coulomb/coulomb-social
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record active platform reset mail and successful SMTP rollout
Some checks failed
Use-case regression gate / usecase-regressions (push) Has been cancelled
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a10e2d-a5ef-7e92-b03d-b1694e915680
This commit is contained in:
tegwick 2026-10-06 20:38:29 +02:00
parent 61ac8d690f
commit 8c45e0c0ee
7 changed files with 135 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

3
SCOPE.md
View file

@ -106,5 +106,6 @@ acceptance remains CSOC-IN-0005. User transfer acceptance stays separate.
Platform email facilities are tracked in CSOC-WP-0010. Shared email-connect
and platform mailbox custody exist outside this repo; Authelia reset SMTP
activation and actual inbox/account acceptance are pending. See
is now active from platform@coulomb.social; actual inbox/account acceptance
remains pending. See
[platform mail assessment](docs/release/platform-email-2026-10-06.md).

4
docs/release/platform-email-2026-10-06.md
View file

@ -1,7 +1,7 @@
# Platform email facilities — 2026-10-06
CSOC-WP-0010 · NK-WP-0047 · RPF-WP-0052 · CCR-2026-0035.
Founder-approved activation is in progress; see platform-email-activation-2026-10-06.md. No credentials fetched into agent
SMTP activation completed; see platform-email-active-2026-10-06.md. Inbox/recovery acceptance pending. No credentials fetched into agent
context, reset links read, private inbox scanned or mail sent in this session.
## What exists
@ -99,7 +99,7 @@ References: owner telemetry custody/native receipt, EMAIL-WP-0004/package manife
and https://www.authelia.com/configuration/notifications/smtp/ (native syntax,
startup check sends no email, TLS and password-file support).
Exact live activation decision: d95b4c9f-30a3-4ed6-b18f-d1b9fa20d84e (founder approved; attended execution pending).
Exact live activation decision: d95b4c9f-30a3-4ed6-b18f-d1b9fa20d84e (founder approved; owner admission and rollout completed).
Custody helper/CCR/workplan preparation is committed on platform owner main
at5d889cfc1d5cd41dc5320600dece9bd29ab03a44; Repo Manager receipt

8
docs/release/platform-email-activation-2026-10-06.md
View file

@ -1,4 +1,10 @@
# Approved SMTP activation — waiting for attended admission
# SMTP activation completed
Attended owner admission and SMTP rollout completed2026-10-06. See
[active receipt](platform-email-active-2026-10-06.md). Actual user inbox/recovery
acceptance remains pending. The prior staging/dependency record follows.
# Approved SMTP activation — original staging record
2026-10-06 · CSOC-WP-0010 / NK-WP-0047 / RPF-WP-0052 / CCR-2026-0035.
Founder explicitly approved: “I approve let's wire this.” Decision

56
docs/release/platform-email-active-2026-10-06.md Normal file
View file

@ -0,0 +1,56 @@
# Platform password-reset SMTP activation receipt — 2026-10-06
Founder exact approval: “I approve let's wire this.” Decision
d95b4c9f-30a3-4ed6-b18f-d1b9fa20d84e; ADMINISTER @
realm:kubernetes/railiance01, activation=APPROVED. Attended OpenBao login and
owner helper completed in founder terminal; fixed receipt independently verified.
## Delivery and runtime proof
Owner receipt: schema authelia.smtp-delivery.v1, status verified, KV version2,
smtp_authenticated=true, reader_admitted=true, coding_agent_denied=true,
password_modified=false, email_sent=false. Native scoped reader admission is
executed, rather than inferred from login success. Password/version preserved;
telemetry roles/consumer untouched. Only receipt fields read by the agent.
After explicit reconciliation, sso/openbao-authelia-smtp SecretStore is ReadyTrue
(Valid); sso/authelia-smtp ExternalSecret ReadyTrue (SecretSynced). Dedicated
Kubernetes service-account binding/OpenBao audience/15m ceiling is retained.
The runtime credential is a read-only mounted password file; no Secret values
or annotations were read into logs, chat, Git or State Hub.
Native Authelia validation Job csoc-authelia-smtp-validation-20261006 succeeded
at2026-10-06T18:31:49Z (started18:31:45Z). It used the exact v4.39.28 image,
existing authentication mounts and the new scoped SMTP mount, ephemeral data,
and a unique non-service pod label. Validation did not replace liveSQLite or
send mail. Earlier owner backup Job completed18:20:43Z; completion is not a
restore drill. Fresh headroom: CPU requests3455m/4000m.
ConfigMap baseline matched reviewed source. Fresh server dry-run/diff showed
only notifier switch and SMTP env-file/volume changes. Applied from railiance01;
Recreate rollout succeeded. Authelia Deployment generation 28 observed 28,1/1 ready,
existing image digest bd97cff4fcbf715b5ff1f9ae286afbe6033afce385302520b0368122d43a6f54.
Runtime notifier is SMTP; filesystem notifier absent; sender
Coulomb Platform <platform@coulomb.social>; IONOS submission587, TLS/STARTTLS
and certificate verification required, native SMTP startup check enabled.
Contained startup-log inspection found no SMTP/fatal startup failure; no raw
logs emitted. Health/API availability confirms initialization completed.
Public checks: auth.coulomb.social root and /api/health200; app health200;
KeyCape discovery and /readyz200. App login302 emits correct KeyCape issuer,
coulomb-social client and S256 PKCE; authorization302 hands off to Authelia.
An initial KeyCape discovery check during the restart was transiently unsuccessful;
readiness/discovery and complete handoff checks passed on retry afterward.
## Actual user acceptance remains open
User asked to request a NEW Passwort zuruecksetzen for tegwick, confirm delivery
to their existing directory email, set a password privately and complete app
sign-in. Delivery readiness and startup SMTP check do not prove inbox receipt
or user recovery. CSOC-WP-0010-T03 and CSOC-WP-0008-T11 remain waiting for that
confirmation; NK-WP-0047-T03 owns the authentication review.
The agent sent no test email, read no reset URL/mail body/password, changed no
user password and imported no ReichelAg data. Subsequent notifications and
platform-inbox/reply operations remain CSOC-WP-0010-T04/T05/T06. Mailbox custody
activation is completed separately in RPF-WP-0052/CCR-2026-0035.

56
history/20261006T183701Z-platform-reset-mail-activation.md Normal file
View file

@ -0,0 +1,56 @@
# Platform password-reset SMTP activation receipt — 2026-10-06
Founder exact approval: “I approve let's wire this.” Decision
d95b4c9f-30a3-4ed6-b18f-d1b9fa20d84e; ADMINISTER @
realm:kubernetes/railiance01, activation=APPROVED. Attended OpenBao login and
owner helper completed in founder terminal; fixed receipt independently verified.
## Delivery and runtime proof
Owner receipt: schema authelia.smtp-delivery.v1, status verified, KV version2,
smtp_authenticated=true, reader_admitted=true, coding_agent_denied=true,
password_modified=false, email_sent=false. Native scoped reader admission is
executed, rather than inferred from login success. Password/version preserved;
telemetry roles/consumer untouched. Only receipt fields read by the agent.
After explicit reconciliation, sso/openbao-authelia-smtp SecretStore is ReadyTrue
(Valid); sso/authelia-smtp ExternalSecret ReadyTrue (SecretSynced). Dedicated
Kubernetes service-account binding/OpenBao audience/15m ceiling is retained.
The runtime credential is a read-only mounted password file; no Secret values
or annotations were read into logs, chat, Git or State Hub.
Native Authelia validation Job csoc-authelia-smtp-validation-20261006 succeeded
at2026-10-06T18:31:49Z (started18:31:45Z). It used the exact v4.39.28 image,
existing authentication mounts and the new scoped SMTP mount, ephemeral data,
and a unique non-service pod label. Validation did not replace liveSQLite or
send mail. Earlier owner backup Job completed18:20:43Z; completion is not a
restore drill. Fresh headroom: CPU requests3455m/4000m.
ConfigMap baseline matched reviewed source. Fresh server dry-run/diff showed
only notifier switch and SMTP env-file/volume changes. Applied from railiance01;
Recreate rollout succeeded. Authelia Deployment generation 28 observed 28,1/1 ready,
existing image digest bd97cff4fcbf715b5ff1f9ae286afbe6033afce385302520b0368122d43a6f54.
Runtime notifier is SMTP; filesystem notifier absent; sender
Coulomb Platform <platform@coulomb.social>; IONOS submission587, TLS/STARTTLS
and certificate verification required, native SMTP startup check enabled.
Contained startup-log inspection found no SMTP/fatal startup failure; no raw
logs emitted. Health/API availability confirms initialization completed.
Public checks: auth.coulomb.social root and /api/health200; app health200;
KeyCape discovery and /readyz200. App login302 emits correct KeyCape issuer,
coulomb-social client and S256 PKCE; authorization302 hands off to Authelia.
An initial KeyCape discovery check during the restart was transiently unsuccessful;
readiness/discovery and complete handoff checks passed on retry afterward.
## Actual user acceptance remains open
User asked to request a NEW Passwort zuruecksetzen for tegwick, confirm delivery
to their existing directory email, set a password privately and complete app
sign-in. Delivery readiness and startup SMTP check do not prove inbox receipt
or user recovery. CSOC-WP-0010-T03 and CSOC-WP-0008-T11 remain waiting for that
confirmation; NK-WP-0047-T03 owns the authentication review.
The agent sent no test email, read no reset URL/mail body/password, changed no
user password and imported no ReichelAg data. Subsequent notifications and
platform-inbox/reply operations remain CSOC-WP-0010-T04/T05/T06. Mailbox custody
activation is completed separately in RPF-WP-0052/CCR-2026-0035.

5
workplans/CSOC-WP-0008-production-transfer-acceptance.md
View file

@ -348,3 +348,8 @@ Password-reset email dependency now has live successor CSOC-WP-0010,
NK-WP-0047 and RPF-WP-0052/CCR-2026-0035. Existing platform mailbox custody
found; native reset-mail connection prepared and dry-run only. T11 still waits
activation and actual user receipt/recovery/sign-in.
Platform reset mail is now active through native Authelia SMTP from platform@.
CSOC-WP-0010-T02 completed; T11 remains wait until user receives a fresh reset,
changes the password privately and completes actual app login. See
docs/release/platform-email-active-2026-10-06.md.

8
workplans/CSOC-WP-0010-platform-email-facilities.md
View file

@ -39,7 +39,7 @@ Fresh read-only inspection: email-connect1/1 healthy, /healthz200, runtime Secre
```task
id: CSOC-WP-0010-T02
status: progress
status: done
priority: high
state_hub_task_id: "caae9504-25e7-583a-8f62-c5d604f11b71"
```
@ -97,3 +97,9 @@ Job csoc-authelia-pre-smtp-20261006 succeeded. Attended OpenBao owner admission
receipt absent; SecretStore reports missing role. Authelia notifier/mount not
changed and server healthy. T02 remains progress, not awaiting permission.
Receipt: docs/release/platform-email-activation-2026-10-06.md.
SMTP activation completed on 2026-10-06: attended helper verified/authenticated,
scoped store/projectionReady, native configuration Job succeeded18:31:49Z,
reviewed notifier/mount rollout generation 28 healthy1/1; public auth/app/issuer
and full authorization handoff pass. T02 done; T03 waits actual reset inbox/recovery
and personal signin. Receipt: docs/release/platform-email-active-2026-10-06.md.