railiance-apps/workplans/RAPPS-WP-0015-coulomb-personal-content-release.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	related	state_hub_workstream_id
RAPPS-WP-0015	workplan	Coulomb-social persistent personal workspace release	financials	railiance-apps	active	codex	railiance-apps	2026-10-06	2026-10-06	CSOC-WP-0008	79abacf8-361e-51ab-829d-40dec8e142d1

RAPPS-WP-0015 — Personal Coulomb workspace

Owning deployment change for CSOC-WP-0008. Prepare a reviewed upgrade from 7fcd0cf to the tested app with static assets and a 2Gi retained local-path CONTENT_ROOT PVC. Use one replica and Recreate to prevent concurrent old/new filesystem writers. Existing OIDC, PostgreSQL and secret references stay in use.

T01 — Prepare immutable source image

id: RAPPS-WP-0015-T01
status: done
priority: high
state_hub_task_id: "e17488d4-60b8-58b7-a5d8-fbcdc55e1f0c"

Source repo runs make check; collect static assets in the container image; exclude private local data from Docker context. Build/publish SHA-tagged image with revision label and registry digest. Verify the image serves the real clipboard asset through production settings without developer static hosting.

T02 — Validate persistent single-writer chart

id: RAPPS-WP-0015-T02
status: done
priority: high
state_hub_task_id: "4e38dd8e-761b-58c8-8005-8490a49767ab"

Content PVC/mount/CONTENT_ROOT wiring, fsGroup 10001, keep policy and Recreate. Reject multiple replicas, rolling writer strategy and root/mount mismatch. Helm lint/render, server dry-run and diff; confirm resource/disk headroom and that coulomb-social is not currently ArgoCD-managed. Publish the review branch.

T03 — Approved upgrade and recovery point

id: RAPPS-WP-0015-T03
status: done
priority: high
state_hub_task_id: "2ce05439-70dc-53cf-b704-5118687857cb"

Founder approves exact image digest, chart diff, 2Gi PVC and brief Recreate interruption: ADMINISTER @ realm:kubernetes/railiance01, activation=APPROVED. Capture a private pre-upgrade DB recovery point through the documented owner backup path. Apply from railiance01 with Helm --atomic, preserve existing tegwick identity and migration data. Do not run legacy env secret-building scripts or dump live Secret objects. No apex cutover.

T04 — Personal sign-in and content acceptance

id: RAPPS-WP-0015-T04
status: wait
priority: high
state_hub_task_id: "8bc4962a-d0d4-57cd-bf2b-295658b88765"

User signs in interactively as existing personal tegwick account. Confirm local Member matches verified issuer/subject, grant only that member the nominated workspace, and smoke page CRUD/duplicate/clipboard. Prove PVC write ownership, restart durability and paired DB/content restore before real productive transfer. CSOC-WP-0008 continues actual ReichelAg reconciliation and user review.

Prepared evidence — 2026-10-06

Source ac7bac1852c9, make check: 88 passed. Container production WhiteNoise serves /static/spaces/copy-content.js HTTP 200, 2909 bytes, ClipboardItem present. Published immutable registry digest: sha256:bf975939e22b9b0a5d9ac05584ae6265ba201169df6dc48e506ec684b30a9c58. Chart 0.2.0 pins that digest; lint and server dry-run pass; unsafe multiple replicas, RollingUpdate and CONTENT_ROOT mismatch are refused.

The user's actual login fails unknown client_id. Guarded read-only inspection confirms the public coulomb-social client is absent. CSOC-WP-0008-T11 prepares its restoration and shared KeyCape restart; no live change has been made. Existing completed apps-pg daily backup is not a paired application restore. T03/T04 remain waiting for exact live approval and personal acceptance.

Approved deployment receipt — 2026-10-06

Founder approved explicit proposal; decision 8bbce691-a787-4140-9cd4-df06e8635a27, ADMINISTER @ realm:kubernetes/railiance01, activation=APPROVED. Fresh apps-pg Backup csoc-preupgrade-20261006145351 completed 14:54:31Z before app upgrade. Chart changes pushed to main at3f5a909. Helm atomic upgrade from railiance01 succeeded: revision10, chart0.2.0, pinned digest above. App1/1 ready, 2Gi PVC Bound, UID/GID10001 write succeeds, zero pending migrations. Dedicated synthetic content marker survived a fresh pod restart and was removed afterward. Public health/landing/clipboard asset200; login302 correct issuer/client/PKCE.

Missing public OIDC client restored and KeyCape restart succeeded under same go; authorization hands off to Authelia. Interactive tegwick sign-in remains pending user confirmation. T03 done; T04 wait for interactive/product acceptance and paired recovery. No productive import or apex cutover. Application receipt: coulomb-social/docs/release/personal-account-deployed-2026-10-06.md.

User sign-in result — 2026-10-06

The user reaches auth.coulomb.social but tegwick is rejected as wrong username or password. Read-only directory query through the existing provisioner confirms tegwick is present. Live Authelia username attribute is uid; its lookup supports uid or mail. Contained recent-log inspection records a tegwick LDAP invalid- credentials failure, without backend connection error or regulation-ban evidence in that entry. This does not establish why the entered credential is rejected.

The app and client restoration are deployed, but personal sign-in is not accepted. CSOC-WP-0008-T11 remains wait for human credential confirmation/recovery and a successful fresh sign-in. The user was asked whether the same password works on another service. No password was requested/read/exported or reset. Authelia's current notifier is filesystem rather than SMTP: do not promise emailed recovery or expose reset tokens from notification files. Any credential reset must use the owning attended recovery/setup lane under a separate exact approved change.

Personal login 500 correction — 2026-10-06

User confirmed fresh password-reset email receipt, then reported HTTP500 after authentication. In-pod credential-safe read-only probes with empty claims show old USER_ENGINE_BASE_URL redirects302 to users.coulomb.social/api/v1/me; canonical endpoint responds400 to empty claims using the existing service credential. No identity was created. The application's httpx client does not follow redirects and raise_for_status rejects302 before establishing its local session.

Correct USER_ENGINE_BASE_URL in chart defaults and production overrides to https://users.coulomb.social. Preserve immutable image, Secret references, identity issuer/subject/tenant, PVC and access rules. This completes the already approved personal app deployment; founder go/interruption approval is recorded in decision8bbce691-a787-4140-9cd4-df06e8635a27. Use node-side Helm atomic upgrade, server dry-run and exact manifest diff; rollback revision10 if necessary. T04 remains waiting for successful interactive personal workspace acceptance.