Mark RAIL-HO-WP-0005-T06 done after SMTP delivery verified

IONOS mail via OpenBao/ESO and smtp.ionos.de STARTTLS confirmed with operator
test email and forgot-password delivery.

workplans/RAIL-HO-WP-0005-forgejo-production-migration.md

@@ -8,7 +8,7 @@ status: active
 owner: railiance
 topic_slug: railiance
 created: "2026-05-03"
-updated: "2026-07-07"
+updated: "2026-07-08"
 state_hub_workstream_id: "84e17675-0d15-4268-a8bd-540124d37018"
 ---
 
@@ -62,8 +62,8 @@ change is made there.
    `the-custodian/docs/forgejo-production-decisions.md`.
 2. ~~Mail delivery path~~ **DECIDED 2026-07-07:** IONOS SMTP for `@coulomb.social`
    mailboxes (operator-provisioned domain/subdomains). Sender mailbox TBD
-   (`forgejo@coulomb.social` recommended); SPF/DKIM via IONOS zone. T06 still
-   requires password-reset test after creds are deployed.
+   (`forgejo@coulomb.social`); SPF/DKIM via IONOS zone. T06 SMTP delivery
+   verified 2026-07-08.
 3. Package registry scope: container images only at first, or also generic,
    npm, PyPI, Go, Maven, and Helm packages.
 4. ~~Actions runner model~~ **DECIDED 2026-07-03:** in-cluster long-lived runner
@@ -113,7 +113,7 @@ acceptance criteria below are tracked across T05, T07, T08, and T10 instead.
 
 Still to prove before T11:
 
-- SMTP/password reset end-to-end (T06).
+- ~~SMTP/password reset end-to-end (T06).~~ **done** (2026-07-08).
 - Backup and restore in isolated namespace (T09) — **drill passed 2026-07-04**;
   scheduled automation pending.
 - Issues/releases/wiki/LFS per inventory classification (T10 matrix).
@@ -184,7 +184,7 @@ Decide the production choices listed in "Key Decisions to Confirm".
 **Partial (2026-07-07):** hostname, exposure, deployment pattern, live deploy,
 in-cluster runner model (`ADR-004`), and **SMTP provider (IONOS)** decided.
 Cutover mode **leaning** staged per-repo (glas-harness pilot). Remaining
-operator decisions: sender mailbox name + T06 test, package scope beyond OCI,
+operator decisions: package scope beyond OCI,
 backup target, final cutover confirmation. See
 `the-custodian/docs/forgejo-production-decisions.md`.
 
@@ -275,7 +275,7 @@ Minimum scope:
 ingress + TLS, SSH NodePort `30022`, Actions enabled, `coulomb` org,
 `railiance01-build-01` runner (ADR-004). Git push/pull via HTTPS and
 `forgejo-remote` SSH proven. Remaining: SOPS hardening for all secrets,
-SMTP (T06), operator user accounts beyond `forgejo_admin`.
+operator user accounts beyond `forgejo_admin`.
 
 **Done when:** Forgejo runs on railiance01 against production platform
 services and can serve login, git clone/push, package registry, and admin
@@ -287,9 +287,9 @@ operations.
 
 ```task
 id: RAIL-HO-WP-0005-T06
-status: todo
+status: done
 priority: high
-needs_human: true
+needs_human: false
 state_hub_task_id: "417faa4d-eab8-4247-9485-4f80e5d5b7ff"
 ```
 
@@ -299,13 +299,18 @@ Configure and test mail delivery for account recovery.
 See `the-custodian/docs/forgejo-production-decisions.md` and
 `railiance-apps/docs/forgejo-on-railiance01.md` (SMTP section).
 
+**Verified (2026-07-08):** OpenBao path `platform/workloads/forgejo/forgejo-mailer`
+(field `PASSWD`) → ESO → Helm `GITEA__mailer__PASSWD`. Mailer uses
+`smtp.ionos.de:587` with `PROTOCOL=smtp+starttls` (EU relay; `.com` auth fails).
+Operator test email and forgot-password flow delivered to `bernd.worsch@gmail.com`.
+
 Minimum scope:
 
-- SMTP credentials stored through the approved secret path (`forgejo-secrets.sops.yaml`).
+- SMTP credentials stored through the approved secret path (OpenBao + ESO).
 - Sender address and domain alignment documented.
 - Password reset email works for a controlled non-admin account.
 - Account recovery runbook covers lost password, lost MFA, disabled account,
-  and emergency admin access.
+  and emergency admin access (emergency path: `forgejo admin user change-password`).
 - Mail failure is observable through logs or a health check.
 
 **Done when:** a user can complete password recovery without operator database
@@ -564,8 +569,8 @@ T03 isolated probe: CANCELLED (superseded by T05 + in-production pilots)
 
 **Current focus (2026-07-07):** T08 **done**; T10 tiers 0–2.5 **complete**, tier-3
 `state-hub` cutover **in progress** (phase 5 stabilization). T09 restore drill
-**passed** but scheduled backups + backup target still open. T02/T06 SMTP and
-backup-target decisions remain operator-gated. T11 partial: `state-hub` primary
+**passed** but scheduled backups + backup target still open. T02 backup-target
+and package-scope decisions remain operator-gated. T11 partial: `state-hub` primary
 on railiance01; ~57 State Hub repos still point at Gitea remotes.
 Do not retire coulombcore `state-hub` until phase 5 closeout and operator
 signoff (`CUST-WP-0054-T05`).