Transfer test and material ownership only after recipient acceptance #50

New issue

Open

opened 2026-11-01 20:12:09 +00:00 by viacheslavshuka · 0 comments

viacheslavshuka commented

2026-11-01 20:12:09 +00:00

Owner

Owners need to hand over assignment authority without appointing an unwilling person. Apply one consistent transfer outcome to tests and reusable material.

Acceptance criteria

A test owner can propose transfer to an eligible accepted co-organizer. A material owner can propose transfer to an eligible accepted collaborator.
The current owner retains ownership until the intended recipient accepts. Acceptance rechecks current ownership, recipient eligibility, and accepted role.
Creating a transfer request atomically emits an actionable inbox notification for the intended recipient. Telegram delivery honors their messaging permission and channel preference.
Notification delivery never accepts the transfer. Replacing or withdrawing a request invalidates its earlier notification action.
Each object permits one pending transfer. It expires after seven days. The initiating owner or moderator can withdraw or replace it.
Replacement invalidates the previous request and its acceptance action. Decline or expiry leaves ownership unchanged and does not cancel a test.
A declined request cannot be resent to that recipient unless the recipient initiates reconsideration.
After acceptance, the former owner retains their co-organizer or collaborator role unless they later leave or the new owner removes them.
A moderator may initiate transfer when an owner loses organizing access or a moderator blocks their account. The moderator cannot bypass recipient acceptance or appoint someone automatically.
Other eligible organizers retain their permissions during recovery. Record the transfer and moderator reason in the relevant history.
A test owner can cancel the test or transfer ownership, but cannot leave while still the owner. Cancellation preserves owner attribution.

Validation

Race acceptance against replacement, expiry, recipient revocation, and account restriction. Assert exactly one owner and no unauthorized role elevation. Check that a stale bot or website action cannot accept a superseded request.

Verify one inbox item per request and recipient after repeated event processing. Delivery failure must leave ownership unchanged.

Transfer a private draft and then remove the original creator's organizer role. Verify that subsequent reads by the original creator fail.

Dependencies

#39: Let material owners invite collaborators and control group reuse. Provides eligible material collaborators.
#47: Manage test co-organizers through accepted invitations. Provides eligible test co-organizers.
#48: Give operator-appointed moderators a private report queue. Provides operator-appointed moderators for recovery initiation.
#22: Keep a durable notification inbox with current action status. Provides actionable ownership-transfer notifications.
#23: Let users control Telegram delivery, reminders, and digests. Provides recipient delivery preferences for transfer requests.

Owners need to hand over assignment authority without appointing an unwilling person. Apply one consistent transfer outcome to tests and reusable material. ## Acceptance criteria - A test owner can propose transfer to an eligible accepted co-organizer. A material owner can propose transfer to an eligible accepted collaborator. - The current owner retains ownership until the intended recipient accepts. Acceptance rechecks current ownership, recipient eligibility, and accepted role. - Creating a transfer request atomically emits an actionable inbox notification for the intended recipient. Telegram delivery honors their messaging permission and channel preference. - Notification delivery never accepts the transfer. Replacing or withdrawing a request invalidates its earlier notification action. - Each object permits one pending transfer. It expires after seven days. The initiating owner or moderator can withdraw or replace it. - Replacement invalidates the previous request and its acceptance action. Decline or expiry leaves ownership unchanged and does not cancel a test. - A declined request cannot be resent to that recipient unless the recipient initiates reconsideration. - After acceptance, the former owner retains their co-organizer or collaborator role unless they later leave or the new owner removes them. - A moderator may initiate transfer when an owner loses organizing access or a moderator blocks their account. The moderator cannot bypass recipient acceptance or appoint someone automatically. - Other eligible organizers retain their permissions during recovery. Record the transfer and moderator reason in the relevant history. - A test owner can cancel the test or transfer ownership, but cannot leave while still the owner. Cancellation preserves owner attribution. ## Validation Race acceptance against replacement, expiry, recipient revocation, and account restriction. Assert exactly one owner and no unauthorized role elevation. Check that a stale bot or website action cannot accept a superseded request. Verify one inbox item per request and recipient after repeated event processing. Delivery failure must leave ownership unchanged. Transfer a private draft and then remove the original creator's organizer role. Verify that subsequent reads by the original creator fail. ## Dependencies - [#39: Let material owners invite collaborators and control group reuse](https://code.viacheslavshuka.com/viacheslavshuka/quorum/issues/39). Provides eligible material collaborators. - [#47: Manage test co-organizers through accepted invitations](https://code.viacheslavshuka.com/viacheslavshuka/quorum/issues/47). Provides eligible test co-organizers. - [#48: Give operator-appointed moderators a private report queue](https://code.viacheslavshuka.com/viacheslavshuka/quorum/issues/48). Provides operator-appointed moderators for recovery initiation. - [#22: Keep a durable notification inbox with current action status](https://code.viacheslavshuka.com/viacheslavshuka/quorum/issues/22). Provides actionable ownership-transfer notifications. - [#23: Let users control Telegram delivery, reminders, and digests](https://code.viacheslavshuka.com/viacheslavshuka/quorum/issues/23). Provides recipient delivery preferences for transfer requests. ## Related work - [#69: Restrict participation and organizing capabilities with reversible expiry](https://code.viacheslavshuka.com/viacheslavshuka/quorum/issues/69) - [#72: Cancel upcoming tests and stop running tests through explicit controls](https://code.viacheslavshuka.com/viacheslavshuka/quorum/issues/72) - [#29: Deliver Telegram notifications with bounded retries and current permissions](https://code.viacheslavshuka.com/viacheslavshuka/quorum/issues/29)

viacheslavshuka referenced this issue

2026-11-01 20:12:31 +00:00

Handle organizer decisions and simple session updates through Telegram #66

viacheslavshuka referenced this issue

2026-11-01 20:12:35 +00:00

Restrict participation and organizing capabilities with reversible expiry #69

viacheslavshuka added the