coulomb-social/workplans/CSOC-WP-0010-platform-email-facilities.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	state_hub_workstream_id
CSOC-WP-0010	workplan	Platform email communication and personal account recovery	communication	coulomb-social	active	codex	coulomb-social	2026-10-06	2026-10-08	c0aa46eb-8266-58d4-92a7-3e4e78f5c90b

User milestone

You receive a requested password-reset message from platform@coulomb.social, recover your existing tegwick account privately, and sign in to the new app. Platform invitation/notification flows then have a governed reusable sender, observable failures and a clearly owned reply inbox. Each flow gets explicit user acceptance before productive use. This is not a campaign-mail system.

First dependency: CSOC-WP-0008-T11. Deployment and mailbox-provider changes belong to NetKingdom, email-connect and railiance-platform, not this product repo. Current evidence: docs/release/platform-email-2026-10-06.md.

Establish mailbox and reusable delivery evidence

id: CSOC-WP-0010-T01
status: done
priority: high
state_hub_task_id: "dff23ff3-e07d-5221-bb4d-52a15becf7f2"

Fresh read-only inspection: email-connect1/1 healthy, /healthz200, runtime SecretSynced, sender forgejo@coulomb.social. platform@coulomb.social existing owner custody has recorded September28 native SMTP/auth and provider-accepted test; telemetry projection currently SecretSynced. This does not prove a fresh inbox receipt or inbound operation.

Connect password reset to platform mailbox

id: CSOC-WP-0010-T02
status: done
priority: high
state_hub_task_id: "caae9504-25e7-583a-8f62-c5d604f11b71"

NK-WP-0047 and RPF-WP-0052/CCR-2026-0035 prepare native Authelia SMTP, TLS verification, scoped ESO password-file mount and fixed consumer admission. Implement and test without credentials in code. Obtain exact founder live go/attended owner admission; validate runtime and deploy. Existing deployment approval does not authorize mailbox-access changes.

Prove personal recovery and sign-in

id: CSOC-WP-0010-T03
status: done
priority: high
state_hub_task_id: "929d6200-f060-5fa0-a324-f15da252b2ca"

User requests a NEW reset for tegwick after SMTP activation, receives mail at the existing directory email, sets a password privately, and completes app.coulomb.social login. Confirm inbox receipt separately from provider acceptance; keep reset URLs, tokens, passwords and private mail content out of Git/Hub/chat. Close CSOC-WP-0008-T11 only after user acceptance.

Establish shared platform notification delivery

id: CSOC-WP-0010-T04
status: progress
priority: high
state_hub_task_id: "ca41be06-3611-5647-b469-4f89f56f77f9"

Extend existing email-connect with explicit caller identities, approved templates, per-caller limits, idempotent retries, suppression/bounce handling and redacted delivery states. Replace forgejo sender with platform identity only through reviewed custody and rollout. Reuse native SMTP for authentication messages, HTTP notification API for supported application templates; do not widen current user-engine-only ingress globally.

2026-10-07 retry correction implemented in email-connect under EMAIL-WP-0006. Durable tenant/client/registration reservations prevent duplicate challenge mail across retries, changed tracing IDs, restart and concurrent connections. Unknown outcomes block automatic resend; definitive retryable refusal cancels the failed challenge before retry. Existing challenge links remain usable, with legacy retries conservative. All 39 transactional tests and all 101 repository tests passed with the synthetic GreenMail SMTP/IMAP harness; the real verification journey confirms one message after restart/retry. Static ESO bootstrap retired in source per platform handoff, without a live custody change. Candidate release is reviewed in email-connect/docs/verification-retry-review-2026-10-07.md. T04 stays progress for caller/sender/limits and ledger recovery admission. 2026-10-07 founder-approved release complete: source7258505 / digest1e613d43 is live with one Ready replica. Private quiesced SQLite backup40960 bytes, SHA2563b4651064fa7dd7bd5073ed8567480ea1f4cb527dbe6c7462cc778182e7da1f8, passes integrity and isolated UID10001/no-network migration rehearsal: all four existing tables retain their rows and the reservation table is added. Health200, unauth401, authenticated template/invalid verification400; no mail sent. Initial probe used an unnormalized mounted token and failed locally; corrected probe matches service normalization. Receiver was held stopped during correction; final Ready20:33:16Z, release window227s from20:29:29Z. No helper remains. Decision8da41538-8482-4c72-b83d-e0fce1b662f0 resolved by founder's Ok, go ahead. EMAIL-WP-0006-T03 (fcf55c0a-49b5-53a8-9497-3dfcc18c3828) release is complete.

Residual handoff from EMAIL-WP-0006 to this live T04: caller/tenant/template admission, per-caller limits, platform sender custody and durable recovery of email-connect's reservation ledger remain open. Its SQLite is not covered by the proposed application DB/content pair; admit its own recovery contract.

2026-10-08 ledger increment: EMAIL-WP-0007-T01/T02 implement coherent quiesced SQLite capture, stable encrypted publication, independent retrieval and guarded attended recovery. Full owner suite 120 passed (zero skips, including 19 new ledger cases); packaged UID10001/no-network rehearsal preserves all five tables/schema/ rows and accepted/unknown/consumed/cancelled/suppressed states with no provider call. Node server dry-run and all four units pass; no live receiver change, capture, upload or timer activation. EMAIL-WP-0007-T03/T04 and RPF-WP-0053-T05 remain live custody/admission/offsite/monitoring handoffs. Recovery must reconcile post-capture submissions/challenge consumption before traffic release. See email-connect/docs/ledger-backup-review-2026-10-08.md. T04 stays progress for those and caller/sender/limit admission.

Establish reply and mailbox operations

id: CSOC-WP-0010-T05
status: progress
priority: high
state_hub_task_id: "d9e165d9-dd0b-54c2-bda1-bd314b999b5b"

Confirm who owns/reads platform inbox, reply routing, monitored bounces, inbound IMAP/provider access, retention and support procedure. Verify domain MX/SPF/DKIM/DMARC and actual inbox receipt with the provider owner. Mailbox existence or SMTP AUTH is not inbox access proof. No unsolicited mailbox scans or automatic response sends.

Residual handoff from EMAIL-WP-0006 to this live T05: custody/retention and expiry of the private pre-release SQLite copies remain part of mailbox/evidence operations. Node root0700 directory /tmp/email-connect-preverification-20261007T202924Z and workstation0700 /tmp/csoc-email-private-hkt09g6u hold matching mode0600 backups. Never infer durable governed custody from these temporary copies.

Register communication use cases and regression checks

id: CSOC-WP-0010-T06
status: progress
priority: high
state_hub_task_id: "97a2da91-debe-5ce2-9b68-1965a5c5abfe"

Catalogue password reset, verification/invitation, and future user-approved notifications. Use synthetic transport fixtures; test authorized caller, invalid recipient/template, retry/idempotency, provider failure and token redaction. ReichelAg protocol distribution remains manual clipboard/email unless the user separately chooses app sending.

Exact live activation decision: d95b4c9f-30a3-4ed6-b18f-d1b9fa20d84e; no runtime activation/mail send.

Activation approved and infrastructure objects applied on2026-10-06. Backup Job csoc-authelia-pre-smtp-20261006 succeeded. Attended OpenBao owner admission receipt absent; SecretStore reports missing role. Authelia notifier/mount not changed and server healthy. T02 remains progress, not awaiting permission. Receipt: docs/release/platform-email-activation-2026-10-06.md.

SMTP activation completed on 2026-10-06: attended helper verified/authenticated, scoped store/projectionReady, native configuration Job succeeded18:31:49Z, reviewed notifier/mount rollout generation 28 healthy1/1; public auth/app/issuer and full authorization handoff pass. T02 done; T03 waits actual reset inbox/recovery and personal signin. Receipt: docs/release/platform-email-active-2026-10-06.md.

User acceptance update: fresh reset email arrived (user confirmation). Login then reaches app HTTP500. Inbox delivery is accepted; full personal app sign-in remains open. See docs/release/personal-login-500-2026-10-06.md. T03 stays wait for post-correction interactive acceptance, not mail-provider readiness.

Final personal acceptance — 2026-10-06

User confirmed fresh reset-email receipt, then after revision11 URL correction confirmed: “I reach my workspace.” Personal sign-in acceptance is complete. No password/reset token/private protocol was requested or recorded.

Shared-delivery review and communication catalogue — 2026-10-07

Prepared docs/release/platform-notifications-review-2026-10-07.md against clean email-connect source73702b7e. Current 27 transactional tests pass with synthetic providers; no network/provider sends. Invitation uncertain-outcome reservations survive restart. A network-forbidden in-memory verification probe demonstrates identical retries create two provider submissions/two challenge rows, including two persisted challenges after provider failures. T04 requires verification idempotency, independent caller authentication/scope, rate limits and redacted caller-scoped status before shared caller admission. Existing shared bearer and user-engine-only ingress remain in place; no external owner work claimed accepted.

T05 progress: fresh DNS observes IONOS MX/SPF and provider DMARC alias with p=none. DKIM alignment, inbound access, named reply/bounce monitor and retention/support returns remain explicit owner requirements in the packet. No mailbox scan, credential retrieval, automatic reply or live configuration change performed.

T06 progress: docs/usecases/platform-communication.md records stable UC-009–012, the accepted personal recovery receipt, invitation/verification candidates and future notification scope, exact existing owner test references and missing cross-owner browser coverage. These are not falsely registered as fully protected end-to-end journeys: T06 remains open until isolated issuer/mailbox/app browser coverage and owner regression bindings are delivered. UC-008 stays protected by make check; protocol distribution remains manual. WP-0008-T07 lint debt closed; full application gate98passed. No Bubble/apex cutover or new notification send.

Executable communication regression increment — 2026-10-08

T06 registers UC-009–012 with synthetic fixture references and explicit established:false/browser gaps. UC-009 retains its existing personal recovery acceptance; the remaining flows are candidates. The UC-008 protected registry and manual email distribution remain intact. communication-regressions.json binds21 exact owner functions; make check-communication snapshots Python source and the synthetic transactional test into a private temporary tree, denies all socket connects/DNS, strips inherited credentials, disables plugin autoload, refuses skipped/xfail or missing contract tests and produces redacted source/ test/contract-hash receipts. The owner checkout is not changed.

Actual current owner gate: 39 passed, zero skips, including verification restart/uncertain/concurrent retry safety. Local runner failure tests prove network denial, environment isolation and missing/disabled-coverage refusal. Application gate: 182 passed, Ruff and both real Chromium journeys pass. Review: docs/release/sharing-portability-review-2026-10-08.md; public owner receipt: docs/release/communication-regressions-2026-10-08.json. This closes stale baseline reporting, not owner admission or full end-to-end automated protection.

T04/T05/T06 remain progress: independent caller/template/tenant admission, limits, caller-scoped status, platform sender and independent ledger backup custody, inbound/reply/bounce ownership, alignment/retention and isolated issuer/mailbox/app browser journeys still need owner returns. EMAIL-WP-0007-T03/T04 and RPF-WP-0053-T05 remain the live ledger custody/activation handoffs. No external owner source/runtime, mailbox access, caller admission or email send changed; no productive new communication flow was accepted or this workplan finished.