diff --git a/SCOPE.md b/SCOPE.md index b6e1b46..b795aca 100644 --- a/SCOPE.md +++ b/SCOPE.md @@ -106,5 +106,6 @@ acceptance remains CSOC-IN-0005. User transfer acceptance stays separate. Platform email facilities are tracked in CSOC-WP-0010. Shared email-connect and platform mailbox custody exist outside this repo; Authelia reset SMTP -activation and actual inbox/account acceptance are pending. See +is now active from platform@coulomb.social; actual inbox/account acceptance +remains pending. See [platform mail assessment](docs/release/platform-email-2026-10-06.md). diff --git a/docs/release/platform-email-2026-10-06.md b/docs/release/platform-email-2026-10-06.md index 1ffe4f5..6c1a1a4 100644 --- a/docs/release/platform-email-2026-10-06.md +++ b/docs/release/platform-email-2026-10-06.md @@ -1,7 +1,7 @@ # Platform email facilities — 2026-10-06 CSOC-WP-0010 · NK-WP-0047 · RPF-WP-0052 · CCR-2026-0035. -Founder-approved activation is in progress; see platform-email-activation-2026-10-06.md. No credentials fetched into agent +SMTP activation completed; see platform-email-active-2026-10-06.md. Inbox/recovery acceptance pending. No credentials fetched into agent context, reset links read, private inbox scanned or mail sent in this session. ## What exists @@ -99,7 +99,7 @@ References: owner telemetry custody/native receipt, EMAIL-WP-0004/package manife and https://www.authelia.com/configuration/notifications/smtp/ (native syntax, startup check sends no email, TLS and password-file support). -Exact live activation decision: d95b4c9f-30a3-4ed6-b18f-d1b9fa20d84e (founder approved; attended execution pending). +Exact live activation decision: d95b4c9f-30a3-4ed6-b18f-d1b9fa20d84e (founder approved; owner admission and rollout completed). Custody helper/CCR/workplan preparation is committed on platform owner main at5d889cfc1d5cd41dc5320600dece9bd29ab03a44; Repo Manager receipt diff --git a/docs/release/platform-email-activation-2026-10-06.md b/docs/release/platform-email-activation-2026-10-06.md index 51d10c8..53ca371 100644 --- a/docs/release/platform-email-activation-2026-10-06.md +++ b/docs/release/platform-email-activation-2026-10-06.md @@ -1,4 +1,10 @@ -# Approved SMTP activation — waiting for attended admission +# SMTP activation completed + +Attended owner admission and SMTP rollout completed2026-10-06. See +[active receipt](platform-email-active-2026-10-06.md). Actual user inbox/recovery +acceptance remains pending. The prior staging/dependency record follows. + +# Approved SMTP activation — original staging record 2026-10-06 · CSOC-WP-0010 / NK-WP-0047 / RPF-WP-0052 / CCR-2026-0035. Founder explicitly approved: “I approve let's wire this.” Decision diff --git a/docs/release/platform-email-active-2026-10-06.md b/docs/release/platform-email-active-2026-10-06.md new file mode 100644 index 0000000..d6dcc5a --- /dev/null +++ b/docs/release/platform-email-active-2026-10-06.md @@ -0,0 +1,56 @@ +# Platform password-reset SMTP activation receipt — 2026-10-06 + +Founder exact approval: “I approve let's wire this.” Decision + d95b4c9f-30a3-4ed6-b18f-d1b9fa20d84e; ADMINISTER @ +realm:kubernetes/railiance01, activation=APPROVED. Attended OpenBao login and +owner helper completed in founder terminal; fixed receipt independently verified. + +## Delivery and runtime proof + +Owner receipt: schema authelia.smtp-delivery.v1, status verified, KV version2, +smtp_authenticated=true, reader_admitted=true, coding_agent_denied=true, +password_modified=false, email_sent=false. Native scoped reader admission is +executed, rather than inferred from login success. Password/version preserved; +telemetry roles/consumer untouched. Only receipt fields read by the agent. + +After explicit reconciliation, sso/openbao-authelia-smtp SecretStore is ReadyTrue +(Valid); sso/authelia-smtp ExternalSecret ReadyTrue (SecretSynced). Dedicated +Kubernetes service-account binding/OpenBao audience/15m ceiling is retained. +The runtime credential is a read-only mounted password file; no Secret values +or annotations were read into logs, chat, Git or State Hub. + +Native Authelia validation Job csoc-authelia-smtp-validation-20261006 succeeded +at2026-10-06T18:31:49Z (started18:31:45Z). It used the exact v4.39.28 image, +existing authentication mounts and the new scoped SMTP mount, ephemeral data, +and a unique non-service pod label. Validation did not replace liveSQLite or +send mail. Earlier owner backup Job completed18:20:43Z; completion is not a +restore drill. Fresh headroom: CPU requests3455m/4000m. + +ConfigMap baseline matched reviewed source. Fresh server dry-run/diff showed +only notifier switch and SMTP env-file/volume changes. Applied from railiance01; +Recreate rollout succeeded. Authelia Deployment generation 28 observed 28,1/1 ready, +existing image digest bd97cff4fcbf715b5ff1f9ae286afbe6033afce385302520b0368122d43a6f54. +Runtime notifier is SMTP; filesystem notifier absent; sender +Coulomb Platform ; IONOS submission587, TLS/STARTTLS +and certificate verification required, native SMTP startup check enabled. +Contained startup-log inspection found no SMTP/fatal startup failure; no raw +logs emitted. Health/API availability confirms initialization completed. + +Public checks: auth.coulomb.social root and /api/health200; app health200; +KeyCape discovery and /readyz200. App login302 emits correct KeyCape issuer, +coulomb-social client and S256 PKCE; authorization302 hands off to Authelia. +An initial KeyCape discovery check during the restart was transiently unsuccessful; +readiness/discovery and complete handoff checks passed on retry afterward. + +## Actual user acceptance remains open + +User asked to request a NEW Passwort zuruecksetzen for tegwick, confirm delivery +to their existing directory email, set a password privately and complete app +sign-in. Delivery readiness and startup SMTP check do not prove inbox receipt +or user recovery. CSOC-WP-0010-T03 and CSOC-WP-0008-T11 remain waiting for that +confirmation; NK-WP-0047-T03 owns the authentication review. + +The agent sent no test email, read no reset URL/mail body/password, changed no +user password and imported no ReichelAg data. Subsequent notifications and +platform-inbox/reply operations remain CSOC-WP-0010-T04/T05/T06. Mailbox custody +activation is completed separately in RPF-WP-0052/CCR-2026-0035. diff --git a/history/20261006T183701Z-platform-reset-mail-activation.md b/history/20261006T183701Z-platform-reset-mail-activation.md new file mode 100644 index 0000000..d6dcc5a --- /dev/null +++ b/history/20261006T183701Z-platform-reset-mail-activation.md @@ -0,0 +1,56 @@ +# Platform password-reset SMTP activation receipt — 2026-10-06 + +Founder exact approval: “I approve let's wire this.” Decision + d95b4c9f-30a3-4ed6-b18f-d1b9fa20d84e; ADMINISTER @ +realm:kubernetes/railiance01, activation=APPROVED. Attended OpenBao login and +owner helper completed in founder terminal; fixed receipt independently verified. + +## Delivery and runtime proof + +Owner receipt: schema authelia.smtp-delivery.v1, status verified, KV version2, +smtp_authenticated=true, reader_admitted=true, coding_agent_denied=true, +password_modified=false, email_sent=false. Native scoped reader admission is +executed, rather than inferred from login success. Password/version preserved; +telemetry roles/consumer untouched. Only receipt fields read by the agent. + +After explicit reconciliation, sso/openbao-authelia-smtp SecretStore is ReadyTrue +(Valid); sso/authelia-smtp ExternalSecret ReadyTrue (SecretSynced). Dedicated +Kubernetes service-account binding/OpenBao audience/15m ceiling is retained. +The runtime credential is a read-only mounted password file; no Secret values +or annotations were read into logs, chat, Git or State Hub. + +Native Authelia validation Job csoc-authelia-smtp-validation-20261006 succeeded +at2026-10-06T18:31:49Z (started18:31:45Z). It used the exact v4.39.28 image, +existing authentication mounts and the new scoped SMTP mount, ephemeral data, +and a unique non-service pod label. Validation did not replace liveSQLite or +send mail. Earlier owner backup Job completed18:20:43Z; completion is not a +restore drill. Fresh headroom: CPU requests3455m/4000m. + +ConfigMap baseline matched reviewed source. Fresh server dry-run/diff showed +only notifier switch and SMTP env-file/volume changes. Applied from railiance01; +Recreate rollout succeeded. Authelia Deployment generation 28 observed 28,1/1 ready, +existing image digest bd97cff4fcbf715b5ff1f9ae286afbe6033afce385302520b0368122d43a6f54. +Runtime notifier is SMTP; filesystem notifier absent; sender +Coulomb Platform ; IONOS submission587, TLS/STARTTLS +and certificate verification required, native SMTP startup check enabled. +Contained startup-log inspection found no SMTP/fatal startup failure; no raw +logs emitted. Health/API availability confirms initialization completed. + +Public checks: auth.coulomb.social root and /api/health200; app health200; +KeyCape discovery and /readyz200. App login302 emits correct KeyCape issuer, +coulomb-social client and S256 PKCE; authorization302 hands off to Authelia. +An initial KeyCape discovery check during the restart was transiently unsuccessful; +readiness/discovery and complete handoff checks passed on retry afterward. + +## Actual user acceptance remains open + +User asked to request a NEW Passwort zuruecksetzen for tegwick, confirm delivery +to their existing directory email, set a password privately and complete app +sign-in. Delivery readiness and startup SMTP check do not prove inbox receipt +or user recovery. CSOC-WP-0010-T03 and CSOC-WP-0008-T11 remain waiting for that +confirmation; NK-WP-0047-T03 owns the authentication review. + +The agent sent no test email, read no reset URL/mail body/password, changed no +user password and imported no ReichelAg data. Subsequent notifications and +platform-inbox/reply operations remain CSOC-WP-0010-T04/T05/T06. Mailbox custody +activation is completed separately in RPF-WP-0052/CCR-2026-0035. diff --git a/workplans/CSOC-WP-0008-production-transfer-acceptance.md b/workplans/CSOC-WP-0008-production-transfer-acceptance.md index c55182d..062fdae 100644 --- a/workplans/CSOC-WP-0008-production-transfer-acceptance.md +++ b/workplans/CSOC-WP-0008-production-transfer-acceptance.md @@ -348,3 +348,8 @@ Password-reset email dependency now has live successor CSOC-WP-0010, NK-WP-0047 and RPF-WP-0052/CCR-2026-0035. Existing platform mailbox custody found; native reset-mail connection prepared and dry-run only. T11 still waits activation and actual user receipt/recovery/sign-in. + +Platform reset mail is now active through native Authelia SMTP from platform@. +CSOC-WP-0010-T02 completed; T11 remains wait until user receives a fresh reset, +changes the password privately and completes actual app login. See +docs/release/platform-email-active-2026-10-06.md. diff --git a/workplans/CSOC-WP-0010-platform-email-facilities.md b/workplans/CSOC-WP-0010-platform-email-facilities.md index a89e4b2..3a74595 100644 --- a/workplans/CSOC-WP-0010-platform-email-facilities.md +++ b/workplans/CSOC-WP-0010-platform-email-facilities.md @@ -39,7 +39,7 @@ Fresh read-only inspection: email-connect1/1 healthy, /healthz200, runtime Secre ```task id: CSOC-WP-0010-T02 -status: progress +status: done priority: high state_hub_task_id: "caae9504-25e7-583a-8f62-c5d604f11b71" ``` @@ -97,3 +97,9 @@ Job csoc-authelia-pre-smtp-20261006 succeeded. Attended OpenBao owner admission receipt absent; SecretStore reports missing role. Authelia notifier/mount not changed and server healthy. T02 remains progress, not awaiting permission. Receipt: docs/release/platform-email-activation-2026-10-06.md. + +SMTP activation completed on 2026-10-06: attended helper verified/authenticated, +scoped store/projectionReady, native configuration Job succeeded18:31:49Z, +reviewed notifier/mount rollout generation 28 healthy1/1; public auth/app/issuer +and full authorization handoff pass. T02 done; T03 waits actual reset inbox/recovery +and personal signin. Receipt: docs/release/platform-email-active-2026-10-06.md.