binky-control/integrations/company-email-openbao.md

Company Email → Net Kingdom / OpenBao Integration Plan

Status: implementation in progress — 2026-07-17 (WARDEN-WP-0028). Goal: bernd.worsch@binky-hedgehog.com becomes an agent-readable event source so StB replies, bank and authority notices reach the control plane. Credential handover is a single Red-lane founder step — no agent solicits or stores the password before provision.

Architecture (sanctioned path)

Layer	Role
OpenBao mount tenants/	Custody for client/tenant commercial secrets
railiance-platform CCR-2026-0007	Policy + OIDC role (applied); value provision separate
ops-warden catalog binky-company-email-imap	Front door (warden access); no custody
email-connect	Read-only IMAP scan; credentials only via env names
binky-control	Queues + mailmeta/ metadata evidence (no message bodies in git)

founder (Red lane, once)
   └─ bao kv put tenants/binky/company-email/imap IMAP_USERNAME=@file IMAP_PASSWORD=@file
        └─ OpenBao: tenants/binky/company-email/imap
             └─ warden access binky-company-email-imap --out / --exec
                  └─ email-connect scan-mailbox → mailmeta / queues

OpenBao lane (non-secret)

Item	Value
Mount	tenants
Path	tenants/binky/company-email/imap
Fields	IMAP_USERNAME, IMAP_PASSWORD
Policy	workload-kv-read-binky-company-email-imap
OIDC role	binky-company-email-imap-workload-kv-read
Catalog	binky-company-email-imap (draft until provision)
Risk	high

email-connect consumer config (non-secret, draft)

mailbox:
  protocol: imap
  host: <provider-imap-host>        # TODO: confirm with founder (Blue)
  port: 993
  folder: INBOX
  username_env: IMAP_USERNAME
  password_env: IMAP_PASSWORD

Scan output (CSV evidence) under mailmeta/ — metadata only.

Execution checklist

1. Path convention decided (tenants/<tenant>/…) — WARDEN-WP-0028
2. Mount tenants/ enabled on bao.coulomb.social
3. CCR-2026-0007 + policy + OIDC role applied (metadata only)
4. ops-warden draft catalog + playbooks
5. Confirm IMAP host/provider facts with founder (Blue, non-secret)
6. Red lane — founder: provision username/password via @file only
7. Capabilities-safe verify + promote catalog to active/resolvable
8. First read-only scan; file metadata evidence; add to OperatingRhythm
9. Recurring scan via activity-core (BINKY-WP-0003 follow-ons)

Boundary rules (binding)

• Secret values never appear in git, State Hub, chat, prompts, logs, or workplans.
• email-connect stays read-only (BODY.PEEK); no mailbox write-back.
• Agents with WARDEN_AGENT_ID set must not stream raw high-risk values.
• Sending mail from the company address is out of scope (separate lane).

See also

• ops-warden wiki/playbooks/binky-company-email-imap.md
• ops-warden wiki/playbooks/tenant-secret-onboarding.md
• railiance-platform credential-change-requests/CCR-2026-0007-binky-company-email-imap.yaml