coulomb/user-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

build: adopt staged records and retain reviewed setup delivery handoff

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a15374-f59f-7a31-86d2-d23b5d2ed181
This commit is contained in:
tegwick 2026-10-19 13:30:58 +02:00
parent 9557d6f867
commit db05c1310d
11 changed files with 203 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

25
workplans/USER-WP-0035-onboarding-handoff-findings.md
View file

@ -49,8 +49,11 @@ No claim about password or factor state is added, and no delivery is claimed.
```task
id: USER-WP-0035-T02
status: todo
status: wait
priority: high
needs_human: false
blocked_on: message-from:email-connect
blocking_reason: "Existing mail service lacks an admitted provider password-setup template and recipient-bound opaque issuer handoff. EMAIL-IN-0001 and NET-IN-0005 request exact owner implementation records; no new founder choice or credential request."
state_hub_task_id: "fae614ba-ffc0-511d-9d22-2d91fbab057f"
```
@ -73,3 +76,23 @@ The latest attended onboarding record still uses out-of-band handoff. No message
was sent and no setup-link secret was copied into an event or work record.
2026-10-03: human gate routed to hub decision 62aa95e4-3ccc-4867-8806-5e3db005b483 (D1: Attended OpenBao provisioning window: one session clears the pending credential lanes) by CUST-WP-0075; resolving that decision raises C-40 here.
2026-10-11 source-boundary review: the scoped receiver and transactional sender
accept only family-member invitation/resend events, while NetKingdom's
identity-provisioner returns its own ephemeral password-setup URL. Neither the
completed EMAIL-WP-0008 caller admission nor NK-WP-0047 Authelia reset-mail
acceptance supplies this separate setup delivery capability. Owner intakes
EMAIL-IN-0001 and NET-IN-0005 request the fixed recipient-bound handoff and exact
implementation task IDs; replace the owner-response qualifier with those IDs
once supplied. The cross-owner case is retained at
`docs/evidence/2026-10-11-setup-link-owner-handoff/coordination-case.json`.
No mail was sent, no credential/grant was read and no secret link entered an
outbox/event/work record. U04/T02 external-blocked acceptance remains unchanged.
2026-10-19 reconciliation: reviewed the pending source handoff against current
caller policy, receiver, provider handler and User Engine portal. Invitation-only
mail admission and the provider-owned setup URL boundary remain unchanged. The
historical October 11 receipt is retained; `source-review-2026-10-19.json` records
current hashes and distinguishes changed handler/portal source from old evidence.
EMAIL-IN-0001 and NET-IN-0005 remain preparation requests, not owner acceptance
or a runtime delivery claim. T02 remains waiting on the named owner return.