tegwick
e795b2970c
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a18e2d-f513-7742-b8e7-12af0b744ff3
165 lines
8.5 KiB
Markdown
165 lines
8.5 KiB
Markdown
---
|
|
id: EMAIL-WP-0010
|
|
type: workplan
|
|
title: "Supervised platform sender transition with ledger continuity"
|
|
domain: infotech
|
|
repo: email-connect
|
|
status: active
|
|
owner: codex
|
|
topic_slug: email-connect
|
|
created: "2026-10-31"
|
|
updated: "2026-10-31"
|
|
related:
|
|
- CSOC-WP-0015
|
|
- RPF-WP-0068
|
|
state_hub_workstream_id: "6d8e1363-e67e-5837-bb6f-e5a95f43d71b"
|
|
---
|
|
|
|
Owner execution dependency of CSOC-WP-0015-T02. The platform mailbox's additional
|
|
reader admission is RPF-WP-0068/CCR-2026-0056; this workplan does not duplicate or
|
|
self-approve that credential lane. Bernd/platform-root reply ownership is settled.
|
|
Existing caller admission, image, ledger, backup schedules and old custody remain
|
|
in scope for preservation. Productive sender/return handling stays in CSOC-WP-0015.
|
|
|
|
## T01 — Establish native ledger and receiver transition boundaries
|
|
|
|
```task
|
|
id: EMAIL-WP-0010-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "f5b03013-3c1b-5b1a-86e2-a96dd817fa00"
|
|
```
|
|
|
|
Completed 2026-10-31 with `scripts/inspect-sender-ledger.py` and
|
|
`docs/sender-ledger-native-2026-10-31.json`. The read-only helper fingerprints all
|
|
six tables and classifies outcomes in one SQLite transaction, including committed
|
|
WAL. Native generation 74/image 5d79fd1f retains forgejo@coulomb.social. Packaged
|
|
transactional source matches the owner checkout. Two invitation receipts and 121
|
|
verification attempts are accepted; zero unknown/unrecognized/orphan outcomes,
|
|
zero unlinked challenges, one suppression. No message body, address, handle,
|
|
credential or individual record was printed. No deployment or ledger write.
|
|
|
|
Successful invitations can retain an in_flight attempt; the deliveries row is
|
|
authoritative. The receiver has no explicit SIGTERM drain handler. A process exit
|
|
can leave an uncertain provider outcome, which must remain non-retryable. This
|
|
observation is not a writer fence, backup, outcome repair or approval. Twelve new
|
|
synthetic cases pass, including concurrent WAL writes, retry continuity, exact
|
|
archive-fingerprint compatibility and private-output refusal. Owner suite:
|
|
192 passed, 21 skipped (pre-existing opt-in container harness tests).
|
|
|
|
## T02 — Prepare and rehearse the supervised configuration executor
|
|
|
|
```task
|
|
id: EMAIL-WP-0010-T02
|
|
status: wait
|
|
blocking_reason: "Executor and assembly tests complete; sealing the live proposal requires verified RPF-WP-0068-T04 and its successful foundation receipt."
|
|
priority: high
|
|
depends_on: [EMAIL-WP-0010-T01, RPF-WP-0068-T04]
|
|
state_hub_task_id: "acb6f995-9177-5a3c-909a-feb152d6bfed"
|
|
```
|
|
|
|
Turn the existing five-operation consumer candidate into a concrete source-bound
|
|
sender executor after inspecting the actual service/caller boundary. Reuse the
|
|
already prepared foundation resources; do not recreate them. Pin cluster,
|
|
namespace, deployment, image, existing caller policy/projections and complete
|
|
before/after configuration. Preserve all unrelated deployment fields and old
|
|
credential custody. The actual source sender change is only forgejo@ -> platform@,
|
|
with the dedicated admitted SMTP projection and explicit username.
|
|
|
|
Prove writer quiescence, fresh recoverable ledger capture, outcome classification,
|
|
complete data preservation, private durable intent before every mutation and
|
|
independent runtime/no-send checks. Reuse existing ledger capture/rehearsal and
|
|
fixed projection proof. Review ambiguity after SIGTERM/lost replies, interruption
|
|
before/after each configuration change, and rollback with legitimate subsequent
|
|
ledger writes. Never restore a pre-release ledger, replay uncertain sends, reenable
|
|
the retired legacy bearer or delete old custody as a configuration rollback.
|
|
Prepare a bounded recovery procedure that refuses unrelated drift. Deliver the
|
|
exact review packet and passing synthetic/native dry-run evidence before asking
|
|
for execution; a read-only ledger snapshot alone does not close this task.
|
|
|
|
2026-10-31 protocol implementation: `scripts/sender_transition.py` implements
|
|
private durable intent records, the exact sender/environment delta, interrupted
|
|
configuration recovery and six-table continuity comparison. Ten real child-process
|
|
exits cover phase boundaries and lost API replies against a file-backed cluster
|
|
fixture; recovery retains subsequent accepted/unknown sends and existing retry
|
|
refusal. Other cases cover repeated recovery interruption, unchanged protected
|
|
state, source/configuration drift, absent admission, journal privacy/truncation,
|
|
unexpected writer resume and preservation of consumed links, quotas and new rows.
|
|
All 27 new cases pass; owner default suite 219 passed / 21 existing optional harness skips.
|
|
|
|
The protocol-core review is
|
|
`docs/sender-transition-protocol-2026-10-31.md`.
|
|
|
|
2026-10-31 native adapter follow-through: `scripts/sender_native.py` now implements
|
|
UID/spec compare-and-swap, metadata-only Secret queries, exact foundation receipt
|
|
and projection checks, the existing exclusive capture lock, PVC/PV/node binding,
|
|
writer fencing, durable helper identities, UID-preconditioned cleanup and actual
|
|
runtime/no-send checks. Five native server dry-runs passed without a configuration
|
|
change. The actual snapshot/replay path passed in the pinned receiver image with
|
|
a synthetic ledger, networking disabled and the source mounted read-only; its
|
|
disposable container was removed. Thirty new adapter cases pass; full owner suite
|
|
249 passed / 21 existing optional harness skips, Ruff clean. Public receipts bind
|
|
the source hashes and scope of each proof. Review:
|
|
`docs/sender-native-adapter-2026-10-31.md`.
|
|
|
|
2026-10-31 assembled execution follow-through: `scripts/release-sender.py` and
|
|
`scripts/sender_release.py` bind eight source files, native preimages, the exact
|
|
foundation receipt and verified owner handoff into an exclusive private capsule.
|
|
The launcher requires a human terminal and exact digest confirmation for deploy
|
|
or recovery; the node retains source capsule/journal/process identities and uses
|
|
the actual adapter/protocol. Twenty-one new cases prove the assembled forward and
|
|
recovery paths against modeled Kubernetes with real SQLite and WSGI probes,
|
|
including a lost configuration response, subsequent accepted/unknown sends,
|
|
capture-lock contention, source/receipt/owner drift and unconfirmed SSH outcomes.
|
|
All four new projection UIDs are sealed; replacement refuses deployment while
|
|
configuration recovery remains available. Owner suite: 270 passed / 21 existing
|
|
optional harness skips; Ruff clean.
|
|
|
|
T02 is now wait on RPF-WP-0068-T04. A real preparation invocation refused with
|
|
`verified_credential_owner_return_required` before any node call or capsule write:
|
|
the owner task is still todo. Once that exact verified receipt exists, seal the
|
|
fresh native proposal and publish its exact execution/recovery review packet to
|
|
finish T02. Review: `docs/sender-attended-entry-2026-10-31.md`. No live grant,
|
|
sender change, production capture or mail send occurred; existing backup and
|
|
foundation source packets remain unchanged. T03/T04 retain live execution/return.
|
|
|
|
## T03 — Execute the admitted sender switch
|
|
|
|
```task
|
|
id: EMAIL-WP-0010-T03
|
|
status: wait
|
|
blocking_reason: "Requires the complete sender executor and verified RPF-WP-0068-T04 credential-owner return."
|
|
priority: high
|
|
depends_on: [EMAIL-WP-0010-T02, RPF-WP-0068-T04]
|
|
state_hub_task_id: "e0cbed16-f08f-50f7-8e15-633b3af29e88"
|
|
```
|
|
|
|
After the verified credential-owner return and concrete sender-packet review,
|
|
obtain the attended execution return through the existing owner deployment lane.
|
|
Do not treat mailbox ownership, credential admission, a prior image release or
|
|
the dry-run candidate as approval for an unprepared configuration change. Inspect
|
|
any existing attempt before replay; uncertain outcomes require the reviewed
|
|
recovery procedure. Preserve application/caller state and retained evidence.
|
|
|
|
## T04 — Verify the native sender return and reconcile sources
|
|
|
|
```task
|
|
id: EMAIL-WP-0010-T04
|
|
status: todo
|
|
priority: high
|
|
depends_on: [EMAIL-WP-0010-T03]
|
|
state_hub_task_id: "19485ff3-132c-567c-8c28-8c039e63c2b4"
|
|
```
|
|
|
|
Independently verify private durable receipts, complete intended spec, actual
|
|
process sender/credential references, Ready state, caller denials and ledger
|
|
continuity. Reconcile deployment sources to the verified runtime only after
|
|
success. Return bounded evidence to CSOC-WP-0015-T02. Delivered-message
|
|
authentication, selected inbox/return handling, suppression authority and
|
|
retention/productive verdicts remain live consumer requirements; this configuration
|
|
return does not establish them. No unsolicited mail is part of these checks.
|
|
|
|
## Completion
|
|
|
|
Finish after all four tasks have their stated native evidence. Hand any newly
|
|
discovered actionable residual to a live work record before finishing.
|