coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

WARDEN-WP-0028: promote binky-company-email-imap active
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Founder provisioned IMAP on tenants/ (KV v2); capabilities-safe verify
pass. Catalog resolvable; workplan finished.
This commit is contained in:
tegwick 2026-07-17 00:33:20 +02:00
parent 6b5432229f
commit 053a1d7cee
5 changed files with 24 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

15
workplans/WARDEN-WP-0028-tenant-secret-custody.md
View file

@ -11,6 +11,7 @@ planning_priority: high
planning_order: 28
created: "2026-07-16"
updated: "2026-07-17"
state_hub_workstream_id: "85b18255-d6a7-4c5e-bae0-e5b5bbc43757"
---
# WARDEN-WP-0028 — Tenant secret custody (NetKingdom pattern)
@ -227,6 +228,7 @@ while binky is founder-operated only.
id: WARDEN-WP-0028-T01
status: done
priority: high
state_hub_task_id: "b78cfae0-6863-4889-8a1c-81dc0b44ff3b"
```
Done 2026-07-17: `wiki/playbooks/tenant-secret-onboarding.md` + CredentialRouting
@ -250,6 +252,7 @@ updated to match (or superseded with link).
id: WARDEN-WP-0028-T02
status: done
priority: high
state_hub_task_id: "030c9e0d-cc25-44ea-93f1-ff575905dec4"
```
Done 2026-07-17: `binky-control/integrations/company-email-openbao.md` rewritten
@ -272,6 +275,7 @@ implementation (T01 in BINKY was "prepared only").
id: WARDEN-WP-0028-T03
status: done
priority: high
state_hub_task_id: "7ebc0a27-d2cc-4b71-985b-f793db583d91"
```
Done 2026-07-17: `tenants/` KV v2 mount live; CCR applier allowlist extended;
@ -303,6 +307,7 @@ reads for verify).
id: WARDEN-WP-0028-T04
status: done
priority: high
state_hub_task_id: "bcb8b75c-9ed6-4fbd-a2d9-19fe127d6d86"
```
Done 2026-07-17: catalog draft `binky-company-email-imap` (`risk: high`,
@ -322,10 +327,16 @@ expected pointers; after T03+T05, `resolvable: true`.
```task
id: WARDEN-WP-0028-T05
status: wait
status: done
priority: high
state_hub_task_id: "0f56a6ef-349b-41db-a6df-fe3f3cccdd13"
```
Done 2026-07-17: Founder provisioned via OpenBao UI (KV version 2; not
placeholder). Capabilities-safe verify pass; catalog + CCR promoted
active/resolvable. Optional follow-up: first email-connect read-only scan into
`binky-control/mailmeta/` (OperatingRhythm), not a custody blocker.
**Human-only value path.** Founder provisions IMAP username/password into
OpenBao via approved tool (`bao kv put … @file` or secrets-engine provision).
Agents never see the value. Run email-connect read-only scan with
@ -341,6 +352,7 @@ promoted active/resolvable; CCR verification evidence complete.
id: WARDEN-WP-0028-T06
status: done
priority: medium
state_hub_task_id: "913389da-72d8-4caf-a670-fdb74c20ee97"
```
Done 2026-07-17 with T01: `wiki/playbooks/tenant-secret-onboarding.md` +
@ -361,6 +373,7 @@ session notes for tenant repos.
id: WARDEN-WP-0028-T07
status: done
priority: low
state_hub_task_id: "f65eafda-9e31-4b18-aeba-2e7a9d906ac6"
```
Done 2026-07-17: **Decision** — tenant production lanes use `mount: tenants`