File CCR-2026-0051 MAS TEM relay lane; propose RPF-WP-0061 self-service CCR intake

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 306568@bnt-lap001
Assistant-Session: 8bdf8150-ea56-41e7-9132-13f04f6b0b91

credential-change-requests/CCR-2026-0051-mas-tem-relay-smtp.yaml

@@ -0,0 +1,95 @@
+id: CCR-2026-0051
+kind: credential-change-request
+schema_version: 1
+request_type: workload-kv-read
+title: Temporary MAS Scaleway TEM relay SMTP ESO read lane
+status: proposed
+created: '2026-10-18'
+updated: '2026-10-18'
+requester:
+  agent: ops-mason
+  reason: ops-mason plans/mas-tem-relay-smtp.md (MASON-WP-0014, reviewed 2026-10-18T10:13:55Z)
+    for consumer mail-address-semantics MAS-WP-0003. Hub messages daa119e6, a77e5879
+    (kv_path correction) and 049afa1f. No approval is implied by this filing.
+review:
+  required: true
+  required_approvers:
+  - founder
+  - railiance-platform-owner
+  - mail-address-semantics-owner
+  comments: []
+target:
+  domain: infotech
+  tenant: platform
+  workload: mas-tem-relay
+  environment: production
+  purpose: Deliver Scaleway TEM SMTP relay username/password to namespace mas only.
+    Temporary lane; torn down with namespace mas.
+openbao:
+  mount: platform
+  kv_path: platform/suppliers/scaleway/mas-tem-relay
+  fields:
+  - username
+  - password
+  metadata_read: false
+  token_self_lifecycle: true
+  policy_name: workload-kv-read-mas-tem-relay
+  policy_file: openbao/policies/workload-kv-read-mas-tem-relay.hcl
+  auth:
+    method: kubernetes
+    mount: kubernetes
+    role: external-secrets-mas-tem-relay
+    bound_claims:
+      service_account_names:
+      - mas-tem-relay-eso
+      service_account_namespaces:
+      - mas
+    bound_claims_confirmed: false
+    policies:
+    - workload-kv-read-mas-tem-relay
+    ttl: 15m
+    audience: openbao
+    token_max_ttl: 15m
+    token_explicit_max_ttl: 15m
+    token_no_default_policy: true
+access_frontdoor:
+  type: external-secrets
+  catalog_id: mas-tem-relay-smtp
+  selector: Namespace mas, SA mas-tem-relay-eso only
+  readiness: pending-review
+  resolvable: false
+delivery:
+  surface: external-secrets
+  target: Namespace mas; dedicated SA mas-tem-relay-eso; ExternalSecret projecting
+    username and password only.
+  bootstrap_command: Not applicable. KV value already written by the founder (v2);
+    this CCR creates no value and authorizes no value read.
+risk:
+  classification: medium
+  notes:
+  - Supplier SMTP credential can send mail as the TEM sending domain; exposure is
+    limited to namespace mas.
+  - New read scope on a supplier path; founder approval required. No other lane reads
+    this path (ops-mason live survey 2026-10-18T10:13:55Z).
+  - Apply may be run by ops-mason under ops-mason-construct (MASON-IN-0005) once
+    installed (MASON-WP-0015-T02) and this CCR is approved; that grant covers
+    workload-kv-read-* policies and external-secrets-* roles only.
+verification:
+  positive:
+  - Exact SA/namespace/audience login succeeds; ESO Ready/SecretSynced; metadata
+    version matches admitted KV version 2 without printing values.
+  negative:
+  - Wrong SA, namespace or audience login refused; sibling paths under platform/suppliers/scaleway,
+    list, metadata, write and delete denied.
+  activation_conditions:
+  - Founder, platform owner and consumer owner approve the exact CCR.
+  - Native bound claims confirmed (confirm-binding) and native policy/role readback
+    matches source.
+  evidence: []
+lifecycle:
+  deactivate: Delete ExternalSecret and role external-secrets-mas-tem-relay, then
+    policy workload-kv-read-mas-tem-relay, when namespace mas is torn down.
+  rotate: Founder writes a new KV version via UI; ESO refresh picks it up; verify
+    metadata version only.
+  compromised: Revoke the SMTP credential at Scaleway, disable the role, rotate the
+    KV value, then re-enable after review.