tegwick
a60a729421
The draft names the live registration binding and quotas, and records that current invitation envelopes are still denied. Ledger tasks stay waiting on pair custody. Assistant: grok Assistant-Session: 01a11cdb-f9fe-7011-947c-936e72007e54
5.4 KiB
| id | type | title | domain | repo | status | owner | topic_slug | created | updated | origin | origin_ref | state_hub_workstream_id |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EMAIL-WP-0008 | workplan | Isolate explicitly admitted transactional mail callers | infotech | email-connect | active | codex | netkingdom | 2026-10-08 | 2026-10-08 | residual | CSOC-WP-0010 | 3a0f264d-e441-5b12-964e-dab8fe5b3828 |
CSOC-WP-0010-T04 needs independent caller credentials, bounded template/tenant permissions, durable limits and scoped diagnostics. This record owns receiver source and its admission; current live single-caller SMTP remains unchanged.
T01 — Implement explicit caller policies and durable isolation
id: EMAIL-WP-0008-T01
status: done
priority: high
state_hub_task_id: "3f63b288-b2ea-506e-ba86-e7fa5778abb1"
Opt-in read-only policy/token-file loader, fixed operation/template/binding admission, exact credential/source identity, per-caller invitations/verifications, atomic persistent request budgets, bounded input, redacted scoped status and privileged suppression controls. Invalid selected policy refuses startup without legacy fallback. Permanent invitation failures now remain terminal across restart; confirmed temporary failures can retry. Unknown outcomes never resend. Explicit original-caller legacy adoption preserves accepted evidence.
T02 — Prove isolation, retry policy and recovered-ledger continuity
id: EMAIL-WP-0008-T02
status: done
priority: high
state_hub_task_id: "88bd986d-6030-59ce-a0e2-74cdad5266e7"
Synthetic tests cover cross-caller handle denial without mutation, scope changes, independent retries, permanent/temporary/unknown outcome, restart, concurrent budgets, backward clock, size/config failure and safe status. App owner gate binds exact tests to modules with no network or inherited secrets. Ledger fingerprint includes rate budgets; rehearsal must preserve scoped accepted and unknown evidence and quota rows without sending. Final owner gate:148passed, zero skips, including the loopback-only GreenMail harness. Network-denied app owner gate:66passed, zero skips. Ruff passes for receiver and caller module/tests. T03 remains waiting for runtime admission.
T03 — Admit original caller transition, runtime custody and recovery
id: EMAIL-WP-0008-T03
status: wait
priority: high
needs_human: true
intervention_note: "Actual callers/scopes/quotas and separate token custody, platform sender/reply/bounce ownership, schema rollout/rollback and independent ledger recovery admission remain unapproved; source tests do not activate them."
state_hub_task_id: "9b4c7260-a6bf-54f9-82f8-2e98c368d294"
Retain this live admission record before any completion. Choose real binding and operation sets/quotas, independent credential delivery and explicit legacy adoption. Review exact immutable image and additive schema migration/rollback. Repin guarded capture/rehearsal helpers together. EMAIL-WP-0007-T03/T04 and RPF-WP-0053-T05/T06 retain offsite archive/atomic credential pair custody. CSOC-WP-0015 retains platform operations and productive/browser review. Review: docs/caller-admission-2026-10-08.md. No sender, caller, token, image, mailbox, production ledger, network admission, upload or timer is activated.
T04 — Deploy the tested receiver source in the admitted startup mode
id: EMAIL-WP-0008-T04
status: done
priority: high
state_hub_task_id: "7035b89f-c23f-5240-aa6d-5b77146bb8dc"
User explicitly instructed deployment. Image eb3e7b68 from sourcec9756b0 is live, revision7, one Ready replica. Image-only spec guard/server dry-run, quiesced private backup, five-table row preservation/new-schema migration, packaged UID10001/no-network rehearsal and no-send denial checks pass. Elapsed62.79s; decision0ef49fde-5e92-4656-ac1e-8f945b4bba08. No scoped policy, sender/caller change or timer activated. Capture/rehearsal helper source pins move together to this digest; old-version recovery and downgrade require their bound receipts. Review: docs/caller-deployment-2026-10-08.md and JSON receipt. T03 stays wait for actual scoped-policy/credential admission. Product follow-up CSOC-WP-0015 and existing EMAIL-WP-0007/RPF-WP-0053 retain operations/recovery.
Original product-workplan closure — 2026-10-08
The user explicitly closed CSOC-WP-0008 and CSOC-WP-0010 after registering residual workplans. They are finished historical records, no longer acceptance trackers. Product communication execution and acceptance now belong to CSOC-WP-0015; EMAIL-WP-0008-T03, EMAIL-WP-0007 and RPF-WP-0053 retain their canonical runtime/custody tasks. Existing personal recovery acceptance and the receiver revision7 deployment remain evidenced. No pending owner requirement is waived or marked satisfied by the original workplans' administrative closure.
User-engine policy draft — 2026-10-08
Founder asked for a user-engine-only draft and no activation. Draft: config/callers.user-engine.draft.json. Review: docs/caller-policy-draft-2026-10-08.md. It names caller/source user-engine, binding tenant:coulomb/coulomb-social, send, delivery-status, status, verify, consume and cancel, both family templates, 10/minute, burst 5, 8192-byte cap, and legacy verification adoption. No suppress operation and no token value. Current invitation envelopes omit client_id, so this draft does not admit them. The token path is not created and EMAIL_CONNECT_CALLERS_FILE is not set. T03 stays wait for approval of these bindings, quotas and separate token custody.