From b2ff07b036c889fba10e329d54151a300c1c8035 Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 17 Jul 2026 00:15:25 +0200 Subject: [PATCH] Record IONOS IMAP host facts for company mailbox Blue-lane provider data: imap.ionos.de:993 SSL/TLS; username is full email address. Non-secret email-connect config; password remains Red OpenBao provision only. --- integrations/company-email-openbao.md | 68 +++++++++++++++++++++++--- integrations/mailbox-binky-company.yml | 47 ++++++++++++++++++ 2 files changed, 108 insertions(+), 7 deletions(-) create mode 100644 integrations/mailbox-binky-company.yml diff --git a/integrations/company-email-openbao.md b/integrations/company-email-openbao.md index e6229ce..c48039e 100644 --- a/integrations/company-email-openbao.md +++ b/integrations/company-email-openbao.md @@ -1,6 +1,6 @@ # Company Email → Net Kingdom / OpenBao Integration Plan -> Status: implementation in progress — 2026-07-17 (WARDEN-WP-0028). +> Status: Blue facts complete — 2026-07-17 (WARDEN-WP-0028). > Goal: `bernd.worsch@binky-hedgehog.com` becomes an agent-readable event > source so StB replies, bank and authority notices reach the control plane. > **Credential handover is a single Red-lane founder step** — no agent solicits @@ -24,7 +24,37 @@ founder (Red lane, once) └─ email-connect scan-mailbox → mailmeta / queues ``` -## OpenBao lane (non-secret) +## Provider facts (IONOS — non-secret) + +Source: IONOS Mail connection tables (founder 2026-07-17). + +### Inbound (we use IMAP) + +| Setting | IMAP | POP3 (unused) | +| --- | --- | --- | +| Server | `imap.ionos.de` | `pop.ionos.de` | +| Port | `993` | `995` | +| Encryption | SSL/TLS | SSL/TLS | + +### Outbound SMTP (out of scope for this lane) + +| Setting | SMTP | +| --- | --- | +| Server | `smtp.ionos.de` | +| Port | `465` | +| Encryption | SSL/TLS | + +### Login shape (IONOS) + +| Field | Value | +| --- | --- | +| Username | Full mailbox address (e.g. `bernd.worsch@binky-hedgehog.com`) | +| Password | Mailbox password for that address | + +Username is not a high-secrecy secret but still lives in OpenBao with the +password so consumers get one fetch surface. **Password never in git/chat.** + +## OpenBao lane | Item | Value | | --- | --- | @@ -36,19 +66,23 @@ founder (Red lane, once) | Catalog | `binky-company-email-imap` (draft until provision) | | Risk | high | -## email-connect consumer config (non-secret, draft) +## email-connect consumer config (non-secret) + +Repo copy: `integrations/mailbox-binky-company.yml` (host/port/env names only). ```yaml mailbox: + id: binky-company-primary protocol: imap - host: # TODO: confirm with founder (Blue) + host: imap.ionos.de port: 993 + tls: true folder: INBOX username_env: IMAP_USERNAME password_env: IMAP_PASSWORD ``` -Scan output (CSV evidence) under `mailmeta/` — metadata only. +Scan output under `mailmeta/` — metadata only (no message bodies in git). ## Execution checklist @@ -56,21 +90,41 @@ Scan output (CSV evidence) under `mailmeta/` — metadata only. 2. [x] Mount `tenants/` enabled on bao.coulomb.social 3. [x] CCR-2026-0007 + policy + OIDC role applied (metadata only) 4. [x] ops-warden draft catalog + playbooks -5. [ ] Confirm IMAP host/provider facts with founder (Blue, non-secret) +5. [x] Confirm IMAP host/provider facts (IONOS: `imap.ionos.de:993` SSL/TLS) 6. [ ] **Red lane — founder:** provision username/password via `@file` only 7. [ ] Capabilities-safe verify + promote catalog to active/resolvable 8. [ ] First read-only scan; file metadata evidence; add to OperatingRhythm 9. [ ] Recurring scan via activity-core (BINKY-WP-0003 follow-ons) +### Founder provision (step 6) — interactive human shell + +```bash +bao login -method=oidc -path=netkingdom role=binky-company-email-imap-workload-kv-read + +# write mailbox address and password to mode-0600 files (never paste into chat) +umask 077 +printf '%s' 'bernd.worsch@binky-hedgehog.com' > /tmp/imap.user +# password into /tmp/imap.pass via editor or paste in a private terminal only + +bao kv put tenants/binky/company-email/imap \ + IMAP_USERNAME=@/tmp/imap.user \ + IMAP_PASSWORD=@/tmp/imap.pass +shred -u /tmp/imap.user /tmp/imap.pass +``` + +Then tell the agent/session so catalog can promote and the first scan can run. + ## Boundary rules (binding) - Secret values never appear in git, State Hub, chat, prompts, logs, or workplans. - email-connect stays read-only (`BODY.PEEK`); no mailbox write-back. - Agents with `WARDEN_AGENT_ID` set must not stream raw high-risk values. -- Sending mail from the company address is out of scope (separate lane). +- **SMTP / sending** from the company address is a **separate** future lane + (`smtp.ionos.de:465`); not this CCR. ## See also +- `integrations/mailbox-binky-company.yml` - ops-warden `wiki/playbooks/binky-company-email-imap.md` - ops-warden `wiki/playbooks/tenant-secret-onboarding.md` - railiance-platform `credential-change-requests/CCR-2026-0007-binky-company-email-imap.yaml` diff --git a/integrations/mailbox-binky-company.yml b/integrations/mailbox-binky-company.yml new file mode 100644 index 0000000..b8817e7 --- /dev/null +++ b/integrations/mailbox-binky-company.yml @@ -0,0 +1,47 @@ +# Non-secret email-connect config for Binky company mailbox (IONOS). +# Credentials: env names only — values from OpenBao tenants/binky/company-email/imap +# via warden access / bao as the caller (WARDEN-WP-0028 / CCR-2026-0007). +# +# Usage (after Red provision): +# export IMAP_USERNAME=... IMAP_PASSWORD=... # via warden access --exec, not chat +# PYTHONPATH=src python3 -m email_connect.cli scan-mailbox \ +# --config integrations/mailbox-binky-company.yml \ +# --out mailmeta/reports/ + +mailbox: + id: binky-company-primary + protocol: imap + host: imap.ionos.de + port: 993 + tls: true + username_env: IMAP_USERNAME + password_env: IMAP_PASSWORD + folder: INBOX + +source: + fixture_dir: null + +scan: + mode: incremental + max_messages_per_run: 500 + since: null + from: null + to: null + include_seen: true + mark_seen: false + store_raw_headers: true + store_raw_body: false + store_raw_message_ref: false + +expected_recipients: + path: null + csv_column: email + +storage: + path: mailmeta/.email-connect-state.sqlite + +reports: + output_dir: mailmeta/reports + include_all_evidence: true + include_unknown_messages: true + timestamp_timezone: Europe/Berlin