tegwick 98a2339b81

CI Smoke / host-smoke (push) Successful in 0s

Details

CI Smoke / container-smoke (push) Successful in 3s

Details

WARDEN-WP-0028: tenant secrets on mount tenants/ (first lane draft)

Adopt tenants/<tenant>/… custody (not platform/workloads). Document
onboarding, add draft binky-company-email-imap catalog entry, and mark
T01–T04/T06–T07 done. Founder Red provision remains T05.

2026-07-17 00:09:28 +02:00

3 KiB

Raw Blame History

Binky company email IMAP

Date: 2026-07-17
Catalog: binky-company-email-imap (status draft until founder provisions)
Owner: railiance-platform (CCR-2026-0007) · consumer need: binky-control
Workplan: WARDEN-WP-0028

IMAP credentials for the company mailbox (founder address) so email-connect can run read-only scans for control-plane event intake.

OpenBao pointers

Field	Value
Mount	`tenants`
Path	`tenants/binky/company-email/imap`
Fields	`IMAP_USERNAME`, `IMAP_PASSWORD`
Policy	`workload-kv-read-binky-company-email-imap`
OIDC role	`binky-company-email-imap-workload-kv-read` (`groups=net-kingdom-admins`)
Risk	`high`

Non-secret connection facts (IMAP host/port) live in email-connect / binky-control config as host + env names, not passwords.

Worker checklist

bao login -method=oidc -path=netkingdom role=binky-company-email-imap-workload-kv-read

Fetch via sanctioned transport (never paste into chat):

warden access binky-company-email-imap --all --no-policy --out /tmp/imap.user
# primary field is IMAP_USERNAME; for password use --field after template support
# or:
warden access binky-company-email-imap --all --no-policy --exec -- \
  env IMAP_USERNAME=…  # prefer secrets-engine / dual-field exec when wired

Until catalog is active and resolvable, use bao as caller with files:

bao kv get -field=IMAP_USERNAME tenants/binky/company-email/imap > /tmp/u
bao kv get -field=IMAP_PASSWORD tenants/binky/company-email/imap > /tmp/p
chmod 600 /tmp/u /tmp/p

Run email-connect read-only scan (config uses env names only).
Store metadata-only evidence under binky-control/mailmeta/.

Agents (WARDEN_AGENT_ID set): raw value stream refused (exit 7). Use --out / --exec / --wrap / --fingerprint.

Verify (capabilities-safe)

LANE=$(bao token create -policy=workload-kv-read-binky-company-email-imap -ttl=2m -field=token)
bao token capabilities "$LANE" tenants/data/binky/company-email/imap   # read
bao token revoke "$LANE"

DEFAULT=$(bao token create -policy=default -ttl=2m -field=token)  # deny of create is also pass
bao token capabilities "$DEFAULT" tenants/data/binky/company-email/imap  # deny
bao token revoke "$DEFAULT"

Never use bao kv get for deny tests.

Founder provision (Red lane)

# values only in mode-0600 files, never argv/chat
bao kv put tenants/binky/company-email/imap \
  IMAP_USERNAME=@/path/to/user.file \
  IMAP_PASSWORD=@/path/to/pass.file
shred -u /path/to/user.file /path/to/pass.file

Then re-verify capabilities, promote catalog to active, set CCR access_frontdoor.resolvable: true / readiness: ready.

Rotation

warden rotate-guide binky-company-email-imap

3 KiB Raw Blame History