Record IONOS IMAP host facts for company mailbox

Blue-lane provider data: imap.ionos.de:993 SSL/TLS; username is full
email address. Non-secret email-connect config; password remains Red
OpenBao provision only.

integrations/company-email-openbao.md

@@ -1,6 +1,6 @@
 # Company Email → Net Kingdom / OpenBao Integration Plan
 
-> Status: implementation in progress — 2026-07-17 (WARDEN-WP-0028).
+> Status: Blue facts complete — 2026-07-17 (WARDEN-WP-0028).  
 > Goal: `bernd.worsch@binky-hedgehog.com` becomes an agent-readable event
 > source so StB replies, bank and authority notices reach the control plane.
 > **Credential handover is a single Red-lane founder step** — no agent solicits
@@ -24,7 +24,37 @@ founder (Red lane, once)
                   └─ email-connect scan-mailbox → mailmeta / queues
 ```
 
-## OpenBao lane (non-secret)
+## Provider facts (IONOS — non-secret)
+
+Source: IONOS Mail connection tables (founder 2026-07-17).
+
+### Inbound (we use IMAP)
+
+| Setting | IMAP | POP3 (unused) |
+| --- | --- | --- |
+| Server | `imap.ionos.de` | `pop.ionos.de` |
+| Port | `993` | `995` |
+| Encryption | SSL/TLS | SSL/TLS |
+
+### Outbound SMTP (out of scope for this lane)
+
+| Setting | SMTP |
+| --- | --- |
+| Server | `smtp.ionos.de` |
+| Port | `465` |
+| Encryption | SSL/TLS |
+
+### Login shape (IONOS)
+
+| Field | Value |
+| --- | --- |
+| Username | Full mailbox address (e.g. `bernd.worsch@binky-hedgehog.com`) |
+| Password | Mailbox password for that address |
+
+Username is not a high-secrecy secret but still lives in OpenBao with the
+password so consumers get one fetch surface. **Password never in git/chat.**
+
+## OpenBao lane
 
 | Item | Value |
 | --- | --- |
@@ -36,19 +66,23 @@ founder (Red lane, once)
 | Catalog | `binky-company-email-imap` (draft until provision) |
 | Risk | high |
 
-## email-connect consumer config (non-secret, draft)
+## email-connect consumer config (non-secret)
+
+Repo copy: `integrations/mailbox-binky-company.yml` (host/port/env names only).
 
 ```yaml
 mailbox:
+  id: binky-company-primary
   protocol: imap
-  host: <provider-imap-host>        # TODO: confirm with founder (Blue)
+  host: imap.ionos.de
   port: 993
+  tls: true
   folder: INBOX
   username_env: IMAP_USERNAME
   password_env: IMAP_PASSWORD
 ```
 
-Scan output (CSV evidence) under `mailmeta/` — metadata only.
+Scan output under `mailmeta/` — metadata only (no message bodies in git).
 
 ## Execution checklist
 
@@ -56,21 +90,41 @@ Scan output (CSV evidence) under `mailmeta/` — metadata only.
 2. [x] Mount `tenants/` enabled on bao.coulomb.social
 3. [x] CCR-2026-0007 + policy + OIDC role applied (metadata only)
 4. [x] ops-warden draft catalog + playbooks
-5. [ ] Confirm IMAP host/provider facts with founder (Blue, non-secret)
+5. [x] Confirm IMAP host/provider facts (IONOS: `imap.ionos.de:993` SSL/TLS)
 6. [ ] **Red lane — founder:** provision username/password via `@file` only
 7. [ ] Capabilities-safe verify + promote catalog to active/resolvable
 8. [ ] First read-only scan; file metadata evidence; add to OperatingRhythm
 9. [ ] Recurring scan via activity-core (BINKY-WP-0003 follow-ons)
 
+### Founder provision (step 6) — interactive human shell
+
+```bash
+bao login -method=oidc -path=netkingdom role=binky-company-email-imap-workload-kv-read
+
+# write mailbox address and password to mode-0600 files (never paste into chat)
+umask 077
+printf '%s' 'bernd.worsch@binky-hedgehog.com' > /tmp/imap.user
+# password into /tmp/imap.pass via editor or paste in a private terminal only
+
+bao kv put tenants/binky/company-email/imap \
+  IMAP_USERNAME=@/tmp/imap.user \
+  IMAP_PASSWORD=@/tmp/imap.pass
+shred -u /tmp/imap.user /tmp/imap.pass
+```
+
+Then tell the agent/session so catalog can promote and the first scan can run.
+
 ## Boundary rules (binding)
 
 - Secret values never appear in git, State Hub, chat, prompts, logs, or workplans.
 - email-connect stays read-only (`BODY.PEEK`); no mailbox write-back.
 - Agents with `WARDEN_AGENT_ID` set must not stream raw high-risk values.
-- Sending mail from the company address is out of scope (separate lane).
+- **SMTP / sending** from the company address is a **separate** future lane
+  (`smtp.ionos.de:465`); not this CCR.
 
 ## See also
 
+- `integrations/mailbox-binky-company.yml`
 - ops-warden `wiki/playbooks/binky-company-email-imap.md`
 - ops-warden `wiki/playbooks/tenant-secret-onboarding.md`
 - railiance-platform `credential-change-requests/CCR-2026-0007-binky-company-email-imap.yaml`

integrations/mailbox-binky-company.yml

@@ -0,0 +1,47 @@
+# Non-secret email-connect config for Binky company mailbox (IONOS).
+# Credentials: env names only — values from OpenBao tenants/binky/company-email/imap
+# via warden access / bao as the caller (WARDEN-WP-0028 / CCR-2026-0007).
+#
+# Usage (after Red provision):
+#   export IMAP_USERNAME=... IMAP_PASSWORD=...   # via warden access --exec, not chat
+#   PYTHONPATH=src python3 -m email_connect.cli scan-mailbox \
+#     --config integrations/mailbox-binky-company.yml \
+#     --out mailmeta/reports/
+
+mailbox:
+  id: binky-company-primary
+  protocol: imap
+  host: imap.ionos.de
+  port: 993
+  tls: true
+  username_env: IMAP_USERNAME
+  password_env: IMAP_PASSWORD
+  folder: INBOX
+
+source:
+  fixture_dir: null
+
+scan:
+  mode: incremental
+  max_messages_per_run: 500
+  since: null
+  from: null
+  to: null
+  include_seen: true
+  mark_seen: false
+  store_raw_headers: true
+  store_raw_body: false
+  store_raw_message_ref: false
+
+expected_recipients:
+  path: null
+  csv_column: email
+
+storage:
+  path: mailmeta/.email-connect-state.sqlite
+
+reports:
+  output_dir: mailmeta/reports
+  include_all_evidence: true
+  include_unknown_messages: true
+  timestamp_timezone: Europe/Berlin