email-connect/workplans/EMAIL-WP-0008-scoped-transactional-callers.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	origin	origin_ref	state_hub_workstream_id
EMAIL-WP-0008	workplan	Isolate explicitly admitted transactional mail callers	infotech	email-connect	active	codex	netkingdom	2026-10-08	2026-10-08	residual	CSOC-WP-0010	3a0f264d-e441-5b12-964e-dab8fe5b3828

CSOC-WP-0010-T04 needs independent caller credentials, bounded template/tenant permissions, durable limits and scoped diagnostics. This record owns receiver source and its admission; current live single-caller SMTP remains unchanged.

T01 — Implement explicit caller policies and durable isolation

id: EMAIL-WP-0008-T01
status: done
priority: high
state_hub_task_id: "3f63b288-b2ea-506e-ba86-e7fa5778abb1"

Opt-in read-only policy/token-file loader, fixed operation/template/binding admission, exact credential/source identity, per-caller invitations/verifications, atomic persistent request budgets, bounded input, redacted scoped status and privileged suppression controls. Invalid selected policy refuses startup without legacy fallback. Permanent invitation failures now remain terminal across restart; confirmed temporary failures can retry. Unknown outcomes never resend. Explicit original-caller legacy adoption preserves accepted evidence.

T02 — Prove isolation, retry policy and recovered-ledger continuity

id: EMAIL-WP-0008-T02
status: done
priority: high
state_hub_task_id: "88bd986d-6030-59ce-a0e2-74cdad5266e7"

Synthetic tests cover cross-caller handle denial without mutation, scope changes, independent retries, permanent/temporary/unknown outcome, restart, concurrent budgets, backward clock, size/config failure and safe status. App owner gate binds exact tests to modules with no network or inherited secrets. Ledger fingerprint includes rate budgets; rehearsal must preserve scoped accepted and unknown evidence and quota rows without sending. Final owner gate:148passed, zero skips, including the loopback-only GreenMail harness. Network-denied app owner gate:66passed, zero skips. Ruff passes for receiver and caller module/tests. T03 remains waiting for runtime admission.

T03 — Admit original caller transition, runtime custody and recovery

id: EMAIL-WP-0008-T03
status: wait
priority: high
needs_human: true
intervention_note: "Actual callers/scopes/quotas and separate token custody, platform sender/reply/bounce ownership, schema rollout/rollback and independent ledger recovery admission remain unapproved; source tests do not activate them."
state_hub_task_id: "9b4c7260-a6bf-54f9-82f8-2e98c368d294"

Retain this live admission record before any completion. Choose real binding and operation sets/quotas, independent credential delivery and explicit legacy adoption. Review exact immutable image and additive schema migration/rollback. Repin guarded capture/rehearsal helpers together. EMAIL-WP-0007-T03/T04 and RPF-WP-0053-T05/T06 retain offsite archive/atomic credential pair custody. CSOC-WP-0015 retains platform operations and productive/browser review. Review: docs/caller-admission-2026-10-08.md. No sender, caller, token, image, mailbox, production ledger, network admission, upload or timer is activated.

T04 — Deploy the tested receiver source in the admitted startup mode

id: EMAIL-WP-0008-T04
status: done
priority: high
state_hub_task_id: "7035b89f-c23f-5240-aa6d-5b77146bb8dc"

User explicitly instructed deployment. Image eb3e7b68 from sourcec9756b0 is live, revision7, one Ready replica. Image-only spec guard/server dry-run, quiesced private backup, five-table row preservation/new-schema migration, packaged UID10001/no-network rehearsal and no-send denial checks pass. Elapsed62.79s; decision0ef49fde-5e92-4656-ac1e-8f945b4bba08. No scoped policy, sender/caller change or timer activated. Capture/rehearsal helper source pins move together to this digest; old-version recovery and downgrade require their bound receipts. Review: docs/caller-deployment-2026-10-08.md and JSON receipt. T03 stays wait for actual scoped-policy/credential admission. Product follow-up CSOC-WP-0015 and existing EMAIL-WP-0007/RPF-WP-0053 retain operations/recovery.

Original product-workplan closure — 2026-10-08

The user explicitly closed CSOC-WP-0008 and CSOC-WP-0010 after registering residual workplans. They are finished historical records, no longer acceptance trackers. Product communication execution and acceptance now belong to CSOC-WP-0015; EMAIL-WP-0008-T03, EMAIL-WP-0007 and RPF-WP-0053 retain their canonical runtime/custody tasks. Existing personal recovery acceptance and the receiver revision7 deployment remain evidenced. No pending owner requirement is waived or marked satisfied by the original workplans' administrative closure.