From 4023e6c3bda5eb60e97bc9d5979584805a4b4722 Mon Sep 17 00:00:00 2001 From: codex Date: Mon, 2 Nov 2026 00:28:46 +0100 Subject: [PATCH] Record verified SMTP activation and isolate approval lifecycle fixture Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a198ed-70cc-7362-a569-d5dbef39b86a --- ...2026-0056-email-connect-platform-smtp.yaml | 25 ++++++++-- ...connect-smtp-native-return-2026-11-01.json | 47 +++++++++++++++++++ tests/test_email_connect_smtp_delivery.py | 15 ++++-- 3 files changed, 80 insertions(+), 7 deletions(-) create mode 100644 docs/evidence/email-connect-smtp-native-return-2026-11-01.json diff --git a/credential-change-requests/CCR-2026-0056-email-connect-platform-smtp.yaml b/credential-change-requests/CCR-2026-0056-email-connect-platform-smtp.yaml index 76fafb6..ed9b7fc 100644 --- a/credential-change-requests/CCR-2026-0056-email-connect-platform-smtp.yaml +++ b/credential-change-requests/CCR-2026-0056-email-connect-platform-smtp.yaml @@ -3,7 +3,7 @@ kind: credential-change-request schema_version: 1 request_type: workload-kv-read title: Email-connect platform SMTP password projection -status: approved +status: active created: '2026-10-31' updated: '2026-11-01' requester: @@ -83,8 +83,8 @@ access_frontdoor: catalog_id: email-connect-platform-smtp selector: Namespace email-connect and ServiceAccount email-connect-platform-smtp-eso only - readiness: pending-review - resolvable: false + readiness: ready + resolvable: true delivery: surface: external-secrets namespace: email-connect @@ -125,7 +125,24 @@ verification: consumers; Warden session revocation confirmed. - Native workload positive and negative login, scoped projection Ready and separate supervised application sender rollout accepted. - evidence: [] + evidence: + - at: '2026-11-01T23:03:43+00:00' + actor: codex + kind: positive_verification + result: passed + details: + - Independent private receipt and Warden exit zero verified; exact native SA binding, + scoped workload login, projection Ready and SMTP AUTH without sending. See docs/evidence/email-connect-smtp-native-return-2026-11-01.json. + - at: '2026-11-01T23:06:17+00:00' + actor: codex + kind: negative_verification + result: passed + details: + - 'Native sibling, metadata and mutation access denied; other-service-account + and wrong-audience login denied; workload token revocation and contained Warden + exit zero verified. Separate supervised sender transition completed at generation + 79 with all six ledger tables preserved. Independent receipt: docs/evidence/email-connect-smtp-native-return-2026-11-01.json; + consumer return: coulomb-social/docs/release/platform-sender-independent-return-2026-11-01.json.' lifecycle: deactivate: Stop the admitted consumer and reconcile pending sends, revoke only this dedicated reader role/policy, and remove only its projection after owner diff --git a/docs/evidence/email-connect-smtp-native-return-2026-11-01.json b/docs/evidence/email-connect-smtp-native-return-2026-11-01.json new file mode 100644 index 0000000..35ce817 --- /dev/null +++ b/docs/evidence/email-connect-smtp-native-return-2026-11-01.json @@ -0,0 +1,47 @@ +{ + "schema": "coulomb.platform-smtp-independent-return.v1", + "verified_at": "2026-11-01T22:54:57.446428+00:00", + "proposal_digest": "sha256:d9f8785060db902f969e5d8d0917494858b2114e8f93ae812dda3a059c090844", + "receipt_sha256": "ceea9b6f944a2fc4cc9073a55f62fe610146884187a2e45d0f0c219788903ac5", + "receipt_records": 10, + "receipt_status": "foundation_admitted_projection_ready", + "warden_exit_code": 0, + "warden_contained_revocation_and_cleanup_confirmed": true, + "native_proofs": { + "native_binding_verified": true, + "native_consumer_auth_verified": true, + "exact_read_verified": true, + "mutation_sibling_metadata_denied": true, + "bounded_ttl": true, + "other_service_account_denied": true, + "wrong_audience_denied": true, + "workload_token_revocation_verified": true, + "projection_ready": true + }, + "application_unchanged_at_foundation_return": true, + "current_application_matches_reviewed_sender_transition": true, + "mailbox_unchanged": true, + "other_consumers_preserved": true, + "smtp_auth_without_send_verified": true, + "foundation_action_sent_mail": false, + "credential_values_printed": false, + "foundation_action_changed_sender": false, + "resource_identities": [ + { + "kind": "ServiceAccount", + "resource_uid": "a6bacc02-5bce-4faa-8a20-2f7db8e8a978" + }, + { + "kind": "SecretStore", + "resource_uid": "f543bafb-ce19-4dc5-8ca5-90bef776bf4f" + }, + { + "kind": "ExternalSecret", + "resource_uid": "b899c1a7-110b-4757-95a6-7056205e035b" + }, + { + "kind": "Secret", + "resource_uid": "40af4db3-ae53-44aa-85ed-a62ab80e797b" + } + ] +} diff --git a/tests/test_email_connect_smtp_delivery.py b/tests/test_email_connect_smtp_delivery.py index b427816..9012994 100644 --- a/tests/test_email_connect_smtp_delivery.py +++ b/tests/test_email_connect_smtp_delivery.py @@ -118,12 +118,21 @@ class AdmissionTests(unittest.TestCase): self.assertTrue(digest.startswith('sha256:')) def test_approval_and_native_binding_do_not_change_reviewed_scope_digest(self): - ccr, _, initial = delivery.prepare() - ccr['status'] = 'approved'; ccr['openbao']['auth']['bound_claims_confirmed'] = True - ccr['review']['comments'] = [{'reviewer': 'fixture', 'decision': 'approved'}] + ccr, _, _ = delivery.prepare() + # Model the review lifecycle independently of the live CCR's activation. + ccr['status'] = 'proposed' + ccr['openbao']['auth']['bound_claims_confirmed'] = False + ccr['review']['comments'] = [] + ccr['verification']['evidence'] = [] + ccr['access_frontdoor'].update(readiness='pending-review', resolvable=False) with tempfile.TemporaryDirectory() as tmp: path = Path(tmp) / 'ccr.yaml'; path.write_text(yaml.safe_dump(ccr)) with patch.object(delivery, 'CCR', path): + initial = delivery.prepare()[2] + ccr['status'] = 'approved' + ccr['openbao']['auth']['bound_claims_confirmed'] = True + ccr['review']['comments'] = [{'reviewer': 'fixture', 'decision': 'approved'}] + path.write_text(yaml.safe_dump(ccr)) self.assertEqual(delivery.prepare()[2], initial) ccr['openbao']['auth']['bound_claims']['service_account_namespaces'] = ['other'] path.write_text(yaml.safe_dump(ccr))