WARDEN-WP-0028: promote binky-company-email-imap active
Founder provisioned IMAP on tenants/ (KV v2); capabilities-safe verify pass. Catalog resolvable; workplan finished.
This commit is contained in:
parent
6b5432229f
commit
053a1d7cee
5 changed files with 24 additions and 8 deletions
|
|
@ -401,11 +401,11 @@ entries:
|
|||
wiki_ref: wiki/playbooks/binky-company-email-imap.md#worker-checklist
|
||||
canon_ref: railiance-platform/docs/workload-kv-access-lanes.md
|
||||
reviewed: "2026-07-17"
|
||||
status: draft
|
||||
status: active
|
||||
risk: high
|
||||
# CCR-2026-0007: tenants/ mount + policy + OIDC role applied 2026-07-17.
|
||||
# Values: founder Red provision pending. Promote to active after provision +
|
||||
# capabilities-safe verify. Sibling non-secret host/port in email-connect config.
|
||||
# CCR-2026-0007: tenants/ mount + policy + OIDC role applied; founder provisioned
|
||||
# values via UI (version ≥2, not placeholder). Capabilities-safe verify 2026-07-17:
|
||||
# lane-policy read; default deny. Host: imap.ionos.de:993 (binky-control config).
|
||||
auth_method: "caller's own OpenBao token (OIDC netkingdom role binky-company-email-imap-workload-kv-read)"
|
||||
path_template: "tenants/binky/company-email/imap"
|
||||
fetch_command: "bao kv get -field=IMAP_PASSWORD tenants/binky/company-email/imap"
|
||||
|
|
|
|||
|
|
@ -99,6 +99,7 @@ run the owner's tool as the caller and preserve owner custody.
|
|||
| `reuse-surface-hub-write-token` | "railiance-platform OpenBao KV + ESO deliver `REUSE_SURFACE_TOKEN` to reuse-surface" | ESO consumes in-cluster; `warden access reuse-surface-hub-write-token --fetch` as yourself |
|
||||
| `railiance-backup-offsite-lane` | "railiance-platform OpenBao KV for Nextcloud WebDAV + age recovery" | `warden access railiance-backup-offsite-lane --out FILE` (`risk: high`; agents: no raw stream) |
|
||||
| `forgejo-admin-api-token` | "railiance-platform OpenBao KV for Forgejo admin PAT" | `warden access forgejo-admin-api-token --out FILE` (`risk: high`) |
|
||||
| `binky-company-email-imap` | "tenant IMAP on `tenants/binky/company-email/imap` (IONOS)" | `warden access binky-company-email-imap --out FILE` (`risk: high`) |
|
||||
|
||||
Promotion criteria: `wiki/playbooks/catalog-lane-promotion.md`.
|
||||
High-risk / agent boundary: `wiki/playbooks/agent-read-boundary.md`.
|
||||
|
|
@ -111,7 +112,6 @@ EXPOSED taint: `wiki/playbooks/exposed-taint.md` · `warden taint <id>`.
|
|||
|
||||
| Catalog `id` | Routing focus | Playbook |
|
||||
| --- | --- | --- |
|
||||
| `binky-company-email-imap` | Tenant IMAP creds on `tenants/binky/…` (provision pending) | `wiki/playbooks/binky-company-email-imap.md` |
|
||||
| `object-storage-sts` | NK-WP-0007 STS vending path | `wiki/playbooks/object-storage-sts.md` |
|
||||
| `database-dynamic-credentials` | OpenBao database secrets engine | `wiki/playbooks/database-dynamic-credentials.md` |
|
||||
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# Binky company email IMAP
|
||||
|
||||
Date: 2026-07-17
|
||||
Catalog: `binky-company-email-imap` (status `draft` until founder provisions)
|
||||
Catalog: `binky-company-email-imap` (status `active`, `resolvable: true`, `risk: high`)
|
||||
Owner: `railiance-platform` (CCR-2026-0007) · consumer need: `binky-control`
|
||||
Workplan: WARDEN-WP-0028
|
||||
|
||||
|
|
|
|||
|
|
@ -91,7 +91,6 @@ out on the OpenBao-delivered value, positive + negative verification audit-logge
|
|||
|
||||
| Catalog `id` | Blocker |
|
||||
| --- | --- |
|
||||
| `binky-company-email-imap` | Founder Red provision of IMAP values (CCR-2026-0007 applied; mount/policy/role live) |
|
||||
| `object-storage-sts` | NK-WP-0007 vending path not production-exercised |
|
||||
| `database-dynamic-credentials` | OpenBao database engine role paths TBD per workload |
|
||||
|
||||
|
|
@ -99,6 +98,10 @@ out on the OpenBao-delivered value, positive + negative verification audit-logge
|
|||
capabilities-safe re-verify (WP-0026 T07); primary field `NC_WEBDAV_TOKEN`;
|
||||
`risk: high` + EXPOSED taint on version 2 (operator may rotate optionally).
|
||||
|
||||
**Promoted 2026-07-17:** `binky-company-email-imap` — CCR-2026-0007 on mount
|
||||
`tenants/`; founder provisioned (KV version ≥2); capabilities-safe verify;
|
||||
primary field `IMAP_PASSWORD`; `risk: high`. Host `imap.ionos.de:993`.
|
||||
|
||||
**Tenant path (WP-0028):** new client secrets use mount `tenants/`, not
|
||||
`platform/workloads/`. See `wiki/playbooks/tenant-secret-onboarding.md`.
|
||||
|
||||
|
|
|
|||
|
|
@ -11,6 +11,7 @@ planning_priority: high
|
|||
planning_order: 28
|
||||
created: "2026-07-16"
|
||||
updated: "2026-07-17"
|
||||
state_hub_workstream_id: "85b18255-d6a7-4c5e-bae0-e5b5bbc43757"
|
||||
---
|
||||
|
||||
# WARDEN-WP-0028 — Tenant secret custody (NetKingdom pattern)
|
||||
|
|
@ -227,6 +228,7 @@ while binky is founder-operated only.
|
|||
id: WARDEN-WP-0028-T01
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "b78cfae0-6863-4889-8a1c-81dc0b44ff3b"
|
||||
```
|
||||
|
||||
Done 2026-07-17: `wiki/playbooks/tenant-secret-onboarding.md` + CredentialRouting
|
||||
|
|
@ -250,6 +252,7 @@ updated to match (or superseded with link).
|
|||
id: WARDEN-WP-0028-T02
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "030c9e0d-cc25-44ea-93f1-ff575905dec4"
|
||||
```
|
||||
|
||||
Done 2026-07-17: `binky-control/integrations/company-email-openbao.md` rewritten
|
||||
|
|
@ -272,6 +275,7 @@ implementation (T01 in BINKY was "prepared only").
|
|||
id: WARDEN-WP-0028-T03
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "7ebc0a27-d2cc-4b71-985b-f793db583d91"
|
||||
```
|
||||
|
||||
Done 2026-07-17: `tenants/` KV v2 mount live; CCR applier allowlist extended;
|
||||
|
|
@ -303,6 +307,7 @@ reads for verify).
|
|||
id: WARDEN-WP-0028-T04
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "bcb8b75c-9ed6-4fbd-a2d9-19fe127d6d86"
|
||||
```
|
||||
|
||||
Done 2026-07-17: catalog draft `binky-company-email-imap` (`risk: high`,
|
||||
|
|
@ -322,10 +327,16 @@ expected pointers; after T03+T05, `resolvable: true`.
|
|||
|
||||
```task
|
||||
id: WARDEN-WP-0028-T05
|
||||
status: wait
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "0f56a6ef-349b-41db-a6df-fe3f3cccdd13"
|
||||
```
|
||||
|
||||
Done 2026-07-17: Founder provisioned via OpenBao UI (KV version 2; not
|
||||
placeholder). Capabilities-safe verify pass; catalog + CCR promoted
|
||||
active/resolvable. Optional follow-up: first email-connect read-only scan into
|
||||
`binky-control/mailmeta/` (OperatingRhythm), not a custody blocker.
|
||||
|
||||
**Human-only value path.** Founder provisions IMAP username/password into
|
||||
OpenBao via approved tool (`bao kv put … @file` or secrets-engine provision).
|
||||
Agents never see the value. Run email-connect read-only scan with
|
||||
|
|
@ -341,6 +352,7 @@ promoted active/resolvable; CCR verification evidence complete.
|
|||
id: WARDEN-WP-0028-T06
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "913389da-72d8-4caf-a670-fdb74c20ee97"
|
||||
```
|
||||
|
||||
Done 2026-07-17 with T01: `wiki/playbooks/tenant-secret-onboarding.md` +
|
||||
|
|
@ -361,6 +373,7 @@ session notes for tenant repos.
|
|||
id: WARDEN-WP-0028-T07
|
||||
status: done
|
||||
priority: low
|
||||
state_hub_task_id: "f65eafda-9e31-4b18-aeba-2e7a9d906ac6"
|
||||
```
|
||||
|
||||
Done 2026-07-17: **Decision** — tenant production lanes use `mount: tenants`
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue