coulomb/coulomb-social
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
coulomb-social/docs/release/platform-email-2026-10-06.md
tegwick 8c45e0c0ee
Some checks failed
Use-case regression gate / usecase-regressions (push) Has been cancelled
Details
Record active platform reset mail and successful SMTP rollout 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a10e2d-a5ef-7e92-b03d-b1694e915680
2026-10-06 20:38:29 +02:00

6.5 KiB
Raw Blame History

Platform email facilities — 2026-10-06

CSOC-WP-0010 · NK-WP-0047 · RPF-WP-0052 · CCR-2026-0035. SMTP activation completed; see platform-email-active-2026-10-06.md. Inbox/recovery acceptance pending. No credentials fetched into agent context, reset links read, private inbox scanned or mail sent in this session.

What exists

The founder previously created platform@coulomb.social at IONOS. Platform owner record docs/telemetry-smtp-custody.md reports September28 native STARTTLS/SMTP AUTH success, admitted scoped consumer and provider-accepted package test mail. Native receipt verified KV version2, password unmodified and coding-agent deny. Live telemetry-alert-smtp ExternalSecret is currently Ready/SecretSynced. This supports reusing existing mailbox custody, not copying the telemetry Secret or claiming that a new consumer is authorized. A fresh recipient inbox check and inbound mailbox operations are not established by that evidence.

email-connect is live 1/1, health200, runtime ExternalSecret SecretSynced. It is an existing authenticated transactional invitation/verification sender on IONOS SMTP587, currently forgejo@coulomb.social. Only user-engine can reach its API; other applications must be admitted deliberately. Do not build a competing mail-delivery application or copy SMTP passwords into every product.

Authelia currently writes recovery notifications into an internal filesystem. The user's request therefore did not deliver recovery email. Its existing NetworkPolicies allow DNS/LDAP egress but not SMTP. The app OIDC/client issue is fixed; successful tegwick credential recovery/sign-in remains open.

Prepared first release

NetKingdom review branch csoc-platform-mail:

  • Native Authelia SMTP notifier: submission://smtp.ionos.de:587, fixed platform username and Coulomb Platform platform@coulomb.social sender, TLS/STARTTLS and certificate verification required, SMTP startup check enabled.
  • Dedicated sso/authelia-smtp-eso ServiceAccount/SecretStore and ExternalSecret projecting only SMTP_PASSWORD from the existing owner-held mailbox path to sso/authelia-smtp:password; mounted read-only via password-file setting.
  • Additive Authelia-only public IPv4 TCP587 egress; exclude private, loopback, link-local and multicast/reserved ranges. Existing DNS/LDAP access remains.
  • Authentication image, passwords, OIDC clients, tenant policy and SQLite data stay in use. No changes to telemetry's role or Secret.

Platform custody review branch csoc-authelia-mail-custody:

  • CCR-2026-0035 admits only the new sso/authelia-smtp-eso consumer to the exact existing mailbox KV path. Kubernetes auth/OpenBao audience, max15m/no default policy. A Vault path read necessarily covers the entry; ESO projects only its SMTP_PASSWORD field. Do not claim field-level Vault ACL isolation.
  • Silent authelia_smtp_delivery.py reuses the tested owner admission lane: attended platform-admin required, verifies fixed settings and SMTP AUTH without sending email, refuses differing existing policy/role, preserves mailbox version/password, verifies coding-agent data/metadata deny.
  • New receipt files mode0600/O_EXCL; fixed redacted results only.

Validation: ten owner SMTP admission tests passed, including dedicated-consumer binding, changed-mailbox/settings rejection, conflicting-policy refusal and unchanged telemetry binding. YAML notifier/mount/projection wiring checked. Server dry-run accepted serviceaccount/store/projection/network/config/deployment. Live Authelia ConfigMap data matches the pre-change owner source. Native validation with the real scoped mounted credential and Ready/inbox checks remain rollout steps; dry-run does not prove those dependencies.

Activation handoff

Requires founder exact live go, ADMINISTER @ realm:kubernetes/railiance01, activation=APPROVED. Earlier app deployment approval is not mailbox admission. After source review, the founder runs an attended OpenBao admission from their own terminal (estate orientation §5), without supplying a password to the agent:

BAO_ADDR=http://127.0.0.1:18200 VAULT_ADDR=http://127.0.0.1:18200 warden access openbao-platform-admin-login --exec -- python3 /home/worsch/railiance-platform/scripts/authelia_smtp_delivery.py --receipt /tmp/authelia-smtp-delivery-first.json

The helper must be run from the approved reviewed owner checkout. Use a fresh receipt filename for each attempt. Warden child-completion and verified receipt are required; an exit code or queued registration alone is not success. After admission, apply custody objects and network policy from railiance01 with fresh diff/dry-run; wait for store/projection Ready without reading Secret values. Validate native Authelia config with the mounted credential and reviewed notifier. Check headroom and SQLite backup before config/mount rollout; use existing Recreate strategy and wait for health/SMTP startup success. No secret-bundle rebuilds or static ESO-token scripts. On failure restore pre-change notifier/ mount, keep auth database/mailbox custody intact and report redacted failure.

The user then requests a NEW reset through auth.coulomb.social. They confirm inbox receipt and set the password privately, then complete app login. Never extract old filesystem links or treat provider acceptance as inbox receipt.

Broader communication milestone

CSOC-WP-0010 covers a shared platform sender for approved invitations/notifications, explicit API callers/templates, idempotency/retry/suppression/delivery evidence, monitored reply/bounce ownership, DNS/provider checks and inbound access procedures. Native authentication notifications use Authelia SMTP; application messages reuse email-connect. Inbound IMAP access, who reads platform replies, and fresh domain MX/SPF/DKIM/DMARC proof remain tasks, not assumed capabilities. ReichelAg protocol email remains the user's existing manual clipboard/mail workflow.

References: owner telemetry custody/native receipt, EMAIL-WP-0004/package manifests, and https://www.authelia.com/configuration/notifications/smtp/ (native syntax, startup check sends no email, TLS and password-file support).

Exact live activation decision: d95b4c9f-30a3-4ed6-b18f-d1b9fa20d84e (founder approved; owner admission and rollout completed).

Custody helper/CCR/workplan preparation is committed on platform owner main at5d889cfc1d5cd41dc5320600dece9bd29ab03a44; Repo Manager receipt primary/railiance01 applied with expected=derived exact commit. This is source registration, not mailbox-consumer admission. NetKingdom package is on the csoc-platform-mail review branch until exact live go.