coulomb-social/workplans/CSOC-WP-0015-communication-runtime-acceptance.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	origin	origin_ref	state_hub_workstream_id
CSOC-WP-0015	workplan	Communication runtime, inbox operations and flow acceptance	communication	coulomb-social	active	codex	coulomb-social	2026-10-08	2026-10-27	residual	CSOC-WP-0010	38208f72-c285-56fa-be44-de9b59a4e031

Residual acceptance from CSOC-WP-0010, split at the user's request. Existing implementation/release/acceptance evidence remains in the originating workplan; these tasks own the remaining concrete outputs. Source checks never grant runtime or productive acceptance.

T01 — Admit and activate explicit transactional caller policies

id: CSOC-WP-0015-T01
status: done
priority: high
state_hub_task_id: "e87ea643-7bee-5427-b4f5-b32f20dc2f29"

Receiver source is implemented and image deployment recorded in EMAIL-WP-0008. EMAIL-WP-0008-T03 owns actual caller/binding/template/operation/quotas, separate token custody/delivery and original-caller transition. Product acceptance verifies the admitted integration; avoid duplicating receiver implementation or granting arbitrary app notifications.

2026-10-27: EMAIL-WP-0008 completed scoped caller custody and coordinated activation on October 9. Current receiver policy/projection and user-engine tenant/client bindings are present, both deployments Ready. Owner no-send denial/replay receipts and the expanded 103-test isolated gate verify the admitted integration. Productive flow verdicts remain T04. See docs/release/acceptance-audit-2026-10-27.md.

T02 — Establish platform sender and monitored reply/bounce ownership

id: CSOC-WP-0015-T02
status: todo
priority: high
state_hub_task_id: "0604cb15-72c7-5d15-bb42-0335d4ec80df"

Review replacing the receiver forgejo sender with platform identity through its credential owner, then name reply/inbox/support owner and prove authorized inbound access, DNS MX/SPF/DKIM/DMARC, correlated bounce/suppression and retention. No unsolicited scans or auto responses. Existing native personal reset is accepted and stays separately evidenced.

T03 — Complete independent ledger recovery and copy custody

id: CSOC-WP-0015-T03
status: done
priority: high
state_hub_task_id: "286e60bf-76a1-5a18-bd2c-edd9d1400c41"

EMAIL-WP-0007-T03/T04 and RPF-WP-0053-T05/T06 own primary archive admission/atomic credential pair, first encrypted capture/retrieval/rehearsal and monitoring. Require image/schema-bound six-table recovery, restored accepted/unknown/consumed/cancelled/suppressed/quota continuity and post-capture reconciliation; govern temporary pre-release copies.

2026-10-27: EMAIL-WP-0007 completed independent provider escrow, separately bound recovery reader, nonexpiring image/tools/receipt kit, six-table offline recovery, mirrored rolling archives and monitored schedules on October 10. Fresh checks show both timers active and today's backup/freshness successful, with verified mirror. The app gate now binds real encryption/recovery and scoped quota continuity tests; 103 owner cases pass with zero skips. Historical private copies remain retained pending explicit owner disposition, with no inferred expiry/deletion. Production restore still requires fencing and post-capture reconciliation. See the audit.

T04 — Establish owner-spanning browser journeys and productive flow verdicts

id: CSOC-WP-0015-T04
status: progress
priority: high
state_hub_task_id: "7c718d86-8f0d-5cb2-a765-b0c07116005c"

Use isolated issuer/directory/local mail sink/app for UC-009/010/011. Bind exact mandatory browser nodes without production URLs/accounts or SMTP provider sends; test expired/replayed handles and tenant/client/caller denials. Future UC-012 needs a user-selected product template/caller. Preserve UC-008 manual mail distribution and UC-009 existing personal reset acceptance.

2026-10-11: the checkout has a loopback issuer, directory and mailbox double. The browser node is bound on UC-009/010/011 and still established: false. It covers reset-to-local-mailbox, sign-in, callback replay, expired and reused handles, tenant and client refusal, registration verify/cancel, and caller/suppression invitation counts. No SMTP, production account, or live issuer is contacted. Real user-engine/email-connect admission, DNS and productive per-flow verdicts remain open. UC-012 stays deferred. Gate for this slice: make check 200 passed.

Completion

Finish when every task above has its stated evidence and acceptance, or hand off any newly discovered residual to a live work record first. Cross-owner dependencies remain their existing canonical records.