coulomb-social/docs/usecases/platform-communication.md

Platform communication use cases

CSOC-WP-0010-T06, reviewed 2026-10-07. Authentication uses native Authelia SMTP; application invitation/verification delivery uses the existing email-connect service. ReichelAg protocol distribution remains UC-008's manual clipboard/email workflow.

These stable IDs extend the discovery catalogue. They are not yet entries in the executable product registry: owner-spanning browser coverage is still required under T06. Personal recovery has user acceptance; the gap in its automated end-to-end protection remains explicit.

ID	Actor, goal and steps	Expected outcome / evidence	Status and owner
CSOC-UC-009	Existing member requests a new reset on the identity portal, receives email, sets a password privately, then signs into the app	Fresh inbox receipt and personal workspace reached; reset URL/password never enter app logs, Git or Hub	User-confirmed and accepted 2026-10-06 for the existing personal account; WP-0010-T02/T03 and WP-0008-T11 done
CSOC-UC-010	New member starts approved registration, receives the verification message, then consumes or cancels its link	Expiring, single-use, purpose-bound channel evidence; cancellation and consumption invalidate one another; account admission remains user-engine's decision	Candidate; implemented service behavior, current personal user workflow not reviewed; T04/T06 with user-engine/NetKingdom/email-connect
CSOC-UC-011	Authorized inviter invites a member; a deliberate resend creates a new event	Fixed invitation template, one provider submission per event, suppression respected; provider acceptance does not establish inbox receipt	Candidate; implemented service behavior, productive user acceptance pending; T04/T06 with user-engine/email-connect
CSOC-UC-012	Member receives a specifically approved application notification and can obtain help through its reply path	Caller/template/recipient authorization, bounded sending, redacted delivery state and monitored reply route	Future candidate; no product template/caller admitted; T04/T05/T06

Personal acceptance reference: workspace acceptance. Original Bubble reset/invitation semantics remain unobserved; UC-009 establishes the replacement's accepted recovery path rather than claiming Bubble parity.

Synthetic regression matrix

Only reserved example addresses, synthetic accounts and injected transports are allowed. Native recovery tests need an isolated issuer, directory, mailbox sink and application; never route a regression through the production mail provider. Do not record usable reset/verification URLs in reports. No mailbox scans or live sends are part of the gate.

Layer / contract	Existing coverage	Remaining gate
App identity boundary	tests/test_identity_regressions.py: consumed callback cannot replay; equal email cannot take over another issuer/subject	UC-009 real-browser issuer reset → local inbox → app login, expired/replayed reset denial, directory isolation
Registration handoff	tests/test_shell.py::test_registration_link_uses_only_configured_destination	UC-010 browser request/verify/cancel; preserve tenant/client binding through owner flow
Invitation auth/template/recipient/key/suppression	email-connect tests/test_transactional.py: test_rejects_auth_recipient_template_and_key, test_suppression_blocks_send	Separate caller identities, caller/template/tenant scope, request limits; no authority from payload source
Invitation retry / uncertain outcome	Owner tests test_sends_fixed_template_once, test_resend_is_separate_event_and_sends_again, test_lost_post_send_record_never_resends_after_restart, test_definitive_failure_retries_but_changed_payload_is_rejected, test_disconnect_after_smtp_acceptance_never_releases_reservation	Per-caller event namespace, bounded retry schedule and operator handling of unknown outcomes
Verification privacy and replay	Owner tests test_registration_verification_is_digest_only_and_single_use, test_registration_cancellation_is_single_use_and_prevents_verification, test_mailbox_evidence_is_not_authorization	Retry-safe challenge creation/submission; expired-handle and binding denials through browser; failure/redaction across every verification path
Provider failure / diagnostic redaction	Owner tests test_provider_timeout_temporary_and_permanent_are_redacted, test_status_authenticates_without_sending_and_redacts_errors	No tokens, recipient/body or provider details in diagnostic projections; caller-scoped status; provider acceptance and inbox receipt shown separately
Reply/bounce operations	Offline scanner fixtures exist in email-connect	Named monitored inbox, authorized inbound access, correlated bounce → suppression, bounded retention and support escalation

Fresh owner baseline: 27 transactional tests pass at source 73702b7e1a1671948b0545ef32d6e0de9cca9c65, clean checkout. This is local source evidence, not a deployed version or fresh inbox receipt. Reproduction from this repository's installed Python environment:

PYTHONDONTWRITEBYTECODE=1 PYTHONPATH=/home/worsch/email-connect/src \
  .venv/bin/python -m pytest -c /home/worsch/email-connect/pyproject.toml \
  /home/worsch/email-connect/tests/test_transactional.py -p no:cacheprovider \
  --basetemp=/tmp/csoc-email-owner-tests

Before registering these as protected executable journeys, bind exact fast and browser node IDs in their owning repositories, arrange the isolated cross-owner harness, and link owner regression receipts here. make check currently protects UC-008; it does not execute the issuer/email-connect suites.