railiance-platform/credential-change-requests/CCR-2026-0051-mas-tem-relay-smtp.yaml

id: CCR-2026-0051
kind: credential-change-request
schema_version: 1
request_type: workload-kv-read
title: Temporary MAS Scaleway TEM relay SMTP ESO read lane
status: applied
created: '2026-10-18'
updated: '2026-10-18'
requester:
  agent: ops-mason
  reason: ops-mason plans/mas-tem-relay-smtp.md (MASON-WP-0014, reviewed 2026-10-18T10:13:55Z)
    for consumer mail-address-semantics MAS-WP-0003. Hub messages daa119e6, a77e5879
    (kv_path correction) and 049afa1f. No approval is implied by this filing.
review:
  required: true
  required_approvers:
  - founder
  - railiance-platform-owner
  - mail-address-semantics-owner
  comments:
  - at: '2026-10-18T10:36:53+00:00'
    reviewer: railiance-platform-owner (policy-as-code ccr-standard-lane v1)
    decision: approved
    comment: 'Standard lane: passes ccr-standard-lane v1 sha256:5481be201456739b9e01b14b0b11211923d7d838a2e71e2e417af038a05aec95.
      Platform-owner source review only; founder approval and confirm-binding still
      required.'
  - at: '2026-10-18T10:42:00+00:00'
    reviewer: founder (Bernd Worsch)
    decision: approved
    comment: 'Approved 2026-10-18 for ops-mason plans/mas-tem-relay-smtp.md (MASON-WP-0014):
      build policy workload-kv-read-mas-tem-relay and kubernetes role external-secrets-mas-tem-relay
      under ops-mason-construct. Temporary; teardown with namespace mas.'
  - at: '2026-10-18T10:46:25+00:00'
    reviewer: founder
    decision: approved
    comment: 'State Hub decision e633607e-ff3e-46ec-bb6f-143e8b44f1af: APPROVE: CCR-2026-0051
      path=platform/suppliers/scaleway/mas-tem-relay policy=workload-kv-read-mas-tem-relay
      auth_role=auth/kubernetes/role/external-secrets-mas-tem-relay; rationale=temporary
      MAS TEM relay lane, read-only, namespace mas, torn down with mas'
  - at: '2026-10-18T10:58:26+00:00'
    reviewer: railiance-platform-owner (claude, native evidence)
    decision: binding_confirmed
    comment: 'Native 2026-10-18: SA mas-tem-relay-eso exists in ns mas (consumer mail-address-semantics
      deploy/railiance/manifests.yaml 2e9a074, automount false). SecretStore mas/openbao-mas-tem-relay
      references mount kubernetes, role external-secrets-mas-tem-relay, SA mas-tem-relay-eso,
      audience openbao, and validated Ready at 10:49:56Z, i.e. a successful login
      with exactly the CCR bound claims. ESO reads the path; the 10:56:56Z failure
      is consumer-side admission, not auth.'
target:
  domain: infotech
  tenant: platform
  workload: mas-tem-relay
  environment: production
  purpose: Deliver Scaleway TEM SMTP relay username/password to namespace mas only.
    Temporary lane; torn down with namespace mas.
openbao:
  mount: platform
  kv_path: platform/suppliers/scaleway/mas-tem-relay
  fields:
  - username
  - password
  metadata_read: false
  token_self_lifecycle: true
  policy_name: workload-kv-read-mas-tem-relay
  policy_file: openbao/policies/workload-kv-read-mas-tem-relay.hcl
  auth:
    method: kubernetes
    mount: kubernetes
    role: external-secrets-mas-tem-relay
    bound_claims:
      service_account_names:
      - mas-tem-relay-eso
      service_account_namespaces:
      - mas
    bound_claims_confirmed: true
    policies:
    - workload-kv-read-mas-tem-relay
    ttl: 15m
    audience: openbao
    token_max_ttl: 15m
    token_explicit_max_ttl: 15m
    token_no_default_policy: true
access_frontdoor:
  type: external-secrets
  catalog_id: mas-tem-relay-smtp
  selector: Namespace mas, SA mas-tem-relay-eso only
  readiness: pending-review
  resolvable: false
delivery:
  surface: external-secrets
  target: Namespace mas; dedicated SA mas-tem-relay-eso; ExternalSecret projecting
    username and password only.
  bootstrap_command: Not applicable. KV value already written by the founder (v2);
    this CCR creates no value and authorizes no value read.
risk:
  classification: medium
  notes:
  - Supplier SMTP credential can send mail as the TEM sending domain; exposure is
    limited to namespace mas.
  - New read scope on a supplier path; founder approval required. No other lane reads
    this path (ops-mason live survey 2026-10-18T10:13:55Z).
  - Apply may be run by ops-mason under ops-mason-construct (MASON-IN-0005) once installed
    (MASON-WP-0015-T02) and this CCR is approved; that grant covers workload-kv-read-*
    policies and external-secrets-* roles only.
verification:
  positive:
  - Exact SA/namespace/audience login succeeds; ESO Ready/SecretSynced; metadata version
    matches admitted KV version 2 without printing values.
  negative:
  - Wrong SA, namespace or audience login refused; sibling paths under platform/suppliers/scaleway,
    list, metadata, write and delete denied.
  activation_conditions:
  - Founder, platform owner and consumer owner approve the exact CCR.
  - Native bound claims confirmed (confirm-binding) and native policy/role readback
    matches source.
  evidence:
  - at: '2026-10-18T10:44:23+00:00'
    actor: ops-mason (claude-MASON-WP-0014-T03, ops-mason-construct)
    kind: apply
    result: success
    details:
    - '2026-10-18: policy workload-kv-read-mas-tem-relay written from openbao/policies/workload-kv-read-mas-tem-relay.hcl;
      read back byte-equal'
    - 'kubernetes role external-secrets-mas-tem-relay written: SA mas-tem-relay-eso,
      ns mas, audience openbao, token_policies [workload-kv-read-mas-tem-relay], ttl/max/explicit_max
      15m, token_no_default_policy true; read back matches CCR'
    - KV platform/suppliers/scaleway/mas-tem-relay present (v2, founder-written);
      no value read
    - 'pending: SA mas-tem-relay-eso not yet applied (bound_claims_confirmed false);
      confirm-binding and ESO sync next'
  - at: '2026-10-18T10:58:27+00:00'
    actor: railiance-platform (claude)
    kind: native-binding
    result: success
    details:
    - SecretStoreValid 2026-10-18T10:49:56Z with the exact CCR SA/namespace/audience/role;
      ESO provider read succeeded; ops-mason apply readback 102668f.
    - 'Open: ExternalSecret mas/mas-relay refused by admission policy reject-secret-last-applied
      (client-side apply annotation copied to target); fix sent to mail-address-semantics
      1a76a832. Negative checks (wrong SA/namespace/audience, sibling, list, metadata,
      write) not yet run.'
lifecycle:
  deactivate: Delete ExternalSecret and role external-secrets-mas-tem-relay, then
    policy workload-kv-read-mas-tem-relay, when namespace mas is torn down.
  rotate: Founder writes a new KV version via UI; ESO refresh picks it up; verify
    metadata version only.
  compromised: Revoke the SMTP credential at Scaleway, disable the role, rotate the
    KV value, then re-enable after review.
state_hub:
  decision_id: e633607e-ff3e-46ec-bb6f-143e8b44f1af
  decision_api_url: http://127.0.0.1:8000/decisions/e633607e-ff3e-46ec-bb6f-143e8b44f1af
  decision_resolved_at: '2026-10-18T10:46:17.864665Z'