From 0fada49c38b10c4266263e6a51a7b775f9dbed8b Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 6 Oct 2026 20:38:28 +0200 Subject: [PATCH] Complete scoped Authelia SMTP admission and record rotation consumers Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a10e2d-a5ef-7e92-b03d-b1694e915680 --- .../CCR-2026-0035-authelia-platform-smtp.yaml | 10 +++++++++- .../authelia-smtp-admission-2026-10-06.json | 10 ++++++++++ docs/telemetry-smtp-custody.md | 19 ++++++++++++++++++ ...P-0052-authelia-platform-smtp-admission.md | 20 ++++++++++++++++--- 4 files changed, 55 insertions(+), 4 deletions(-) create mode 100644 docs/evidence/authelia-smtp-admission-2026-10-06.json diff --git a/credential-change-requests/CCR-2026-0035-authelia-platform-smtp.yaml b/credential-change-requests/CCR-2026-0035-authelia-platform-smtp.yaml index 9843954..8947867 100644 --- a/credential-change-requests/CCR-2026-0035-authelia-platform-smtp.yaml +++ b/credential-change-requests/CCR-2026-0035-authelia-platform-smtp.yaml @@ -3,7 +3,7 @@ kind: credential-change-request schema_version: 1 request_type: workload-kv-read title: Authelia platform SMTP password projection -status: approved +status: active created: '2026-10-06' updated: '2026-10-06' requester: @@ -56,3 +56,11 @@ invariants: - Telemetry role and Secret unchanged - No static ESO tokens or credentials in code/logs/chat - Owner attended admission required; no live activation from this proposal +activation: + date: '2026-10-06' + owner_receipt: docs/evidence/authelia-smtp-admission-2026-10-06.json + status: verified + kv_version: 2 + credential_changed: false + consumer: sso/authelia-smtp-eso + secret_projection_ready: true diff --git a/docs/evidence/authelia-smtp-admission-2026-10-06.json b/docs/evidence/authelia-smtp-admission-2026-10-06.json new file mode 100644 index 0000000..71e1004 --- /dev/null +++ b/docs/evidence/authelia-smtp-admission-2026-10-06.json @@ -0,0 +1,10 @@ +{ + "schema": "authelia.smtp-delivery.v1", + "status": "verified", + "kv_version": 2, + "smtp_authenticated": true, + "reader_admitted": true, + "coding_agent_denied": true, + "password_modified": false, + "email_sent": false +} diff --git a/docs/telemetry-smtp-custody.md b/docs/telemetry-smtp-custody.md index d037ffb..e71162e 100644 --- a/docs/telemetry-smtp-custody.md +++ b/docs/telemetry-smtp-custody.md @@ -61,3 +61,22 @@ reader admission and coding-agent deny. Password unmodified. Recorded in docs/evidence/telemetry-smtp-custody-2026-09-28.json. Native store and ExternalSecret are Ready. Package test Job subsequently used the projected password and IONOS accepted the email. Inbox receipt and alert acknowledgment are separate gates. + +## Additional admitted consumer — Authelia, 2026-10-06 + +CCR-2026-0035 / RPF-WP-0052 admitted sso/authelia-smtp-eso to the same existing +platform mailbox entry; no duplicate KV entry or password rotation. Dedicated +read-only authelia-smtp-eso policy/role, OpenBao audience/max15m/no default policy; +SecretStore sso/openbao-authelia-smtp projects only SMTP_PASSWORD into +sso/authelia-smtp:password. Telemetry's role/Secret remains separate and unchanged. +Native store/projection and SMTP package readiness verified; actual user inbox +acceptance is NK-WP-0047-T03 / CSOC-WP-0010-T03. + +Future mailbox rotation must preserve the public entry fields and account for +both admitted consumers. Coordinate provider rotation/overlap with the owner, +verify both scoped ESO projections refreshed without reading values, then reload +telemetry's consumer and restart Authelia so its startup password-file read uses +the new credential. Verify TLS/SMTP readiness for both before retiring a +predecessor. Never rotate by overwriting only one consumer Secret or by copying +the telemetry Secret into sso. Native authentication notifications use this +scoped SMTP lane; email-connect admission is a separate future change. diff --git a/workplans/RPF-WP-0052-authelia-platform-smtp-admission.md b/workplans/RPF-WP-0052-authelia-platform-smtp-admission.md index ab0f8fe..96ac6b7 100644 --- a/workplans/RPF-WP-0052-authelia-platform-smtp-admission.md +++ b/workplans/RPF-WP-0052-authelia-platform-smtp-admission.md @@ -4,7 +4,7 @@ type: workplan title: "Admit scoped Authelia platform mailbox consumption" domain: financials repo: railiance-platform -status: active +status: finished owner: codex topic_slug: railiance-platform created: "2026-10-06" @@ -33,7 +33,7 @@ CCR-2026-0035 and scripts/authelia_smtp_delivery.py reuse the tested silent owne ```task id: RPF-WP-0052-T02 -status: wait +status: done priority: high state_hub_task_id: "de531f67-3788-53ca-889e-db06deb51205" ``` @@ -44,7 +44,7 @@ Founder exact approval and own interactive OpenBao platform-admin login required ```task id: RPF-WP-0052-T03 -status: wait +status: done priority: high state_hub_task_id: "60ed616a-0b75-59c2-86cb-e1eae07fb7bb" ``` @@ -62,3 +62,17 @@ CCR35 approved; T02 waits attended owner execution, not additional authorization Founder asked to run canonical silent helper in own terminal. No verified receipt yet. Native sso SA/store/projection exists but controller reports missing role. Mailbox credential/telemetry role untouched; package notifier not activated. + +## Completion and live handoff + +Founder attended login/helper execution verified from fixed private receipt: +status verified, KVversion2, smtp_authenticated/reader_admitted / coding_agent_denied +true, password_modified/email_sent false. Native sso store/projection now Ready; +exact role/consumer binding and agent negative boundary verified by owner helper. +Authelia validation succeeded and reviewedSMTP rollout is healthy generation 28. +Mailbox custody task completed; credential/version and telemetry access preserved. + +Residual acceptance is already in live NK-WP-0047-T03 and CSOC-WP-0010-T03 +(actual user inbox/recovery/signin). Shared notification sender and inbox/reply +operations are CSOC-WP-0010-T04/T05/T06. No custody action left untracked. +Rotation consumers are recorded in docs/telemetry-smtp-custody.md.