railiance-platform/docs/telemetry-smtp-custody.md

Telemetry SMTP entry

Existing RTEL-WP-0002-T04; no new task/workplan. Founder requested entry creation on 2026-09-28 after creating platform@coulomb.social, and will add the password.

KV v2 mount: platform. Entry: workloads/railiance-telemetry/smtp. Full CLI path: platform/workloads/railiance-telemetry/smtp. Initial fields: SMTP_HOST=smtp.ionos.de, SMTP_PORT=587, SMTP_USERNAME=platform@coulomb.social, SMTP_FROM=platform@coulomb.social, SMTP_STARTTLS=true. SMTP_PASSWORD is deliberately absent until founder update. Preserve the existing fields when saving that new version.

Attended founder command (requires existing local OpenBao forwarding):

BAO_ADDR=http://127.0.0.1:18200 VAULT_ADDR=http://127.0.0.1:18200 warden access openbao-platform-admin-login --exec -- python3 /home/worsch/railiance-platform/scripts/telemetry_smtp_entry.py

The helper is silent. CAS=0 never overwrites any existing path/version. Existing version returns without reading values or writing. Four tests cover first creation, existing version preservation, permission errors and CAS conflict. Exit 20 invalid metadata; 21 metadata access failure; 22 creation failure; 23 unexpected write version; 24 verification failure; 25 contained failure. A successful rerun on an existing path only proves presence, not its contents.

Read Warden's printed completion line: login-failed means no child ran; completed-but-revocation-unconfirmed means creation ran but session revocation requires attention. Native creation is pending until that attended result. This helper does not grant ESO access, copy another mailbox's credential, or activate SMTP. Scoped workload delivery remains the existing telemetry task.

Password supplied; scoped delivery admission

The founder reports SMTP_PASSWORD added. This is not yet native verification. The dedicated telemetry-smtp-eso ServiceAccount and package-owned acknowledgment/smtp-custody.yaml are installed after dry-run and diff. They project only SMTP_PASSWORD to telemetry/telemetry-alert-smtp:password.

The next attended command validates the exact public settings and password, performs certificate-verified IONOS STARTTLS authentication without sending mail, and admits the exact read-only policy and Kubernetes role (telemetry namespace, telemetry-smtp-eso ServiceAccount, openbao audience, maximum 15 minutes). Existing different policy/role values fail closed. Mailbox versions are untouched. Coding-agent deny boundary is extended for data and metadata and tested.

BAO_ADDR=http://127.0.0.1:18200 VAULT_ADDR=http://127.0.0.1:18200 warden access openbao-platform-admin-login --exec -- python3 /home/worsch/railiance-platform/scripts/telemetry_smtp_delivery.py --receipt /tmp/telemetry-smtp-delivery.json

Use a new receipt filename on retry; existing evidence is never overwritten. The helper is silent and writes only fixed status fields/KV version in its 0600 receipt. It never reads Kubernetes Secret values. Ten custody tests pass. After successful attended completion, check ClusterSecretStore/ExternalSecret Ready and record the receipt. Actual scoped Kubernetes auth and ESO delivery remain unproved until that reconciliation. The alert route is still disabled.

Native result — 2026-09-28

Attended receipt verified KV version 2, successful STARTTLS/SMTP authentication, reader admission and coding-agent deny. Password unmodified. Recorded in docs/evidence/telemetry-smtp-custody-2026-09-28.json. Native store and ExternalSecret are Ready. Package test Job subsequently used the projected password and IONOS accepted the email. Inbox receipt and alert acknowledgment are separate gates.

Additional admitted consumer — Authelia, 2026-10-06

CCR-2026-0035 / RPF-WP-0052 admitted sso/authelia-smtp-eso to the same existing platform mailbox entry; no duplicate KV entry or password rotation. Dedicated read-only authelia-smtp-eso policy/role, OpenBao audience/max15m/no default policy; SecretStore sso/openbao-authelia-smtp projects only SMTP_PASSWORD into sso/authelia-smtp:password. Telemetry's role/Secret remains separate and unchanged. Native store/projection and SMTP package readiness verified; actual user inbox acceptance is NK-WP-0047-T03 / CSOC-WP-0010-T03.

Future mailbox rotation must preserve the public entry fields and account for both admitted consumers. Coordinate provider rotation/overlap with the owner, verify both scoped ESO projections refreshed without reading values, then reload telemetry's consumer and restart Authelia so its startup password-file read uses the new credential. Verify TLS/SMTP readiness for both before retiring a predecessor. Never rotate by overwriting only one consumer Secret or by copying the telemetry Secret into sso. Native authentication notifications use this scoped SMTP lane; email-connect admission is a separate future change.