Plan platform communication facilities and password-reset delivery

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a10e2d-a5ef-7e92-b03d-b1694e915680

SCOPE.md

@@ -103,3 +103,8 @@ and tests/usecases/, starting with ReichelAg. `make check` runs fast/application
 and actual-browser journeys with mandatory test coverage validation and JUnit
 reports. Forgejo workflow is configured; remote runner/required-merge-check
 acceptance remains CSOC-IN-0005. User transfer acceptance stays separate.
+
+Platform email facilities are tracked in CSOC-WP-0010. Shared email-connect
+and platform mailbox custody exist outside this repo; Authelia reset SMTP
+activation and actual inbox/account acceptance are pending. See
+[platform mail assessment](docs/release/platform-email-2026-10-06.md).

docs/release/platform-email-2026-10-06.md

@@ -0,0 +1,100 @@
+# Platform email facilities — 2026-10-06
+
+CSOC-WP-0010 · NK-WP-0047 · RPF-WP-0052 · CCR-2026-0035.
+Prepared implementation, not activated. No credentials fetched into agent
+context, reset links read, private inbox scanned or mail sent in this session.
+
+## What exists
+
+The founder previously created platform@coulomb.social at IONOS. Platform owner
+record docs/telemetry-smtp-custody.md reports September28 native STARTTLS/SMTP
+AUTH success, admitted scoped consumer and provider-accepted package test mail.
+Native receipt verified KV version2, password unmodified and coding-agent deny.
+Live telemetry-alert-smtp ExternalSecret is currently Ready/SecretSynced. This
+supports reusing existing mailbox custody, not copying the telemetry Secret or
+claiming that a new consumer is authorized. A fresh recipient inbox check and
+inbound mailbox operations are not established by that evidence.
+
+email-connect is live 1/1, health200, runtime ExternalSecret SecretSynced. It is
+an existing authenticated transactional invitation/verification sender on IONOS
+SMTP587, currently forgejo@coulomb.social. Only user-engine can reach its API;
+other applications must be admitted deliberately. Do not build a competing
+mail-delivery application or copy SMTP passwords into every product.
+
+Authelia currently writes recovery notifications into an internal filesystem.
+The user's request therefore did not deliver recovery email. Its existing
+NetworkPolicies allow DNS/LDAP egress but not SMTP. The app OIDC/client issue
+is fixed; successful tegwick credential recovery/sign-in remains open.
+
+## Prepared first release
+
+NetKingdom review branch csoc-platform-mail:
+- Native Authelia SMTP notifier: submission://smtp.ionos.de:587, fixed platform
+  username and Coulomb Platform <platform@coulomb.social> sender, TLS/STARTTLS
+  and certificate verification required, SMTP startup check enabled.
+- Dedicated sso/authelia-smtp-eso ServiceAccount/SecretStore and ExternalSecret
+  projecting only SMTP_PASSWORD from the existing owner-held mailbox path to
+  sso/authelia-smtp:password; mounted read-only via password-file setting.
+- Additive Authelia-only public IPv4 TCP587 egress; exclude private, loopback,
+  link-local and multicast/reserved ranges. Existing DNS/LDAP access remains.
+- Authentication image, passwords, OIDC clients, tenant policy and SQLite data
+  stay in use. No changes to telemetry's role or Secret.
+
+Platform custody review branch csoc-authelia-mail-custody:
+- CCR-2026-0035 admits only the new sso/authelia-smtp-eso consumer to the exact
+  existing mailbox KV path. Kubernetes auth/OpenBao audience, max15m/no default
+  policy. A Vault path read necessarily covers the entry; ESO projects only
+  its SMTP_PASSWORD field. Do not claim field-level Vault ACL isolation.
+- Silent authelia_smtp_delivery.py reuses the tested owner admission lane:
+  attended platform-admin required, verifies fixed settings and SMTP AUTH
+  without sending email, refuses differing existing policy/role, preserves
+  mailbox version/password, verifies coding-agent data/metadata deny.
+- New receipt files mode0600/O_EXCL; fixed redacted results only.
+
+Validation: ten owner SMTP admission tests passed, including dedicated-consumer
+binding, changed-mailbox/settings rejection, conflicting-policy refusal and
+unchanged telemetry binding. YAML notifier/mount/projection wiring checked.
+Server dry-run accepted serviceaccount/store/projection/network/config/deployment.
+Live Authelia ConfigMap data matches the pre-change owner source. Native validation
+with the real scoped mounted credential and Ready/inbox checks remain rollout
+steps; dry-run does not prove those dependencies.
+
+## Activation handoff
+
+Requires founder exact live go, ADMINISTER @ realm:kubernetes/railiance01,
+activation=APPROVED. Earlier app deployment approval is not mailbox admission.
+After source review, the founder runs an attended OpenBao admission from their
+own terminal (estate orientation §5), without supplying a password to the agent:
+
+```sh
+BAO_ADDR=http://127.0.0.1:18200 VAULT_ADDR=http://127.0.0.1:18200 warden access openbao-platform-admin-login --exec -- python3 /tmp/csoc-mail-railiance-platform/scripts/authelia_smtp_delivery.py --receipt /tmp/authelia-smtp-delivery-first.json
+```
+
+The helper must be run from the approved reviewed owner checkout. Use a fresh
+receipt filename for each attempt. Warden child-completion and verified receipt
+are required; an exit code or queued registration alone is not success.
+After admission, apply custody objects and network policy from railiance01 with
+fresh diff/dry-run; wait for store/projection Ready without reading Secret values.
+Validate native Authelia config with the mounted credential and reviewed notifier.
+Check headroom and SQLite backup before config/mount rollout; use existing
+Recreate strategy and wait for health/SMTP startup success. No secret-bundle
+rebuilds or static ESO-token scripts. On failure restore pre-change notifier/
+mount, keep auth database/mailbox custody intact and report redacted failure.
+
+The user then requests a NEW reset through auth.coulomb.social. They confirm
+inbox receipt and set the password privately, then complete app login. Never
+extract old filesystem links or treat provider acceptance as inbox receipt.
+
+## Broader communication milestone
+
+CSOC-WP-0010 covers a shared platform sender for approved invitations/notifications,
+explicit API callers/templates, idempotency/retry/suppression/delivery evidence,
+monitored reply/bounce ownership, DNS/provider checks and inbound access procedures.
+Native authentication notifications use Authelia SMTP; application messages reuse
+email-connect. Inbound IMAP access, who reads platform replies, and fresh domain
+MX/SPF/DKIM/DMARC proof remain tasks, not assumed capabilities. ReichelAg protocol
+email remains the user's existing manual clipboard/mail workflow.
+
+References: owner telemetry custody/native receipt, EMAIL-WP-0004/package manifests,
+and https://www.authelia.com/configuration/notifications/smtp/ (native syntax,
+startup check sends no email, TLS and password-file support).

history/20261006T173020Z-platform-email-assessment-and-plan.md

@@ -0,0 +1,100 @@
+# Platform email facilities — 2026-10-06
+
+CSOC-WP-0010 · NK-WP-0047 · RPF-WP-0052 · CCR-2026-0035.
+Prepared implementation, not activated. No credentials fetched into agent
+context, reset links read, private inbox scanned or mail sent in this session.
+
+## What exists
+
+The founder previously created platform@coulomb.social at IONOS. Platform owner
+record docs/telemetry-smtp-custody.md reports September28 native STARTTLS/SMTP
+AUTH success, admitted scoped consumer and provider-accepted package test mail.
+Native receipt verified KV version2, password unmodified and coding-agent deny.
+Live telemetry-alert-smtp ExternalSecret is currently Ready/SecretSynced. This
+supports reusing existing mailbox custody, not copying the telemetry Secret or
+claiming that a new consumer is authorized. A fresh recipient inbox check and
+inbound mailbox operations are not established by that evidence.
+
+email-connect is live 1/1, health200, runtime ExternalSecret SecretSynced. It is
+an existing authenticated transactional invitation/verification sender on IONOS
+SMTP587, currently forgejo@coulomb.social. Only user-engine can reach its API;
+other applications must be admitted deliberately. Do not build a competing
+mail-delivery application or copy SMTP passwords into every product.
+
+Authelia currently writes recovery notifications into an internal filesystem.
+The user's request therefore did not deliver recovery email. Its existing
+NetworkPolicies allow DNS/LDAP egress but not SMTP. The app OIDC/client issue
+is fixed; successful tegwick credential recovery/sign-in remains open.
+
+## Prepared first release
+
+NetKingdom review branch csoc-platform-mail:
+- Native Authelia SMTP notifier: submission://smtp.ionos.de:587, fixed platform
+  username and Coulomb Platform <platform@coulomb.social> sender, TLS/STARTTLS
+  and certificate verification required, SMTP startup check enabled.
+- Dedicated sso/authelia-smtp-eso ServiceAccount/SecretStore and ExternalSecret
+  projecting only SMTP_PASSWORD from the existing owner-held mailbox path to
+  sso/authelia-smtp:password; mounted read-only via password-file setting.
+- Additive Authelia-only public IPv4 TCP587 egress; exclude private, loopback,
+  link-local and multicast/reserved ranges. Existing DNS/LDAP access remains.
+- Authentication image, passwords, OIDC clients, tenant policy and SQLite data
+  stay in use. No changes to telemetry's role or Secret.
+
+Platform custody review branch csoc-authelia-mail-custody:
+- CCR-2026-0035 admits only the new sso/authelia-smtp-eso consumer to the exact
+  existing mailbox KV path. Kubernetes auth/OpenBao audience, max15m/no default
+  policy. A Vault path read necessarily covers the entry; ESO projects only
+  its SMTP_PASSWORD field. Do not claim field-level Vault ACL isolation.
+- Silent authelia_smtp_delivery.py reuses the tested owner admission lane:
+  attended platform-admin required, verifies fixed settings and SMTP AUTH
+  without sending email, refuses differing existing policy/role, preserves
+  mailbox version/password, verifies coding-agent data/metadata deny.
+- New receipt files mode0600/O_EXCL; fixed redacted results only.
+
+Validation: ten owner SMTP admission tests passed, including dedicated-consumer
+binding, changed-mailbox/settings rejection, conflicting-policy refusal and
+unchanged telemetry binding. YAML notifier/mount/projection wiring checked.
+Server dry-run accepted serviceaccount/store/projection/network/config/deployment.
+Live Authelia ConfigMap data matches the pre-change owner source. Native validation
+with the real scoped mounted credential and Ready/inbox checks remain rollout
+steps; dry-run does not prove those dependencies.
+
+## Activation handoff
+
+Requires founder exact live go, ADMINISTER @ realm:kubernetes/railiance01,
+activation=APPROVED. Earlier app deployment approval is not mailbox admission.
+After source review, the founder runs an attended OpenBao admission from their
+own terminal (estate orientation §5), without supplying a password to the agent:
+
+```sh
+BAO_ADDR=http://127.0.0.1:18200 VAULT_ADDR=http://127.0.0.1:18200 warden access openbao-platform-admin-login --exec -- python3 /tmp/csoc-mail-railiance-platform/scripts/authelia_smtp_delivery.py --receipt /tmp/authelia-smtp-delivery-first.json
+```
+
+The helper must be run from the approved reviewed owner checkout. Use a fresh
+receipt filename for each attempt. Warden child-completion and verified receipt
+are required; an exit code or queued registration alone is not success.
+After admission, apply custody objects and network policy from railiance01 with
+fresh diff/dry-run; wait for store/projection Ready without reading Secret values.
+Validate native Authelia config with the mounted credential and reviewed notifier.
+Check headroom and SQLite backup before config/mount rollout; use existing
+Recreate strategy and wait for health/SMTP startup success. No secret-bundle
+rebuilds or static ESO-token scripts. On failure restore pre-change notifier/
+mount, keep auth database/mailbox custody intact and report redacted failure.
+
+The user then requests a NEW reset through auth.coulomb.social. They confirm
+inbox receipt and set the password privately, then complete app login. Never
+extract old filesystem links or treat provider acceptance as inbox receipt.
+
+## Broader communication milestone
+
+CSOC-WP-0010 covers a shared platform sender for approved invitations/notifications,
+explicit API callers/templates, idempotency/retry/suppression/delivery evidence,
+monitored reply/bounce ownership, DNS/provider checks and inbound access procedures.
+Native authentication notifications use Authelia SMTP; application messages reuse
+email-connect. Inbound IMAP access, who reads platform replies, and fresh domain
+MX/SPF/DKIM/DMARC proof remain tasks, not assumed capabilities. ReichelAg protocol
+email remains the user's existing manual clipboard/mail workflow.
+
+References: owner telemetry custody/native receipt, EMAIL-WP-0004/package manifests,
+and https://www.authelia.com/configuration/notifications/smtp/ (native syntax,
+startup check sends no email, TLS and password-file support).

workplans/CSOC-WP-0008-production-transfer-acceptance.md

@@ -343,3 +343,8 @@ another service. No password was requested/read/exported or reset. Authelia's
 current notifier is filesystem rather than SMTP: do not promise emailed recovery
 or expose reset tokens from notification files. Any credential reset must use
 the owning attended recovery/setup lane under a separate exact approved change.
+
+Password-reset email dependency now has live successor CSOC-WP-0010,
+NK-WP-0047 and RPF-WP-0052/CCR-2026-0035. Existing platform mailbox custody
+found; native reset-mail connection prepared and dry-run only. T11 still waits
+activation and actual user receipt/recovery/sign-in.

workplans/CSOC-WP-0010-platform-email-facilities.md

@@ -0,0 +1,84 @@
+---
+id: CSOC-WP-0010
+type: workplan
+title: "Platform email communication and personal account recovery"
+domain: communication
+repo: coulomb-social
+status: active
+owner: codex
+topic_slug: coulomb-social
+created: "2026-10-06"
+updated: "2026-10-06"
+---
+
+# User milestone
+
+You receive a requested password-reset message from platform@coulomb.social,
+recover your existing tegwick account privately, and sign in to the new app.
+Platform invitation/notification flows then have a governed reusable sender,
+observable failures and a clearly owned reply inbox. Each flow gets explicit
+user acceptance before productive use. This is not a campaign-mail system.
+
+First dependency: CSOC-WP-0008-T11. Deployment and mailbox-provider changes belong
+to NetKingdom, email-connect and railiance-platform, not this product repo.
+Current evidence: docs/release/platform-email-2026-10-06.md.
+
+## Establish mailbox and reusable delivery evidence
+
+```task
+id: CSOC-WP-0010-T01
+status: done
+priority: high
+```
+
+Fresh read-only inspection: email-connect1/1 healthy, /healthz200, runtime SecretSynced, sender forgejo@coulomb.social. platform@coulomb.social existing owner custody has recorded September28 native SMTP/auth and provider-accepted test; telemetry projection currently SecretSynced. This does not prove a fresh inbox receipt or inbound operation.
+
+## Connect password reset to platform mailbox
+
+```task
+id: CSOC-WP-0010-T02
+status: progress
+priority: high
+```
+
+NK-WP-0047 and RPF-WP-0052/CCR-2026-0035 prepare native Authelia SMTP, TLS verification, scoped ESO password-file mount and fixed consumer admission. Implement and test without credentials in code. Obtain exact founder live go/attended owner admission; validate runtime and deploy. Existing deployment approval does not authorize mailbox-access changes.
+
+## Prove personal recovery and sign-in
+
+```task
+id: CSOC-WP-0010-T03
+status: wait
+priority: high
+```
+
+User requests a NEW reset for tegwick after SMTP activation, receives mail at the existing directory email, sets a password privately, and completes app.coulomb.social login. Confirm inbox receipt separately from provider acceptance; keep reset URLs, tokens, passwords and private mail content out of Git/Hub/chat. Close CSOC-WP-0008-T11 only after user acceptance.
+
+## Establish shared platform notification delivery
+
+```task
+id: CSOC-WP-0010-T04
+status: todo
+priority: high
+```
+
+Extend existing email-connect with explicit caller identities, approved templates, per-caller limits, idempotent retries, suppression/bounce handling and redacted delivery states. Replace forgejo sender with platform identity only through reviewed custody and rollout. Reuse native SMTP for authentication messages, HTTP notification API for supported application templates; do not widen current user-engine-only ingress globally.
+
+## Establish reply and mailbox operations
+
+```task
+id: CSOC-WP-0010-T05
+status: todo
+priority: high
+```
+
+Confirm who owns/reads platform inbox, reply routing, monitored bounces, inbound IMAP/provider access, retention and support procedure. Verify domain MX/SPF/DKIM/DMARC and actual inbox receipt with the provider owner. Mailbox existence or SMTP AUTH is not inbox access proof. No unsolicited mailbox scans or automatic response sends.
+
+## Register communication use cases and regression checks
+
+```task
+id: CSOC-WP-0010-T06
+status: todo
+priority: high
+```
+
+Catalogue password reset, verification/invitation, and future user-approved notifications. Use synthetic transport fixtures; test authorized caller, invalid recipient/template, retry/idempotency, provider failure and token redaction. ReichelAg protocol distribution remains manual clipboard/email unless the user separately chooses app sending.