email-connect/workplans/EMAIL-WP-0008-scoped-transactional-callers.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	origin	origin_ref	state_hub_workstream_id
EMAIL-WP-0008	workplan	Isolate explicitly admitted transactional mail callers	infotech	email-connect	finished	codex	netkingdom	2026-10-08	2026-10-09	residual	CSOC-WP-0010	3a0f264d-e441-5b12-964e-dab8fe5b3828

CSOC-WP-0010-T04 needs independent caller credentials, bounded template/tenant permissions, durable limits and scoped diagnostics. This record owns receiver source and its admission. Scoped original-caller activation is complete; productive journey acceptance remains in CSOC-WP-0015.

T01 — Implement explicit caller policies and durable isolation

id: EMAIL-WP-0008-T01
status: done
priority: high
state_hub_task_id: "3f63b288-b2ea-506e-ba86-e7fa5778abb1"

Opt-in read-only policy/token-file loader, fixed operation/template/binding admission, exact credential/source identity, per-caller invitations/verifications, atomic persistent request budgets, bounded input, redacted scoped status and privileged suppression controls. Invalid selected policy refuses startup without legacy fallback. Permanent invitation failures now remain terminal across restart; confirmed temporary failures can retry. Unknown outcomes never resend. Explicit original-caller legacy adoption preserves accepted evidence.

T02 — Prove isolation, retry policy and recovered-ledger continuity

id: EMAIL-WP-0008-T02
status: done
priority: high
state_hub_task_id: "88bd986d-6030-59ce-a0e2-74cdad5266e7"

Synthetic tests cover cross-caller handle denial without mutation, scope changes, independent retries, permanent/temporary/unknown outcome, restart, concurrent budgets, backward clock, size/config failure and safe status. App owner gate binds exact tests to modules with no network or inherited secrets. Ledger fingerprint includes rate budgets; rehearsal must preserve scoped accepted and unknown evidence and quota rows without sending. Final owner gate:148passed, zero skips, including the loopback-only GreenMail harness. Network-denied app owner gate:66passed, zero skips. Ruff passes for receiver and caller module/tests. T03 remains waiting for runtime admission.

T03 — Admit original caller transition, runtime custody and recovery

id: EMAIL-WP-0008-T03
status: done
priority: high
needs_human: false
state_hub_task_id: "9b4c7260-a6bf-54f9-82f8-2e98c368d294"

Retain this live admission record before any completion. Choose real binding and operation sets/quotas, independent credential delivery and explicit legacy adoption. Review exact immutable image and additive schema migration/rollback. Repin guarded capture/rehearsal helpers together. EMAIL-WP-0007-T03/T04 and RPF-WP-0053-T05/T06 retain offsite archive/atomic credential pair custody. CSOC-WP-0015 retains platform operations and productive/browser review. Review: docs/caller-admission-2026-10-08.md. No sender, caller, token, image, mailbox, production ledger, network admission, upload or timer is activated.

T04 — Deploy the tested receiver source in the admitted startup mode

id: EMAIL-WP-0008-T04
status: done
priority: high
state_hub_task_id: "7035b89f-c23f-5240-aa6d-5b77146bb8dc"

User explicitly instructed deployment. Image eb3e7b68 from sourcec9756b0 is live, revision7, one Ready replica. Image-only spec guard/server dry-run, quiesced private backup, five-table row preservation/new-schema migration, packaged UID10001/no-network rehearsal and no-send denial checks pass. Elapsed62.79s; decision0ef49fde-5e92-4656-ac1e-8f945b4bba08. No scoped policy, sender/caller change or timer activated. Capture/rehearsal helper source pins move together to this digest; old-version recovery and downgrade require their bound receipts. Review: docs/caller-deployment-2026-10-08.md and JSON receipt. T03 stays wait for actual scoped-policy/credential admission. Product follow-up CSOC-WP-0015 and existing EMAIL-WP-0007/RPF-WP-0053 retain operations/recovery.

Original product-workplan closure — 2026-10-08

The user explicitly closed CSOC-WP-0008 and CSOC-WP-0010 after registering residual workplans. They are finished historical records, no longer acceptance trackers. Product communication execution and acceptance now belong to CSOC-WP-0015; EMAIL-WP-0008-T03, EMAIL-WP-0007 and RPF-WP-0053 retain their canonical runtime/custody tasks. Existing personal recovery acceptance and the receiver revision7 deployment remain evidenced. No pending owner requirement is waived or marked satisfied by the original workplans' administrative closure.

User-engine policy draft — 2026-10-08

Founder asked for a user-engine-only draft and no activation. Draft: config/callers.user-engine.draft.json. Review: docs/caller-policy-draft-2026-10-08.md. It names caller/source user-engine, binding tenant:coulomb/coulomb-social, send, delivery-status, status, verify, consume and cancel, both family templates, 10/minute, burst 5, 8192-byte cap, and legacy verification adoption. No suppress operation and no token value. Current invitation envelopes omit client_id, so this draft does not admit them. The token path is not created and EMAIL_CONNECT_CALLERS_FILE is not set. T03 stays wait for approval of these bindings, quotas and separate token custody.

Compatible original-caller rollout prepared — 2026-10-09

User requested compatible invitation transport with the draft limits and an allow-list supporting globs or regexes. Receiver policies now accept optional binding_patterns pairs using case-sensitive whole-identifier * and ? globs. Identifiers/patterns are bounded to 128 characters and 128 total binding pairs; regex and character-class syntax are refused. Exact bindings remain supported. The same matcher constrains send, verification, consume and cancel.

Draft retains tenant:coulomb/coulomb-social and proposes tenant:-family and tenant:family- with literal client coulomb-social. The latter patterns are reviewable family-name conventions, not discovery of every live tenant. Original user-engine can explicitly adopt legacy invitations while retaining their event ids, accepted receipts and unknown/permanent restrictions. Matching an existing legacy fingerprint permits only the added transport client_id to be omitted from its fingerprint; changed recipients/payloads still refuse and scope checks run first. New bound invitations retain their full fingerprint across restarts.

User-engine source now has opt-in USER_ENGINE_MAIL_CLIENT_BINDINGS: a bounded JSON list of tenant-glob/literal-client pairs. Ambiguous or missing matches deny mail before either delivery lane is contacted. It adds client_id only to the mail envelope, leaving persisted outbox and audit envelopes unchanged. Default legacy mode is preserved. Owner patch: deploy/caller-rollout/user-engine-mail-bindings.patch; applied to /home/worsch/user-engine with its six new synthetic tests passing. Full user-engine regression: 302 tests, eight optional skips, no failures.

Local candidate email-connect:email-wp-0008-globs-20261009 is built and tested under UID10001/network-none/read-only root with its exact caller module hash. Proof: deploy/caller-rollout/packaged-evidence-2026-10-09.json. Immutable policy ConfigMap and receiver mount/env patch in deploy/caller-rollout pass node server dry-run. They require separately delivered email-connect-caller-user-engine/token, an admitted immutable registry image and coordinated user-engine rollout; they are excluded from the live kustomization and have not been applied.

The receiver remains on eb3e7b68 in single-caller mode; capture/rehearsal pins remain correctly aligned with that live image. EMAIL-WP-0007 now has an actual offsite recovery drill and inbox failure receipt. Its remaining recurring backup and independent custody obligations are not waived. T03 is progress while credential delivery, exact scope/image and coordinated activation remain open.

Final email regression after caller/notification preparation: 178 passed, zero skips with the loopback-only GreenMail harness. Focused syntax checks pass. User-engine source preparation is recorded at adf6e99 in its owner repository.

Closure preparation — 2026-10-09

Published both immutable candidates and dry-ran two deployment patches plus six caller delivery objects. The user-engine candidate patches only live baseline 0d0751d; 302 regression tests pass with 20 baseline optional skips and all six packaged binding tests pass. Full email suite: 193 passed, zero skips. Exact custody/activation contract: deploy/closure/plan.json; public preparation evidence: deploy/closure/evidence-2026-10-09.json. Reviewed plan SHA256: 8e529e2ffdb6ee3d53a768d65b2d025b95e788734c48a29f2f8b975825dbaed7. Attended caller custody, native reader proofs and coordinated scoped activation remain open. T03 stays progress; live receiver and caller mode are unchanged. Execution handoff: docs/caller-policy-draft-2026-10-08.md.

Scoped continuation authorized — 2026-10-09

User instructed continuation after the activation handoff. Decision 8edbff8c-f62d-4357-8465-8eb37300f311 binds the existing reviewed plan SHA256 8e529e2ffdb6ee3d53a768d65b2d025b95e788734c48a29f2f8b975825dbaed7. OpenBao edge is initialized/unsealed. The private receipt directory exists and the exact silent attended command was supplied to the user. No completed login, credential issue or native reader proof is claimed; awaiting the actual receipt. Current receiver/user-engine deployments remain Ready at their baseline images.

Scoped activation complete — 2026-10-09

EMAIL-WP-0008 now runs the published scoped receiver and compatible user-engine images, with one Ready replica each. Decision 8edbff8c-f62d-4357-8465-8eb37300f311 admitted continuation of the reviewed package. The attended child installed both exact policies/roles and created/read back caller KV version 1, then failed because its writer self-revocation CLI command was invalid. User confirmed parent login revocation. Corrected to bao token revoke -self; a real CLI test against a synthetic local HTTP endpoint verifies that call. Failure receipts now retain only allow-listed diagnostic codes. No second administrator session was used.

Both approved ESO readers deliver equal credentials. Exact policy/900-second bounds and own-leaf read pass; sibling data, metadata, parent list, administrative policy read and a non-mutating CAS0 write to the existing leaf deny. Wrong bound identity, account and audience logins deny. Both proof tokens self-revoke and subsequent lookup denies. User-engine's invitation/registration credentials match its own projection and its binding JSON matches the reviewed exact/glob pairs.

Quiesced pre-release offsite capture version 1791569299633609 precedes coordinated activation. A probe initially rejected a newline in the retired legacy bearer; Python rendered that bearer in its error. Automatic rollback restored baseline, then dispatch was fenced and scoped mode restored immediately. The corrected contained probe strips/rejects invalid header characters. The live receiver now returns 401 for the exposed legacy bearer. New caller/provider credentials were not exposed. Platform-root notice: b78dfaf0-953e-410c-b9fb-0309af4c42ae. Never restore the retired bearer or the old single-caller rollback spec. Its custody record was not deleted; retirement is enforced by the active scoped policy and canonical receiver manifests. Productive provider traffic remains separately owned.

Live no-send probes verify forbidden suppression, foreign tenant, 8192-byte cap, burst five and preservation of both existing accepted deliveries. Non-quota ledger tables remain unchanged; SMTP authentication/database diagnostics pass. The synthetic recovery/package tests retain unknown-outcome, consumed/cancelled handle and legacy adoption coverage; those live state tables were empty.

Canonical receiver kustomization now retains the scoped image, immutable policy and exact receiver-side ESO projection and passes server dry-run. The user-engine activation patch remains deploy/closure/user-engine.patch.json. Capture/rehearsal pins are changed together in source and installed runtime to the actual scoped image. Fresh offsite version 1791569930973785 and isolated UID10001/network-none recovery preserve all six tables, including the populated caller quota bucket. A refreshed private kit bundles the image/tools/age ciphertext/public receipts and excludes the private age identity. It remains local, not independent escrow.

Public proofs: docs/scoped-caller-live-2026-10-09.json and docs/ledger-scoped-image-recovery-2026-10-09.json. Focused backup/notification/ custody regressions: 41 passed; focused syntax checks pass. Earlier full email regression remains 193 passed, zero skips. EMAIL-WP-0008-T03 is done. Independent Scaleway custody, generation retention and recurring backup activation remain EMAIL-WP-0007; backup timers stay disabled. Productive/browser sender/reply/bounce acceptance remains CSOC-WP-0015.