tegwick 053a1d7cee

CI Smoke / host-smoke (push) Successful in 0s

Details

CI Smoke / container-smoke (push) Successful in 1s

Details

WARDEN-WP-0028: promote binky-company-email-imap active

Founder provisioned IMAP on tenants/ (KV v2); capabilities-safe verify
pass. Catalog resolvable; workplan finished.

2026-07-17 00:33:20 +02:00

3.2 KiB

Raw Blame History

Binky company email IMAP

Date: 2026-07-17
Catalog: binky-company-email-imap (status active, resolvable: true, risk: high)
Owner: railiance-platform (CCR-2026-0007) · consumer need: binky-control
Workplan: WARDEN-WP-0028

IMAP credentials for the company mailbox (founder address) so email-connect can run read-only scans for control-plane event intake.

Provider (IONOS — non-secret)

Setting	Value
IMAP host	`imap.ionos.de`
IMAP port	`993`
Encryption	SSL/TLS
Username shape	full mailbox address (e.g. `bernd.worsch@binky-hedgehog.com`)
SMTP (future lane)	`smtp.ionos.de:465` SSL/TLS — not this CCR

Config (host/port/env names only):
binky-control/integrations/mailbox-binky-company.yml

OpenBao pointers

Field	Value
Mount	`tenants`
Path	`tenants/binky/company-email/imap`
Fields	`IMAP_USERNAME`, `IMAP_PASSWORD`
Policy	`workload-kv-read-binky-company-email-imap`
OIDC role	`binky-company-email-imap-workload-kv-read` (`groups=net-kingdom-admins`)
Risk	`high`

Worker checklist

bao login -method=oidc -path=netkingdom role=binky-company-email-imap-workload-kv-read

Fetch via sanctioned transport (never paste into chat):

warden access binky-company-email-imap --all --no-policy --out /tmp/imap.user
# primary field is IMAP_USERNAME; for password use --field after template support
# or:
warden access binky-company-email-imap --all --no-policy --exec -- \
  env IMAP_USERNAME=…  # prefer secrets-engine / dual-field exec when wired

Until catalog is active and resolvable, use bao as caller with files:

bao kv get -field=IMAP_USERNAME tenants/binky/company-email/imap > /tmp/u
bao kv get -field=IMAP_PASSWORD tenants/binky/company-email/imap > /tmp/p
chmod 600 /tmp/u /tmp/p

Run email-connect read-only scan (config uses env names only).
Store metadata-only evidence under binky-control/mailmeta/.

Agents (WARDEN_AGENT_ID set): raw value stream refused (exit 7). Use --out / --exec / --wrap / --fingerprint.

Verify (capabilities-safe)

LANE=$(bao token create -policy=workload-kv-read-binky-company-email-imap -ttl=2m -field=token)
bao token capabilities "$LANE" tenants/data/binky/company-email/imap   # read
bao token revoke "$LANE"

DEFAULT=$(bao token create -policy=default -ttl=2m -field=token)  # deny of create is also pass
bao token capabilities "$DEFAULT" tenants/data/binky/company-email/imap  # deny
bao token revoke "$DEFAULT"

Never use bao kv get for deny tests.

Founder provision (Red lane)

# values only in mode-0600 files, never argv/chat
bao kv put tenants/binky/company-email/imap \
  IMAP_USERNAME=@/path/to/user.file \
  IMAP_PASSWORD=@/path/to/pass.file
shred -u /path/to/user.file /path/to/pass.file

Then re-verify capabilities, promote catalog to active, set CCR access_frontdoor.resolvable: true / readiness: ready.

Rotation

warden rotate-guide binky-company-email-imap

3.2 KiB Raw Blame History