Complete scoped Authelia SMTP admission and record rotation consumers

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a10e2d-a5ef-7e92-b03d-b1694e915680

credential-change-requests/CCR-2026-0035-authelia-platform-smtp.yaml

@@ -3,7 +3,7 @@ kind: credential-change-request
 schema_version: 1
 request_type: workload-kv-read
 title: Authelia platform SMTP password projection
-status: approved
+status: active
 created: '2026-10-06'
 updated: '2026-10-06'
 requester:
@@ -56,3 +56,11 @@ invariants:
 - Telemetry role and Secret unchanged
 - No static ESO tokens or credentials in code/logs/chat
 - Owner attended admission required; no live activation from this proposal
+activation:
+  date: '2026-10-06'
+  owner_receipt: docs/evidence/authelia-smtp-admission-2026-10-06.json
+  status: verified
+  kv_version: 2
+  credential_changed: false
+  consumer: sso/authelia-smtp-eso
+  secret_projection_ready: true

docs/evidence/authelia-smtp-admission-2026-10-06.json

@@ -0,0 +1,10 @@
+{
+  "schema": "authelia.smtp-delivery.v1",
+  "status": "verified",
+  "kv_version": 2,
+  "smtp_authenticated": true,
+  "reader_admitted": true,
+  "coding_agent_denied": true,
+  "password_modified": false,
+  "email_sent": false
+}

docs/telemetry-smtp-custody.md

@@ -61,3 +61,22 @@ reader admission and coding-agent deny. Password unmodified. Recorded in
 docs/evidence/telemetry-smtp-custody-2026-09-28.json. Native store and ExternalSecret
 are Ready. Package test Job subsequently used the projected password and IONOS
 accepted the email. Inbox receipt and alert acknowledgment are separate gates.
+
+## Additional admitted consumer — Authelia, 2026-10-06
+
+CCR-2026-0035 / RPF-WP-0052 admitted sso/authelia-smtp-eso to the same existing
+platform mailbox entry; no duplicate KV entry or password rotation. Dedicated
+read-only authelia-smtp-eso policy/role, OpenBao audience/max15m/no default policy;
+SecretStore sso/openbao-authelia-smtp projects only SMTP_PASSWORD into
+sso/authelia-smtp:password. Telemetry's role/Secret remains separate and unchanged.
+Native store/projection and SMTP package readiness verified; actual user inbox
+acceptance is NK-WP-0047-T03 / CSOC-WP-0010-T03.
+
+Future mailbox rotation must preserve the public entry fields and account for
+both admitted consumers. Coordinate provider rotation/overlap with the owner,
+verify both scoped ESO projections refreshed without reading values, then reload
+telemetry's consumer and restart Authelia so its startup password-file read uses
+the new credential. Verify TLS/SMTP readiness for both before retiring a
+predecessor. Never rotate by overwriting only one consumer Secret or by copying
+the telemetry Secret into sso. Native authentication notifications use this
+scoped SMTP lane; email-connect admission is a separate future change.

workplans/RPF-WP-0052-authelia-platform-smtp-admission.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Admit scoped Authelia platform mailbox consumption"
 domain: financials
 repo: railiance-platform
-status: active
+status: finished
 owner: codex
 topic_slug: railiance-platform
 created: "2026-10-06"
@@ -33,7 +33,7 @@ CCR-2026-0035 and scripts/authelia_smtp_delivery.py reuse the tested silent owne
 
 ```task
 id: RPF-WP-0052-T02
-status: wait
+status: done
 priority: high
 state_hub_task_id: "de531f67-3788-53ca-889e-db06deb51205"
 ```
@@ -44,7 +44,7 @@ Founder exact approval and own interactive OpenBao platform-admin login required
 
 ```task
 id: RPF-WP-0052-T03
-status: wait
+status: done
 priority: high
 state_hub_task_id: "60ed616a-0b75-59c2-86cb-e1eae07fb7bb"
 ```
@@ -62,3 +62,17 @@ CCR35 approved; T02 waits attended owner execution, not additional authorization
 Founder asked to run canonical silent helper in own terminal. No verified receipt
 yet. Native sso SA/store/projection exists but controller reports missing role.
 Mailbox credential/telemetry role untouched; package notifier not activated.
+
+## Completion and live handoff
+
+Founder attended login/helper execution verified from fixed private receipt:
+status verified, KVversion2, smtp_authenticated/reader_admitted / coding_agent_denied
+true, password_modified/email_sent false. Native sso store/projection now Ready;
+exact role/consumer binding and agent negative boundary verified by owner helper.
+Authelia validation succeeded and reviewedSMTP rollout is healthy generation 28.
+Mailbox custody task completed; credential/version and telemetry access preserved.
+
+Residual acceptance is already in live NK-WP-0047-T03 and CSOC-WP-0010-T03
+(actual user inbox/recovery/signin). Shared notification sender and inbox/reply
+operations are CSOC-WP-0010-T04/T05/T06. No custody action left untracked.
+Rotation consumers are recorded in docs/telemetry-smtp-custody.md.