Record approved SMTP wiring and pending owner-attended admission
Some checks failed
Use-case regression gate / usecase-regressions (push) Failing after 2m47s
Some checks failed
Use-case regression gate / usecase-regressions (push) Failing after 2m47s
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a10e2d-a5ef-7e92-b03d-b1694e915680
This commit is contained in:
parent
30a240e245
commit
61ac8d690f
4 changed files with 106 additions and 2 deletions
|
|
@ -1,7 +1,7 @@
|
|||
# Platform email facilities — 2026-10-06
|
||||
|
||||
CSOC-WP-0010 · NK-WP-0047 · RPF-WP-0052 · CCR-2026-0035.
|
||||
Prepared implementation, not activated. No credentials fetched into agent
|
||||
Founder-approved activation is in progress; see platform-email-activation-2026-10-06.md. No credentials fetched into agent
|
||||
context, reset links read, private inbox scanned or mail sent in this session.
|
||||
|
||||
## What exists
|
||||
|
|
@ -99,7 +99,7 @@ References: owner telemetry custody/native receipt, EMAIL-WP-0004/package manife
|
|||
and https://www.authelia.com/configuration/notifications/smtp/ (native syntax,
|
||||
startup check sends no email, TLS and password-file support).
|
||||
|
||||
Exact live activation decision: d95b4c9f-30a3-4ed6-b18f-d1b9fa20d84e (pending founder answer).
|
||||
Exact live activation decision: d95b4c9f-30a3-4ed6-b18f-d1b9fa20d84e (founder approved; attended execution pending).
|
||||
|
||||
Custody helper/CCR/workplan preparation is committed on platform owner main
|
||||
at5d889cfc1d5cd41dc5320600dece9bd29ab03a44; Repo Manager receipt
|
||||
|
|
|
|||
49
docs/release/platform-email-activation-2026-10-06.md
Normal file
49
docs/release/platform-email-activation-2026-10-06.md
Normal file
|
|
@ -0,0 +1,49 @@
|
|||
# Approved SMTP activation — waiting for attended admission
|
||||
|
||||
2026-10-06 · CSOC-WP-0010 / NK-WP-0047 / RPF-WP-0052 / CCR-2026-0035.
|
||||
Founder explicitly approved: “I approve let's wire this.” Decision
|
||||
d95b4c9f-30a3-4ed6-b18f-d1b9fa20d84e is resolved by that human answer.
|
||||
ADMINISTER @ realm:kubernetes/railiance01, activation=APPROVED.
|
||||
No additional permission request is outstanding. Owner-attended execution is.
|
||||
|
||||
## Executed
|
||||
|
||||
Fresh checks confirmed railiance01/92.205.62.239 and CPU requests3455m/4000m.
|
||||
Ten SMTP admission tests still pass. Repeated server dry-run/diff accepted the
|
||||
reviewed objects. Installed sso/authelia-smtp-eso ServiceAccount,
|
||||
openbao-authelia-smtp SecretStore, authelia-smtp ExternalSecret and additive
|
||||
Authelia-only public TCP587 network egress. Native Kubernetes auth remains a
|
||||
scoped new consumer; no static token or copied telemetry Secret was used.
|
||||
|
||||
A manual clone of the existing authelia-backup CronJob completed successfully:
|
||||
csoc-authelia-pre-smtp-20261006, started2026-10-06T18:20:38Z,
|
||||
completed18:20:43Z, succeeded1. Used the owner backup procedure with all child
|
||||
outputs suppressed; no backup/credential content entered evidence. This is
|
||||
backup-job completion, not restore-drill acceptance.
|
||||
|
||||
Approved NetKingdom source was merged/pushed to main27c3edf so future package
|
||||
reconciliation retains the declared SMTP wiring. The deployed notifier and pod
|
||||
mounts are still the previous configuration. Authelia stays1/1 healthy, image
|
||||
v4.39.28; no restart or password change performed. Temporary native validation
|
||||
Job/config are prepared and server-dry-run accepted, not launched while the
|
||||
runtime SMTP Secret is unavailable. It uses ephemeral data, preserving liveSQLite.
|
||||
|
||||
## Remaining dependency
|
||||
|
||||
The SecretStore/ExternalSecret are currently not Ready. Contained event analysis
|
||||
identifies an invalid/missing OpenBao role; no credential values or raw errors
|
||||
were emitted. The required attended owner command has not produced a receipt
|
||||
at /tmp/authelia-smtp-delivery-first.json. The founder was asked to run it from
|
||||
their own terminal under the estate orientation §5:
|
||||
|
||||
```sh
|
||||
BAO_ADDR=http://127.0.0.1:18200 VAULT_ADDR=http://127.0.0.1:18200 warden access openbao-platform-admin-login --exec -- python3 /home/worsch/railiance-platform/scripts/authelia_smtp_delivery.py --receipt /tmp/authelia-smtp-delivery-first.json
|
||||
```
|
||||
|
||||
Resume: verify actual Warden child completion and fixed verified receipt;
|
||||
force scoped ESO reconciliation and wait Ready; run native validator with the
|
||||
mounted password; compare live config/deployment and retain only reviewed changes;
|
||||
apply notifier/mount update from railiance01, restart/wait health and verify
|
||||
SMTP startup status. Then user requests a NEW reset and confirms inbox receipt,
|
||||
private password change and app login. Do not extract filesystem reset links.
|
||||
No mail was sent by the agent, and SMTP remains inactive until these steps pass.
|
||||
|
|
@ -0,0 +1,49 @@
|
|||
# Approved SMTP activation — waiting for attended admission
|
||||
|
||||
2026-10-06 · CSOC-WP-0010 / NK-WP-0047 / RPF-WP-0052 / CCR-2026-0035.
|
||||
Founder explicitly approved: “I approve let's wire this.” Decision
|
||||
d95b4c9f-30a3-4ed6-b18f-d1b9fa20d84e is resolved by that human answer.
|
||||
ADMINISTER @ realm:kubernetes/railiance01, activation=APPROVED.
|
||||
No additional permission request is outstanding. Owner-attended execution is.
|
||||
|
||||
## Executed
|
||||
|
||||
Fresh checks confirmed railiance01/92.205.62.239 and CPU requests3455m/4000m.
|
||||
Ten SMTP admission tests still pass. Repeated server dry-run/diff accepted the
|
||||
reviewed objects. Installed sso/authelia-smtp-eso ServiceAccount,
|
||||
openbao-authelia-smtp SecretStore, authelia-smtp ExternalSecret and additive
|
||||
Authelia-only public TCP587 network egress. Native Kubernetes auth remains a
|
||||
scoped new consumer; no static token or copied telemetry Secret was used.
|
||||
|
||||
A manual clone of the existing authelia-backup CronJob completed successfully:
|
||||
csoc-authelia-pre-smtp-20261006, started2026-10-06T18:20:38Z,
|
||||
completed18:20:43Z, succeeded1. Used the owner backup procedure with all child
|
||||
outputs suppressed; no backup/credential content entered evidence. This is
|
||||
backup-job completion, not restore-drill acceptance.
|
||||
|
||||
Approved NetKingdom source was merged/pushed to main27c3edf so future package
|
||||
reconciliation retains the declared SMTP wiring. The deployed notifier and pod
|
||||
mounts are still the previous configuration. Authelia stays1/1 healthy, image
|
||||
v4.39.28; no restart or password change performed. Temporary native validation
|
||||
Job/config are prepared and server-dry-run accepted, not launched while the
|
||||
runtime SMTP Secret is unavailable. It uses ephemeral data, preserving liveSQLite.
|
||||
|
||||
## Remaining dependency
|
||||
|
||||
The SecretStore/ExternalSecret are currently not Ready. Contained event analysis
|
||||
identifies an invalid/missing OpenBao role; no credential values or raw errors
|
||||
were emitted. The required attended owner command has not produced a receipt
|
||||
at /tmp/authelia-smtp-delivery-first.json. The founder was asked to run it from
|
||||
their own terminal under the estate orientation §5:
|
||||
|
||||
```sh
|
||||
BAO_ADDR=http://127.0.0.1:18200 VAULT_ADDR=http://127.0.0.1:18200 warden access openbao-platform-admin-login --exec -- python3 /home/worsch/railiance-platform/scripts/authelia_smtp_delivery.py --receipt /tmp/authelia-smtp-delivery-first.json
|
||||
```
|
||||
|
||||
Resume: verify actual Warden child completion and fixed verified receipt;
|
||||
force scoped ESO reconciliation and wait Ready; run native validator with the
|
||||
mounted password; compare live config/deployment and retain only reviewed changes;
|
||||
apply notifier/mount update from railiance01, restart/wait health and verify
|
||||
SMTP startup status. Then user requests a NEW reset and confirms inbox receipt,
|
||||
private password change and app login. Do not extract filesystem reset links.
|
||||
No mail was sent by the agent, and SMTP remains inactive until these steps pass.
|
||||
|
|
@ -91,3 +91,9 @@ state_hub_task_id: "97a2da91-debe-5ce2-9b68-1965a5c5abfe"
|
|||
Catalogue password reset, verification/invitation, and future user-approved notifications. Use synthetic transport fixtures; test authorized caller, invalid recipient/template, retry/idempotency, provider failure and token redaction. ReichelAg protocol distribution remains manual clipboard/email unless the user separately chooses app sending.
|
||||
|
||||
Exact live activation decision: d95b4c9f-30a3-4ed6-b18f-d1b9fa20d84e; no runtime activation/mail send.
|
||||
|
||||
Activation approved and infrastructure objects applied on2026-10-06. Backup
|
||||
Job csoc-authelia-pre-smtp-20261006 succeeded. Attended OpenBao owner admission
|
||||
receipt absent; SecretStore reports missing role. Authelia notifier/mount not
|
||||
changed and server healthy. T02 remains progress, not awaiting permission.
|
||||
Receipt: docs/release/platform-email-activation-2026-10-06.md.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue