railiance-platform/workplans/RPF-WP-0068-email-connect-platform-smtp.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	state_hub_workstream_id
RPF-WP-0068	workplan	Admit the email-connect platform mailbox consumer	financials	railiance-platform	finished	codex	railiance	2026-10-31	2026-10-31	c042789b-4d7f-5c55-8d49-39dd16500f41

Owner custody dependency of CSOC-WP-0015-T02. Existing platform mailbox readers remain telemetry and Authelia. User decision9392ef52 names platform-root with Bernd as the human reply/bounce operator; it does not admit this additional reader. CCR-2026-0056 is proposed. Preserve its approval and binding gates.

T01 — Prepare the fixed reader contract and guarded owner helper

id: RPF-WP-0068-T01
status: done
priority: high
state_hub_task_id: "feb33534-d87b-531d-9e80-e9026d3fbe08"

CCR-2026-0056, exact read-only policy and email_connect_smtp_delivery.py are prepared. Twenty-nine SMTP tests pass, including fifteen new admission tests. The offline proposal binds functional CCR scope, seven source files and the observed OpenBao cluster identity. Execution requires approved CCR, confirmed native service-account claims and exact digest. The silent helper preserves the mailbox and existing consumer metadata, refuses drift and records append-only private checkpoints before admission. No live owner call was executed. Evidence: docs/evidence/email-connect-smtp-admission-preparation-2026-10-31.json.

T02 — Prepare supervised projection and native binding verification

id: RPF-WP-0068-T02
status: done
priority: high
state_hub_task_id: "de0ec1f9-cc11-593f-88c5-5a3972969f01"

Complete the attended foundation/projection controller for the consumer's three server-dry-run-validated resources: dedicated service account, namespace store and password-only projection. Bind current cluster/namespace identities and resource preimages, journal exact progress, and prove the native SA/namespace/ audience claims before owner confirm-binding. Prepare positive workload login, other-consumer/wrong-audience denial, exact capabilities, revocation and Ready readback after admission without printing values or reading Kubernetes Secrets. Use coulomb-social/docs/release/platform-mail-sender-2026-10-31/candidate.json. Do not deploy the application sender here or reuse an existing consumer's grant.

Preparation completed 2026-10-31: email_connect_smtp_foundation.py binds the server-defaulted three-object bundle and pinned primary/namespace/application identities. It performs native TokenReview before canonical binding confirmation, guarded owner admission, positive/negative workload login with token revocation, exclusive projection creation and Ready/ownership checks. PartialObjectMetadata queries avoid Secret values; fresh native query confirms target absent. All41 SMTP tests pass (12 foundation cases). No live creation/admission executed. Native execution results belong to T03/T04, not this preparation completion. Exact packet: docs/email-connect-smtp-foundation-review-2026-10-31.md.

T03 — Obtain exact admission and execute through the attended owner lane

id: RPF-WP-0068-T03
status: done
priority: high
needs_human: false
intervention_note: "Attended Warden execution completed 2026-11-01T22:40:38Z. Reader admitted, SMTP authentication checked, no message sent, sender unchanged."
depends_on:
- RPF-WP-0068-T02
state_hub_task_id: "50df1d39-28be-564d-b93a-678877a03399"

After the complete concrete packet, obtain the exact CCR/platform/consumer review and founder decision. The shared reader is outside automatic single-reader approval. Sync the founder decision through the existing owner workflow; never self-approve the request. The founder then uses the contained OpenBao admin lane and reviewed digest. Success requires the complete private receipt, exact policy/ role, unchanged shared mailbox and other readers, and Warden session revocation. An uncertain attempt requires inspection; never overwrite its journal or blindly rerun. A role metadata receipt alone does not establish actual workload login.

The complete packet is committed and projected to primary/railiance01. This task is flagged for human review in State Hub. No platform-owner review or founder approval has been fabricated. The native Railiance topic is ca369340-a64e-442e- 98f1-a4fa7dc74a38, slug railiance; its initial missing Hub association was repaired and the source slug corrected to that native topic.

T04 — Verify native consumer delivery and return the custody result

id: RPF-WP-0068-T04
status: done
priority: high
state_hub_task_id: "da56d175-3126-5eaa-90c5-dd1e9da050d5"

Verify actual scoped Kubernetes login and the named projection Ready, including effective scope/TTL and negative boundaries. Record non-secret evidence in the CCR, mark the active reader in the mailbox rotation inventory, and hand the verified custody result to CSOC-WP-0015-T02/email-connect. The application sender rollout, selected-message authentication, inbox access, correlated return handling, suppression operator and retention remain those live consumer obligations.

Done 2026-11-01. The final foundation record is foundation_admitted_projection_ready: projection Ready, exact read, native binding and consumer authentication, 15-minute bound, other service account denied, wrong audience denied, and workload token revocation verified. CCR-2026-0056 carries the binding confirmation. The third reader is recorded in docs/telemetry-smtp-custody.md. No message was sent and the sender was not changed. The consumer may now seal its sender proposal.

Completion

Finish only on native admitted reader/projection proof and the explicit consumer return; preserve live consumer work rather than treating custody as mail-flow acceptance. No mailbox rotation, value copying, IMAP grant or arbitrary caller admission is in this workplan.