coulomb-social/docs/release/acceptance-audit-2026-10-27.md

Workplan acceptance audit — 2026-10-27

WP-0012–0015 remain active. UC-008 weekly-call acceptance and UC-009 personal reset acceptance retain their original scope. Neither authorizes a new cohort import, a mailbox scan, a provider email, or Bubble retirement.

Verified returns

make check: Ruff and 219 tests pass, including mandatory real-browser journeys. make check-communication EMAIL_CONNECT_ROOT=/home/worsch/email-connect: 103 tests pass, zero skipped, no missing required functions. Its private snapshot now includes four explicitly declared recovery helpers. Source/test/helper hashes are retained in var/test-results/communication.json; no owner configuration, credentials or ledger is copied. Recovery covers all six tables and accepted/unknown deliveries, consumed/cancelled handles, suppression and persisted caller quota continuity.

The real migration executor passes on both the normal SQLite test database and disposable PostgreSQL 16.14. Legacy collisions refuse before application of 0003, without modifying either conflicting row or memberships. Reversing 0003 preserves rows, grants and tenant uniqueness; reapplying restores global uniqueness. Reproduce with uv run python scripts/rehearse-storage-migration.py. Hash-bound PostgreSQL proof. This does not prove a production migration or a packaged candidate release.

Read-only SSH checks on railiance01 found:

• App Ready 1/1 at sha256:9a646d8e01a61ba5316d3c2eb0273064e17f2d0300ad07af766ccedda65ecb18. Latest owning rollout is Helm revision 17 (WP-0017); revision 16 is its unchanged product-image provenance. Spaces migrations 0001/0002 are applied; global slug constraint is absent. Two spaces, zero duplicate-slug groups, 82 content files and zero pending recovery journals; registration URL configured.
• /etc/coulomb-social-backup/primary.env is absent. CCR-2026-0036 is applied for the reader, but its three delivery admission flags remain false. The record explicitly says node delivery is unadmitted. RPF-WP-0053-T01/T02 still own execution and delivery admission; do not substitute the email key.
• Scoped email receiver Ready 1/1 at sha256:5d79fd1fec15d3a279383820f170d263de3a55f5308df01a0a34732ebaea6d3d; generation 66 observed. Its caller policy ConfigMap is email-connect-callers-user-engine-276257849bf2, with caller projection present.
• User-engine Ready 1/1 at sha256:1e6547c40c93c49f01438edcf76c20f561ccebc110220bae020723505aa56c70; generation 77 observed. Caller projection and exact tenant:coulomb, tenant:*-family, tenant:family-* bindings to client coulomb-social remain. This is a newer caller image than the October 9 rollout, not a fresh mail receipt.
• Both ledger timers active. Backup service last succeeded 04:20:49 UTC today; freshness service last succeeded 20:00:00 UTC. Last capture 04:19:47 UTC, primary version 1793074846197328, ciphertext SHA256 53f0b616876da23a34d8a3fe2d7376128fa41bff381798c11a625991db052bc3. Verified independent mirror version 1793074847672146; versioned receipt 1793074848495349. No credentials or message bodies were read.

Requirement disposition

Task	Evidence and remaining requirement
WP-0012-T01	Reader/provider pair preparation exists, node delivery absent; execution admission, independent application receipt/key custody, capacity/retention and temporary app-pair disposition still required.
WP-0012-T02	Capture/retrieve/decrypt/restore tooling exists; no first admitted offsite Coulomb point. Run exact version retrieval and content/membership/denial rehearsal after admission.
WP-0012-T03	Prepared units/runbook and historical local restore exist; recurring Coulomb backup, received failure/stale signal, measured complete recovery and service conformance remain unproven. CSOC-IN-0004 live CRUD/transfer smoke remains open.
WP-0013-T01	Constraint and refusal/concurrency tests plus actual forward/reverse PostgreSQL proof pass. Guarded image release, fresh pre-release pair, production migration and postflight still required.
WP-0013-T02	Retention/recovery implementation and tests pass. Representative original custom Markdown/raw HTML/body assets and productive fidelity verdict missing; no live purge/recovery was run.
WP-0013-T03	Sharing/export/exit UI implemented and browser-tested; separate user UC-003/004/005/006 verdicts missing.
WP-0014-T01	71-space/109-article historical inventory remains inventory. User now specifies all spaces, newest creation first. Deterministic planner and date-preserving import implemented; fresh private source, identity/grants, complete chunks/assets and retained workflow comparison remain.
WP-0014-T02	Catalogue preserves stable IDs and confidence. Original/rebuild comparison and user disposition required for remaining journeys and later candidates.
WP-0014-T03	Existing cutover decision 186be722-e2c7-4109-a1e6-d120fe8fca5b remains open; needs WP-0012/0013 returns and explicit cohort/apex decision.
WP-0015-T01	Complete: EMAIL-WP-0008 admitted/activated the scoped original caller, template/operation/binding quotas and separate token custody; current runtime retains those bindings. Productive per-flow verdict remains T04.
WP-0015-T02	Platform sender, named support/reply owner, authorized inbound access, DNS alignment and correlated bounce/suppression/retention evidence remain missing.
WP-0015-T03	Complete: EMAIL-WP-0007 independent six-table recovery/copy custody and recurring operation accepted October 10; current timers and independently verified archive mirror confirmed. See references below.
WP-0015-T04	Loopback double covers app browser mechanics; actual owner-spanning issuer/directory/mail-sink/app journey and productive UC-010/011 verdicts remain missing. UC-012 still needs a nominated product caller/template.

Owner returns, inspected in their repositories:

• email-connect/docs/scoped-caller-live-2026-10-09.json and EMAIL-WP-0008: admitted policy/custody, coordinated rollout, retired bearer refusal, no-send tenant/payload/burst/suppression denials and preserved accepted deliveries.
• email-connect/docs/ledger-scaleway-custody-2026-10-10.json, deploy/backup/operating-acceptance-2026-10-10.json and EMAIL-WP-0007: provider-retrieved nonexpiring kit and escrow, separately bound recovery reader, native worker/read/write/delete denials and network-disabled image-bound restore. Live empty transactional states are covered synthetically, not claimed observed. Daily mirrored archives expire after 30 days; protected kit has no expiry. Platform-root owns weekly retention/capacity/kit refresh and failure reception. Historical private pre-release copies remain retained pending explicit owner disposition; no expiry or destruction is inferred. Production restore requires caller/challenge fencing and post-capture reconciliation; 60-minute RTO is a target.

Concrete next returns

1. Platform owner must admit the existing Coulomb node executor/delivery contract in CCR-2026-0036 and RPF-WP-0053, with native provider boundary proof. Use its pair-aware delivery helper, exact CCR hash and pinned KV version; deliver only the Coulomb pair to root:root 0600 primary.env beneath a 0700 parent. No bucket/IAM/escrow administration belongs in this worker. Existing founder schedule approval (daily 03:15 UTC; RPO 24h, stale 26h, RTO target 60min) is already recorded in RPF-WP-0053; do not ask for that schedule again.
2. Retain independent version/hash receipts and key/image recovery custody, bind lifecycle/headroom, run/retrieve/rehearse the first point, then activate and prove monitored backup/freshness units. A local paired capture does not meet this.
3. Release the storage/content hardening only with fresh paired rollback evidence and the PostgreSQL migration proof above. Restore production only under a separate incident decision accounting for writes after capture.
4. User specifies eventual transfer of all spaces, newest-created first, with original space/page/chunk creation dates preserved. Use the deterministic planner in docs/migration/corpus-import.md and refresh the expired Bubble session; record each comparison/verdict using the existing review walkthrough. Bulk productive import still requires complete source/chunk/asset reconciliation and explicit grants. Prepared UC-003–006 steps are in docs/usecases/sharing-portability-review.md.
5. Complete real owner-spanning communication browser tests and appoint the platform sender/reply/bounce operator. No live mail or mailbox scan was performed.

Subsequent approved node delivery — 2026-10-27

The earlier absent/unadmitted file observations above were pre-admission checks. User decision 9557e2b8-2b37-5b94-a5e6-e5fe08d0351e now approves the Coulomb-only node executor and delivery. Native boundary checks pass and version-2 own-pair delivery is complete, hash-bound to CCR 1f624cd21f73bcbbb5920c6bd8d8dcf9ccee2e8389a06560644b35947c333925. See backup-boundaries-2026-10-27.json and backup-delivery-2026-10-27.json. No completed object, first paired capture, independent escrow/retrieval or timer activation is implied. Those remain WP-0012-T01/T02/T03 returns.

Platform admission source sync succeeded at commit 4583b22fd697b4212ebff46750930fdb06a61adc (primary railiance01, expected commit equals derived commit, applied). The original admission source commit is 98b1190; Repo Manager's required identifier assignment produced the synced follow-up commit. Normal hooks, including the pinned secret scanner, passed after clarifying a public source-file SHA256 field name.

Installed paired/snapshot helpers passed the current-image server dry-run, with no app pause or archive upload. Node /var/lib free space observed 122,820,976,640 bytes of 206,900,281,344 total. This observation is not a retention/independent custody acceptance.

Packaged candidate and fresh source reconciliation

Published image c11300a, digest sha256:fb579adefa6e3e0c16fedeac134b2e05f4ed6216807cb25995fbc0da826c1167, passes the packaged PostgreSQL migration lifecycle (image source and Django, only test tools injected), migration-drift check and server dry-run. Three-resource Helm comparison against revision17 changes only the deployment image. Candidate proof. Not deployed; fresh paired rollback/recovery evidence remains required before the guarded release.

The all-visible-space pass checkpointed 70 visits but hit its parent deadline before a final index. Those records were retained, not reclassified as complete. The new reference continuation follows only source-referenced UI addresses, hashes its input files and bounds each response read. It completed 34 visits without a response timeout, yielding 70 fresh spaces/162 articles. The planner combines fresh records with the entire retained inventory, marking absent spaces space_not_refreshed, never certifying old metadata as fresh. It retains all 71 known spaces: 67 captured graphs pass; one inventory-only space, two absent body fields, two missing/invalid creation and modification dates (including the stale space), one cross-space chunk relation and one unassigned article remain visible. No graph pass certifies assets, privacy, live source completeness or acceptance. Non-secret reconciliation. Private source bodies, IDs, account mapping and checkpoints remain outside Git.

Bubble-marked imports now require an original creation date on the space index and every page/chunk, before any writes, including refusal to synthesize an index with an unknown original space date. Updated synthetic rollback fixtures preserve date metadata while testing real rollback. Full gate219 passes; Node capture8 passes. Candidate c11300a predates this strict guard and must be refreshed before its production release; it remains an interim packaged SQL proof, not deployment approval. An additional native DeleteObjectVersion probe returns403 on a unique never-published key, touching no retained object. Receipt: backup-version-delete-boundary-2026-10-27.json.

Wrong-namespace login using the same admitted ServiceAccount name also returns403, without reading sibling credentials or any data. Receipt: backup-wrong-namespace-boundary-2026-10-27.json. Whole-capture field-completeness counts are separate from per-space graph counts: 69 fresh space dates and 160 article creation dates are present/valid; 159 article records have a text body, and two captured article records contain only an ID. Those stubs are not proof of deletion, permission, an empty body or an original creation date.

Offline all-tree preparation — 2026-10-28

The deterministic compiler prepares all known spaces in creation-date order; blocked spaces remain in the private queue. Captured source-body bytes, original space/page/chunk dates and ordered parent/chunk/contents relations are preserved. Draft space indexes link to separate source root articles rather than assigning the root article the space's creation date. Stable source-ID-derived filenames avoid title/order collisions. No productive manifest, identities or grants are inferred. Asset/link/custom-rendering and existing destination reconciliation remain explicit, with no exhaustive-parser claim or remote asset downloads.

Following newly detected contents relations recovered additional source records in 57 targeted visits: 244 captured articles, 241 text bodies and 242 valid article creation dates. All 71 known spaces remain queued; 67 draft trees pass the narrow captured-graph checks. Five capture references, the four prior space graph gaps, contents semantics and attachment exceptions remain unresolved. One response read timed out; it was bounded and the checkpoint/pass completed.

An actual-capture rehearsal, with outgoing network disabled, isolated SQLite and a synthetic owner, imported the 67 draft trees. It verified 543 prepared file hashes, 235 included page/chunk file/body hashes and creation dates, and all 67 SQL space creation dates without mismatch. The other six source bodies remain in sidecars for blocked/unassigned records. No live tree, membership or database was modified. Counts and hash-bound proof. The accepted-cohort date backfill and actual rendering/access review remain open.

Current rendering/candidate/recovery returns — 2026-10-28

The private rendering audit invokes the actual product renderer for all 244 captured article records: 241 bodies render; three bodies remain missing. Six records have structural sanitizer changes (three custom tags and 17 attributes removed); intermediate/sanitized extracted text is unchanged. This is not a comparison with Bubble's renderer. Exact old/current renderer HTML matches for all 241 bodies, so the audit helper refactor does not change rendering policy. All six changed-record cards open under their restrictive resource policy with zero external request attempts. Source/product cards and the expanded UC-003–006 walkthrough are ready; productive fidelity verdicts remain open. Public evidence: corpus-rendering-audit-2026-10-28.json.

Refreshed packaged candidate 17d0eb6 includes the strict original-date guard. Packaged PostgreSQL 16.14 lifecycle, missing-index/chunk-date write-free refusal, SQL space birthdate/chunk-byte preservation, source hash comparison, migration drift check, three-resource image-only manifest comparison and server dry-run pass. Source full gate: 231 tests. Candidate proof: storage-candidate-17d0eb6-2026-10-28.json. No deployment; fresh paired rollback and recovery proof remain required.

User admitted independent Coulomb recovery custody under decision 27bbc1ac-e275-42be-ba34-6cf16eae4e78 and the concrete recovery-custody-review packet. RPF-WP-0053 records the approval; no repeat scope/schedule approval is needed. Native provisioning needs an attended platform-owned operator front door: the current bootstrap route is draft/unresolvable, and no local operator environment, standard config or active browser-debug session is present. Existing scoped publisher and sibling credentials cannot substitute for that authority. No recovery grant/key/kit or first archive/timer is claimed by admission alone.