From 2e02e69c34cfcd946c13fabe49768a40ddfa52b4 Mon Sep 17 00:00:00 2001
From: codex <codex@local>
Date: Mon, 28 Sep 2026 11:27:00 +0200
Subject: [PATCH] Record verified SMTP custody and scoped reader admission

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e6f1-443f-7783-9920-a16b2ffc467f
---
 docs/evidence/telemetry-smtp-custody-2026-09-28.json | 10 ++++++++++
 docs/telemetry-smtp-custody.md                       |  8 ++++++++
 2 files changed, 18 insertions(+)
 create mode 100644 docs/evidence/telemetry-smtp-custody-2026-09-28.json

diff --git a/docs/evidence/telemetry-smtp-custody-2026-09-28.json b/docs/evidence/telemetry-smtp-custody-2026-09-28.json
new file mode 100644
index 0000000..b1d0058
--- /dev/null
+++ b/docs/evidence/telemetry-smtp-custody-2026-09-28.json
@@ -0,0 +1,10 @@
+{
+  "schema": "telemetry.smtp-delivery.v1",
+  "status": "verified",
+  "kv_version": 2,
+  "smtp_authenticated": true,
+  "reader_admitted": true,
+  "coding_agent_denied": true,
+  "password_modified": false,
+  "email_sent": false
+}
diff --git a/docs/telemetry-smtp-custody.md b/docs/telemetry-smtp-custody.md
index 90a872e..d037ffb 100644
--- a/docs/telemetry-smtp-custody.md
+++ b/docs/telemetry-smtp-custody.md
@@ -53,3 +53,11 @@ The helper is silent and writes only fixed status fields/KV version in its
 After successful attended completion, check ClusterSecretStore/ExternalSecret
 Ready and record the receipt. Actual scoped Kubernetes auth and ESO delivery
 remain unproved until that reconciliation. The alert route is still disabled.
+
+## Native result — 2026-09-28
+
+Attended receipt verified KV version 2, successful STARTTLS/SMTP authentication,
+reader admission and coding-agent deny. Password unmodified. Recorded in
+docs/evidence/telemetry-smtp-custody-2026-09-28.json. Native store and ExternalSecret
+are Ready. Package test Job subsequently used the projected password and IONOS
+accepted the email. Inbox receipt and alert acknowledgment are separate gates.