coulomb-social/SCOPE.md

SCOPE — implemented capability and boundaries

Reviewed 2026-10-07 against application source, tests and dated repository records. This describes what the checkout can do; historical live evidence is identified separately. It is not a current production acceptance certificate.

What this repository is

A standalone Django co-creation application rebuilding coulomb.social on Railiance / NetKingdom / HelixForge. Today it implements an authenticated spaces and markdown-pages product plus local content migration tools. It is not yet the complete social network or marketplace described by INTENT.md.

The accepted stage-1 cut prioritizes onboarding and productive spaces/pages transfer; marketplace, favorites, payments and real-time collaboration are later capabilities.

Implemented in this checkout

Capability	Actual behavior and evidence
Identity	OIDC/PKCE login, logout, JIT local Member linked to user-engine; issuer+subject identity, session diagnostics and assurance handling. Development claims login is restricted to DEBUG with OIDC disabled. apps/identity/, identity tests.
Registration entry	Configured NetKingdom registration redirect; this app does not issue passwords or send verification mail. CSOC-IN-0001 is closed with 2026-08-14 Case B evidence.
Spaces	Tenant-filtered list/detail, member-facing create/update/archive, Title, Abstractor (description) and Visual metadata. apps/spaces/services.py, tests/test_space_crud.py.
Pages	Markdown/frontmatter list, render, create/update/delete, independent copy and transfer with source/destination access checks. Duplicate filenames default to the new title; a visible Rename page action edits title/filename while preserving notes, Visual and source metadata and refusing overwrite. Index cannot be deleted or transferred. Separate clipboard copy exports the full title, italic subtitle, original Markdown and legacy Bubble xxx footer as plain text, plus sanitized rich HTML, for manual email distribution. pageops.py, PageOps tests.
Content sources	Local CONTENT_ROOT/spaces/<slug>/pages and assets; optional Forgejo read/edit fallback, cache refresh and push webhook. Markdown is sanitized on render. Local writes do not automatically commit/push to Forgejo.
Import	import_content_tree for one ADR-0004 tree; import_content_corpus for a preflighted JSON batch with explicit existing tenant+issuer+subject membership mappings. Dry-run, replacement opt-in, per-space staging/rollback and aggregate counts. Synthetic multi-space regression coverage; one historical private-space rehearsal.
Delivery preparation	Docker/Gunicorn packaging, SQLite development / PostgreSQL URL support, migrations, health endpoint and deployment/runbook docs. Actual Helm values and cluster hosting belong to railiance-apps.
Evidence and coordination	Bubble surface/capability inventory, authenticated export scripts, design extraction, schema sketch, accepted cut decision, resource-demand/SLO/labor evidence and file-backed State Hub work records.

Source paths above are under coulomb_social/. Member and Space metadata are tenant-keyed. Filesystem paths are slug-keyed, and spaces_space_slug_global_uniq rejects a second row with the same slug, including inactive and cross-tenant rows. Creation, import and admin validation refuse an existing slug before write; the constraint is the storage boundary when those checks race. Migration 0003_space_slug_global_uniq refuses to apply while duplicate slugs exist and does not rename or merge them. Rollback with manage.py migrate spaces 0002 drops only that constraint. Deployment remains instance-per-client. This is not a filesystem tenant namespace.

Practical limits

• Space reads now require explicit membership or a creator grant. Viewer memberships are read-only across product mutation routes and service writes; owner/member grants permit writes. Sharing-management UI and exact Bubble privacy parity remain incomplete. Imported mappings add/update grants; replacement does not revoke old grants. Review access before a real cohort import.
• Copy/transfer handles relative Visual files, not arbitrary body-linked assets, incoming page links, graph identity or Bubble parent/chunk semantics. Visual metadata and copied files do not establish an authenticated asset-serving or upload pipeline.
• Import requires local prepared trees and existing active identities. It does not create platform accounts, import passwords, scrape missing Bubble content, or certify corpus completeness. It runs with writers paused; the batch is restartable per space, not globally atomic or crash-transactional.
• No app-local member export/delete product, automatic content git versioning, outline/include/projection authoring or marketplace/social/payment product is implemented here.
• Historical health/auth evidence does not prove current image, persistence, runtime SLOs, backup success or complete service-contract compliance.

Recorded deployment state

The host strategy is rebuild on app.coulomb.social with Bubble on apex until an explicit cutover. Historical identity/app-shell evidence is in identity smoke. Public registration was evidenced on 2026-08-14. CSOC-IN-0004 remains open for PageOps deployment, migration, live product acceptance. On 2026-10-06, founder-approved Helm revision 10 deployed the tested app (source ac7bac1852, chart 0.2.0, digest pinned) with a retained 2Gi CONTENT_ROOT PVC and one writer/Recreate. OIDC client registration was restored and KeyCape restarted; authorization now hands off to Authelia. Public health, clipboard asset delivery, zero pending migrations and content restart durability passed. The user confirmed fresh reset-mail receipt, then reported app500 after authentication. Revision11 corrects a stale user-service URL with the same image; the user then confirmed interactive tegwick workspace access. Fresh ReichelAG content is now imported for tegwick:36source articles plus index (37markdown files),36assets, exactly one explicit owner grant. The latest dated protocol is2026-10-02; all29August source IDs plus7new are present. User workflow acceptance and subsequent Bubble-space transfers remain pending; deployment receipt records exact evidence and gaps. All six original numbered workplans are finished; their residual intakes remain the source of unfinished work.

Ownership boundaries

This repo owns product behavior, local identity integration, application models, content/migration tooling, packaging and acceptance evidence. It does not own Railiance infrastructure/charts, NetKingdom issuer/mail/secrets services, HelixForge standards, or fleet improvement loops. Core Hub embedding and Bubble as the long-term development surface remain out of scope.

Next work and orientation

Read INTENT.md, the timestamped assessment, CSOC-WP-0007, and CSOC-WP-0008. The local transfer tool closes a preparation gap; persistence/restore, private cohort migration, access acceptance and founder cutover are live successor work.

Development: README.md, docs/dev.md, make test, make lint. Content architecture: ADR-0003/0004 and docs/architecture/. Migration: docs/migration/, including corpus-import.md. Delivery: docs/deploy.md; residual records: docs/intakes/csoc-residuals.md.

First user-confirmed review case: ReichelAg weekly founder-call protocols (UC-008), full duplication and manual editing plus clipboard copy for external email. See docs/usecases/reichelag-weekly-call.md; first-cohort import is live, user workflow acceptance is pending.

Established use-case regression protection is in docs/usecases/registry.json and tests/usecases/, starting with ReichelAg. make check runs fast/application and actual-browser journeys with mandatory test coverage validation and JUnit reports. Forgejo workflow is configured; remote runner/required-merge-check acceptance remains CSOC-IN-0005. User transfer acceptance stays separate.

Platform email facilities are tracked in CSOC-WP-0010. Shared email-connect and platform mailbox custody exist outside this repo; Authelia reset SMTP is now active from platform@coulomb.social; actual inbox receipt is confirmed. Personal-account login acceptance is also confirmed. See platform mail assessment.

Paired recovery preparation (2026-10-06): guarded app-quiesced PostgreSQL/content snapshot and isolated restore helpers are implemented. Live pre-import pair restored13tables/102rows with empty content; a synthetic populated pair restored 13tables/111rows and4files with rendering and permission checks. Retained backup custody/retention and real corpus/rollback acceptance stay CSOC-WP-0008-T02. Bubble authentication was renewed through attended browser login; the first real ReichelAG cohort is imported and persists after app restart. A paired real-content rehearsal restored13tables/104rows/73files with hashes/rendering/denied-read checks. Expired/public-only source captures are rejected by the targeted exporter. Current page navigation remains index-first/alphabetical; latest-change ordering and UI framework architecture are backlog CSOC-WP-0011. See real import receipt.

Clipboard fidelity correction (2026-10-07): founder review identified omitted title/subtitle and lost Markdown syntax. Revision12 deploys the full original Bubble export format, including its xxx footer. Live text/template payload match the observed original, and all74content files are unchanged. Exact payload regressions pass; actual mail-client acceptance remains T09. See clipboard release receipt.

Protocol naming correction (2026-10-07): revision13 makes duplicate filenames default to the new title and adds a visible Rename page action. Filename changes also change the page address; title-only edits keep it stable. Collisions and index filename changes are refused; notes/Visual/source metadata are retained. Founder confirms editing and clipboard copy; naming review remains T09. Protocol naming receipt.

Local orientation brief policy — 2026-10-21

.custodian-brief.md is a local, ignored State Hub orientation snapshot. Refreshing it does not require a Git commit. Authored workplans and the generated WORK-RECORDS index keep their existing source and staged-generation contracts.