tegwick
8c45e0c0ee
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a10e2d-a5ef-7e92-b03d-b1694e915680
3.3 KiB
Platform password-reset SMTP activation receipt — 2026-10-06
Founder exact approval: “I approve let's wire this.” Decision d95b4c9f-30a3-4ed6-b18f-d1b9fa20d84e; ADMINISTER @ realm:kubernetes/railiance01, activation=APPROVED. Attended OpenBao login and owner helper completed in founder terminal; fixed receipt independently verified.
Delivery and runtime proof
Owner receipt: schema authelia.smtp-delivery.v1, status verified, KV version2, smtp_authenticated=true, reader_admitted=true, coding_agent_denied=true, password_modified=false, email_sent=false. Native scoped reader admission is executed, rather than inferred from login success. Password/version preserved; telemetry roles/consumer untouched. Only receipt fields read by the agent.
After explicit reconciliation, sso/openbao-authelia-smtp SecretStore is ReadyTrue (Valid); sso/authelia-smtp ExternalSecret ReadyTrue (SecretSynced). Dedicated Kubernetes service-account binding/OpenBao audience/15m ceiling is retained. The runtime credential is a read-only mounted password file; no Secret values or annotations were read into logs, chat, Git or State Hub.
Native Authelia validation Job csoc-authelia-smtp-validation-20261006 succeeded at2026-10-06T18:31:49Z (started18:31:45Z). It used the exact v4.39.28 image, existing authentication mounts and the new scoped SMTP mount, ephemeral data, and a unique non-service pod label. Validation did not replace liveSQLite or send mail. Earlier owner backup Job completed18:20:43Z; completion is not a restore drill. Fresh headroom: CPU requests3455m/4000m.
ConfigMap baseline matched reviewed source. Fresh server dry-run/diff showed only notifier switch and SMTP env-file/volume changes. Applied from railiance01; Recreate rollout succeeded. Authelia Deployment generation 28 observed 28,1/1 ready, existing image digest bd97cff4fcbf715b5ff1f9ae286afbe6033afce385302520b0368122d43a6f54. Runtime notifier is SMTP; filesystem notifier absent; sender Coulomb Platform platform@coulomb.social; IONOS submission587, TLS/STARTTLS and certificate verification required, native SMTP startup check enabled. Contained startup-log inspection found no SMTP/fatal startup failure; no raw logs emitted. Health/API availability confirms initialization completed.
Public checks: auth.coulomb.social root and /api/health200; app health200; KeyCape discovery and /readyz200. App login302 emits correct KeyCape issuer, coulomb-social client and S256 PKCE; authorization302 hands off to Authelia. An initial KeyCape discovery check during the restart was transiently unsuccessful; readiness/discovery and complete handoff checks passed on retry afterward.
Actual user acceptance remains open
User asked to request a NEW Passwort zuruecksetzen for tegwick, confirm delivery to their existing directory email, set a password privately and complete app sign-in. Delivery readiness and startup SMTP check do not prove inbox receipt or user recovery. CSOC-WP-0010-T03 and CSOC-WP-0008-T11 remain waiting for that confirmation; NK-WP-0047-T03 owns the authentication review.
The agent sent no test email, read no reset URL/mail body/password, changed no user password and imported no ReichelAg data. Subsequent notifications and platform-inbox/reply operations remain CSOC-WP-0010-T04/T05/T06. Mailbox custody activation is completed separately in RPF-WP-0052/CCR-2026-0035.