Verify integrity release against real mail and storage providers #299

New Issue

2026-09-08T12:43:05+02:00

zemion commented

2026-09-08 12:43:05 +02:00

Purpose and state

Operational acceptance for the published integrity implementation tracked in Core #298, especially Files #47 and Mail #24.

This is not missing implementation and requires no architecture or product-policy decision. Regression tests, local development schema verification, isolated PostgreSQL backup restoration/no-op migration checks and Datasources concurrency tests already cover the implemented contracts. This separate issue needs suitable isolated provider fixtures and operator coordination to exercise actual transport/provider behavior.

Target production-like resource/capacity/load acceptance remains in Core #297; this issue neither replaces that gate nor claims a production rollout or security certification.

Required isolated provider verification

S3: pin immutable VersionId reads and conditional IfMatch reads; deliberately replace the object between observation and retrieval. Verify mismatches fail without persisting misleading source evidence, and acquired-byte checksums remain separate from provider claims.
SMB: verify actual read-sharing/deny-writer behavior and before/after revision, size and stat checks while a controlled concurrent writer changes a disposable source file. Verify conflicts do not commit a partial or falsely attributed import.
Seafile: deliberately change a disposable file between revision observation, download and post-read verification. Verify the change is rejected and no partial local import/evidence is committed.
POP3: using dedicated test maildrops, verify account switches are distinct, replacement credentials/password rotation for the same exact account retain duplicate identity, and reused UIDLs with changed content reject the entire selected import batch before writes.
POP3 historical reconciliation: exercise the explicit bind-maildrop workflow only against disposable retained test records and a matching test account. Verify current transport revision, all required scopes, explicit confirmation, byte/SHA-256 equality and competing-binding checks; preserve content/IDs/history and produce the expected non-secret audit record. Mismatching or unavailable originals must remain retained and unresolved.

Coordination and safety boundary

An operator must identify approved non-production, isolated storage services and POP3 maildrops, provide narrowly scoped credentials through existing secure configuration, and agree the fixture/race/cleanup window.
Do not send mail, delete provider messages, resend anything, perform source reconciliation or mutate production data automatically. Any legacy binding is an explicitly approved test case against test records, not a blanket migration step.
Record provider/product versions, exact GovOPlaN tags/commits, scenario outcomes, expected conflicts, local transaction/cleanup evidence and sanitized audit references. Never attach credentials, raw mailbox contents or personal data.
Completion requires successful provider-backed positive and negative/race cases above and a concise reproducible sanitized receipt. If a provider violates an assumed contract, create an owning implementation issue with a failing regression; do not weaken integrity checks to make the test pass.

Blocked only on suitable isolated provider fixtures and operator coordination. Source implementation issue closure does not close this operational gate.

## Purpose and state Operational acceptance for the published integrity implementation tracked in [Core #298](https://git.add-ideas.de/GovOPlaN/govoplan-core/issues/298), especially [Files #47](https://git.add-ideas.de/GovOPlaN/govoplan-files/issues/47) and [Mail #24](https://git.add-ideas.de/GovOPlaN/govoplan-mail/issues/24). This is **not missing implementation** and requires no architecture or product-policy decision. Regression tests, local development schema verification, isolated PostgreSQL backup restoration/no-op migration checks and Datasources concurrency tests already cover the implemented contracts. This separate issue needs suitable isolated provider fixtures and operator coordination to exercise actual transport/provider behavior. Target production-like resource/capacity/load acceptance remains in [Core #297](https://git.add-ideas.de/GovOPlaN/govoplan-core/issues/297); this issue neither replaces that gate nor claims a production rollout or security certification. ## Required isolated provider verification - S3: pin immutable VersionId reads and conditional IfMatch reads; deliberately replace the object between observation and retrieval. Verify mismatches fail without persisting misleading source evidence, and acquired-byte checksums remain separate from provider claims. - SMB: verify actual read-sharing/deny-writer behavior and before/after revision, size and stat checks while a controlled concurrent writer changes a disposable source file. Verify conflicts do not commit a partial or falsely attributed import. - Seafile: deliberately change a disposable file between revision observation, download and post-read verification. Verify the change is rejected and no partial local import/evidence is committed. - POP3: using dedicated test maildrops, verify account switches are distinct, replacement credentials/password rotation for the same exact account retain duplicate identity, and reused UIDLs with changed content reject the entire selected import batch before writes. - POP3 historical reconciliation: exercise the explicit bind-maildrop workflow only against disposable retained test records and a matching test account. Verify current transport revision, all required scopes, explicit confirmation, byte/SHA-256 equality and competing-binding checks; preserve content/IDs/history and produce the expected non-secret audit record. Mismatching or unavailable originals must remain retained and unresolved. ## Coordination and safety boundary - An operator must identify approved **non-production**, isolated storage services and POP3 maildrops, provide narrowly scoped credentials through existing secure configuration, and agree the fixture/race/cleanup window. - Do not send mail, delete provider messages, resend anything, perform source reconciliation or mutate production data automatically. Any legacy binding is an explicitly approved test case against test records, not a blanket migration step. - Record provider/product versions, exact GovOPlaN tags/commits, scenario outcomes, expected conflicts, local transaction/cleanup evidence and sanitized audit references. Never attach credentials, raw mailbox contents or personal data. - Completion requires successful provider-backed positive and negative/race cases above and a concise reproducible sanitized receipt. If a provider violates an assumed contract, create an owning implementation issue with a failing regression; do not weaken integrity checks to make the test pass. Blocked only on suitable isolated provider fixtures and operator coordination. Source implementation issue closure does not close this operational gate.

zemion added the

labels 2026-09-08 12:43:05 +02:00

zemion referenced this issue from GovOPlaN/govoplan-dataflow

2026-09-08 12:57:22 +02:00

[Integrity review] Preserve edits made during Save and explicit CSV import fidelity #23