tegwick
d644e6a79f
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a10e2d-a5ef-7e92-b03d-b1694e915680
95 lines
4.5 KiB
Markdown
95 lines
4.5 KiB
Markdown
---
|
|
id: NK-WP-0047
|
|
type: workplan
|
|
title: "Deliver password-reset mail from platform mailbox"
|
|
domain: infotech
|
|
repo: net-kingdom
|
|
status: finished
|
|
owner: codex
|
|
topic_slug: net-kingdom
|
|
created: "2026-10-06"
|
|
updated: "2026-10-06"
|
|
state_hub_workstream_id: "53b7c429-e780-5dfe-9ad4-88dd0490ecb8"
|
|
---
|
|
|
|
# Scope
|
|
|
|
CSOC-WP-0010 unblocks CSOC-WP-0008-T11. SMTP-only authentication notifications;
|
|
no application template API or protocol-mail sending. Configuration is prepared,
|
|
not live. Existing platform mailbox credential is reused through a new admitted
|
|
consumer; telemetry roles/Secrets are not shared or copied.
|
|
|
|
Knowledge: emergent-security0.2.6 deployment, verified-files, orientation-only;
|
|
digest8d1d6a9d4d07fec7b619618de7dfe2254c1790f85f4198c7fe19db9751c02.
|
|
Native validation and live SecretSynced/inbox proof remain pending.
|
|
|
|
## Prepare native SMTP package and scoped runtime projection
|
|
|
|
```task
|
|
id: NK-WP-0047-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "3cdce5c1-4313-5cc8-98db-df289f01ae97"
|
|
```
|
|
|
|
Review branch changes only Authelia notifier to IONOS TLS platform sender, adds password-file mount and sso-only SecretStore/ExternalSecret/serviceaccount. Existing authentication secrets, identity config, images and replicas remain. SMTP startup check enabled; rollback procedure documented.
|
|
|
|
## Admit custody and validate exact live rollout
|
|
|
|
```task
|
|
id: NK-WP-0047-T02
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "662c58dd-fa16-5a5a-9ae7-645a1048277a"
|
|
```
|
|
|
|
Depends on RPF-WP-0052/CCR-2026-0035 and founder exact go. Apply admission resources with server dry-run/diff, wait store/projection Ready without reading Secret values; native Authelia config validation, existing-config drift check, headroom/SQLite recovery preflight, reviewed rollout. Preserve issued identity/custody state; do not reconstruct old auth Secrets.
|
|
|
|
## Complete actual reset and personal login acceptance
|
|
|
|
```task
|
|
id: NK-WP-0047-T03
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "0dd88024-d2ce-5e31-b8ab-1c6091516105"
|
|
```
|
|
|
|
User starts a fresh reset, receives email and completes password change privately then app login. Record accepted/received/authenticated separately, no links/tokens/passwords in evidence. Rollback notifier config/mount on runtime failure, leave mailbox/version/password unchanged.
|
|
|
|
Prepared evidence: ten SMTP admission tests passed; notifier/password-mount
|
|
and password-only ESO projection parsed; server dry-run accepted package
|
|
resources. Dedicated SMTP egress is required and drafted. Native runtime
|
|
credential validation, admitted consumer and inbox receipt remain pending.
|
|
No live activation or mail sent.
|
|
|
|
Founder exact go recorded in decision d95b4c9f-30a3-4ed6-b18f-d1b9fa20d84e.
|
|
Approved branch27c3edf merged to main; SA/store/projection/SMTP egress applied
|
|
with fresh dry-run/diff. Owner backup clone csoc-authelia-pre-smtp-20261006
|
|
succeeded18:20:43Z. Store/projection await missing OpenBao role from attended
|
|
owner admission. Runtime notifier/mount remains previous; Authelia1/1 healthy.
|
|
Native validation Job prepared/dry-run only. No restart/password change/mail sent.
|
|
|
|
Attended mailbox admission independently verified on 2026-10-06: SMTP authenticated,
|
|
reader admitted / coding agent denied, KV version 2 / password unchanged. Store and projection
|
|
Ready, native validator completed18:31:49Z; notifier/mount rollout generation 28
|
|
succeeded1/1. RuntimeSMTP/platform sender TLS/startupcheck verified. Public auth/
|
|
app/issuer health and authorization handoff pass. T02 done; T03 waits user reset
|
|
inbox/password change/signin. No reset links or credential values read or mail sent by the agent.
|
|
|
|
User confirmed actual fresh reset-email inbox receipt. Subsequent app login
|
|
returns500 after authentication; coulomb-social and owning RAPPS-WP-0015 traced
|
|
a stale app user-service URL and deployed the correction as Helm revision11.
|
|
T03 stays wait for successful end-to-end app sign-in; do not infer failure of
|
|
SMTP delivery from the separate application callback failure.
|
|
|
|
## Final personal acceptance — 2026-10-06
|
|
|
|
User confirmed fresh reset-email receipt, then after revision11 URL correction
|
|
confirmed: “I reach my workspace.” Personal sign-in acceptance is complete.
|
|
No password/reset token/private protocol was requested or recorded.
|
|
|
|
Residual handoff before closure: shared notifications, platform-inbox/reply
|
|
operations and communication usecase regressions remain live tasks
|
|
CSOC-WP-0010-T04/T05/T06. ReichelAg product/data/restore review remains live
|
|
CSOC-WP-0008-T01/T02/T03/T09. Native password-reset SMTP and personal-login
|
|
acceptance required by this owner workplan are complete.
|