coulomb-social/SCOPE.md

# SCOPE — implemented capability and boundaries

Reviewed 2026-10-07 against application source, tests and dated repository
records. This describes what the checkout can do; historical live evidence is
identified separately. It is not a current production acceptance certificate.

## What this repository is

A standalone Django co-creation application rebuilding coulomb.social on
Railiance / NetKingdom / HelixForge. Today it implements an authenticated spaces
and markdown-pages product plus local content migration tools. It is not yet
the complete social network or marketplace described by INTENT.md.

The accepted [stage-1 cut](docs/decisions/2026-08-12-feature-cut-stage-1.md)
prioritizes onboarding and productive spaces/pages transfer; marketplace,
favorites, payments and real-time collaboration are later capabilities.

## Implemented in this checkout

| Capability | Actual behavior and evidence |
|---|---|
| Identity | OIDC/PKCE login, logout, JIT local Member linked to user-engine; issuer+subject identity, session diagnostics and assurance handling. Development claims login is restricted to DEBUG with OIDC disabled. `apps/identity/`, identity tests. |
| Registration entry | Configured NetKingdom registration redirect; this app does not issue passwords or send verification mail. CSOC-IN-0001 is closed with 2026-08-14 Case B evidence. |
| Spaces | Tenant-filtered list/detail, member-facing create/update/archive, Title, Abstractor (`description`) and Visual metadata. `apps/spaces/services.py`, `tests/test_space_crud.py`. |
| Pages | Markdown/frontmatter list, render, create/update/delete, independent copy and transfer with source/destination access checks. Duplicate filenames default to the new title; a visible Rename page action edits title/filename while preserving notes, Visual and source metadata and refusing overwrite. Index cannot be deleted or transferred. Separate clipboard copy exports the full title, italic subtitle, original Markdown and legacy Bubble `xxx` footer as plain text, plus sanitized rich HTML, for manual email distribution. `pageops.py`, PageOps tests. |
| Content sources | Local `CONTENT_ROOT/spaces/<slug>/pages` and assets; optional Forgejo read/edit fallback, cache refresh and push webhook. Markdown is sanitized on render. Local writes do not automatically commit/push to Forgejo. |
| Import | `import_content_tree` for one ADR-0004 tree; `import_content_corpus` for a preflighted JSON batch with explicit existing tenant+issuer+subject membership mappings. Dry-run, replacement opt-in, per-space staging/rollback and aggregate counts. Synthetic multi-space regression coverage; one historical private-space rehearsal. |
| Delivery preparation | Docker/Gunicorn packaging, SQLite development / PostgreSQL URL support, migrations, health endpoint and deployment/runbook docs. Actual Helm values and cluster hosting belong to railiance-apps. |
| Evidence and coordination | Bubble surface/capability inventory, authenticated export scripts, design extraction, schema sketch, accepted cut decision, resource-demand/SLO/labor evidence and file-backed State Hub work records. |

Source paths above are under `coulomb_social/`. Member and Space metadata are
tenant-keyed. Filesystem paths are **slug-keyed**, and
`spaces_space_slug_global_uniq` rejects a second row with the same slug,
including inactive and cross-tenant rows. Creation, import and admin validation
refuse an existing slug before write; the constraint is the storage boundary
when those checks race. Migration `0003_space_slug_global_uniq` refuses to apply
while duplicate slugs exist and does not rename or merge them. Rollback with
`manage.py migrate spaces 0002` drops only that constraint. Deployment remains
instance-per-client. This is not a filesystem tenant namespace.

## Practical limits

- Space reads now require explicit membership or a creator grant. Viewer
  memberships are read-only across product mutation routes and service writes;
  owner/member grants permit writes. Sharing-management UI and exact Bubble
  privacy parity remain incomplete. Imported mappings add/update grants;
  replacement does not revoke old grants. Review access before a real cohort import.
- Copy/transfer handles relative Visual files, not arbitrary body-linked assets,
  incoming page links, graph identity or Bubble parent/chunk semantics. Visual
  metadata and copied files do not establish an authenticated asset-serving or
  upload pipeline.
- Import requires local prepared trees and existing active identities. It does
  not create platform accounts, import passwords, scrape missing Bubble content,
  or certify corpus completeness. It runs with writers paused; the batch is
  restartable per space, not globally atomic or crash-transactional.
- No app-local member export/delete product,
  automatic content git versioning, outline/include/projection authoring or
  marketplace/social/payment product is implemented here.
- Historical health/auth evidence does not prove current image, persistence,
  runtime SLOs, backup success or complete service-contract compliance.

## Recorded deployment state

The host strategy is rebuild on `app.coulomb.social` with Bubble on apex until
an explicit cutover. Historical identity/app-shell evidence is in
[identity smoke](docs/identity/smoke.md). Public registration was evidenced on
2026-08-14. **CSOC-IN-0004 remains open** for PageOps deployment, migration,
live product acceptance. On 2026-10-06, founder-approved Helm revision 10 deployed
the tested app (source ac7bac1852c9, chart 0.2.0, digest pinned) with a retained
2Gi CONTENT_ROOT PVC and one writer/Recreate. OIDC client registration was restored
and KeyCape restarted; authorization now hands off to Authelia. Public health,
clipboard asset delivery, zero pending migrations and content restart durability
passed. The user confirmed fresh reset-mail receipt, then reported app500 after
authentication. Revision11 corrects a stale user-service URL with the same image;
the user then confirmed interactive tegwick workspace access.
Fresh ReichelAG content is now imported for tegwick:36source articles plus
index (37markdown files),36assets, exactly one explicit owner grant. The latest
dated protocol is2026-10-02; all29August source IDs plus7new are present.
User workflow acceptance and subsequent Bubble-space transfers remain pending;
[deployment receipt](docs/release/personal-account-deployed-2026-10-06.md) records
exact evidence and gaps. All six original numbered workplans are finished;
their residual intakes remain the source of unfinished work.

## Ownership boundaries

This repo owns product behavior, local identity integration, application models,
content/migration tooling, packaging and acceptance evidence. It does not own
Railiance infrastructure/charts, NetKingdom issuer/mail/secrets services,
HelixForge standards, or fleet improvement loops. Core Hub embedding and Bubble
as the long-term development surface remain out of scope.

## Next work and orientation

Read [INTENT.md](INTENT.md), [the timestamped assessment](history/20261005T223104Z-scope-intent-assessment.md),
[CSOC-WP-0007](workplans/CSOC-WP-0007-safe-transfer-readiness.md), and
[CSOC-WP-0008](workplans/CSOC-WP-0008-production-transfer-acceptance.md).
The local transfer tool closes a preparation gap; persistence/restore, private
cohort migration, access acceptance and founder cutover are live successor work.

Development: `README.md`, `docs/dev.md`, `make test`, `make lint`.
Content architecture: ADR-0003/0004 and `docs/architecture/`.
Migration: `docs/migration/`, including `corpus-import.md`.
Delivery: `docs/deploy.md`; residual records: `docs/intakes/csoc-residuals.md`.

First user-confirmed review case: ReichelAg weekly founder-call protocols
(UC-008), full duplication and manual editing plus clipboard copy for external
email. See docs/usecases/reichelag-weekly-call.md; first-cohort import is live,
user workflow acceptance is pending.

Established use-case regression protection is in docs/usecases/registry.json
and tests/usecases/, starting with ReichelAg. `make check` runs fast/application
and actual-browser journeys with mandatory test coverage validation and JUnit
reports. Forgejo workflow is configured; remote runner/required-merge-check
acceptance remains CSOC-IN-0005. User transfer acceptance stays separate.

Platform email facilities are tracked in CSOC-WP-0010. Shared email-connect
and platform mailbox custody exist outside this repo; Authelia reset SMTP
is now active from platform@coulomb.social; actual inbox receipt is confirmed.
Personal-account login acceptance is also confirmed. See
[platform mail assessment](docs/release/platform-email-2026-10-06.md).

Paired recovery preparation (2026-10-06): guarded app-quiesced PostgreSQL/content
snapshot and isolated restore helpers are implemented. Live pre-import pair
restored13tables/102rows with empty content; a synthetic populated pair restored
13tables/111rows and4files with rendering and permission checks. Retained backup
custody/retention and real corpus/rollback acceptance stay CSOC-WP-0008-T02.
Bubble authentication was renewed through attended browser login; the first real
ReichelAG cohort is imported and persists after app restart. A paired real-content
rehearsal restored13tables/104rows/73files with hashes/rendering/denied-read checks.
Expired/public-only source captures are rejected by the targeted exporter.
Current page navigation remains index-first/alphabetical; latest-change ordering
and UI framework architecture are backlog CSOC-WP-0011. See
[real import receipt](docs/release/reichelag-imported-2026-10-06.md).

Clipboard fidelity correction (2026-10-07): founder review identified omitted
title/subtitle and lost Markdown syntax. Revision12 deploys the full original
Bubble export format, including its `xxx` footer. Live text/template payload
match the observed original, and all74content files are unchanged. Exact
payload regressions pass; actual mail-client acceptance remains T09. See
[clipboard release receipt](docs/release/reichelag-clipboard-2026-10-07.md).

Protocol naming correction (2026-10-07): revision13 makes duplicate filenames
default to the new title and adds a visible Rename page action. Filename changes
also change the page address; title-only edits keep it stable. Collisions and
index filename changes are refused; notes/Visual/source metadata are retained.
Founder confirms editing and clipboard copy; naming review remains T09.
[Protocol naming receipt](docs/release/reichelag-naming-2026-10-07.md).

## Local orientation brief policy — 2026-10-21

`.custodian-brief.md` is a local, ignored State Hub orientation snapshot. Refreshing
it does not require a Git commit. Authored workplans and the generated
WORK-RECORDS index keep their existing source and staged-generation contracts.