coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

WARDEN-WP-0028: promote binky-company-email-imap active
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Founder provisioned IMAP on tenants/ (KV v2); capabilities-safe verify
pass. Catalog resolvable; workplan finished.
This commit is contained in:
tegwick 2026-07-17 00:33:20 +02:00
parent 6b5432229f
commit 053a1d7cee
5 changed files with 24 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

2
wiki/CredentialRouting.md
View file

@ -99,6 +99,7 @@ run the owner's tool as the caller and preserve owner custody.
| `reuse-surface-hub-write-token` | "railiance-platform OpenBao KV + ESO deliver `REUSE_SURFACE_TOKEN` to reuse-surface" | ESO consumes in-cluster; `warden access reuse-surface-hub-write-token --fetch` as yourself |
| `railiance-backup-offsite-lane` | "railiance-platform OpenBao KV for Nextcloud WebDAV + age recovery" | `warden access railiance-backup-offsite-lane --out FILE` (`risk: high`; agents: no raw stream) |
| `forgejo-admin-api-token` | "railiance-platform OpenBao KV for Forgejo admin PAT" | `warden access forgejo-admin-api-token --out FILE` (`risk: high`) |
| `binky-company-email-imap` | "tenant IMAP on `tenants/binky/company-email/imap` (IONOS)" | `warden access binky-company-email-imap --out FILE` (`risk: high`) |
Promotion criteria: `wiki/playbooks/catalog-lane-promotion.md`.
High-risk / agent boundary: `wiki/playbooks/agent-read-boundary.md`.
@ -111,7 +112,6 @@ EXPOSED taint: `wiki/playbooks/exposed-taint.md` · `warden taint <id>`.
| Catalog `id` | Routing focus | Playbook |
| --- | --- | --- |
| `binky-company-email-imap` | Tenant IMAP creds on `tenants/binky/…` (provision pending) | `wiki/playbooks/binky-company-email-imap.md` |
| `object-storage-sts` | NK-WP-0007 STS vending path | `wiki/playbooks/object-storage-sts.md` |
| `database-dynamic-credentials` | OpenBao database secrets engine | `wiki/playbooks/database-dynamic-credentials.md` |

2
wiki/playbooks/binky-company-email-imap.md
View file

@ -1,7 +1,7 @@
# Binky company email IMAP
Date: 2026-07-17
Catalog: `binky-company-email-imap` (status `draft` until founder provisions)
Catalog: `binky-company-email-imap` (status `active`, `resolvable: true`, `risk: high`)
Owner: `railiance-platform` (CCR-2026-0007) · consumer need: `binky-control`
Workplan: WARDEN-WP-0028

5
wiki/playbooks/catalog-lane-promotion.md
View file

@ -91,7 +91,6 @@ out on the OpenBao-delivered value, positive + negative verification audit-logge
| Catalog `id` | Blocker |
| --- | --- |
| `binky-company-email-imap` | Founder Red provision of IMAP values (CCR-2026-0007 applied; mount/policy/role live) |
| `object-storage-sts` | NK-WP-0007 vending path not production-exercised |
| `database-dynamic-credentials` | OpenBao database engine role paths TBD per workload |
@ -99,6 +98,10 @@ out on the OpenBao-delivered value, positive + negative verification audit-logge
capabilities-safe re-verify (WP-0026 T07); primary field `NC_WEBDAV_TOKEN`;
`risk: high` + EXPOSED taint on version 2 (operator may rotate optionally).
**Promoted 2026-07-17:** `binky-company-email-imap` — CCR-2026-0007 on mount
`tenants/`; founder provisioned (KV version ≥2); capabilities-safe verify;
primary field `IMAP_PASSWORD`; `risk: high`. Host `imap.ionos.de:993`.
**Tenant path (WP-0028):** new client secrets use mount `tenants/`, not
`platform/workloads/`. See `wiki/playbooks/tenant-secret-onboarding.md`.