email-connect/workplans/EMAIL-WP-0010-platform-sender-transition.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	related	state_hub_workstream_id
EMAIL-WP-0010	workplan	Supervised platform sender transition with ledger continuity	infotech	email-connect	active	codex	email-connect	2026-10-31	2026-10-31	CSOC-WP-0015 RPF-WP-0068	6d8e1363-e67e-5837-bb6f-e5a95f43d71b

Owner execution dependency of CSOC-WP-0015-T02. The platform mailbox's additional reader admission is RPF-WP-0068/CCR-2026-0056; this workplan does not duplicate or self-approve that credential lane. Bernd/platform-root reply ownership is settled. Existing caller admission, image, ledger, backup schedules and old custody remain in scope for preservation. Productive sender/return handling stays in CSOC-WP-0015.

T01 — Establish native ledger and receiver transition boundaries

id: EMAIL-WP-0010-T01
status: done
priority: high
state_hub_task_id: "f5b03013-3c1b-5b1a-86e2-a96dd817fa00"

Completed 2026-10-31 with scripts/inspect-sender-ledger.py and docs/sender-ledger-native-2026-10-31.json. The read-only helper fingerprints all six tables and classifies outcomes in one SQLite transaction, including committed WAL. Native generation 74/image 5d79fd1f retains forgejo@coulomb.social. Packaged transactional source matches the owner checkout. Two invitation receipts and 121 verification attempts are accepted; zero unknown/unrecognized/orphan outcomes, zero unlinked challenges, one suppression. No message body, address, handle, credential or individual record was printed. No deployment or ledger write.

Successful invitations can retain an in_flight attempt; the deliveries row is authoritative. The receiver has no explicit SIGTERM drain handler. A process exit can leave an uncertain provider outcome, which must remain non-retryable. This observation is not a writer fence, backup, outcome repair or approval. Twelve new synthetic cases pass, including concurrent WAL writes, retry continuity, exact archive-fingerprint compatibility and private-output refusal. Owner suite: 192 passed, 21 skipped (pre-existing opt-in container harness tests).

T02 — Prepare and rehearse the supervised configuration executor

id: EMAIL-WP-0010-T02
status: wait
blocking_reason: "Executor and assembly tests complete; sealing the live proposal requires verified RPF-WP-0068-T04 and its successful foundation receipt."
priority: high
depends_on: [EMAIL-WP-0010-T01, RPF-WP-0068-T04]
state_hub_task_id: "acb6f995-9177-5a3c-909a-feb152d6bfed"

Turn the existing five-operation consumer candidate into a concrete source-bound sender executor after inspecting the actual service/caller boundary. Reuse the already prepared foundation resources; do not recreate them. Pin cluster, namespace, deployment, image, existing caller policy/projections and complete before/after configuration. Preserve all unrelated deployment fields and old credential custody. The actual source sender change is only forgejo@ -> platform@, with the dedicated admitted SMTP projection and explicit username.

Prove writer quiescence, fresh recoverable ledger capture, outcome classification, complete data preservation, private durable intent before every mutation and independent runtime/no-send checks. Reuse existing ledger capture/rehearsal and fixed projection proof. Review ambiguity after SIGTERM/lost replies, interruption before/after each configuration change, and rollback with legitimate subsequent ledger writes. Never restore a pre-release ledger, replay uncertain sends, reenable the retired legacy bearer or delete old custody as a configuration rollback. Prepare a bounded recovery procedure that refuses unrelated drift. Deliver the exact review packet and passing synthetic/native dry-run evidence before asking for execution; a read-only ledger snapshot alone does not close this task.

2026-10-31 protocol implementation: scripts/sender_transition.py implements private durable intent records, the exact sender/environment delta, interrupted configuration recovery and six-table continuity comparison. Ten real child-process exits cover phase boundaries and lost API replies against a file-backed cluster fixture; recovery retains subsequent accepted/unknown sends and existing retry refusal. Other cases cover repeated recovery interruption, unchanged protected state, source/configuration drift, absent admission, journal privacy/truncation, unexpected writer resume and preservation of consumed links, quotas and new rows. All 27 new cases pass; owner default suite 219 passed / 21 existing optional harness skips.

The protocol-core review is docs/sender-transition-protocol-2026-10-31.md.

2026-10-31 native adapter follow-through: scripts/sender_native.py now implements UID/spec compare-and-swap, metadata-only Secret queries, exact foundation receipt and projection checks, the existing exclusive capture lock, PVC/PV/node binding, writer fencing, durable helper identities, UID-preconditioned cleanup and actual runtime/no-send checks. Five native server dry-runs passed without a configuration change. The actual snapshot/replay path passed in the pinned receiver image with a synthetic ledger, networking disabled and the source mounted read-only; its disposable container was removed. Thirty new adapter cases pass; full owner suite 249 passed / 21 existing optional harness skips, Ruff clean. Public receipts bind the source hashes and scope of each proof. Review: docs/sender-native-adapter-2026-10-31.md.

2026-10-31 assembled execution follow-through: scripts/release-sender.py and scripts/sender_release.py bind eight source files, native preimages, the exact foundation receipt and verified owner handoff into an exclusive private capsule. The launcher requires a human terminal and exact digest confirmation for deploy or recovery; the node retains source capsule/journal/process identities and uses the actual adapter/protocol. Twenty-one new cases prove the assembled forward and recovery paths against modeled Kubernetes with real SQLite and WSGI probes, including a lost configuration response, subsequent accepted/unknown sends, capture-lock contention, source/receipt/owner drift and unconfirmed SSH outcomes. All four new projection UIDs are sealed; replacement refuses deployment while configuration recovery remains available. Owner suite: 270 passed / 21 existing optional harness skips; Ruff clean.

T02 is now wait on RPF-WP-0068-T04. A real preparation invocation refused with verified_credential_owner_return_required before any node call or capsule write: the owner task is still todo. Once that exact verified receipt exists, seal the fresh native proposal and publish its exact execution/recovery review packet to finish T02. Review: docs/sender-attended-entry-2026-10-31.md. No live grant, sender change, production capture or mail send occurred; existing backup and foundation source packets remain unchanged. T03/T04 retain live execution/return.

T03 — Execute the admitted sender switch

id: EMAIL-WP-0010-T03
status: wait
blocking_reason: "Requires the complete sender executor and verified RPF-WP-0068-T04 credential-owner return."
priority: high
depends_on: [EMAIL-WP-0010-T02, RPF-WP-0068-T04]
state_hub_task_id: "e0cbed16-f08f-50f7-8e15-633b3af29e88"

After the verified credential-owner return and concrete sender-packet review, obtain the attended execution return through the existing owner deployment lane. Do not treat mailbox ownership, credential admission, a prior image release or the dry-run candidate as approval for an unprepared configuration change. Inspect any existing attempt before replay; uncertain outcomes require the reviewed recovery procedure. Preserve application/caller state and retained evidence.

T04 — Verify the native sender return and reconcile sources

id: EMAIL-WP-0010-T04
status: todo
priority: high
depends_on: [EMAIL-WP-0010-T03]
state_hub_task_id: "19485ff3-132c-567c-8c28-8c039e63c2b4"

Independently verify private durable receipts, complete intended spec, actual process sender/credential references, Ready state, caller denials and ledger continuity. Reconcile deployment sources to the verified runtime only after success. Return bounded evidence to CSOC-WP-0015-T02. Delivered-message authentication, selected inbox/return handling, suppression authority and retention/productive verdicts remain live consumer requirements; this configuration return does not establish them. No unsolicited mail is part of these checks.

Completion

Finish after all four tasks have their stated native evidence. Hand any newly discovered actionable residual to a live work record before finishing.