railiance-platform/workplans/RPF-WP-0052-authelia-platform-smtp-admission.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	state_hub_workstream_id
RPF-WP-0052	workplan	Admit scoped Authelia platform mailbox consumption	financials	railiance-platform	finished	codex	railiance-platform	2026-10-06	2026-10-06	4ad59669-1e78-59eb-a94a-0599958bfafc

Purpose and change boundary

Approve a new consumer of the existing platform@coulomb.social SMTP mailbox, not a new mailbox, password rotation, shared namespace role or telemetry change. Related: CSOC-WP-0010, NK-WP-0047, CCR-2026-0035. Prepared review branch only.

Prepare fixed attended mailbox-consumer admission

id: RPF-WP-0052-T01
status: done
priority: high
state_hub_task_id: "54e60123-afba-548e-94f1-b620e3ed0b6c"

CCR-2026-0035 and scripts/authelia_smtp_delivery.py reuse the tested silent owner lane; exact sso/authelia-smtp-eso ServiceAccount, OpenBao audience, max15m token/no default policy. Preserve SMTP credential/version and telemetry consumer. Verify password/settings privately and SMTP AUTH without mail send; deny coding-agent direct data/metadata access; refuse different existing policy/role.

Execute attended owner admission

id: RPF-WP-0052-T02
status: done
priority: high
state_hub_task_id: "de531f67-3788-53ca-889e-db06deb51205"

Founder exact approval and own interactive OpenBao platform-admin login required. Execute helper from approved owner checkout with a new mode0600 receipt. Success requires verified receipt and Warden actual child-completion outcome, not exit code alone. Never print mailbox fields/password or reuse static ESO token helpers.

Verify scoped delivery and owner handoff

id: RPF-WP-0052-T03
status: done
priority: high
state_hub_task_id: "60ed616a-0b75-59c2-86cb-e1eae07fb7bb"

NetKingdom applies dedicated service account/store/projection and checks Ready. Demonstrate correct consumer positive/other-consumer negative boundary, read-only path, credential untouched, actual package SMTP readiness. Record retained role/policy IDs and handoff to NK-WP-0047; do not claim inbox receipt from AUTH alone.

Prepared evidence: ten SMTP admission tests passed; notifier/password-mount and password-only ESO projection parsed; server dry-run accepted package resources. Dedicated SMTP egress is required and drafted. Native runtime credential validation, admitted consumer and inbox receipt remain pending. No live activation or mail sent.

Founder exact go recorded2026-10-06: decision d95b4c9f-30a3-4ed6-b18f-d1b9fa20d84e. CCR35 approved; T02 waits attended owner execution, not additional authorization. Founder asked to run canonical silent helper in own terminal. No verified receipt yet. Native sso SA/store/projection exists but controller reports missing role. Mailbox credential/telemetry role untouched; package notifier not activated.

Completion and live handoff

Founder attended login/helper execution verified from fixed private receipt: status verified, KVversion2, smtp_authenticated/reader_admitted / coding_agent_denied true, password_modified/email_sent false. Native sso store/projection now Ready; exact role/consumer binding and agent negative boundary verified by owner helper. Authelia validation succeeded and reviewedSMTP rollout is healthy generation 28. Mailbox custody task completed; credential/version and telemetry access preserved.

Residual acceptance is already in live NK-WP-0047-T03 and CSOC-WP-0010-T03 (actual user inbox/recovery/signin). Shared notification sender and inbox/reply operations are CSOC-WP-0010-T04/T05/T06. No custody action left untracked. Rotation consumers are recorded in docs/telemetry-smtp-custody.md.