Record verified SMTP activation and isolate approval lifecycle fixture

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a198ed-70cc-7362-a569-d5dbef39b86a

credential-change-requests/CCR-2026-0056-email-connect-platform-smtp.yaml

@@ -3,7 +3,7 @@ kind: credential-change-request
 schema_version: 1
 request_type: workload-kv-read
 title: Email-connect platform SMTP password projection
-status: approved
+status: active
 created: '2026-10-31'
 updated: '2026-11-01'
 requester:
@@ -83,8 +83,8 @@ access_frontdoor:
   catalog_id: email-connect-platform-smtp
   selector: Namespace email-connect and ServiceAccount email-connect-platform-smtp-eso
     only
-  readiness: pending-review
-  resolvable: false
+  readiness: ready
+  resolvable: true
 delivery:
   surface: external-secrets
   namespace: email-connect
@@ -125,7 +125,24 @@ verification:
     consumers; Warden session revocation confirmed.
   - Native workload positive and negative login, scoped projection Ready and separate
     supervised application sender rollout accepted.
-  evidence: []
+  evidence:
+  - at: '2026-11-01T23:03:43+00:00'
+    actor: codex
+    kind: positive_verification
+    result: passed
+    details:
+    - Independent private receipt and Warden exit zero verified; exact native SA binding,
+      scoped workload login, projection Ready and SMTP AUTH without sending. See docs/evidence/email-connect-smtp-native-return-2026-11-01.json.
+  - at: '2026-11-01T23:06:17+00:00'
+    actor: codex
+    kind: negative_verification
+    result: passed
+    details:
+    - 'Native sibling, metadata and mutation access denied; other-service-account
+      and wrong-audience login denied; workload token revocation and contained Warden
+      exit zero verified. Separate supervised sender transition completed at generation
+      79 with all six ledger tables preserved. Independent receipt: docs/evidence/email-connect-smtp-native-return-2026-11-01.json;
+      consumer return: coulomb-social/docs/release/platform-sender-independent-return-2026-11-01.json.'
 lifecycle:
   deactivate: Stop the admitted consumer and reconcile pending sends, revoke only
     this dedicated reader role/policy, and remove only its projection after owner

docs/evidence/email-connect-smtp-native-return-2026-11-01.json

@@ -0,0 +1,47 @@
+{
+  "schema": "coulomb.platform-smtp-independent-return.v1",
+  "verified_at": "2026-11-01T22:54:57.446428+00:00",
+  "proposal_digest": "sha256:d9f8785060db902f969e5d8d0917494858b2114e8f93ae812dda3a059c090844",
+  "receipt_sha256": "ceea9b6f944a2fc4cc9073a55f62fe610146884187a2e45d0f0c219788903ac5",
+  "receipt_records": 10,
+  "receipt_status": "foundation_admitted_projection_ready",
+  "warden_exit_code": 0,
+  "warden_contained_revocation_and_cleanup_confirmed": true,
+  "native_proofs": {
+    "native_binding_verified": true,
+    "native_consumer_auth_verified": true,
+    "exact_read_verified": true,
+    "mutation_sibling_metadata_denied": true,
+    "bounded_ttl": true,
+    "other_service_account_denied": true,
+    "wrong_audience_denied": true,
+    "workload_token_revocation_verified": true,
+    "projection_ready": true
+  },
+  "application_unchanged_at_foundation_return": true,
+  "current_application_matches_reviewed_sender_transition": true,
+  "mailbox_unchanged": true,
+  "other_consumers_preserved": true,
+  "smtp_auth_without_send_verified": true,
+  "foundation_action_sent_mail": false,
+  "credential_values_printed": false,
+  "foundation_action_changed_sender": false,
+  "resource_identities": [
+    {
+      "kind": "ServiceAccount",
+      "resource_uid": "a6bacc02-5bce-4faa-8a20-2f7db8e8a978"
+    },
+    {
+      "kind": "SecretStore",
+      "resource_uid": "f543bafb-ce19-4dc5-8ca5-90bef776bf4f"
+    },
+    {
+      "kind": "ExternalSecret",
+      "resource_uid": "b899c1a7-110b-4757-95a6-7056205e035b"
+    },
+    {
+      "kind": "Secret",
+      "resource_uid": "40af4db3-ae53-44aa-85ed-a62ab80e797b"
+    }
+  ]
+}

tests/test_email_connect_smtp_delivery.py

@@ -118,12 +118,21 @@ class AdmissionTests(unittest.TestCase):
         self.assertTrue(digest.startswith('sha256:'))
 
     def test_approval_and_native_binding_do_not_change_reviewed_scope_digest(self):
-        ccr, _, initial = delivery.prepare()
-        ccr['status'] = 'approved'; ccr['openbao']['auth']['bound_claims_confirmed'] = True
-        ccr['review']['comments'] = [{'reviewer': 'fixture', 'decision': 'approved'}]
+        ccr, _, _ = delivery.prepare()
+        # Model the review lifecycle independently of the live CCR's activation.
+        ccr['status'] = 'proposed'
+        ccr['openbao']['auth']['bound_claims_confirmed'] = False
+        ccr['review']['comments'] = []
+        ccr['verification']['evidence'] = []
+        ccr['access_frontdoor'].update(readiness='pending-review', resolvable=False)
         with tempfile.TemporaryDirectory() as tmp:
             path = Path(tmp) / 'ccr.yaml'; path.write_text(yaml.safe_dump(ccr))
             with patch.object(delivery, 'CCR', path):
+                initial = delivery.prepare()[2]
+                ccr['status'] = 'approved'
+                ccr['openbao']['auth']['bound_claims_confirmed'] = True
+                ccr['review']['comments'] = [{'reviewer': 'fixture', 'decision': 'approved'}]
+                path.write_text(yaml.safe_dump(ccr))
                 self.assertEqual(delivery.prepare()[2], initial)
                 ccr['openbao']['auth']['bound_claims']['service_account_namespaces'] = ['other']
                 path.write_text(yaml.safe_dump(ccr))