tegwick
7ce58ae638
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1
113 lines
3.2 KiB
Markdown
113 lines
3.2 KiB
Markdown
# Binky company email IMAP
|
|
|
|
Date: 2026-07-17
|
|
Catalog: `binky-company-email-imap` (status `active`, `resolvable: true`, `risk: high`)
|
|
Owner: `railiance-platform` (CCR-2026-0007) · consumer need: `binky-control`
|
|
Workplan: WARDEN-WP-0028
|
|
|
|
IMAP credentials for the company mailbox (founder address) so email-connect can
|
|
run **read-only** scans for control-plane event intake.
|
|
|
|
---
|
|
|
|
## Provider (IONOS — non-secret)
|
|
|
|
| Setting | Value |
|
|
| --- | --- |
|
|
| IMAP host | `imap.ionos.de` |
|
|
| IMAP port | `993` |
|
|
| Encryption | SSL/TLS |
|
|
| Username shape | full mailbox address (e.g. `bernd.worsch@binky-hedgehog.com`) |
|
|
| SMTP (future lane) | `smtp.ionos.de:465` SSL/TLS — **not** this CCR |
|
|
|
|
Config (host/port/env names only):
|
|
`binky-control/integrations/mailbox-binky-company.yml`
|
|
|
|
## OpenBao pointers
|
|
|
|
| Field | Value |
|
|
| --- | --- |
|
|
| Mount | `tenants` |
|
|
| Path | `tenants/binky/company-email/imap` |
|
|
| Fields | `IMAP_USERNAME`, `IMAP_PASSWORD` |
|
|
| Policy | `workload-kv-read-binky-company-email-imap` |
|
|
| OIDC role | `binky-company-email-imap-workload-kv-read` (`groups=net-kingdom-admins`) |
|
|
| Risk | `high` |
|
|
|
|
---
|
|
|
|
## Worker checklist
|
|
|
|
1. Login as caller:
|
|
|
|
```bash
|
|
bao login -method=oidc -path=netkingdom role=binky-company-email-imap-workload-kv-read
|
|
```
|
|
|
|
2. Fetch via sanctioned transport (never paste into chat):
|
|
|
|
```bash
|
|
warden access binky-company-email-imap --all --out /tmp/imap.user
|
|
# primary field is IMAP_USERNAME; for password use --field after template support
|
|
# or:
|
|
warden access binky-company-email-imap --all --exec -- \
|
|
env IMAP_USERNAME=… # prefer secrets-engine / dual-field exec when wired
|
|
```
|
|
|
|
Until catalog is `active` and resolvable, use bao as caller with files:
|
|
|
|
```bash
|
|
bao kv get -field=IMAP_USERNAME tenants/binky/company-email/imap > /tmp/u
|
|
bao kv get -field=IMAP_PASSWORD tenants/binky/company-email/imap > /tmp/p
|
|
chmod 600 /tmp/u /tmp/p
|
|
```
|
|
|
|
3. Run email-connect read-only scan (config uses env names only).
|
|
|
|
4. Store **metadata-only** evidence under `binky-control/mailmeta/`.
|
|
|
|
Agents (`WARDEN_AGENT_ID` set): raw value stream refused (exit 7). Use `--out` /
|
|
`--exec` / `--wrap` / `--fingerprint`.
|
|
|
|
---
|
|
|
|
## Verify (capabilities-safe)
|
|
|
|
```bash
|
|
LANE=$(bao token create -policy=workload-kv-read-binky-company-email-imap -ttl=2m -field=token)
|
|
bao token capabilities "$LANE" tenants/data/binky/company-email/imap # read
|
|
bao token revoke "$LANE"
|
|
|
|
DEFAULT=$(bao token create -policy=default -ttl=2m -field=token) # deny of create is also pass
|
|
bao token capabilities "$DEFAULT" tenants/data/binky/company-email/imap # deny
|
|
bao token revoke "$DEFAULT"
|
|
```
|
|
|
|
Never use `bao kv get` for deny tests.
|
|
|
|
---
|
|
|
|
## Founder provision (Red lane)
|
|
|
|
```bash
|
|
# values only in mode-0600 files, never argv/chat
|
|
bao kv put tenants/binky/company-email/imap \
|
|
IMAP_USERNAME=@/path/to/user.file \
|
|
IMAP_PASSWORD=@/path/to/pass.file
|
|
shred -u /path/to/user.file /path/to/pass.file
|
|
```
|
|
|
|
Then re-verify capabilities, promote catalog to `active`, set CCR
|
|
`access_frontdoor.resolvable: true` / `readiness: ready`.
|
|
|
|
## Rotation
|
|
|
|
```bash
|
|
warden rotate-guide binky-company-email-imap
|
|
```
|
|
|
|
## See also
|
|
|
|
- `binky-control/integrations/company-email-openbao.md`
|
|
- `wiki/playbooks/tenant-secret-onboarding.md`
|
|
- CCR-2026-0007 in railiance-platform
|