From 30e8b5f32150784b52e215c3944ceaf339519646 Mon Sep 17 00:00:00 2001 From: codex Date: Mon, 2 Nov 2026 00:38:46 +0100 Subject: [PATCH] Record bounded selected inbox check purpose approval Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a198ed-70cc-7362-a569-d5dbef39b86a --- docs/telemetry-smtp-custody.md | 25 +++++++++++++++++++++++-- 1 file changed, 23 insertions(+), 2 deletions(-) diff --git a/docs/telemetry-smtp-custody.md b/docs/telemetry-smtp-custody.md index e9f1236..e7aa330 100644 --- a/docs/telemetry-smtp-custody.md +++ b/docs/telemetry-smtp-custody.md @@ -89,6 +89,27 @@ password change. The dedicated role reads that record; the projection supplies only SMTP_PASSWORD, with a 15-minute token. The private foundation journal records projection Ready, exact read, native consumer authentication, sibling denial, wrong-audience denial, and workload-token revocation. SMTP -authentication was checked and no message was sent. The application sender -remains forgejo@coulomb.social until the consumer's own sender step. A future +authentication was checked and no message was sent by admission. The separately +approved EMAIL-WP-0010 sender transition subsequently completed at generation79 +with platform@coulomb.social active and all six ledger tables preserved. A future rotation must refresh this projection as well as telemetry and Authelia. + +## Bounded selected inbox check — 2026-11-02 + +Founder approval in decision4fe1be4e-e8f7-452b-be94-987186df5850 explicitly extends +the existing email-connect credential's purpose for one operator-invoked T02 +read-only selected test-return check at imap.ionos.de:993. This is additional to +CCR-2026-0056's original SMTP-only scope; that original approval is not rewritten. +The credential stays inside the admitted receiver. No new OpenBao reader, role, +password copy, standing scanner, HTTP caller or provider deletion is admitted. +Only the two approved normal public registration test requests are submitted: +Bernd Gmail and a reserved .invalid recipient. No verification is consumed. +Selected retrieval requires an authoritative accepted test Message-ID/binding, +INBOX read-only, BODY.PEEK, at most five matches/2MiB each, and exact-provider-IP +temporary egress with owned-policy cleanup even on failure. Raw evidence remains +private; no bearer handles or message bodies enter public receipts. The fixed +review and explicit approval receipt are in coulomb-social/docs/release/ +platform-mail-controlled-check-2026-11-02.md and +platform-mail-controlled-check-approval-2026-11-02.json. No blanket inbox read is +authorized. Builder custody/30-day copied-raw retention continues under resolved +decision112e14bb-4b5d-46d7-b365-84628f72f115.