57 lines
3.3 KiB
Markdown
57 lines
3.3 KiB
Markdown
|
# Platform password-reset SMTP activation receipt — 2026-10-06
|
||
|
|
|
||
|
|
Founder exact approval: “I approve let's wire this.” Decision
|
||
|
|
d95b4c9f-30a3-4ed6-b18f-d1b9fa20d84e; ADMINISTER @
|
||
|
|
realm:kubernetes/railiance01, activation=APPROVED. Attended OpenBao login and
|
||
|
|
owner helper completed in founder terminal; fixed receipt independently verified.
|
||
|
|
|
||
|
|
## Delivery and runtime proof
|
||
|
|
|
||
|
|
Owner receipt: schema authelia.smtp-delivery.v1, status verified, KV version2,
|
||
|
|
smtp_authenticated=true, reader_admitted=true, coding_agent_denied=true,
|
||
|
|
password_modified=false, email_sent=false. Native scoped reader admission is
|
||
|
|
executed, rather than inferred from login success. Password/version preserved;
|
||
|
|
telemetry roles/consumer untouched. Only receipt fields read by the agent.
|
||
|
|
|
||
|
|
After explicit reconciliation, sso/openbao-authelia-smtp SecretStore is ReadyTrue
|
||
|
|
(Valid); sso/authelia-smtp ExternalSecret ReadyTrue (SecretSynced). Dedicated
|
||
|
|
Kubernetes service-account binding/OpenBao audience/15m ceiling is retained.
|
||
|
|
The runtime credential is a read-only mounted password file; no Secret values
|
||
|
|
or annotations were read into logs, chat, Git or State Hub.
|
||
|
|
|
||
|
|
Native Authelia validation Job csoc-authelia-smtp-validation-20261006 succeeded
|
||
|
|
at2026-10-06T18:31:49Z (started18:31:45Z). It used the exact v4.39.28 image,
|
||
|
|
existing authentication mounts and the new scoped SMTP mount, ephemeral data,
|
||
|
|
and a unique non-service pod label. Validation did not replace liveSQLite or
|
||
|
|
send mail. Earlier owner backup Job completed18:20:43Z; completion is not a
|
||
|
|
restore drill. Fresh headroom: CPU requests3455m/4000m.
|
||
|
|
|
||
|
|
ConfigMap baseline matched reviewed source. Fresh server dry-run/diff showed
|
||
|
|
only notifier switch and SMTP env-file/volume changes. Applied from railiance01;
|
||
|
|
Recreate rollout succeeded. Authelia Deployment generation 28 observed 28,1/1 ready,
|
||
|
|
existing image digest bd97cff4fcbf715b5ff1f9ae286afbe6033afce385302520b0368122d43a6f54.
|
||
|
|
Runtime notifier is SMTP; filesystem notifier absent; sender
|
||
|
|
Coulomb Platform <platform@coulomb.social>; IONOS submission587, TLS/STARTTLS
|
||
|
|
and certificate verification required, native SMTP startup check enabled.
|
||
|
|
Contained startup-log inspection found no SMTP/fatal startup failure; no raw
|
||
|
|
logs emitted. Health/API availability confirms initialization completed.
|
||
|
|
|
||
|
|
Public checks: auth.coulomb.social root and /api/health200; app health200;
|
||
|
|
KeyCape discovery and /readyz200. App login302 emits correct KeyCape issuer,
|
||
|
|
coulomb-social client and S256 PKCE; authorization302 hands off to Authelia.
|
||
|
|
An initial KeyCape discovery check during the restart was transiently unsuccessful;
|
||
|
|
readiness/discovery and complete handoff checks passed on retry afterward.
|
||
|
|
|
||
|
|
## Actual user acceptance remains open
|
||
|
|
|
||
|
|
User asked to request a NEW Passwort zuruecksetzen for tegwick, confirm delivery
|
||
|
|
to their existing directory email, set a password privately and complete app
|
||
|
|
sign-in. Delivery readiness and startup SMTP check do not prove inbox receipt
|
||
|
|
or user recovery. CSOC-WP-0010-T03 and CSOC-WP-0008-T11 remain waiting for that
|
||
|
|
confirmation; NK-WP-0047-T03 owns the authentication review.
|
||
|
|
|
||
|
|
The agent sent no test email, read no reset URL/mail body/password, changed no
|
||
|
|
user password and imported no ReichelAg data. Subsequent notifications and
|
||
|
|
platform-inbox/reply operations remain CSOC-WP-0010-T04/T05/T06. Mailbox custody
|
||
|
|
activation is completed separately in RPF-WP-0052/CCR-2026-0035.
|