# Binky company email IMAP

Date: 2026-07-17  
Catalog: `binky-company-email-imap` (status `draft` until founder provisions)  
Owner: `railiance-platform` (CCR-2026-0007) · consumer need: `binky-control`  
Workplan: WARDEN-WP-0028

IMAP credentials for the company mailbox (founder address) so email-connect can
run **read-only** scans for control-plane event intake.

---

## OpenBao pointers

| Field | Value |
| --- | --- |
| Mount | `tenants` |
| Path | `tenants/binky/company-email/imap` |
| Fields | `IMAP_USERNAME`, `IMAP_PASSWORD` |
| Policy | `workload-kv-read-binky-company-email-imap` |
| OIDC role | `binky-company-email-imap-workload-kv-read` (`groups=net-kingdom-admins`) |
| Risk | `high` |

Non-secret connection facts (IMAP host/port) live in email-connect / binky-control
config as host + env **names**, not passwords.

---

## Worker checklist

1. Login as caller:

   ```bash
   bao login -method=oidc -path=netkingdom role=binky-company-email-imap-workload-kv-read
   ```

2. Fetch via sanctioned transport (never paste into chat):

   ```bash
   warden access binky-company-email-imap --all --no-policy --out /tmp/imap.user
   # primary field is IMAP_USERNAME; for password use --field after template support
   # or:
   warden access binky-company-email-imap --all --no-policy --exec -- \
     env IMAP_USERNAME=…  # prefer secrets-engine / dual-field exec when wired
   ```

   Until catalog is `active` and resolvable, use bao as caller with files:

   ```bash
   bao kv get -field=IMAP_USERNAME tenants/binky/company-email/imap > /tmp/u
   bao kv get -field=IMAP_PASSWORD tenants/binky/company-email/imap > /tmp/p
   chmod 600 /tmp/u /tmp/p
   ```

3. Run email-connect read-only scan (config uses env names only).

4. Store **metadata-only** evidence under `binky-control/mailmeta/`.

Agents (`WARDEN_AGENT_ID` set): raw value stream refused (exit 7). Use `--out` /
`--exec` / `--wrap` / `--fingerprint`.

---

## Verify (capabilities-safe)

```bash
LANE=$(bao token create -policy=workload-kv-read-binky-company-email-imap -ttl=2m -field=token)
bao token capabilities "$LANE" tenants/data/binky/company-email/imap   # read
bao token revoke "$LANE"

DEFAULT=$(bao token create -policy=default -ttl=2m -field=token)  # deny of create is also pass
bao token capabilities "$DEFAULT" tenants/data/binky/company-email/imap  # deny
bao token revoke "$DEFAULT"
```

Never use `bao kv get` for deny tests.

---

## Founder provision (Red lane)

```bash
# values only in mode-0600 files, never argv/chat
bao kv put tenants/binky/company-email/imap \
  IMAP_USERNAME=@/path/to/user.file \
  IMAP_PASSWORD=@/path/to/pass.file
shred -u /path/to/user.file /path/to/pass.file
```

Then re-verify capabilities, promote catalog to `active`, set CCR
`access_frontdoor.resolvable: true` / `readiness: ready`.

## Rotation

```bash
warden rotate-guide binky-company-email-imap
```

## See also

- `binky-control/integrations/company-email-openbao.md`
- `wiki/playbooks/tenant-secret-onboarding.md`
- CCR-2026-0007 in railiance-platform