Align company email OpenBao plan to tenants/binky path

Match WARDEN-WP-0028 / CCR-2026-0007: mount tenants, checklist for
founder Red provision and host confirmation.

integrations/company-email-openbao.md

@@ -1,119 +1,76 @@
 # Company Email → Net Kingdom / OpenBao Integration Plan
 
-> Status: prepared v1 — 2026-07-16 (BINKY-WP-0003-T01, AWQ-007).
+> Status: implementation in progress — 2026-07-17 (WARDEN-WP-0028).
 > Goal: `bernd.worsch@binky-hedgehog.com` becomes an agent-readable event
 > source so StB replies, bank and authority notices reach the control plane.
-> **Credential handover is a single Red-lane founder step at the end** — no
+> **Credential handover is a single Red-lane founder step** — no agent solicits
-> agent solicits or stores the password before the vault lane exists.
+> or stores the password before provision.
 
 ## Architecture (sanctioned path)
 
-Per `net-kingdom/docs/secrets-engine-security-infrastructure-boundary.md`:
+| Layer | Role |
-OpenBao owns custody/policy/audit; **secrets-engine** owns the workflow
+| --- | --- |
-(catalog → decision → plan/apply → provisioning → exec-time delivery);
+| OpenBao mount **`tenants/`** | Custody for client/tenant commercial secrets |
-**email-connect** is the consumer (read-only IMAP mailbox scan, MVP already
+| railiance-platform **CCR-2026-0007** | Policy + OIDC role (applied); value provision separate |
-supports `mailbox.protocol: imap` with credential *environment variable
+| ops-warden catalog **`binky-company-email-imap`** | Front door (`warden access`); no custody |
-names* in config — values never in config files).
+| email-connect | Read-only IMAP scan; credentials only via env *names* |
+| binky-control | Queues + `mailmeta/` metadata evidence (no message bodies in git) |
 
 ```text
 founder (Red lane, once)
-   └─ provisions IMAP password into OpenBao via secrets-engine plan
+   └─ bao kv put tenants/binky/company-email/imap IMAP_USERNAME=@file IMAP_PASSWORD=@file
-        └─ OpenBao kv: secret/prod/binky/company-email/imap
+        └─ OpenBao: tenants/binky/company-email/imap
-             └─ secrets-engine exec --catalog binky-company-email-imap \
+             └─ warden access binky-company-email-imap --out / --exec
-                    -- python -m email_connect.cli scan-mailbox ...
+                  └─ email-connect scan-mailbox → mailmeta / queues
-                  └─ scan reports / classified evidence → binky-control queues
 ```
 
-## Draft secrets-engine catalog entry (non-secret)
+## OpenBao lane (non-secret)
 
-To be landed in `~/secrets-engine/catalog/binky-company-email-imap.yaml`
+| Item | Value |
-after review (kept here as the reviewed source until then):
+| --- | --- |
-
+| Mount | `tenants` |
-```yaml
+| Path | `tenants/binky/company-email/imap` |
-id: binky-company-email-imap
+| Fields | `IMAP_USERNAME`, `IMAP_PASSWORD` |
-org: binky
+| Policy | `workload-kv-read-binky-company-email-imap` |
-repo: binky-control
+| OIDC role | `binky-company-email-imap-workload-kv-read` |
-stage: prod
+| Catalog | `binky-company-email-imap` (draft until provision) |
-description: >-
+| Risk | high |
-  IMAP credentials for the company mailbox bernd.worsch@binky-hedgehog.com.
-  Read-only mailbox scanning by email-connect so real-world events (StB
-  replies, bank/authority notices) reach the Binky control plane.
-
-mount: secret
-path: prod/binky/company-email/imap
-
-fields:
-  - imap_username
-  - imap_password
-
-consumers:
-  - name: email-connect-scanner
-    auth: approle
-    claim: "role:email-connect-scanner"
-    purpose: "read-only IMAP scan of the company mailbox"
-
-delivery_modes:
-  - exec-env        # secrets-engine exec injects IMAP_USERNAME/IMAP_PASSWORD
-
-approval:
-  model: decision   # State Hub decision + founder handover (Red lane)
-  notes: "Founder provisions the value once; agents never see or relay it."
-
-verification:
-  positive: "email-connect scan-mailbox completes a read-only folder scan"
-  negative: "no other consumer role can read prod/binky/* paths"
-
-rotation:
-  expectation: "on suspicion or provider change; founder-triggered"
-
-deactivation:
-  expectation: "disable AppRole + delete kv path if mailbox is migrated"
-
-audit:
-  evidence: "actor, path, timestamp, result — no secret value"
-```
-
-Non-secret connection facts still to confirm with the founder (Blue lane,
-not credentials): IMAP host/port for the binky-hedgehog.com mail provider,
-folder to scan (default INBOX).
 
 ## email-connect consumer config (non-secret, draft)
 
 ```yaml
 mailbox:
   protocol: imap
-  host: <provider-imap-host>        # TODO: confirm provider
+  host: <provider-imap-host>        # TODO: confirm with founder (Blue)
   port: 993
   folder: INBOX
   username_env: IMAP_USERNAME
   password_env: IMAP_PASSWORD
 ```
 
-Scan output (CSV evidence reports) initially lands in this repo under
+Scan output (CSV evidence) under `mailmeta/` — metadata only.
-`mailmeta/` (metadata only — no message bodies in git); triage routes items
-into DecisionQueue / OfficeHourQueue / RiskRegister, receipts toward DUO
-Belegablage (shared triage step with paper mail, AWQ-008).
 
 ## Execution checklist
 
-1. [x] Vault path + catalog entry designed (this document)
+1. [x] Path convention decided (`tenants/<tenant>/…`) — WARDEN-WP-0028
-2. [ ] Confirm IMAP host/provider facts with founder (non-secret)
+2. [x] Mount `tenants/` enabled on bao.coulomb.social
-3. [ ] Land catalog entry in `secrets-engine/catalog/`; register decision in
+3. [x] CCR-2026-0007 + policy + OIDC role applied (metadata only)
-       State Hub (approval model `decision`)
+4. [x] ops-warden draft catalog + playbooks
-4. [ ] Verify OpenBao prod reachability from the executing machine
+5. [ ] Confirm IMAP host/provider facts with founder (Blue, non-secret)
-       (workstation has no local OpenBao on :8200 — prod custody lives in
+6. [ ] **Red lane — founder:** provision username/password via `@file` only
-       the NetKingdom deployment; check via secrets-engine roles)
+7. [ ] Capabilities-safe verify + promote catalog to active/resolvable
-5. [ ] **Red lane — founder, once:** provision the IMAP password through the
+8. [ ] First read-only scan; file metadata evidence; add to OperatingRhythm
-       secrets-engine provisioning flow (never via chat/prompt/file)
+9. [ ] Recurring scan via activity-core (BINKY-WP-0003 follow-ons)
-6. [ ] First read-only scan via `secrets-engine exec … scan-mailbox`;
-       file evidence report; add triage step to OperatingRhythm
-7. [ ] Recurring scan becomes an activity-core definition (see T05) and an
-       llm-connect execution target (see T06)
 
 ## Boundary rules (binding)
 
-- Secret values never appear in git, State Hub, chat, prompts, logs, or
+- Secret values never appear in git, State Hub, chat, prompts, logs, or workplans.
-  workplans — catalog metadata only.
 - email-connect stays read-only (`BODY.PEEK`); no mailbox write-back.
-- Sending mail from the company address is out of scope here; it would be a
+- Agents with `WARDEN_AGENT_ID` set must not stream raw high-risk values.
-  separate catalog lane and a separate decision.
+- Sending mail from the company address is out of scope (separate lane).
+
+## See also
+
+- ops-warden `wiki/playbooks/binky-company-email-imap.md`
+- ops-warden `wiki/playbooks/tenant-secret-onboarding.md`
+- railiance-platform `credential-change-requests/CCR-2026-0007-binky-company-email-imap.yaml`