coulomb/binky-control
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record IONOS IMAP host facts for company mailbox

Browse source 
Blue-lane provider data: imap.ionos.de:993 SSL/TLS; username is full
email address. Non-secret email-connect config; password remains Red
OpenBao provision only.
This commit is contained in:
tegwick 2026-07-17 00:15:25 +02:00
parent a2a561757f
commit b2ff07b036
2 changed files with 108 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

68
integrations/company-email-openbao.md
View file

@ -1,6 +1,6 @@
# Company Email → Net Kingdom / OpenBao Integration Plan
> Status: implementation in progress — 2026-07-17 (WARDEN-WP-0028).
> Status: Blue facts complete — 2026-07-17 (WARDEN-WP-0028).
> Goal: `bernd.worsch@binky-hedgehog.com` becomes an agent-readable event
> source so StB replies, bank and authority notices reach the control plane.
> **Credential handover is a single Red-lane founder step** — no agent solicits
@ -24,7 +24,37 @@ founder (Red lane, once)
└─ email-connect scan-mailbox → mailmeta / queues
```
## OpenBao lane (non-secret)
## Provider facts (IONOS — non-secret)
Source: IONOS Mail connection tables (founder 2026-07-17).
### Inbound (we use IMAP)
| Setting | IMAP | POP3 (unused) |
| --- | --- | --- |
| Server | `imap.ionos.de` | `pop.ionos.de` |
| Port | `993` | `995` |
| Encryption | SSL/TLS | SSL/TLS |
### Outbound SMTP (out of scope for this lane)
| Setting | SMTP |
| --- | --- |
| Server | `smtp.ionos.de` |
| Port | `465` |
| Encryption | SSL/TLS |
### Login shape (IONOS)
| Field | Value |
| --- | --- |
| Username | Full mailbox address (e.g. `bernd.worsch@binky-hedgehog.com`) |
| Password | Mailbox password for that address |
Username is not a high-secrecy secret but still lives in OpenBao with the
password so consumers get one fetch surface. **Password never in git/chat.**
## OpenBao lane
| Item | Value |
| --- | --- |
@ -36,19 +66,23 @@ founder (Red lane, once)
| Catalog | `binky-company-email-imap` (draft until provision) |
| Risk | high |
## email-connect consumer config (non-secret, draft)
## email-connect consumer config (non-secret)
Repo copy: `integrations/mailbox-binky-company.yml` (host/port/env names only).
```yaml
mailbox:
id: binky-company-primary
protocol: imap
host: <provider-imap-host> # TODO: confirm with founder (Blue)
host: imap.ionos.de
port: 993
tls: true
folder: INBOX
username_env: IMAP_USERNAME
password_env: IMAP_PASSWORD
```
Scan output (CSV evidence) under `mailmeta/` — metadata only.
Scan output under `mailmeta/` — metadata only (no message bodies in git).
## Execution checklist
@ -56,21 +90,41 @@ Scan output (CSV evidence) under `mailmeta/` — metadata only.
2. [x] Mount `tenants/` enabled on bao.coulomb.social
3. [x] CCR-2026-0007 + policy + OIDC role applied (metadata only)
4. [x] ops-warden draft catalog + playbooks
5. [ ] Confirm IMAP host/provider facts with founder (Blue, non-secret)
5. [x] Confirm IMAP host/provider facts (IONOS: `imap.ionos.de:993` SSL/TLS)
6. [ ] **Red lane — founder:** provision username/password via `@file` only
7. [ ] Capabilities-safe verify + promote catalog to active/resolvable
8. [ ] First read-only scan; file metadata evidence; add to OperatingRhythm
9. [ ] Recurring scan via activity-core (BINKY-WP-0003 follow-ons)
### Founder provision (step 6) — interactive human shell
```bash
bao login -method=oidc -path=netkingdom role=binky-company-email-imap-workload-kv-read
# write mailbox address and password to mode-0600 files (never paste into chat)
umask 077
printf '%s' 'bernd.worsch@binky-hedgehog.com' > /tmp/imap.user
# password into /tmp/imap.pass via editor or paste in a private terminal only
bao kv put tenants/binky/company-email/imap \
IMAP_USERNAME=@/tmp/imap.user \
IMAP_PASSWORD=@/tmp/imap.pass
shred -u /tmp/imap.user /tmp/imap.pass
```
Then tell the agent/session so catalog can promote and the first scan can run.
## Boundary rules (binding)
- Secret values never appear in git, State Hub, chat, prompts, logs, or workplans.
- email-connect stays read-only (`BODY.PEEK`); no mailbox write-back.
- Agents with `WARDEN_AGENT_ID` set must not stream raw high-risk values.
- Sending mail from the company address is out of scope (separate lane).
- **SMTP / sending** from the company address is a **separate** future lane
(`smtp.ionos.de:465`); not this CCR.
## See also
- `integrations/mailbox-binky-company.yml`
- ops-warden `wiki/playbooks/binky-company-email-imap.md`
- ops-warden `wiki/playbooks/tenant-secret-onboarding.md`
- railiance-platform `credential-change-requests/CCR-2026-0007-binky-company-email-imap.yaml`

47
integrations/mailbox-binky-company.yml Normal file
View file

@ -0,0 +1,47 @@
# Non-secret email-connect config for Binky company mailbox (IONOS).
# Credentials: env names only — values from OpenBao tenants/binky/company-email/imap
# via warden access / bao as the caller (WARDEN-WP-0028 / CCR-2026-0007).
#
# Usage (after Red provision):
# export IMAP_USERNAME=... IMAP_PASSWORD=... # via warden access --exec, not chat
# PYTHONPATH=src python3 -m email_connect.cli scan-mailbox \
# --config integrations/mailbox-binky-company.yml \
# --out mailmeta/reports/
mailbox:
id: binky-company-primary
protocol: imap
host: imap.ionos.de
port: 993
tls: true
username_env: IMAP_USERNAME
password_env: IMAP_PASSWORD
folder: INBOX
source:
fixture_dir: null
scan:
mode: incremental
max_messages_per_run: 500
since: null
from: null
to: null
include_seen: true
mark_seen: false
store_raw_headers: true
store_raw_body: false
store_raw_message_ref: false
expected_recipients:
path: null
csv_column: email
storage:
path: mailmeta/.email-connect-state.sqlite
reports:
output_dir: mailmeta/reports
include_all_evidence: true
include_unknown_messages: true
timestamp_timezone: Europe/Berlin