From bc49a24c4c4d61d939dd63933363672308f70310 Mon Sep 17 00:00:00 2001 From: tegwick Date: Thu, 16 Jul 2026 10:50:29 +0200 Subject: [PATCH] =?UTF-8?q?BINKY-WP-0003-T01:=20company=20email=20?= =?UTF-8?q?=E2=86=92=20OpenBao=20integration=20plan=20(AWQ-007=20prep)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Vault path prod/binky/company-email/imap, secrets-engine catalog draft, email-connect read-only IMAP wiring. Credential handover stays a single Red-lane founder step. Co-Authored-By: Claude Fable 5 --- AutopilotWorkQueue.md | 18 +-- integrations/company-email-openbao.md | 119 ++++++++++++++++++ .../BINKY-WP-0003-autopilot-and-rhythm.md | 2 +- 3 files changed, 125 insertions(+), 14 deletions(-) create mode 100644 integrations/company-email-openbao.md diff --git a/AutopilotWorkQueue.md b/AutopilotWorkQueue.md index b6739c5..92cf05a 100644 --- a/AutopilotWorkQueue.md +++ b/AutopilotWorkQueue.md @@ -51,18 +51,6 @@ lane: green pulls_from: [EcosystemMap.md cartography v0 caveat] ``` -```yaml -id: AWQ-007 -title: "Onboard company email (bernd.worsch@binky-hedgehog.com) into Net Kingdom / OpenBao" -lane: blue -pulls_from: [audits/OK-Audit-v0-binky.md digital presence, identity-and-access capability] -notes: "Store credentials in OpenBao; wire mailbox into agent event loop (email-connect - is the natural capability). Credential handover from founder is Red-lane — prepare - the vault path and integration plan first, then request the secret once. Goal: - real-world events (StB replies, Qonto notices) reach the control plane. Direct - dogfood of the net_kingdom + railiance pillars." -``` - ```yaml id: AWQ-008 title: "Design weekly paper-mail scan intake pipeline" @@ -82,4 +70,8 @@ with a one-line outcome. ## Completed -*(none yet)* +- **AWQ-007** (2026-07-16, BINKY-WP-0003-T01): company-email → OpenBao + integration prepared — vault path, secrets-engine catalog draft, and + email-connect wiring in `integrations/company-email-openbao.md`. Remaining + steps (provider facts, Red-lane credential handover) tracked in that + document's checklist. diff --git a/integrations/company-email-openbao.md b/integrations/company-email-openbao.md new file mode 100644 index 0000000..4be0df0 --- /dev/null +++ b/integrations/company-email-openbao.md @@ -0,0 +1,119 @@ +# Company Email → Net Kingdom / OpenBao Integration Plan + +> Status: prepared v1 — 2026-07-16 (BINKY-WP-0003-T01, AWQ-007). +> Goal: `bernd.worsch@binky-hedgehog.com` becomes an agent-readable event +> source so StB replies, bank and authority notices reach the control plane. +> **Credential handover is a single Red-lane founder step at the end** — no +> agent solicits or stores the password before the vault lane exists. + +## Architecture (sanctioned path) + +Per `net-kingdom/docs/secrets-engine-security-infrastructure-boundary.md`: +OpenBao owns custody/policy/audit; **secrets-engine** owns the workflow +(catalog → decision → plan/apply → provisioning → exec-time delivery); +**email-connect** is the consumer (read-only IMAP mailbox scan, MVP already +supports `mailbox.protocol: imap` with credential *environment variable +names* in config — values never in config files). + +```text +founder (Red lane, once) + └─ provisions IMAP password into OpenBao via secrets-engine plan + └─ OpenBao kv: secret/prod/binky/company-email/imap + └─ secrets-engine exec --catalog binky-company-email-imap \ + -- python -m email_connect.cli scan-mailbox ... + └─ scan reports / classified evidence → binky-control queues +``` + +## Draft secrets-engine catalog entry (non-secret) + +To be landed in `~/secrets-engine/catalog/binky-company-email-imap.yaml` +after review (kept here as the reviewed source until then): + +```yaml +id: binky-company-email-imap +org: binky +repo: binky-control +stage: prod +description: >- + IMAP credentials for the company mailbox bernd.worsch@binky-hedgehog.com. + Read-only mailbox scanning by email-connect so real-world events (StB + replies, bank/authority notices) reach the Binky control plane. + +mount: secret +path: prod/binky/company-email/imap + +fields: + - imap_username + - imap_password + +consumers: + - name: email-connect-scanner + auth: approle + claim: "role:email-connect-scanner" + purpose: "read-only IMAP scan of the company mailbox" + +delivery_modes: + - exec-env # secrets-engine exec injects IMAP_USERNAME/IMAP_PASSWORD + +approval: + model: decision # State Hub decision + founder handover (Red lane) + notes: "Founder provisions the value once; agents never see or relay it." + +verification: + positive: "email-connect scan-mailbox completes a read-only folder scan" + negative: "no other consumer role can read prod/binky/* paths" + +rotation: + expectation: "on suspicion or provider change; founder-triggered" + +deactivation: + expectation: "disable AppRole + delete kv path if mailbox is migrated" + +audit: + evidence: "actor, path, timestamp, result — no secret value" +``` + +Non-secret connection facts still to confirm with the founder (Blue lane, +not credentials): IMAP host/port for the binky-hedgehog.com mail provider, +folder to scan (default INBOX). + +## email-connect consumer config (non-secret, draft) + +```yaml +mailbox: + protocol: imap + host: # TODO: confirm provider + port: 993 + folder: INBOX + username_env: IMAP_USERNAME + password_env: IMAP_PASSWORD +``` + +Scan output (CSV evidence reports) initially lands in this repo under +`mailmeta/` (metadata only — no message bodies in git); triage routes items +into DecisionQueue / OfficeHourQueue / RiskRegister, receipts toward DUO +Belegablage (shared triage step with paper mail, AWQ-008). + +## Execution checklist + +1. [x] Vault path + catalog entry designed (this document) +2. [ ] Confirm IMAP host/provider facts with founder (non-secret) +3. [ ] Land catalog entry in `secrets-engine/catalog/`; register decision in + State Hub (approval model `decision`) +4. [ ] Verify OpenBao prod reachability from the executing machine + (workstation has no local OpenBao on :8200 — prod custody lives in + the NetKingdom deployment; check via secrets-engine roles) +5. [ ] **Red lane — founder, once:** provision the IMAP password through the + secrets-engine provisioning flow (never via chat/prompt/file) +6. [ ] First read-only scan via `secrets-engine exec … scan-mailbox`; + file evidence report; add triage step to OperatingRhythm +7. [ ] Recurring scan becomes an activity-core definition (see T05) and an + llm-connect execution target (see T06) + +## Boundary rules (binding) + +- Secret values never appear in git, State Hub, chat, prompts, logs, or + workplans — catalog metadata only. +- email-connect stays read-only (`BODY.PEEK`); no mailbox write-back. +- Sending mail from the company address is out of scope here; it would be a + separate catalog lane and a separate decision. diff --git a/workplans/BINKY-WP-0003-autopilot-and-rhythm.md b/workplans/BINKY-WP-0003-autopilot-and-rhythm.md index 7e28c73..b295fde 100644 --- a/workplans/BINKY-WP-0003-autopilot-and-rhythm.md +++ b/workplans/BINKY-WP-0003-autopilot-and-rhythm.md @@ -22,7 +22,7 @@ StB replies and bank/authority notices reach the control plane. ```task id: BINKY-WP-0003-T01 -status: todo +status: done priority: high ```