From 96e439495cf4e81dd74a712c40e010c83000ac43 Mon Sep 17 00:00:00 2001 From: tegwick Date: Mon, 5 Oct 2026 16:14:16 +0200 Subject: [PATCH] Close ILIB-WP-0002 and ILIB-WP-0003: AppRole lane built, live scan verified, routed. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 1170398@bnt-lap001 Assistant-Session: 622cd705-cb31-4322-ba08-dd42e44fa583 --- .../ILIB-WP-0002-library-infrastructure.md | 7 +++--- .../ILIB-WP-0003-openbao-approle-imap.md | 23 +++++++++++++++---- 2 files changed, 22 insertions(+), 8 deletions(-) diff --git a/workplans/ILIB-WP-0002-library-infrastructure.md b/workplans/ILIB-WP-0002-library-infrastructure.md index cb38050..a76aa2d 100644 --- a/workplans/ILIB-WP-0002-library-infrastructure.md +++ b/workplans/ILIB-WP-0002-library-infrastructure.md @@ -4,7 +4,7 @@ type: workplan title: "Establish the inbound-library infrastructure" domain: infotech repo: inbound-library -status: active +status: finished flavor: implementation owner: claude topic_slug: custodian @@ -158,8 +158,7 @@ Done 2026-10-05: `run-due` runs under a lock. The systemd units are in `ops/syst ```task id: ILIB-WP-0002-T07 -status: wait -blocking_reason: "Needs the unattended OpenBao AppRole lane (ILIB-WP-0003)." +status: done priority: high state_hub_task_id: "1e2ab60c-86ef-5e1c-9b94-1f9f1b3182ba" ``` @@ -200,3 +199,5 @@ needed for acceptance. 2026-10-05: the founder rejected an env file as a credential cache. The live credential now comes from an ops-mason AppRole lane, fetched on every run (ILIB-WP-0003). This task completes with ILIB-WP-0003-T06. + +Done 2026-10-05: live read-only scan through the ILIB-WP-0003 AppRole lane retained 2 real mails with provenance. diff --git a/workplans/ILIB-WP-0003-openbao-approle-imap.md b/workplans/ILIB-WP-0003-openbao-approle-imap.md index c3e81d3..d054d32 100644 --- a/workplans/ILIB-WP-0003-openbao-approle-imap.md +++ b/workplans/ILIB-WP-0003-openbao-approle-imap.md @@ -4,7 +4,7 @@ type: workplan title: "Read the library IMAP credential unattended from OpenBao" domain: infotech repo: inbound-library -status: active +status: finished flavor: implementation owner: claude topic_slug: custodian @@ -87,7 +87,7 @@ executive summary is in section 5. ```task id: ILIB-WP-0003-T02 -status: todo +status: done priority: high state_hub_task_id: "9266eb3f-a2f5-5868-a826-881643c85898" ``` @@ -97,11 +97,13 @@ The founder decides from the executive summary. The plan then records Acceptance: the plan is `approved`. The digest matches the build spec. +Done 2026-10-05: approved by Bernd Worsch for digest `c62765c8…e2ba` (ops-mason e4c68e2). + ## Build the lane ```task id: ILIB-WP-0003-T03 -status: todo +status: done priority: high state_hub_task_id: "a723e048-36dd-5d23-be09-f28c1e2a3d47" ``` @@ -115,6 +117,8 @@ and no value is printed. Append section 6 with the build result. Acceptance: the plan is `built`, and the evidence is in ops-mason `docs/evidence/`. +Done 2026-10-05: policy and AppRole built, and role_id/secret_id delivered (0600). The build result is in section 6 of the plan. A default-policy token gets `deny`; the consumer run proves the positive side (T06). + ## Fetch the credential on every run ```task @@ -158,7 +162,7 @@ Implications for the T01 plan: ```task id: ILIB-WP-0003-T05 -status: todo +status: done priority: medium state_hub_task_id: "2a4754b0-c86f-5050-8bfc-c62e488c1173" ``` @@ -169,11 +173,18 @@ ops-mason proposes a pointer-only catalog entry `inbound-library-imap-approle` Acceptance: `warden access` resolves the need to this lane. +Done 2026-10-05: ops-warden catalog entry `inbound-library-imap-approle` is in +place. It is pointer-only (`warden_executes: false`, owner ops-mason, risk +`high`). The playbook is `wiki/playbooks/inbound-library-imap-approle.md`. +Coverage was re-measured (unknown 20 -> 21). The regenerated high-risk path +artifact now lists the entry path, which feeds railiance-platform's coding-agent +deny boundary. `warden access` resolves to it, and 517 warden tests pass. + ## Live verification ```task id: ILIB-WP-0003-T06 -status: todo +status: done priority: high state_hub_task_id: "d063f2dd-e9cc-5b53-b1a8-8fd07f78de7a" ``` @@ -184,3 +195,5 @@ in the output. This also completes ILIB-WP-0002-T07. Acceptance: one real mail is retained with provenance. No mailbox state changes, and no credential file exists other than the AppRole delivery. + +Done 2026-10-05: `make install-timer`, then `systemctl --user start inbound-library.service`. The run did the AppRole login, the OpenBao read and the read-only IMAP scan of library@coulomb.social, and retained 2 messages with provenance. No secret appeared in the journal, and no credential file exists other than the AppRole delivery. Both messages are founder forwards (bernd.worsch@gmail.com, DKIM pass) and are quarantined because that sender has no registered source.