tegwick
93b6ba2aae
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a11fd9-caf6-7a63-b578-9daaaa134ff2
8.3 KiB
| id | type | title | domain | repo | status | owner | topic_slug | created | updated | origin | origin_ref | state_hub_workstream_id |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EMAIL-WP-0008 | workplan | Isolate explicitly admitted transactional mail callers | infotech | email-connect | active | codex | netkingdom | 2026-10-08 | 2026-10-09 | residual | CSOC-WP-0010 | 3a0f264d-e441-5b12-964e-dab8fe5b3828 |
CSOC-WP-0010-T04 needs independent caller credentials, bounded template/tenant permissions, durable limits and scoped diagnostics. This record owns receiver source and its admission; current live single-caller SMTP remains unchanged.
T01 — Implement explicit caller policies and durable isolation
id: EMAIL-WP-0008-T01
status: done
priority: high
state_hub_task_id: "3f63b288-b2ea-506e-ba86-e7fa5778abb1"
Opt-in read-only policy/token-file loader, fixed operation/template/binding admission, exact credential/source identity, per-caller invitations/verifications, atomic persistent request budgets, bounded input, redacted scoped status and privileged suppression controls. Invalid selected policy refuses startup without legacy fallback. Permanent invitation failures now remain terminal across restart; confirmed temporary failures can retry. Unknown outcomes never resend. Explicit original-caller legacy adoption preserves accepted evidence.
T02 — Prove isolation, retry policy and recovered-ledger continuity
id: EMAIL-WP-0008-T02
status: done
priority: high
state_hub_task_id: "88bd986d-6030-59ce-a0e2-74cdad5266e7"
Synthetic tests cover cross-caller handle denial without mutation, scope changes, independent retries, permanent/temporary/unknown outcome, restart, concurrent budgets, backward clock, size/config failure and safe status. App owner gate binds exact tests to modules with no network or inherited secrets. Ledger fingerprint includes rate budgets; rehearsal must preserve scoped accepted and unknown evidence and quota rows without sending. Final owner gate:148passed, zero skips, including the loopback-only GreenMail harness. Network-denied app owner gate:66passed, zero skips. Ruff passes for receiver and caller module/tests. T03 remains waiting for runtime admission.
T03 — Admit original caller transition, runtime custody and recovery
id: EMAIL-WP-0008-T03
status: progress
priority: high
needs_human: true
intervention_note: "User approved compatible rollout preparation, proposed limits and pattern support. Glob allow-list, legacy invitation adoption, user-engine transport, candidate image and manifests are prepared. Separate token custody and coordinated runtime activation remain open; productive sender/reply/bounce acceptance stays in CSOC-WP-0015."
state_hub_task_id: "9b4c7260-a6bf-54f9-82f8-2e98c368d294"
Retain this live admission record before any completion. Choose real binding and operation sets/quotas, independent credential delivery and explicit legacy adoption. Review exact immutable image and additive schema migration/rollback. Repin guarded capture/rehearsal helpers together. EMAIL-WP-0007-T03/T04 and RPF-WP-0053-T05/T06 retain offsite archive/atomic credential pair custody. CSOC-WP-0015 retains platform operations and productive/browser review. Review: docs/caller-admission-2026-10-08.md. No sender, caller, token, image, mailbox, production ledger, network admission, upload or timer is activated.
T04 — Deploy the tested receiver source in the admitted startup mode
id: EMAIL-WP-0008-T04
status: done
priority: high
state_hub_task_id: "7035b89f-c23f-5240-aa6d-5b77146bb8dc"
User explicitly instructed deployment. Image eb3e7b68 from sourcec9756b0 is live, revision7, one Ready replica. Image-only spec guard/server dry-run, quiesced private backup, five-table row preservation/new-schema migration, packaged UID10001/no-network rehearsal and no-send denial checks pass. Elapsed62.79s; decision0ef49fde-5e92-4656-ac1e-8f945b4bba08. No scoped policy, sender/caller change or timer activated. Capture/rehearsal helper source pins move together to this digest; old-version recovery and downgrade require their bound receipts. Review: docs/caller-deployment-2026-10-08.md and JSON receipt. T03 stays wait for actual scoped-policy/credential admission. Product follow-up CSOC-WP-0015 and existing EMAIL-WP-0007/RPF-WP-0053 retain operations/recovery.
Original product-workplan closure — 2026-10-08
The user explicitly closed CSOC-WP-0008 and CSOC-WP-0010 after registering residual workplans. They are finished historical records, no longer acceptance trackers. Product communication execution and acceptance now belong to CSOC-WP-0015; EMAIL-WP-0008-T03, EMAIL-WP-0007 and RPF-WP-0053 retain their canonical runtime/custody tasks. Existing personal recovery acceptance and the receiver revision7 deployment remain evidenced. No pending owner requirement is waived or marked satisfied by the original workplans' administrative closure.
User-engine policy draft — 2026-10-08
Founder asked for a user-engine-only draft and no activation. Draft: config/callers.user-engine.draft.json. Review: docs/caller-policy-draft-2026-10-08.md. It names caller/source user-engine, binding tenant:coulomb/coulomb-social, send, delivery-status, status, verify, consume and cancel, both family templates, 10/minute, burst 5, 8192-byte cap, and legacy verification adoption. No suppress operation and no token value. Current invitation envelopes omit client_id, so this draft does not admit them. The token path is not created and EMAIL_CONNECT_CALLERS_FILE is not set. T03 stays wait for approval of these bindings, quotas and separate token custody.
Compatible original-caller rollout prepared — 2026-10-09
User requested compatible invitation transport with the draft limits and an allow-list supporting globs or regexes. Receiver policies now accept optional binding_patterns pairs using case-sensitive whole-identifier * and ? globs. Identifiers/patterns are bounded to 128 characters and 128 total binding pairs; regex and character-class syntax are refused. Exact bindings remain supported. The same matcher constrains send, verification, consume and cancel.
Draft retains tenant:coulomb/coulomb-social and proposes tenant:-family and tenant:family- with literal client coulomb-social. The latter patterns are reviewable family-name conventions, not discovery of every live tenant. Original user-engine can explicitly adopt legacy invitations while retaining their event ids, accepted receipts and unknown/permanent restrictions. Matching an existing legacy fingerprint permits only the added transport client_id to be omitted from its fingerprint; changed recipients/payloads still refuse and scope checks run first. New bound invitations retain their full fingerprint across restarts.
User-engine source now has opt-in USER_ENGINE_MAIL_CLIENT_BINDINGS: a bounded JSON list of tenant-glob/literal-client pairs. Ambiguous or missing matches deny mail before either delivery lane is contacted. It adds client_id only to the mail envelope, leaving persisted outbox and audit envelopes unchanged. Default legacy mode is preserved. Owner patch: deploy/caller-rollout/user-engine-mail-bindings.patch; applied to /home/worsch/user-engine with its six new synthetic tests passing. Full user-engine regression: 302 tests, eight optional skips, no failures.
Local candidate email-connect:email-wp-0008-globs-20261009 is built and tested under UID10001/network-none/read-only root with its exact caller module hash. Proof: deploy/caller-rollout/packaged-evidence-2026-10-09.json. Immutable policy ConfigMap and receiver mount/env patch in deploy/caller-rollout pass node server dry-run. They require separately delivered email-connect-caller-user-engine/token, an admitted immutable registry image and coordinated user-engine rollout; they are excluded from the live kustomization and have not been applied.
The receiver remains on eb3e7b68 in single-caller mode; capture/rehearsal pins remain correctly aligned with that live image. EMAIL-WP-0007 now has an actual offsite recovery drill and inbox failure receipt. Its remaining recurring backup and independent custody obligations are not waived. T03 is progress while credential delivery, exact scope/image and coordinated activation remain open.
Final email regression after caller/notification preparation: 178 passed, zero skips with the loopback-only GreenMail harness. Focused syntax checks pass. User-engine source preparation is recorded at adf6e99 in its owner repository.