Return the admitted email-connect SMTP reader to the consumer.

The attended foundation completed with the projection ready and SMTP
authentication checked. No message was sent and the sender is unchanged.
The third reader is recorded for a future mailbox rotation.

Assistant: grok
Assistant-Session: 01a198fa-fd27-7e41-a0a2-57355c3e4efd

WORK-RECORDS.md

@@ -47,7 +47,7 @@
 | workplan | RPF-WP-0065 | proposed | — | workplans/RPF-WP-0065-netkingdom-role-claim-bindings.md |
 | workplan | RPF-WP-0066 | proposed | — | workplans/RPF-WP-0066-openbao-durable-audit-snapshots-conformance.md |
 | workplan | RPF-WP-0067 | active | — | workplans/RPF-WP-0067-netkingdom-identity-receipt-and-metadata-answers.md |
-| workplan | RPF-WP-0068 | active | — | workplans/RPF-WP-0068-email-connect-platform-smtp.md |
+| workplan | RPF-WP-0068 | finished | — | workplans/RPF-WP-0068-email-connect-platform-smtp.md |
 | workplan | RPF-WP-0069 | active | — | workplans/RPF-WP-0069-bounded-executor-lanes.md |
 | workplan | RPF-WP-0070 | blocked | — | workplans/RPF-WP-0070-mas-evidence-recovery.md |
 | task | RPF-WP-ADHOC-2026-10-10-T01 | done | — | workplans/ADHOC-2026-10-10.md |
@@ -225,8 +225,8 @@
 | task | RPF-WP-0067-T03 | wait | — | workplans/RPF-WP-0067-netkingdom-identity-receipt-and-metadata-answers.md |
 | task | RPF-WP-0068-T01 | done | — | workplans/RPF-WP-0068-email-connect-platform-smtp.md |
 | task | RPF-WP-0068-T02 | done | — | workplans/RPF-WP-0068-email-connect-platform-smtp.md |
-| task | RPF-WP-0068-T03 | wait | — | workplans/RPF-WP-0068-email-connect-platform-smtp.md |
-| task | RPF-WP-0068-T04 | todo | — | workplans/RPF-WP-0068-email-connect-platform-smtp.md |
+| task | RPF-WP-0068-T03 | done | — | workplans/RPF-WP-0068-email-connect-platform-smtp.md |
+| task | RPF-WP-0068-T04 | done | — | workplans/RPF-WP-0068-email-connect-platform-smtp.md |
 | task | RPF-WP-0069-T01 | done | — | workplans/RPF-WP-0069-bounded-executor-lanes.md |
 | task | RPF-WP-0069-T02 | done | — | workplans/RPF-WP-0069-bounded-executor-lanes.md |
 | task | RPF-WP-0069-T03 | wait | — | workplans/RPF-WP-0069-bounded-executor-lanes.md |

docs/telemetry-smtp-custody.md

@@ -73,10 +73,22 @@ Native store/projection and SMTP package readiness verified; actual user inbox
 acceptance is NK-WP-0047-T03 / CSOC-WP-0010-T03.
 
 Future mailbox rotation must preserve the public entry fields and account for
-both admitted consumers. Coordinate provider rotation/overlap with the owner,
-verify both scoped ESO projections refreshed without reading values, then reload
+every admitted consumer. Coordinate provider rotation/overlap with the owner,
+verify each scoped projection refreshed without reading values, then reload
 telemetry's consumer and restart Authelia so its startup password-file read uses
 the new credential. Verify TLS/SMTP readiness for both before retiring a
 predecessor. Never rotate by overwriting only one consumer Secret or by copying
 the telemetry Secret into sso. Native authentication notifications use this
-scoped SMTP lane; email-connect admission is a separate future change.
+scoped SMTP lane.
+
+## Additional admitted consumer — email-connect, 2026-11-01
+
+CCR-2026-0056 / RPF-WP-0068 admitted email-connect/email-connect-platform-smtp-eso
+as a third reader of the same mailbox entry. No duplicate KV entry and no
+password change. The dedicated role reads that record; the projection supplies
+only SMTP_PASSWORD, with a 15-minute token. The private foundation journal
+records projection Ready, exact read, native consumer authentication, sibling
+denial, wrong-audience denial, and workload-token revocation. SMTP
+authentication was checked and no message was sent. The application sender
+remains forgejo@coulomb.social until the consumer's own sender step. A future
+rotation must refresh this projection as well as telemetry and Authelia.

workplans/RPF-WP-0068-email-connect-platform-smtp.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Admit the email-connect platform mailbox consumer"
 domain: financials
 repo: railiance-platform
-status: active
+status: finished
 owner: codex
 topic_slug: railiance
 created: "2026-10-31"
@@ -68,10 +68,10 @@ Exact packet: docs/email-connect-smtp-foundation-review-2026-10-31.md.
 
 ```task
 id: RPF-WP-0068-T03
-status: wait
+status: done
 priority: high
-needs_human: true
-intervention_note: "Review CCR-2026-0056 and docs/email-connect-smtp-foundation-review-2026-10-31.md as platform owner/founder; owner decision sync and attended Warden execution remain required. No live reader admitted."
+needs_human: false
+intervention_note: "Attended Warden execution completed 2026-11-01T22:40:38Z. Reader admitted, SMTP authentication checked, no message sent, sender unchanged."
 depends_on:
 - RPF-WP-0068-T02
 state_hub_task_id: "50df1d39-28be-564d-b93a-678877a03399"
@@ -96,7 +96,7 @@ and the source slug corrected to that native topic.
 
 ```task
 id: RPF-WP-0068-T04
-status: todo
+status: done
 priority: high
 state_hub_task_id: "da56d175-3126-5eaa-90c5-dd1e9da050d5"
 ```
@@ -108,6 +108,14 @@ verified custody result to CSOC-WP-0015-T02/email-connect. The application sende
 rollout, selected-message authentication, inbox access, correlated return handling,
 suppression operator and retention remain those live consumer obligations.
 
+Done 2026-11-01. The final foundation record is
+`foundation_admitted_projection_ready`: projection Ready, exact read, native
+binding and consumer authentication, 15-minute bound, other service account
+denied, wrong audience denied, and workload token revocation verified. CCR-2026-0056
+carries the binding confirmation. The third reader is recorded in
+`docs/telemetry-smtp-custody.md`. No message was sent and the sender was not
+changed. The consumer may now seal its sender proposal.
+
 ## Completion
 
 Finish only on native admitted reader/projection proof and the explicit consumer