tegwick
209e3383a3
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a10e2d-a5ef-7e92-b03d-b1694e915680
62 lines
3.7 KiB
Markdown
62 lines
3.7 KiB
Markdown
# Platform password-reset SMTP activation receipt — 2026-10-06
|
|
|
|
Founder exact approval: “I approve let's wire this.” Decision
|
|
d95b4c9f-30a3-4ed6-b18f-d1b9fa20d84e; ADMINISTER @
|
|
realm:kubernetes/railiance01, activation=APPROVED. Attended OpenBao login and
|
|
owner helper completed in founder terminal; fixed receipt independently verified.
|
|
|
|
## Delivery and runtime proof
|
|
|
|
Owner receipt: schema authelia.smtp-delivery.v1, status verified, KV version2,
|
|
smtp_authenticated=true, reader_admitted=true, coding_agent_denied=true,
|
|
password_modified=false, email_sent=false. Native scoped reader admission is
|
|
executed, rather than inferred from login success. Password/version preserved;
|
|
telemetry roles/consumer untouched. Only receipt fields read by the agent.
|
|
|
|
After explicit reconciliation, sso/openbao-authelia-smtp SecretStore is ReadyTrue
|
|
(Valid); sso/authelia-smtp ExternalSecret ReadyTrue (SecretSynced). Dedicated
|
|
Kubernetes service-account binding/OpenBao audience/15m ceiling is retained.
|
|
The runtime credential is a read-only mounted password file; no Secret values
|
|
or annotations were read into logs, chat, Git or State Hub.
|
|
|
|
Native Authelia validation Job csoc-authelia-smtp-validation-20261006 succeeded
|
|
at2026-10-06T18:31:49Z (started18:31:45Z). It used the exact v4.39.28 image,
|
|
existing authentication mounts and the new scoped SMTP mount, ephemeral data,
|
|
and a unique non-service pod label. Validation did not replace liveSQLite or
|
|
send mail. Earlier owner backup Job completed18:20:43Z; completion is not a
|
|
restore drill. Fresh headroom: CPU requests3455m/4000m.
|
|
|
|
ConfigMap baseline matched reviewed source. Fresh server dry-run/diff showed
|
|
only notifier switch and SMTP env-file/volume changes. Applied from railiance01;
|
|
Recreate rollout succeeded. Authelia Deployment generation 28 observed 28,1/1 ready,
|
|
existing image digest bd97cff4fcbf715b5ff1f9ae286afbe6033afce385302520b0368122d43a6f54.
|
|
Runtime notifier is SMTP; filesystem notifier absent; sender
|
|
Coulomb Platform <platform@coulomb.social>; IONOS submission587, TLS/STARTTLS
|
|
and certificate verification required, native SMTP startup check enabled.
|
|
Contained startup-log inspection found no SMTP/fatal startup failure; no raw
|
|
logs emitted. Health/API availability confirms initialization completed.
|
|
|
|
Public checks: auth.coulomb.social root and /api/health200; app health200;
|
|
KeyCape discovery and /readyz200. App login302 emits correct KeyCape issuer,
|
|
coulomb-social client and S256 PKCE; authorization302 hands off to Authelia.
|
|
An initial KeyCape discovery check during the restart was transiently unsuccessful;
|
|
readiness/discovery and complete handoff checks passed on retry afterward.
|
|
|
|
## Inbox receipt confirmed; app acceptance remains open
|
|
|
|
The user confirmed: “The reset email arrived.” This proves actual inbox receipt
|
|
for the fresh reset request independently of SMTP startup/provider acceptance.
|
|
The subsequent login reaches a Server Error500 page; app acceptance remains
|
|
open in CSOC-WP-0010-T03 and CSOC-WP-0008-T11. NK-WP-0047-T03 retains the
|
|
authentication review. See personal-login-500-2026-10-06.md for diagnosis and
|
|
correction. No complete app sign-in is inferred from email delivery.
|
|
|
|
The agent sent no test email, read no reset URL/mail body/password, changed no
|
|
user password and imported no ReichelAg data. Subsequent notifications and
|
|
platform-inbox/reply operations remain CSOC-WP-0010-T04/T05/T06. Mailbox custody
|
|
activation is completed separately in RPF-WP-0052/CCR-2026-0035.
|
|
|
|
Final acceptance: after app revision11 URL correction, user confirmed workspace
|
|
access. Fresh reset inbox receipt and end-to-end personal sign-in are accepted;
|
|
CSOC-WP-0010-T03/CSOC-WP-0008-T11 done; NK-WP-0047 finishes with future mail
|
|
operations handed off to CSOC-WP-0010-T04/T05/T06.
|