# Company Email → Net Kingdom / OpenBao Integration Plan

> Status: implementation in progress — 2026-07-17 (WARDEN-WP-0028).
> Goal: `bernd.worsch@binky-hedgehog.com` becomes an agent-readable event
> source so StB replies, bank and authority notices reach the control plane.
> **Credential handover is a single Red-lane founder step** — no agent solicits
> or stores the password before provision.

## Architecture (sanctioned path)

| Layer | Role |
| --- | --- |
| OpenBao mount **`tenants/`** | Custody for client/tenant commercial secrets |
| railiance-platform **CCR-2026-0007** | Policy + OIDC role (applied); value provision separate |
| ops-warden catalog **`binky-company-email-imap`** | Front door (`warden access`); no custody |
| email-connect | Read-only IMAP scan; credentials only via env *names* |
| binky-control | Queues + `mailmeta/` metadata evidence (no message bodies in git) |

```text
founder (Red lane, once)
   └─ bao kv put tenants/binky/company-email/imap IMAP_USERNAME=@file IMAP_PASSWORD=@file
        └─ OpenBao: tenants/binky/company-email/imap
             └─ warden access binky-company-email-imap --out / --exec
                  └─ email-connect scan-mailbox → mailmeta / queues
```

## OpenBao lane (non-secret)

| Item | Value |
| --- | --- |
| Mount | `tenants` |
| Path | `tenants/binky/company-email/imap` |
| Fields | `IMAP_USERNAME`, `IMAP_PASSWORD` |
| Policy | `workload-kv-read-binky-company-email-imap` |
| OIDC role | `binky-company-email-imap-workload-kv-read` |
| Catalog | `binky-company-email-imap` (draft until provision) |
| Risk | high |

## email-connect consumer config (non-secret, draft)

```yaml
mailbox:
  protocol: imap
  host: <provider-imap-host>        # TODO: confirm with founder (Blue)
  port: 993
  folder: INBOX
  username_env: IMAP_USERNAME
  password_env: IMAP_PASSWORD
```

Scan output (CSV evidence) under `mailmeta/` — metadata only.

## Execution checklist

1. [x] Path convention decided (`tenants/<tenant>/…`) — WARDEN-WP-0028
2. [x] Mount `tenants/` enabled on bao.coulomb.social
3. [x] CCR-2026-0007 + policy + OIDC role applied (metadata only)
4. [x] ops-warden draft catalog + playbooks
5. [ ] Confirm IMAP host/provider facts with founder (Blue, non-secret)
6. [ ] **Red lane — founder:** provision username/password via `@file` only
7. [ ] Capabilities-safe verify + promote catalog to active/resolvable
8. [ ] First read-only scan; file metadata evidence; add to OperatingRhythm
9. [ ] Recurring scan via activity-core (BINKY-WP-0003 follow-ons)

## Boundary rules (binding)

- Secret values never appear in git, State Hub, chat, prompts, logs, or workplans.
- email-connect stays read-only (`BODY.PEEK`); no mailbox write-back.
- Agents with `WARDEN_AGENT_ID` set must not stream raw high-risk values.
- Sending mail from the company address is out of scope (separate lane).

## See also

- ops-warden `wiki/playbooks/binky-company-email-imap.md`
- ops-warden `wiki/playbooks/tenant-secret-onboarding.md`
- railiance-platform `credential-change-requests/CCR-2026-0007-binky-company-email-imap.yaml`