From 61ac8d690f30d8fac988e9f00600f2af988d68be Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 6 Oct 2026 20:25:29 +0200 Subject: [PATCH] Record approved SMTP wiring and pending owner-attended admission Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a10e2d-a5ef-7e92-b03d-b1694e915680 --- docs/release/platform-email-2026-10-06.md | 4 +- .../platform-email-activation-2026-10-06.md | 49 +++++++++++++++++++ ...56Z-smtp-activation-attended-dependency.md | 49 +++++++++++++++++++ .../CSOC-WP-0010-platform-email-facilities.md | 6 +++ 4 files changed, 106 insertions(+), 2 deletions(-) create mode 100644 docs/release/platform-email-activation-2026-10-06.md create mode 100644 history/20261006T182456Z-smtp-activation-attended-dependency.md diff --git a/docs/release/platform-email-2026-10-06.md b/docs/release/platform-email-2026-10-06.md index 4ab6323..1ffe4f5 100644 --- a/docs/release/platform-email-2026-10-06.md +++ b/docs/release/platform-email-2026-10-06.md @@ -1,7 +1,7 @@ # Platform email facilities — 2026-10-06 CSOC-WP-0010 · NK-WP-0047 · RPF-WP-0052 · CCR-2026-0035. -Prepared implementation, not activated. No credentials fetched into agent +Founder-approved activation is in progress; see platform-email-activation-2026-10-06.md. No credentials fetched into agent context, reset links read, private inbox scanned or mail sent in this session. ## What exists @@ -99,7 +99,7 @@ References: owner telemetry custody/native receipt, EMAIL-WP-0004/package manife and https://www.authelia.com/configuration/notifications/smtp/ (native syntax, startup check sends no email, TLS and password-file support). -Exact live activation decision: d95b4c9f-30a3-4ed6-b18f-d1b9fa20d84e (pending founder answer). +Exact live activation decision: d95b4c9f-30a3-4ed6-b18f-d1b9fa20d84e (founder approved; attended execution pending). Custody helper/CCR/workplan preparation is committed on platform owner main at5d889cfc1d5cd41dc5320600dece9bd29ab03a44; Repo Manager receipt diff --git a/docs/release/platform-email-activation-2026-10-06.md b/docs/release/platform-email-activation-2026-10-06.md new file mode 100644 index 0000000..51d10c8 --- /dev/null +++ b/docs/release/platform-email-activation-2026-10-06.md @@ -0,0 +1,49 @@ +# Approved SMTP activation — waiting for attended admission + +2026-10-06 · CSOC-WP-0010 / NK-WP-0047 / RPF-WP-0052 / CCR-2026-0035. +Founder explicitly approved: “I approve let's wire this.” Decision + d95b4c9f-30a3-4ed6-b18f-d1b9fa20d84e is resolved by that human answer. +ADMINISTER @ realm:kubernetes/railiance01, activation=APPROVED. +No additional permission request is outstanding. Owner-attended execution is. + +## Executed + +Fresh checks confirmed railiance01/92.205.62.239 and CPU requests3455m/4000m. +Ten SMTP admission tests still pass. Repeated server dry-run/diff accepted the +reviewed objects. Installed sso/authelia-smtp-eso ServiceAccount, +openbao-authelia-smtp SecretStore, authelia-smtp ExternalSecret and additive +Authelia-only public TCP587 network egress. Native Kubernetes auth remains a +scoped new consumer; no static token or copied telemetry Secret was used. + +A manual clone of the existing authelia-backup CronJob completed successfully: +csoc-authelia-pre-smtp-20261006, started2026-10-06T18:20:38Z, +completed18:20:43Z, succeeded1. Used the owner backup procedure with all child +outputs suppressed; no backup/credential content entered evidence. This is +backup-job completion, not restore-drill acceptance. + +Approved NetKingdom source was merged/pushed to main27c3edf so future package +reconciliation retains the declared SMTP wiring. The deployed notifier and pod +mounts are still the previous configuration. Authelia stays1/1 healthy, image +v4.39.28; no restart or password change performed. Temporary native validation +Job/config are prepared and server-dry-run accepted, not launched while the +runtime SMTP Secret is unavailable. It uses ephemeral data, preserving liveSQLite. + +## Remaining dependency + +The SecretStore/ExternalSecret are currently not Ready. Contained event analysis +identifies an invalid/missing OpenBao role; no credential values or raw errors +were emitted. The required attended owner command has not produced a receipt +at /tmp/authelia-smtp-delivery-first.json. The founder was asked to run it from +their own terminal under the estate orientation §5: + +```sh +BAO_ADDR=http://127.0.0.1:18200 VAULT_ADDR=http://127.0.0.1:18200 warden access openbao-platform-admin-login --exec -- python3 /home/worsch/railiance-platform/scripts/authelia_smtp_delivery.py --receipt /tmp/authelia-smtp-delivery-first.json +``` + +Resume: verify actual Warden child completion and fixed verified receipt; +force scoped ESO reconciliation and wait Ready; run native validator with the +mounted password; compare live config/deployment and retain only reviewed changes; +apply notifier/mount update from railiance01, restart/wait health and verify +SMTP startup status. Then user requests a NEW reset and confirms inbox receipt, +private password change and app login. Do not extract filesystem reset links. +No mail was sent by the agent, and SMTP remains inactive until these steps pass. diff --git a/history/20261006T182456Z-smtp-activation-attended-dependency.md b/history/20261006T182456Z-smtp-activation-attended-dependency.md new file mode 100644 index 0000000..51d10c8 --- /dev/null +++ b/history/20261006T182456Z-smtp-activation-attended-dependency.md @@ -0,0 +1,49 @@ +# Approved SMTP activation — waiting for attended admission + +2026-10-06 · CSOC-WP-0010 / NK-WP-0047 / RPF-WP-0052 / CCR-2026-0035. +Founder explicitly approved: “I approve let's wire this.” Decision + d95b4c9f-30a3-4ed6-b18f-d1b9fa20d84e is resolved by that human answer. +ADMINISTER @ realm:kubernetes/railiance01, activation=APPROVED. +No additional permission request is outstanding. Owner-attended execution is. + +## Executed + +Fresh checks confirmed railiance01/92.205.62.239 and CPU requests3455m/4000m. +Ten SMTP admission tests still pass. Repeated server dry-run/diff accepted the +reviewed objects. Installed sso/authelia-smtp-eso ServiceAccount, +openbao-authelia-smtp SecretStore, authelia-smtp ExternalSecret and additive +Authelia-only public TCP587 network egress. Native Kubernetes auth remains a +scoped new consumer; no static token or copied telemetry Secret was used. + +A manual clone of the existing authelia-backup CronJob completed successfully: +csoc-authelia-pre-smtp-20261006, started2026-10-06T18:20:38Z, +completed18:20:43Z, succeeded1. Used the owner backup procedure with all child +outputs suppressed; no backup/credential content entered evidence. This is +backup-job completion, not restore-drill acceptance. + +Approved NetKingdom source was merged/pushed to main27c3edf so future package +reconciliation retains the declared SMTP wiring. The deployed notifier and pod +mounts are still the previous configuration. Authelia stays1/1 healthy, image +v4.39.28; no restart or password change performed. Temporary native validation +Job/config are prepared and server-dry-run accepted, not launched while the +runtime SMTP Secret is unavailable. It uses ephemeral data, preserving liveSQLite. + +## Remaining dependency + +The SecretStore/ExternalSecret are currently not Ready. Contained event analysis +identifies an invalid/missing OpenBao role; no credential values or raw errors +were emitted. The required attended owner command has not produced a receipt +at /tmp/authelia-smtp-delivery-first.json. The founder was asked to run it from +their own terminal under the estate orientation §5: + +```sh +BAO_ADDR=http://127.0.0.1:18200 VAULT_ADDR=http://127.0.0.1:18200 warden access openbao-platform-admin-login --exec -- python3 /home/worsch/railiance-platform/scripts/authelia_smtp_delivery.py --receipt /tmp/authelia-smtp-delivery-first.json +``` + +Resume: verify actual Warden child completion and fixed verified receipt; +force scoped ESO reconciliation and wait Ready; run native validator with the +mounted password; compare live config/deployment and retain only reviewed changes; +apply notifier/mount update from railiance01, restart/wait health and verify +SMTP startup status. Then user requests a NEW reset and confirms inbox receipt, +private password change and app login. Do not extract filesystem reset links. +No mail was sent by the agent, and SMTP remains inactive until these steps pass. diff --git a/workplans/CSOC-WP-0010-platform-email-facilities.md b/workplans/CSOC-WP-0010-platform-email-facilities.md index ca99794..a89e4b2 100644 --- a/workplans/CSOC-WP-0010-platform-email-facilities.md +++ b/workplans/CSOC-WP-0010-platform-email-facilities.md @@ -91,3 +91,9 @@ state_hub_task_id: "97a2da91-debe-5ce2-9b68-1965a5c5abfe" Catalogue password reset, verification/invitation, and future user-approved notifications. Use synthetic transport fixtures; test authorized caller, invalid recipient/template, retry/idempotency, provider failure and token redaction. ReichelAg protocol distribution remains manual clipboard/email unless the user separately chooses app sending. Exact live activation decision: d95b4c9f-30a3-4ed6-b18f-d1b9fa20d84e; no runtime activation/mail send. + +Activation approved and infrastructure objects applied on2026-10-06. Backup +Job csoc-authelia-pre-smtp-20261006 succeeded. Attended OpenBao owner admission +receipt absent; SecretStore reports missing role. Authelia notifier/mount not +changed and server healthy. T02 remains progress, not awaiting permission. +Receipt: docs/release/platform-email-activation-2026-10-06.md.