coulomb/inbound-library
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Close ILIB-WP-0002 and ILIB-WP-0003: AppRole lane built, live scan verified, routed.

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1170398@bnt-lap001
Assistant-Session: 622cd705-cb31-4322-ba08-dd42e44fa583
This commit is contained in:
tegwick 2026-10-05 16:14:16 +02:00
parent f234e60c49
commit 96e439495c
2 changed files with 22 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

7
workplans/ILIB-WP-0002-library-infrastructure.md
View file

@ -4,7 +4,7 @@ type: workplan
title: "Establish the inbound-library infrastructure"
domain: infotech
repo: inbound-library
status: active
status: finished
flavor: implementation
owner: claude
topic_slug: custodian
@ -158,8 +158,7 @@ Done 2026-10-05: `run-due` runs under a lock. The systemd units are in `ops/syst
```task
id: ILIB-WP-0002-T07
status: wait
blocking_reason: "Needs the unattended OpenBao AppRole lane (ILIB-WP-0003)."
status: done
priority: high
state_hub_task_id: "1e2ab60c-86ef-5e1c-9b94-1f9f1b3182ba"
```
@ -200,3 +199,5 @@ needed for acceptance.
2026-10-05: the founder rejected an env file as a credential cache. The live
credential now comes from an ops-mason AppRole lane, fetched on every run
(ILIB-WP-0003). This task completes with ILIB-WP-0003-T06.
Done 2026-10-05: live read-only scan through the ILIB-WP-0003 AppRole lane retained 2 real mails with provenance.

23
workplans/ILIB-WP-0003-openbao-approle-imap.md
View file

@ -4,7 +4,7 @@ type: workplan
title: "Read the library IMAP credential unattended from OpenBao"
domain: infotech
repo: inbound-library
status: active
status: finished
flavor: implementation
owner: claude
topic_slug: custodian
@ -87,7 +87,7 @@ executive summary is in section 5.
```task
id: ILIB-WP-0003-T02
status: todo
status: done
priority: high
state_hub_task_id: "9266eb3f-a2f5-5868-a826-881643c85898"
```
@ -97,11 +97,13 @@ The founder decides from the executive summary. The plan then records
Acceptance: the plan is `approved`. The digest matches the build spec.
Done 2026-10-05: approved by Bernd Worsch for digest `c62765c8…e2ba` (ops-mason e4c68e2).
## Build the lane
```task
id: ILIB-WP-0003-T03
status: todo
status: done
priority: high
state_hub_task_id: "a723e048-36dd-5d23-be09-f28c1e2a3d47"
```
@ -115,6 +117,8 @@ and no value is printed. Append section 6 with the build result.
Acceptance: the plan is `built`, and the evidence is in ops-mason
`docs/evidence/`.
Done 2026-10-05: policy and AppRole built, and role_id/secret_id delivered (0600). The build result is in section 6 of the plan. A default-policy token gets `deny`; the consumer run proves the positive side (T06).
## Fetch the credential on every run
```task
@ -158,7 +162,7 @@ Implications for the T01 plan:
```task
id: ILIB-WP-0003-T05
status: todo
status: done
priority: medium
state_hub_task_id: "2a4754b0-c86f-5050-8bfc-c62e488c1173"
```
@ -169,11 +173,18 @@ ops-mason proposes a pointer-only catalog entry `inbound-library-imap-approle`
Acceptance: `warden access` resolves the need to this lane.
Done 2026-10-05: ops-warden catalog entry `inbound-library-imap-approle` is in
place. It is pointer-only (`warden_executes: false`, owner ops-mason, risk
`high`). The playbook is `wiki/playbooks/inbound-library-imap-approle.md`.
Coverage was re-measured (unknown 20 -> 21). The regenerated high-risk path
artifact now lists the entry path, which feeds railiance-platform's coding-agent
deny boundary. `warden access` resolves to it, and 517 warden tests pass.
## Live verification
```task
id: ILIB-WP-0003-T06
status: todo
status: done
priority: high
state_hub_task_id: "d063f2dd-e9cc-5b53-b1a8-8fd07f78de7a"
```
@ -184,3 +195,5 @@ in the output. This also completes ILIB-WP-0002-T07.
Acceptance: one real mail is retained with provenance. No mailbox state changes,
and no credential file exists other than the AppRole delivery.
Done 2026-10-05: `make install-timer`, then `systemctl --user start inbound-library.service`. The run did the AppRole login, the OpenBao read and the read-only IMAP scan of library@coulomb.social, and retained 2 messages with provenance. No secret appeared in the journal, and no credential file exists other than the AppRole delivery. Both messages are founder forwards (bernd.worsch@gmail.com, DKIM pass) and are quarantined because that sender has no registered source.