tegwick
789e69902d
Some checks failed
Use-case regression gate / usecase-regressions (push) Failing after 7m5s
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a17f16-d99c-7ea3-95f0-8212897fba6b
116 lines
9.3 KiB
Markdown
116 lines
9.3 KiB
Markdown
# Platform communication use cases
|
||
|
||
CSOC-WP-0010-T06, reviewed 2026-10-07. Authentication uses native Authelia
|
||
SMTP; application invitation/verification delivery uses the existing
|
||
email-connect service. ReichelAg protocol distribution remains UC-008's manual
|
||
clipboard/email workflow.
|
||
|
||
These stable IDs are registered in `registry.json` with synthetic fixture
|
||
references, app-side fast checks and `established: false`. Owner-spanning browser
|
||
coverage is still required under T06. Personal recovery retains its recorded
|
||
user acceptance; it is not marked as an established automated journey until
|
||
its full fast/browser contract can be protected. UC-010–012 remain candidates.
|
||
|
||
| ID | Actor, goal and steps | Expected outcome / evidence | Status and owner |
|
||
| --- | --- | --- | --- |
|
||
| CSOC-UC-009 | Existing member requests a new reset on the identity portal, receives email, sets a password privately, then signs into the app | Fresh inbox receipt and personal workspace reached; reset URL/password never enter app logs, Git or Hub | User-confirmed and accepted 2026-10-06 for the existing personal account; WP-0010-T02/T03 and WP-0008-T11 done |
|
||
| CSOC-UC-010 | New member starts approved registration, receives the verification message, then consumes or cancels its link | Expiring, single-use, purpose-bound channel evidence; cancellation and consumption invalidate one another; account admission remains user-engine's decision | Candidate; implemented service behavior, current personal user workflow not reviewed; T04/T06 with user-engine/NetKingdom/email-connect |
|
||
| CSOC-UC-011 | Authorized inviter invites a member; a deliberate resend creates a new event | Fixed invitation template, one provider submission per event, suppression respected; provider acceptance does not establish inbox receipt | Candidate; implemented service behavior, productive user acceptance pending; T04/T06 with user-engine/email-connect |
|
||
| CSOC-UC-012 | Member receives a specifically approved application notification and can obtain help through its reply path | Caller/template/recipient authorization, bounded sending, redacted delivery state and monitored reply route | Future candidate; no product template/caller admitted; T04/T05/T06 |
|
||
|
||
Personal acceptance reference:
|
||
[workspace acceptance](../../history/20261006T185411Z-personal-workspace-acceptance.md).
|
||
Original Bubble reset/invitation semantics remain unobserved; UC-009 establishes
|
||
the replacement's accepted recovery path rather than claiming Bubble parity.
|
||
|
||
## Synthetic regression matrix
|
||
|
||
Only reserved example addresses, synthetic accounts and injected transports are
|
||
allowed. Native recovery tests need an isolated issuer, directory, mailbox sink
|
||
and application; never route a regression through the production mail provider.
|
||
Do not record usable reset/verification URLs in reports. No mailbox scans or
|
||
live sends are part of the gate.
|
||
|
||
| Layer / contract | Existing coverage | Remaining gate |
|
||
| --- | --- | --- |
|
||
| App identity boundary | `tests/test_identity_regressions.py`: consumed callback cannot replay; equal email cannot take over another issuer/subject | UC-009 real-browser issuer reset → local inbox → app login, expired/replayed reset denial, directory isolation |
|
||
| Registration handoff | `tests/test_shell.py::test_registration_link_uses_only_configured_destination` | UC-010 browser request/verify/cancel; preserve tenant/client binding through owner flow |
|
||
| Invitation auth/template/recipient/key/suppression | email-connect `tests/test_transactional.py`: `test_rejects_auth_recipient_template_and_key`, `test_suppression_blocks_send` | Separate caller identities, caller/template/tenant scope, request limits; no authority from payload `source` |
|
||
| Invitation retry / uncertain outcome | Owner tests `test_sends_fixed_template_once`, `test_resend_is_separate_event_and_sends_again`, `test_lost_post_send_record_never_resends_after_restart`, `test_definitive_failure_retries_but_changed_payload_is_rejected`, `test_disconnect_after_smtp_acceptance_never_releases_reservation` | Per-caller event namespace, bounded retry schedule and operator handling of unknown outcomes |
|
||
| Verification privacy and replay | Owner tests `test_registration_verification_is_digest_only_and_single_use`, `test_registration_cancellation_is_single_use_and_prevents_verification`, `test_mailbox_evidence_is_not_authorization`, plus retry/restart/concurrency functions bound below | Expired-handle and binding denials through an isolated owner-spanning browser journey |
|
||
| Provider failure / diagnostic redaction | Owner tests `test_provider_timeout_temporary_and_permanent_are_redacted`, `test_status_authenticates_without_sending_and_redacts_errors` | Diagnostic projections omit bearer values, recipient addresses, message bodies and provider details; caller-scoped status; provider acceptance and inbox receipt shown separately |
|
||
| Reply/bounce operations | Offline scanner fixtures exist in email-connect | Named monitored inbox, authorized inbound access, correlated bounce → suppression, bounded retention and support escalation |
|
||
|
||
Historical owner baseline (2026-10-07): 27 transactional tests pass at source
|
||
`73702b7e1a1671948b0545ef32d6e0de9cca9c65`, clean checkout.
|
||
This is local source evidence, not a deployed version or fresh inbox receipt.
|
||
Reproduction from this repository's installed Python environment:
|
||
|
||
```sh
|
||
PYTHONDONTWRITEBYTECODE=1 PYTHONPATH=/home/worsch/email-connect/src \
|
||
.venv/bin/python -m pytest -c /home/worsch/email-connect/pyproject.toml \
|
||
/home/worsch/email-connect/tests/test_transactional.py -p no:cacheprovider \
|
||
--basetemp=/tmp/csoc-email-owner-tests
|
||
```
|
||
|
||
## Reproducible owner regression gate — 2026-10-08
|
||
|
||
Run `make check-communication EMAIL_CONNECT_ROOT=/path/to/email-connect`.
|
||
`communication-regressions.json` binds 37 module-qualified required test functions covering
|
||
authorization/template/recipient denial, suppression, provider failure and
|
||
redaction, invitation uncertainty and verification restart/concurrency safety.
|
||
The runner copies only Python source and the two declared synthetic test modules to a private
|
||
temporary tree. It denies socket connects and DNS, strips inherited credentials,
|
||
disables plugin autoload, and refuses removed or skipped/xfail contract coverage.
|
||
It leaves the owner checkout untouched. Gate tests in `make check` prove those
|
||
failure boundaries. No mailbox, SMTP, issuer or live account is contacted.
|
||
|
||
The redacted receipt at `var/test-results/communication.json` binds exact
|
||
executed source/test/contract hashes and records counts, missing tests and
|
||
outstanding acceptance. The current owner check passes **66 tests, zero skips**.
|
||
This closes the stale verification-retry baseline above: accepted and uncertain
|
||
outcomes now retain their reservations across retries/restarts; definitive
|
||
retryable refusals cancel the failed challenge before retry.
|
||
|
||
Before marking UC-009–012 as established protected journeys, bind the missing
|
||
browser node IDs in their owners, arrange the isolated issuer/mailbox/application
|
||
harness, and record owner admission. As of 2026-10-11 the app checkout binds
|
||
`test_isolated_recovery_registration_and_invitation` for UC-009/010/011 against
|
||
a loopback double only. That node is not established protection and does not
|
||
replace the real identity portal, email-connect caller, or a productive verdict. `make check` protects UC-008 and tests the
|
||
new app UI; `check-communication` is a separate explicitly selected owner gate.
|
||
Independent caller scopes, persisted limits and redacted status are implemented
|
||
in owner source f703bf6 (EMAIL-WP-0008), with148 full tests including the isolated
|
||
mail harness and scoped-ledger rehearsal. Runtime policy/credential, sender,
|
||
ledger backup admission,
|
||
inbox ownership, DNS alignment and productive per-flow user acceptance remain
|
||
open. [Owner review](/home/worsch/email-connect/docs/caller-admission-2026-10-08.md).
|
||
|
||
## Current work ownership — 2026-10-08
|
||
|
||
WP-0010 is finished at the user's instruction. Existing personal reset acceptance
|
||
and receiver deployment remain evidenced. Its unfinished T04/T05/T06 scopes are
|
||
superseded by WP-0015-T01/T03, WP-0015-T02/T03 and WP-0015-T04 respectively.
|
||
EMAIL-WP-0008-T03, EMAIL-WP-0007 and RPF-WP-0053 retain canonical owner/custody
|
||
work. WP-0010 references above are historical provenance, not active gates.
|
||
|
||
|
||
## Verified owner returns — 2026-10-27
|
||
|
||
EMAIL-WP-0008 completed scoped caller custody/activation on October 9;
|
||
EMAIL-WP-0007 completed independent ledger escrow/kit/reader, mirrored daily
|
||
archives and monitored schedules on October 10. Current receiver policy and
|
||
user-engine bindings remain deployed/Ready. Today's backup and freshness
|
||
checks succeeded and its independent versioned mirror is verified.
|
||
WP-0015-T01/T03 are done; earlier source-only statements above are historical.
|
||
|
||
The offline gate now declares four recovery Python helpers and the synthetic
|
||
ledger-backup test module as well as caller/transactional tests. It copies/hashes
|
||
only those helpers, source and tests and passes **103 tests, zero skips**,
|
||
including real ephemeral age encryption/decryption, all-six-table recovery and
|
||
scoped quota continuity. No production configuration/ledger/custody is copied.
|
||
|
||
Actual owner-spanning browser integration, platform sender/inbound/reply/bounce
|
||
operations and productive UC-010/011 verdicts remain WP-0015-T02/T04.
|
||
UC-009 personal recovery acceptance is preserved; UC-012 remains deferred.
|
||
Details: ../release/acceptance-audit-2026-10-27.md.
|