coulomb-social/history/20261006T182456Z-smtp-activation-attended-dependency.md

Approved SMTP activation — waiting for attended admission

2026-10-06 · CSOC-WP-0010 / NK-WP-0047 / RPF-WP-0052 / CCR-2026-0035. Founder explicitly approved: “I approve let's wire this.” Decision d95b4c9f-30a3-4ed6-b18f-d1b9fa20d84e is resolved by that human answer. ADMINISTER @ realm:kubernetes/railiance01, activation=APPROVED. No additional permission request is outstanding. Owner-attended execution is.

Executed

Fresh checks confirmed railiance01/92.205.62.239 and CPU requests3455m/4000m. Ten SMTP admission tests still pass. Repeated server dry-run/diff accepted the reviewed objects. Installed sso/authelia-smtp-eso ServiceAccount, openbao-authelia-smtp SecretStore, authelia-smtp ExternalSecret and additive Authelia-only public TCP587 network egress. Native Kubernetes auth remains a scoped new consumer; no static token or copied telemetry Secret was used.

A manual clone of the existing authelia-backup CronJob completed successfully: csoc-authelia-pre-smtp-20261006, started2026-10-06T18:20:38Z, completed18:20:43Z, succeeded1. Used the owner backup procedure with all child outputs suppressed; no backup/credential content entered evidence. This is backup-job completion, not restore-drill acceptance.

Approved NetKingdom source was merged/pushed to main27c3edf so future package reconciliation retains the declared SMTP wiring. The deployed notifier and pod mounts are still the previous configuration. Authelia stays1/1 healthy, image v4.39.28; no restart or password change performed. Temporary native validation Job/config are prepared and server-dry-run accepted, not launched while the runtime SMTP Secret is unavailable. It uses ephemeral data, preserving liveSQLite.

Remaining dependency

The SecretStore/ExternalSecret are currently not Ready. Contained event analysis identifies an invalid/missing OpenBao role; no credential values or raw errors were emitted. The required attended owner command has not produced a receipt at /tmp/authelia-smtp-delivery-first.json. The founder was asked to run it from their own terminal under the estate orientation §5:

BAO_ADDR=http://127.0.0.1:18200 VAULT_ADDR=http://127.0.0.1:18200 warden access openbao-platform-admin-login --exec -- python3 /home/worsch/railiance-platform/scripts/authelia_smtp_delivery.py --receipt /tmp/authelia-smtp-delivery-first.json

Resume: verify actual Warden child completion and fixed verified receipt; force scoped ESO reconciliation and wait Ready; run native validator with the mounted password; compare live config/deployment and retain only reviewed changes; apply notifier/mount update from railiance01, restart/wait health and verify SMTP startup status. Then user requests a NEW reset and confirms inbox receipt, private password change and app login. Do not extract filesystem reset links. No mail was sent by the agent, and SMTP remains inactive until these steps pass.