coulomb-social/workplans/CSOC-WP-0013-sharing-content-hardening.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	origin	origin_ref	state_hub_workstream_id
CSOC-WP-0013	workplan	Sharing, portability and content-storage acceptance	communication	coulomb-social	active	codex	coulomb-social	2026-10-08	2026-10-31	residual	CSOC-WP-0008	70370f4e-7cba-5b0a-853b-fedcd2bd49a5

Residual acceptance from CSOC-WP-0008, split at the user's request. Existing implementation/release/acceptance evidence remains in the originating workplan; these tasks own the remaining concrete outputs. Source checks never grant runtime or productive acceptance.

Current execution map — 2026-10-31

T01 storage enforcement is complete. T04 now exposes completed fidelity-review preparation. T02 still owns actual corpus/assets fidelity verdicts and final content acceptance; its revision lifecycle detail is T05. T03 owns four separate UC-003/004/005/006 productive verdicts. No review verdict has been inferred from tests or weekly-call acceptance.

The four-workplan assessment records the scope split and effort estimate. Task counts are not effort percentages. Historical notes retain the evidence trail; this map and the task blocks govern current status. No original acceptance requirement has been dropped.

T01 — Finish unambiguous storage enforcement

id: CSOC-WP-0013-T01
status: done
priority: high
needs_human: false
decision_id: "9b320990-0688-4fa9-a947-4b54cf01f5c7"
intervention_note: "Founder executed proposal5fd7ccd8; durable node receipt, independent native postflight, revision18/image51281946, migration0003/global constraint and unchanged92rows/86files verified on 2026-10-31. No further execution is needed for T01."
state_hub_task_id: "4d18a390-c82a-5d6b-8509-1b1704975150"

Decide and enforce the existing global-slug invariant at SQL/storage boundaries, including admin/import concurrency and legacy collision migration refusal. Preserve tenant/member denial and protected journeys. Prepare migration/rollback proof before a guarded rollout.

2026-10-11: spaces_space_slug_global_uniq is in the model and migration 0003. The migration raises before adding the constraint when any slug is duplicated and does not rename, merge, or delete those rows. Admin save, space create and import map the constraint failure to the existing validation errors. Rollback is manage.py migrate spaces 0002, which drops only the global constraint. Tests cover parallel inserts, a missed import pre-check, an admin race, inactive slug reservation, migration refusal, and the legacy fail-closed reads. The live database has not been migrated.

2026-10-27: Added a real MigrationExecutor forward/refusal/reverse/reapply regression and rehearsed it on disposable PostgreSQL 16.14. Conflicting rows and grants stay unchanged; rollback retains tenant uniqueness. Current production has zero duplicate slug groups and still only migrations 0001/0002. Guarded release remains open. Proof: docs/release/storage-migration-rehearsal-2026-10-27.json.

2026-10-27 candidate: c11300a published at digest fb579adefa6e3e0c16fedeac134b2e05f4ed6216807cb25995fbc0da826c1167. Its actual packaged Django/source pass the PostgreSQL lifecycle proof, with only pytest tools injected. Migration drift check and server dry-run pass; Helm render comparison changes only the app image across three resources. Live rollout still requires a fresh paired rollback point/rehearsal. Proof: docs/release/storage-candidate-c11300a-2026-10-27.json.

2026-10-28: Refreshed candidate 17d0eb6 is published at OCI digest 512819463a1902b43a615beee14be7bf97e6a05e016385082b9380692ad1a8cd. Actual packaged source/Django pass PostgreSQL 16.14 forward/refusal/reverse/reapply proof. Packaged network-none checks reject missing Bubble index/chunk dates before writes and preserve original SQL space dates and exact chunk bytes/metadata. Packaged source hashes match the tested worktree; full source gate 231 passes. Migration drift is absent; current Helm comparison changes only the deployment image across three resources, and server dry-run passes. This supersedes c11300a as the prepared candidate and includes the strict source-date guard. No production migration or deployment; fresh paired rollback/recovery proof remains required. Evidence: docs/release/storage-candidate-17d0eb6-2026-10-28.json.

2026-10-29: The independently provider-recovered real pair now passes candidate forward/refusal/reverse/reapply while preserving all12business tables/91rows and 82files; all39pages/owner/viewer/ungranted checks pass. Old9a646d8e also reads the migrated copy and denies unsaved outsiders. Live data hashes exactly match that recovered point. Native live preflight proves revision17, one Ready Recreate replica, Bound PVC, no pressure and68%CPU/76%memory requests. Three-resource comparison changes only the app image. Exact sealed client/server/Helm dry-runs pass without app/schema changes. Full make check246passes; ten synthetic release safety cases and Helm lint pass.

The founder's new exact-action disposition is required by the deployment owner's standing supervision rules. Prepared rollout includes a fresh already-admitted paired capture/readback, data-drift refusals, atomic Helm rollout, read-only postflight, image rollback preserving writes and root-owned backup-helper image pin refresh. The packet and one attended command are in docs/release/storage-release-review-2026-10-29.md; proposal3389c506d86f1613c6567a2bba5c29ae22b812f19b011ebe454bb08af39a4132, pending decision05c9b00f-e4e4-4593-bdeb-c63fe6a4fe15. No new Scaleway login or credential delivery is needed. No live migration, rollout, SQL date correction, purge, grants, mail or timer change has been made. T01 waits only at that exact privileged execution gate; other workplan tasks remain active.

Evidence: storage-real-pair-rehearsal-2026-10-29.json, storage-rollback-compatibility-2026-10-29.json, storage-release-preflight-2026-10-29.json and storage-sealed-preflight-2026-10-29.json under docs/release/.

2026-10-31 current-point refresh: old proposal3389c506 correctly refused live data drift. Founder capture at23:50:40Z was verified on the node, mirrored and independently recovered. Candidate forward/refusal/reverse/reapply preserves 92 business rows/86 files; 40 owner pages and outsider denials pass, including old-image compatibility after migration. Corrected complete provider kit and separate protected proof recover in42.651s. New exact proposal5fd7ccd8 retains the same code/chart/image and passes native read-only preflight. Founder execution/postflight remains required; no live image/schema change occurred. Packet: docs/release/storage-release-review-2026-10-31.md. Pending replacement decision9b320990-0688-4fa9-a947-4b54cf01f5c7 replaces the stale proposal's review.

2026-10-31 founder execution completed: durable proposal5fd7ccd8 receipt reports storage_candidate_deployed_verified at00:29:28Z, Helm revision18 and99.527s. Independent fresh read-only postflight verifies current image51281946, applied migration0003/global and tenant constraints, zero duplicates, all92business rows and86files unchanged,40actual owner pages and40unsaved-outsider denials. Current snapshot helper hash matches the sealed replacement4ff81b79 and its server dry-run passes; paired worker43e119ac remains unchanged. All73packaged source files match source17d0eb6 exactly. Receipt and independent evidence are under docs/release/storage-release-{receipt,independent-postflight,source-provenance}-2026-10-31.json. T01 is done. Productive corpus/sharing/portability verdicts remain T02/T03.

T02 — Complete content fidelity and revision lifecycle

id: CSOC-WP-0013-T02
status: progress
priority: high
state_hub_task_id: "8d06cdee-e0ce-5c3e-bf98-705deed0ee62"

Review custom Markdown/raw HTML and body-linked assets with privately nominated corpus examples. Define revision retention/purge and failed multi-file copy/move crash recovery without losing source or incoming-address authorization. Current immutable revisions, stale-edit refusal, supported Markdown attachments and aliases are deployed; preserve them.

2026-10-11: Supported Markdown is fenced code, tables, newline breaks and sane lists. Raw HTML, script, event handlers and non-http(s)/mailto URLs are removed. Relative asset URLs stay. No private corpus has been nominated, so this is not corpus acceptance. Revisions are not purged on save. purge_revisions deletes only inactive revisions older than an explicit timezone-aware cutoff, keeps the live page bytes, and keeps every revision of a deleted page. A hash mismatch aborts the purge before any deletion. Copy and move write a journal under CONTENT_ROOT/.recovery. The next content write finishes a confirmed move or discards an unconfirmed destination. The source is deleted only when its bytes still match the journal. Alias changes do not grant destination access. The live content root has not been purged or recovered.

2026-10-28: The refreshed all-space capture supplies privately scoped corpus examples without sending note bodies to inference. Added deterministic audit/cards using the actual product renderer and the same intermediate Markdown path, with no renderer policy change. All 244 captured article records remain represented; 241 bodies render, three are missing. Six records have structural sanitizer changes: three removed custom tags and 17 removed attributes. Extracted text is unchanged between intermediate and sanitized HTML, which does not establish fidelity to Bubble. Private source/product cards prioritize those exceptions, disable sample resources/interaction and link explicitly to the original view. No productive verdict inferred. Hash/count-only receipt: docs/release/corpus-rendering-audit-2026-10-28.json. Exact review steps are appended to docs/usecases/sharing-portability-review.md. User comparison/verdicts remain open.

2026-10-31: Renewed source continuation added one article/body. Rebuilt private rendering cards cover 245 records/242 bodies, with the same six markup-change cases and three body-missing records. No source/product fidelity verdict is inferred. Cards: ~/.config/coulomb-social/auth/exports/rendering-review-20261031/index.html. The review guide now identifies the deployed revision 18/storage release instead of incorrectly describing storage hardening as unreleased. Source/capture proof: docs/release/bubble-source-continuation-2026-10-31.json. Productive UC-003–006 verdicts and remaining content/revision obligations are still open.

T03 — Review productive sharing and personal portability

id: CSOC-WP-0013-T03
status: todo
priority: high
state_hub_task_id: "8edd7661-17b0-5aa0-b177-6170aa159623"

Review owner Share space/revocation, reader/outsider denial, account-local export, successor ownership and local exit semantics with the user. Keep platform identity outside app deletion. Record UC-003/004/005/006 verdicts independently; weekly-call acceptance is UC-008 only.

2026-10-27: User requested prepared review steps rather than supplying verdicts. Prepared exact UC-003–006 steps in docs/usecases/sharing-portability-review.md; no acceptance inferred.

T04 — Prepare private corpus fidelity review evidence

id: CSOC-WP-0013-T04
status: done
priority: high
state_hub_task_id: "17a2e781-5e44-5e89-8b76-e357d32de7ab"

Captured-source audit and private source/product cards cover 245 records/242 bodies, explicitly retaining three missing bodies and six markup-change cases. Review steps identify source/product comparison and separate resource review. Evidence: docs/release/corpus-rendering-audit-2026-10-28.json, bubble-source-continuation-2026-10-31.json and docs/usecases/sharing-portability-review.md. This closes preparation only; the actual verdict belongs to T02.

T05 — Accept revision retention and interrupted copy or move recovery

id: CSOC-WP-0013-T05
status: todo
priority: high
state_hub_task_id: "c2986a84-4da2-5fb3-b021-7bbe5104fe47"

Explicit lifecycle portion of T02: review the existing revision purge/retention policy and failed multi-file copy/move recovery, preserve source/incoming-address authorization, and obtain the required operational/product acceptance. Reuse existing source and crash-recovery tests; investigate concrete gaps before adding implementation. No live purge is authorized by task creation. Close with the agreed policy and evidence for the intended lifecycle.

Completion

Finish when every task above has its stated evidence and acceptance, or hand off any newly discovered residual to a live work record first. Cross-owner dependencies remain their existing canonical records.