coulomb-social/workplans/CSOC-WP-0013-sharing-content-hardening.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	origin	origin_ref	state_hub_workstream_id
CSOC-WP-0013	workplan	Sharing, portability and content-storage acceptance	communication	coulomb-social	active	codex	coulomb-social	2026-10-08	2026-10-29	residual	CSOC-WP-0008	70370f4e-7cba-5b0a-853b-fedcd2bd49a5

Residual acceptance from CSOC-WP-0008, split at the user's request. Existing implementation/release/acceptance evidence remains in the originating workplan; these tasks own the remaining concrete outputs. Source checks never grant runtime or productive acceptance.

T01 — Finish unambiguous storage enforcement

id: CSOC-WP-0013-T01
status: wait
priority: high
needs_human: true
decision_id: "05c9b00f-e4e4-4593-bdeb-c63fe6a4fe15"
intervention_note: "Exact storage/content release is prepared and native preflight passes. Founder attended execution of reviewed proposal3389c506 is required by current deployment supervision rules; run the one command in docs/release/storage-release-review-2026-10-29.md. Prior backup/custody approvals remain valid."
state_hub_task_id: "4d18a390-c82a-5d6b-8509-1b1704975150"

Decide and enforce the existing global-slug invariant at SQL/storage boundaries, including admin/import concurrency and legacy collision migration refusal. Preserve tenant/member denial and protected journeys. Prepare migration/rollback proof before a guarded rollout.

2026-10-11: spaces_space_slug_global_uniq is in the model and migration 0003. The migration raises before adding the constraint when any slug is duplicated and does not rename, merge, or delete those rows. Admin save, space create and import map the constraint failure to the existing validation errors. Rollback is manage.py migrate spaces 0002, which drops only the global constraint. Tests cover parallel inserts, a missed import pre-check, an admin race, inactive slug reservation, migration refusal, and the legacy fail-closed reads. The live database has not been migrated.

2026-10-27: Added a real MigrationExecutor forward/refusal/reverse/reapply regression and rehearsed it on disposable PostgreSQL 16.14. Conflicting rows and grants stay unchanged; rollback retains tenant uniqueness. Current production has zero duplicate slug groups and still only migrations 0001/0002. Guarded release remains open. Proof: docs/release/storage-migration-rehearsal-2026-10-27.json.

2026-10-27 candidate: c11300a published at digest fb579adefa6e3e0c16fedeac134b2e05f4ed6216807cb25995fbc0da826c1167. Its actual packaged Django/source pass the PostgreSQL lifecycle proof, with only pytest tools injected. Migration drift check and server dry-run pass; Helm render comparison changes only the app image across three resources. Live rollout still requires a fresh paired rollback point/rehearsal. Proof: docs/release/storage-candidate-c11300a-2026-10-27.json.

2026-10-28: Refreshed candidate 17d0eb6 is published at OCI digest 512819463a1902b43a615beee14be7bf97e6a05e016385082b9380692ad1a8cd. Actual packaged source/Django pass PostgreSQL 16.14 forward/refusal/reverse/reapply proof. Packaged network-none checks reject missing Bubble index/chunk dates before writes and preserve original SQL space dates and exact chunk bytes/metadata. Packaged source hashes match the tested worktree; full source gate 231 passes. Migration drift is absent; current Helm comparison changes only the deployment image across three resources, and server dry-run passes. This supersedes c11300a as the prepared candidate and includes the strict source-date guard. No production migration or deployment; fresh paired rollback/recovery proof remains required. Evidence: docs/release/storage-candidate-17d0eb6-2026-10-28.json.

2026-10-29: The independently provider-recovered real pair now passes candidate forward/refusal/reverse/reapply while preserving all12business tables/91rows and 82files; all39pages/owner/viewer/ungranted checks pass. Old9a646d8e also reads the migrated copy and denies unsaved outsiders. Live data hashes exactly match that recovered point. Native live preflight proves revision17, one Ready Recreate replica, Bound PVC, no pressure and68%CPU/76%memory requests. Three-resource comparison changes only the app image. Exact sealed client/server/Helm dry-runs pass without app/schema changes. Full make check246passes; ten synthetic release safety cases and Helm lint pass.

The founder's new exact-action disposition is required by the deployment owner's standing supervision rules. Prepared rollout includes a fresh already-admitted paired capture/readback, data-drift refusals, atomic Helm rollout, read-only postflight, image rollback preserving writes and root-owned backup-helper image pin refresh. The packet and one attended command are in docs/release/storage-release-review-2026-10-29.md; proposal3389c506d86f1613c6567a2bba5c29ae22b812f19b011ebe454bb08af39a4132, pending decision05c9b00f-e4e4-4593-bdeb-c63fe6a4fe15. No new Scaleway login or credential delivery is needed. No live migration, rollout, SQL date correction, purge, grants, mail or timer change has been made. T01 waits only at that exact privileged execution gate; other workplan tasks remain active.

Evidence: storage-real-pair-rehearsal-2026-10-29.json, storage-rollback-compatibility-2026-10-29.json, storage-release-preflight-2026-10-29.json and storage-sealed-preflight-2026-10-29.json under docs/release/.

T02 — Complete content fidelity and revision lifecycle

id: CSOC-WP-0013-T02
status: progress
priority: high
state_hub_task_id: "8d06cdee-e0ce-5c3e-bf98-705deed0ee62"

Review custom Markdown/raw HTML and body-linked assets with privately nominated corpus examples. Define revision retention/purge and failed multi-file copy/move crash recovery without losing source or incoming-address authorization. Current immutable revisions, stale-edit refusal, supported Markdown attachments and aliases are deployed; preserve them.

2026-10-11: Supported Markdown is fenced code, tables, newline breaks and sane lists. Raw HTML, script, event handlers and non-http(s)/mailto URLs are removed. Relative asset URLs stay. No private corpus has been nominated, so this is not corpus acceptance. Revisions are not purged on save. purge_revisions deletes only inactive revisions older than an explicit timezone-aware cutoff, keeps the live page bytes, and keeps every revision of a deleted page. A hash mismatch aborts the purge before any deletion. Copy and move write a journal under CONTENT_ROOT/.recovery. The next content write finishes a confirmed move or discards an unconfirmed destination. The source is deleted only when its bytes still match the journal. Alias changes do not grant destination access. The live content root has not been purged or recovered.

2026-10-28: The refreshed all-space capture supplies privately scoped corpus examples without sending note bodies to inference. Added deterministic audit/cards using the actual product renderer and the same intermediate Markdown path, with no renderer policy change. All 244 captured article records remain represented; 241 bodies render, three are missing. Six records have structural sanitizer changes: three removed custom tags and 17 removed attributes. Extracted text is unchanged between intermediate and sanitized HTML, which does not establish fidelity to Bubble. Private source/product cards prioritize those exceptions, disable sample resources/interaction and link explicitly to the original view. No productive verdict inferred. Hash/count-only receipt: docs/release/corpus-rendering-audit-2026-10-28.json. Exact review steps are appended to docs/usecases/sharing-portability-review.md. User comparison/verdicts remain open.

T03 — Review productive sharing and personal portability

id: CSOC-WP-0013-T03
status: todo
priority: high
state_hub_task_id: "8edd7661-17b0-5aa0-b177-6170aa159623"

Review owner Share space/revocation, reader/outsider denial, account-local export, successor ownership and local exit semantics with the user. Keep platform identity outside app deletion. Record UC-003/004/005/006 verdicts independently; weekly-call acceptance is UC-008 only.

2026-10-27: User requested prepared review steps rather than supplying verdicts. Prepared exact UC-003–006 steps in docs/usecases/sharing-portability-review.md; no acceptance inferred.

Completion

Finish when every task above has its stated evidence and acceptance, or hand off any newly discovered residual to a live work record first. Cross-owner dependencies remain their existing canonical records.