diff --git a/registry/routing/catalog.yaml b/registry/routing/catalog.yaml index 8bf07cf..f01c1a9 100644 --- a/registry/routing/catalog.yaml +++ b/registry/routing/catalog.yaml @@ -401,11 +401,11 @@ entries: wiki_ref: wiki/playbooks/binky-company-email-imap.md#worker-checklist canon_ref: railiance-platform/docs/workload-kv-access-lanes.md reviewed: "2026-07-17" - status: draft + status: active risk: high - # CCR-2026-0007: tenants/ mount + policy + OIDC role applied 2026-07-17. - # Values: founder Red provision pending. Promote to active after provision + - # capabilities-safe verify. Sibling non-secret host/port in email-connect config. + # CCR-2026-0007: tenants/ mount + policy + OIDC role applied; founder provisioned + # values via UI (version ≥2, not placeholder). Capabilities-safe verify 2026-07-17: + # lane-policy read; default deny. Host: imap.ionos.de:993 (binky-control config). auth_method: "caller's own OpenBao token (OIDC netkingdom role binky-company-email-imap-workload-kv-read)" path_template: "tenants/binky/company-email/imap" fetch_command: "bao kv get -field=IMAP_PASSWORD tenants/binky/company-email/imap" diff --git a/wiki/CredentialRouting.md b/wiki/CredentialRouting.md index 47a86e6..dfdbda7 100644 --- a/wiki/CredentialRouting.md +++ b/wiki/CredentialRouting.md @@ -99,6 +99,7 @@ run the owner's tool as the caller and preserve owner custody. | `reuse-surface-hub-write-token` | "railiance-platform OpenBao KV + ESO deliver `REUSE_SURFACE_TOKEN` to reuse-surface" | ESO consumes in-cluster; `warden access reuse-surface-hub-write-token --fetch` as yourself | | `railiance-backup-offsite-lane` | "railiance-platform OpenBao KV for Nextcloud WebDAV + age recovery" | `warden access railiance-backup-offsite-lane --out FILE` (`risk: high`; agents: no raw stream) | | `forgejo-admin-api-token` | "railiance-platform OpenBao KV for Forgejo admin PAT" | `warden access forgejo-admin-api-token --out FILE` (`risk: high`) | +| `binky-company-email-imap` | "tenant IMAP on `tenants/binky/company-email/imap` (IONOS)" | `warden access binky-company-email-imap --out FILE` (`risk: high`) | Promotion criteria: `wiki/playbooks/catalog-lane-promotion.md`. High-risk / agent boundary: `wiki/playbooks/agent-read-boundary.md`. @@ -111,7 +112,6 @@ EXPOSED taint: `wiki/playbooks/exposed-taint.md` · `warden taint `. | Catalog `id` | Routing focus | Playbook | | --- | --- | --- | -| `binky-company-email-imap` | Tenant IMAP creds on `tenants/binky/…` (provision pending) | `wiki/playbooks/binky-company-email-imap.md` | | `object-storage-sts` | NK-WP-0007 STS vending path | `wiki/playbooks/object-storage-sts.md` | | `database-dynamic-credentials` | OpenBao database secrets engine | `wiki/playbooks/database-dynamic-credentials.md` | diff --git a/wiki/playbooks/binky-company-email-imap.md b/wiki/playbooks/binky-company-email-imap.md index dbaf288..16e0857 100644 --- a/wiki/playbooks/binky-company-email-imap.md +++ b/wiki/playbooks/binky-company-email-imap.md @@ -1,7 +1,7 @@ # Binky company email IMAP Date: 2026-07-17 -Catalog: `binky-company-email-imap` (status `draft` until founder provisions) +Catalog: `binky-company-email-imap` (status `active`, `resolvable: true`, `risk: high`) Owner: `railiance-platform` (CCR-2026-0007) · consumer need: `binky-control` Workplan: WARDEN-WP-0028 diff --git a/wiki/playbooks/catalog-lane-promotion.md b/wiki/playbooks/catalog-lane-promotion.md index 5bdc929..4c713c6 100644 --- a/wiki/playbooks/catalog-lane-promotion.md +++ b/wiki/playbooks/catalog-lane-promotion.md @@ -91,7 +91,6 @@ out on the OpenBao-delivered value, positive + negative verification audit-logge | Catalog `id` | Blocker | | --- | --- | -| `binky-company-email-imap` | Founder Red provision of IMAP values (CCR-2026-0007 applied; mount/policy/role live) | | `object-storage-sts` | NK-WP-0007 vending path not production-exercised | | `database-dynamic-credentials` | OpenBao database engine role paths TBD per workload | @@ -99,6 +98,10 @@ out on the OpenBao-delivered value, positive + negative verification audit-logge capabilities-safe re-verify (WP-0026 T07); primary field `NC_WEBDAV_TOKEN`; `risk: high` + EXPOSED taint on version 2 (operator may rotate optionally). +**Promoted 2026-07-17:** `binky-company-email-imap` — CCR-2026-0007 on mount +`tenants/`; founder provisioned (KV version ≥2); capabilities-safe verify; +primary field `IMAP_PASSWORD`; `risk: high`. Host `imap.ionos.de:993`. + **Tenant path (WP-0028):** new client secrets use mount `tenants/`, not `platform/workloads/`. See `wiki/playbooks/tenant-secret-onboarding.md`. diff --git a/workplans/WARDEN-WP-0028-tenant-secret-custody.md b/workplans/WARDEN-WP-0028-tenant-secret-custody.md index 2085150..2558499 100644 --- a/workplans/WARDEN-WP-0028-tenant-secret-custody.md +++ b/workplans/WARDEN-WP-0028-tenant-secret-custody.md @@ -11,6 +11,7 @@ planning_priority: high planning_order: 28 created: "2026-07-16" updated: "2026-07-17" +state_hub_workstream_id: "85b18255-d6a7-4c5e-bae0-e5b5bbc43757" --- # WARDEN-WP-0028 — Tenant secret custody (NetKingdom pattern) @@ -227,6 +228,7 @@ while binky is founder-operated only. id: WARDEN-WP-0028-T01 status: done priority: high +state_hub_task_id: "b78cfae0-6863-4889-8a1c-81dc0b44ff3b" ``` Done 2026-07-17: `wiki/playbooks/tenant-secret-onboarding.md` + CredentialRouting @@ -250,6 +252,7 @@ updated to match (or superseded with link). id: WARDEN-WP-0028-T02 status: done priority: high +state_hub_task_id: "030c9e0d-cc25-44ea-93f1-ff575905dec4" ``` Done 2026-07-17: `binky-control/integrations/company-email-openbao.md` rewritten @@ -272,6 +275,7 @@ implementation (T01 in BINKY was "prepared only"). id: WARDEN-WP-0028-T03 status: done priority: high +state_hub_task_id: "7ebc0a27-d2cc-4b71-985b-f793db583d91" ``` Done 2026-07-17: `tenants/` KV v2 mount live; CCR applier allowlist extended; @@ -303,6 +307,7 @@ reads for verify). id: WARDEN-WP-0028-T04 status: done priority: high +state_hub_task_id: "bcb8b75c-9ed6-4fbd-a2d9-19fe127d6d86" ``` Done 2026-07-17: catalog draft `binky-company-email-imap` (`risk: high`, @@ -322,10 +327,16 @@ expected pointers; after T03+T05, `resolvable: true`. ```task id: WARDEN-WP-0028-T05 -status: wait +status: done priority: high +state_hub_task_id: "0f56a6ef-349b-41db-a6df-fe3f3cccdd13" ``` +Done 2026-07-17: Founder provisioned via OpenBao UI (KV version 2; not +placeholder). Capabilities-safe verify pass; catalog + CCR promoted +active/resolvable. Optional follow-up: first email-connect read-only scan into +`binky-control/mailmeta/` (OperatingRhythm), not a custody blocker. + **Human-only value path.** Founder provisions IMAP username/password into OpenBao via approved tool (`bao kv put … @file` or secrets-engine provision). Agents never see the value. Run email-connect read-only scan with @@ -341,6 +352,7 @@ promoted active/resolvable; CCR verification evidence complete. id: WARDEN-WP-0028-T06 status: done priority: medium +state_hub_task_id: "913389da-72d8-4caf-a670-fdb74c20ee97" ``` Done 2026-07-17 with T01: `wiki/playbooks/tenant-secret-onboarding.md` + @@ -361,6 +373,7 @@ session notes for tenant repos. id: WARDEN-WP-0028-T07 status: done priority: low +state_hub_task_id: "f65eafda-9e31-4b18-aeba-2e7a9d906ac6" ``` Done 2026-07-17: **Decision** — tenant production lanes use `mount: tenants`