

T03 — Complete independent ledger recovery and copy custody

id: CSOC-WP-0015-T03
status: done
priority: high
state_hub_task_id: "286e60bf-76a1-5a18-bd2c-edd9d1400c41"

EMAIL-WP-0007-T03/T04 and RPF-WP-0053-T05/T06 own primary archive admission/atomic credential pair, first encrypted capture/retrieval/rehearsal and monitoring. Require image/schema-bound six-table recovery, restored accepted/unknown/consumed/cancelled/suppressed/quota continuity and post-capture reconciliation; govern temporary pre-release copies.

2026-10-27: EMAIL-WP-0007 completed independent provider escrow, separately bound recovery reader, nonexpiring image/tools/receipt kit, six-table offline recovery, mirrored rolling archives and monitored schedules on October 10. Fresh checks show both timers active and today's backup/freshness successful, with verified mirror. The app gate now binds real encryption/recovery and scoped quota continuity tests; 103 owner cases pass with zero skips. Historical private copies remain retained pending explicit owner disposition, with no inferred expiry/deletion. Production restore still requires fencing and post-capture reconciliation. See the audit.

T04 — Establish owner-spanning browser journeys and productive flow verdicts

id: CSOC-WP-0015-T04
status: progress
priority: high
state_hub_task_id: "7c718d86-8f0d-5cb2-a765-b0c07116005c"

Use isolated issuer/directory/local mail sink/app for UC-009/010/011. Bind exact mandatory browser nodes without production URLs/accounts or SMTP provider sends; test expired/replayed handles and tenant/client/caller denials. Future UC-012 needs a user-selected product template/caller. Preserve UC-008 manual mail distribution and UC-009 existing personal reset acceptance.

2026-10-11: the checkout has a loopback issuer, directory and mailbox double. The browser node is bound on UC-009/010/011 and still established: false. It covers reset-to-local-mailbox, sign-in, callback replay, expired and reused handles, tenant and client refusal, registration verify/cancel, and caller/suppression invitation counts. No SMTP, production account, or live issuer is contacted. Real user-engine/email-connect admission, DNS and productive per-flow verdicts remain open. UC-012 stays deferred. Gate for this slice: make check 200 passed.

2026-10-30: added an explicit real-owner-source browser gate for UC-010/011. Private snapshots run the actual user-engine portal, registration/outbox HTTP adapters and email-connect scoped receiver/SQLite ledger, with synthetic session, authorization, directory, activity sink and mail provider. Actual forms cover verify/cancel/expiry/replay, fresh-handle cross-caller denial, tenant/client/token denials, cross-tenant admin refusal, invitation/resend, duplicate delivery and suppression. Python only permits fixture ports; browser routes/API redirects are bounded to fixture origins. No production configuration, account, SMTP provider, mailbox scan or original note body is used. Exact node is linked in the candidate registry and the invocation is in docs/usecases/platform-communication.md. Proof: docs/release/owner-communication-browser-2026-10-30.json. This completes the owner-source UC-010/011 browser integration slice, not native issuer/directory/ app-login coverage or productive per-flow verdicts. T04 remains progress; T02 sender/inbound/bounce ownership and UC-012 nomination remain separate gates.

Completion

Finish when every task above has its stated evidence and acceptance, or hand off any newly discovered residual to a live work record first. Cross-owner dependencies remain their existing canonical records.