tegwick
48823c8182
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a119cf-56d0-7fa3-840b-eb8732e1db0b
4.2 KiB
Email receiver deployment — 2026-10-08
Released under the user's explicit “If not please do so” instruction and
State Hub decision 0ef49fde-5e92-4656-ac1e-8f945b4bba08. Source c9756b0 (runtime code f703bf6),
image forgejo.coulomb.social/coulomb/email-connect@sha256:eb3e7b68d21209e9eb71b928a5b0bc987e8e3164f21dca4ff712f946d0c103f2. Deployment revision7, one Ready replica.
Started 2026-10-08T12:05:17Z; elapsed 62.79s.
The live Deployment spec changed only its immutable image. Existing caller token, sender, config, PVC, ServiceAccount and networking are retained. Scoped policy is not selected: per-caller admission is a separate operation in EMAIL-WP-0008-T03 and CSOC-WP-0015-T01. Permanent invitation rejection now remains terminal in the existing startup mode; new caller controls are available for admitted policy. No new caller, credential, sender, mailbox access, offsite upload or timer is activated. No mail was sent for release verification.
Preflight: pinned cluster UID a553c742-0115-43d4-99a4-a5ca56fe0786, old image1e613d43 and one Ready replica, Bound existing PVC, expected database path and no selected caller policy. Node Ready/no pressure, CPU requests3455m of4000m, memory9440Mi, disk120Gi free. Server dry-run proves image-only spec. Seven offline failure scenarios prove pre-patch old-receiver resumption and post-patch stopped-receiver fencing. Guard tests full template and replica count before quiescing; historical helper cannot repeat this completed rollout.
Pause writer, take SQLite backup through read-only data-PVC helper without runtime credentials, rehearse new-schema migration in its private copy, remove helper, patch old-image test→new image, resume and verify. Every row and old column in all five pre-release tables remains unchanged; caller namespace defaults empty, caller budget table empty, two accepted invitation reservations remain duplicate receipts. Isolated local packaged UID10001/read-only-root/network-none migration of the actual copied backup passes the same proof. Synthetic packaged tests prove scoped restart/idempotency, scope denial and redacted reference behavior.
Postflight: healthz/readyz200, unauthorized401, admitted bearer/disallowed template400, invalid verification400, SQLite integrityok, six-table caller schema, zero budget records and no selected scoped policy. One Ready replica, only image spec change and no capture helper left. Public receipt: caller-deployment-2026-10-08.json. Guarded capture and rehearsal helper source pins are repinned together to the new digest; focused backup/release gates pass.
Private pre-release SQLite:49152bytes, SHA256 1c943f28517cb75f324f1b11ed2e24f9aaa9779992a8534ef85906c1ff09dcae. Node root0700 /tmp/email-connect-precallers-20261008/database.sqlite3 and workstation0700 /tmp/csoc-mail-private-j4qnemvw/database.sqlite3 hold matching mode0600 copies. These are temporary custody, not governed offsite recovery. Their retention/ expiry stays live in CSOC-WP-0015-T03 and EMAIL-WP-0007-T03/T04.
Rollback: stop the receiver first and preserve current ledger plus private backup. Prefer rolling forward. Old code ignores caller ownership/budgets and terminal failure policy, and old inserts can fail against added columns. Never use unrestricted rollout undo or overwrite the current ledger with a pre-release snapshot after traffic: reconcile later provider acceptance and challenge use before any release of restored traffic. Scope/mode change needs separate return.
Remaining product work is CSOC-WP-0015 (runtime policy, sender/reply/bounce, independent ledger custody and isolated owner-browser/flow acceptance), with EMAIL-WP-0008-T03 and EMAIL-WP-0007-T03/T04 as canonical owner tasks.
Original product-workplan closure — 2026-10-08
The user explicitly closed CSOC-WP-0008 and CSOC-WP-0010 after registering residual workplans. They are finished historical records, no longer acceptance trackers. Product communication execution and acceptance now belong to CSOC-WP-0015; EMAIL-WP-0008-T03, EMAIL-WP-0007 and RPF-WP-0053 retain their canonical runtime/custody tasks. Existing personal recovery acceptance and the receiver revision7 deployment remain evidenced. No pending owner requirement is waived or marked satisfied by the original workplans' administrative closure.