tegwick
a2a561757f
Match WARDEN-WP-0028 / CCR-2026-0007: mount tenants, checklist for founder Red provision and host confirmation.
76 lines
3 KiB
Markdown
76 lines
3 KiB
Markdown
# Company Email → Net Kingdom / OpenBao Integration Plan
|
|
|
|
> Status: implementation in progress — 2026-07-17 (WARDEN-WP-0028).
|
|
> Goal: `bernd.worsch@binky-hedgehog.com` becomes an agent-readable event
|
|
> source so StB replies, bank and authority notices reach the control plane.
|
|
> **Credential handover is a single Red-lane founder step** — no agent solicits
|
|
> or stores the password before provision.
|
|
|
|
## Architecture (sanctioned path)
|
|
|
|
| Layer | Role |
|
|
| --- | --- |
|
|
| OpenBao mount **`tenants/`** | Custody for client/tenant commercial secrets |
|
|
| railiance-platform **CCR-2026-0007** | Policy + OIDC role (applied); value provision separate |
|
|
| ops-warden catalog **`binky-company-email-imap`** | Front door (`warden access`); no custody |
|
|
| email-connect | Read-only IMAP scan; credentials only via env *names* |
|
|
| binky-control | Queues + `mailmeta/` metadata evidence (no message bodies in git) |
|
|
|
|
```text
|
|
founder (Red lane, once)
|
|
└─ bao kv put tenants/binky/company-email/imap IMAP_USERNAME=@file IMAP_PASSWORD=@file
|
|
└─ OpenBao: tenants/binky/company-email/imap
|
|
└─ warden access binky-company-email-imap --out / --exec
|
|
└─ email-connect scan-mailbox → mailmeta / queues
|
|
```
|
|
|
|
## OpenBao lane (non-secret)
|
|
|
|
| Item | Value |
|
|
| --- | --- |
|
|
| Mount | `tenants` |
|
|
| Path | `tenants/binky/company-email/imap` |
|
|
| Fields | `IMAP_USERNAME`, `IMAP_PASSWORD` |
|
|
| Policy | `workload-kv-read-binky-company-email-imap` |
|
|
| OIDC role | `binky-company-email-imap-workload-kv-read` |
|
|
| Catalog | `binky-company-email-imap` (draft until provision) |
|
|
| Risk | high |
|
|
|
|
## email-connect consumer config (non-secret, draft)
|
|
|
|
```yaml
|
|
mailbox:
|
|
protocol: imap
|
|
host: <provider-imap-host> # TODO: confirm with founder (Blue)
|
|
port: 993
|
|
folder: INBOX
|
|
username_env: IMAP_USERNAME
|
|
password_env: IMAP_PASSWORD
|
|
```
|
|
|
|
Scan output (CSV evidence) under `mailmeta/` — metadata only.
|
|
|
|
## Execution checklist
|
|
|
|
1. [x] Path convention decided (`tenants/<tenant>/…`) — WARDEN-WP-0028
|
|
2. [x] Mount `tenants/` enabled on bao.coulomb.social
|
|
3. [x] CCR-2026-0007 + policy + OIDC role applied (metadata only)
|
|
4. [x] ops-warden draft catalog + playbooks
|
|
5. [ ] Confirm IMAP host/provider facts with founder (Blue, non-secret)
|
|
6. [ ] **Red lane — founder:** provision username/password via `@file` only
|
|
7. [ ] Capabilities-safe verify + promote catalog to active/resolvable
|
|
8. [ ] First read-only scan; file metadata evidence; add to OperatingRhythm
|
|
9. [ ] Recurring scan via activity-core (BINKY-WP-0003 follow-ons)
|
|
|
|
## Boundary rules (binding)
|
|
|
|
- Secret values never appear in git, State Hub, chat, prompts, logs, or workplans.
|
|
- email-connect stays read-only (`BODY.PEEK`); no mailbox write-back.
|
|
- Agents with `WARDEN_AGENT_ID` set must not stream raw high-risk values.
|
|
- Sending mail from the company address is out of scope (separate lane).
|
|
|
|
## See also
|
|
|
|
- ops-warden `wiki/playbooks/binky-company-email-imap.md`
|
|
- ops-warden `wiki/playbooks/tenant-secret-onboarding.md`
|
|
- railiance-platform `credential-change-requests/CCR-2026-0007-binky-company-email-imap.yaml`
|