tegwick
209e3383a3
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a10e2d-a5ef-7e92-b03d-b1694e915680
3.7 KiB
Platform password-reset SMTP activation receipt — 2026-10-06
Founder exact approval: “I approve let's wire this.” Decision d95b4c9f-30a3-4ed6-b18f-d1b9fa20d84e; ADMINISTER @ realm:kubernetes/railiance01, activation=APPROVED. Attended OpenBao login and owner helper completed in founder terminal; fixed receipt independently verified.
Delivery and runtime proof
Owner receipt: schema authelia.smtp-delivery.v1, status verified, KV version2, smtp_authenticated=true, reader_admitted=true, coding_agent_denied=true, password_modified=false, email_sent=false. Native scoped reader admission is executed, rather than inferred from login success. Password/version preserved; telemetry roles/consumer untouched. Only receipt fields read by the agent.
After explicit reconciliation, sso/openbao-authelia-smtp SecretStore is ReadyTrue (Valid); sso/authelia-smtp ExternalSecret ReadyTrue (SecretSynced). Dedicated Kubernetes service-account binding/OpenBao audience/15m ceiling is retained. The runtime credential is a read-only mounted password file; no Secret values or annotations were read into logs, chat, Git or State Hub.
Native Authelia validation Job csoc-authelia-smtp-validation-20261006 succeeded at2026-10-06T18:31:49Z (started18:31:45Z). It used the exact v4.39.28 image, existing authentication mounts and the new scoped SMTP mount, ephemeral data, and a unique non-service pod label. Validation did not replace liveSQLite or send mail. Earlier owner backup Job completed18:20:43Z; completion is not a restore drill. Fresh headroom: CPU requests3455m/4000m.
ConfigMap baseline matched reviewed source. Fresh server dry-run/diff showed only notifier switch and SMTP env-file/volume changes. Applied from railiance01; Recreate rollout succeeded. Authelia Deployment generation 28 observed 28,1/1 ready, existing image digest bd97cff4fcbf715b5ff1f9ae286afbe6033afce385302520b0368122d43a6f54. Runtime notifier is SMTP; filesystem notifier absent; sender Coulomb Platform platform@coulomb.social; IONOS submission587, TLS/STARTTLS and certificate verification required, native SMTP startup check enabled. Contained startup-log inspection found no SMTP/fatal startup failure; no raw logs emitted. Health/API availability confirms initialization completed.
Public checks: auth.coulomb.social root and /api/health200; app health200; KeyCape discovery and /readyz200. App login302 emits correct KeyCape issuer, coulomb-social client and S256 PKCE; authorization302 hands off to Authelia. An initial KeyCape discovery check during the restart was transiently unsuccessful; readiness/discovery and complete handoff checks passed on retry afterward.
Inbox receipt confirmed; app acceptance remains open
The user confirmed: “The reset email arrived.” This proves actual inbox receipt for the fresh reset request independently of SMTP startup/provider acceptance. The subsequent login reaches a Server Error500 page; app acceptance remains open in CSOC-WP-0010-T03 and CSOC-WP-0008-T11. NK-WP-0047-T03 retains the authentication review. See personal-login-500-2026-10-06.md for diagnosis and correction. No complete app sign-in is inferred from email delivery.
The agent sent no test email, read no reset URL/mail body/password, changed no user password and imported no ReichelAg data. Subsequent notifications and platform-inbox/reply operations remain CSOC-WP-0010-T04/T05/T06. Mailbox custody activation is completed separately in RPF-WP-0052/CCR-2026-0035.
Final acceptance: after app revision11 URL correction, user confirmed workspace access. Fresh reset inbox receipt and end-to-end personal sign-in are accepted; CSOC-WP-0010-T03/CSOC-WP-0008-T11 done; NK-WP-0047 finishes with future mail operations handed off to CSOC-WP-0010-T04/T05/T06.