30e8b5f321
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a198ed-70cc-7362-a569-d5dbef39b86a
115 lines
6.8 KiB
Markdown
115 lines
6.8 KiB
Markdown
# Telemetry SMTP entry
|
|
|
|
Existing RTEL-WP-0002-T04; no new task/workplan. Founder requested entry creation
|
|
on 2026-09-28 after creating platform@coulomb.social, and will add the password.
|
|
|
|
KV v2 mount: platform. Entry: workloads/railiance-telemetry/smtp.
|
|
Full CLI path: platform/workloads/railiance-telemetry/smtp.
|
|
Initial fields: SMTP_HOST=smtp.ionos.de, SMTP_PORT=587,
|
|
SMTP_USERNAME=platform@coulomb.social, SMTP_FROM=platform@coulomb.social,
|
|
SMTP_STARTTLS=true. SMTP_PASSWORD is deliberately absent until founder update.
|
|
Preserve the existing fields when saving that new version.
|
|
|
|
Attended founder command (requires existing local OpenBao forwarding):
|
|
|
|
```sh
|
|
BAO_ADDR=http://127.0.0.1:18200 VAULT_ADDR=http://127.0.0.1:18200 warden access openbao-platform-admin-login --exec -- python3 /home/worsch/railiance-platform/scripts/telemetry_smtp_entry.py
|
|
```
|
|
|
|
The helper is silent. CAS=0 never overwrites any existing path/version. Existing
|
|
version returns without reading values or writing. Four tests cover first
|
|
creation, existing version preservation, permission errors and CAS conflict.
|
|
Exit 20 invalid metadata; 21 metadata access failure; 22 creation failure;
|
|
23 unexpected write version; 24 verification failure; 25 contained failure.
|
|
A successful rerun on an existing path only proves presence, not its contents.
|
|
|
|
Read Warden's printed completion line: login-failed means no child ran;
|
|
completed-but-revocation-unconfirmed means creation ran but session revocation
|
|
requires attention. Native creation is pending until that attended result.
|
|
This helper does not grant ESO access, copy another mailbox's credential, or
|
|
activate SMTP. Scoped workload delivery remains the existing telemetry task.
|
|
|
|
## Password supplied; scoped delivery admission
|
|
|
|
The founder reports SMTP_PASSWORD added. This is not yet native verification.
|
|
The dedicated telemetry-smtp-eso ServiceAccount and package-owned
|
|
acknowledgment/smtp-custody.yaml are installed after dry-run and diff.
|
|
They project only SMTP_PASSWORD to telemetry/telemetry-alert-smtp:password.
|
|
|
|
The next attended command validates the exact public settings and password,
|
|
performs certificate-verified IONOS STARTTLS authentication without sending mail,
|
|
and admits the exact read-only policy and Kubernetes role (telemetry namespace,
|
|
telemetry-smtp-eso ServiceAccount, openbao audience, maximum 15 minutes).
|
|
Existing different policy/role values fail closed. Mailbox versions are untouched.
|
|
Coding-agent deny boundary is extended for data and metadata and tested.
|
|
|
|
```sh
|
|
BAO_ADDR=http://127.0.0.1:18200 VAULT_ADDR=http://127.0.0.1:18200 warden access openbao-platform-admin-login --exec -- python3 /home/worsch/railiance-platform/scripts/telemetry_smtp_delivery.py --receipt /tmp/telemetry-smtp-delivery.json
|
|
```
|
|
|
|
Use a new receipt filename on retry; existing evidence is never overwritten.
|
|
The helper is silent and writes only fixed status fields/KV version in its
|
|
0600 receipt. It never reads Kubernetes Secret values. Ten custody tests pass.
|
|
After successful attended completion, check ClusterSecretStore/ExternalSecret
|
|
Ready and record the receipt. Actual scoped Kubernetes auth and ESO delivery
|
|
remain unproved until that reconciliation. The alert route is still disabled.
|
|
|
|
## Native result — 2026-09-28
|
|
|
|
Attended receipt verified KV version 2, successful STARTTLS/SMTP authentication,
|
|
reader admission and coding-agent deny. Password unmodified. Recorded in
|
|
docs/evidence/telemetry-smtp-custody-2026-09-28.json. Native store and ExternalSecret
|
|
are Ready. Package test Job subsequently used the projected password and IONOS
|
|
accepted the email. Inbox receipt and alert acknowledgment are separate gates.
|
|
|
|
## Additional admitted consumer — Authelia, 2026-10-06
|
|
|
|
CCR-2026-0035 / RPF-WP-0052 admitted sso/authelia-smtp-eso to the same existing
|
|
platform mailbox entry; no duplicate KV entry or password rotation. Dedicated
|
|
read-only authelia-smtp-eso policy/role, OpenBao audience/max15m/no default policy;
|
|
SecretStore sso/openbao-authelia-smtp projects only SMTP_PASSWORD into
|
|
sso/authelia-smtp:password. Telemetry's role/Secret remains separate and unchanged.
|
|
Native store/projection and SMTP package readiness verified; actual user inbox
|
|
acceptance is NK-WP-0047-T03 / CSOC-WP-0010-T03.
|
|
|
|
Future mailbox rotation must preserve the public entry fields and account for
|
|
every admitted consumer. Coordinate provider rotation/overlap with the owner,
|
|
verify each scoped projection refreshed without reading values, then reload
|
|
telemetry's consumer and restart Authelia so its startup password-file read uses
|
|
the new credential. Verify TLS/SMTP readiness for both before retiring a
|
|
predecessor. Never rotate by overwriting only one consumer Secret or by copying
|
|
the telemetry Secret into sso. Native authentication notifications use this
|
|
scoped SMTP lane.
|
|
|
|
## Additional admitted consumer — email-connect, 2026-11-01
|
|
|
|
CCR-2026-0056 / RPF-WP-0068 admitted email-connect/email-connect-platform-smtp-eso
|
|
as a third reader of the same mailbox entry. No duplicate KV entry and no
|
|
password change. The dedicated role reads that record; the projection supplies
|
|
only SMTP_PASSWORD, with a 15-minute token. The private foundation journal
|
|
records projection Ready, exact read, native consumer authentication, sibling
|
|
denial, wrong-audience denial, and workload-token revocation. SMTP
|
|
authentication was checked and no message was sent by admission. The separately
|
|
approved EMAIL-WP-0010 sender transition subsequently completed at generation79
|
|
with platform@coulomb.social active and all six ledger tables preserved. A future
|
|
rotation must refresh this projection as well as telemetry and Authelia.
|
|
|
|
## Bounded selected inbox check — 2026-11-02
|
|
|
|
Founder approval in decision4fe1be4e-e8f7-452b-be94-987186df5850 explicitly extends
|
|
the existing email-connect credential's purpose for one operator-invoked T02
|
|
read-only selected test-return check at imap.ionos.de:993. This is additional to
|
|
CCR-2026-0056's original SMTP-only scope; that original approval is not rewritten.
|
|
The credential stays inside the admitted receiver. No new OpenBao reader, role,
|
|
password copy, standing scanner, HTTP caller or provider deletion is admitted.
|
|
Only the two approved normal public registration test requests are submitted:
|
|
Bernd Gmail and a reserved .invalid recipient. No verification is consumed.
|
|
Selected retrieval requires an authoritative accepted test Message-ID/binding,
|
|
INBOX read-only, BODY.PEEK, at most five matches/2MiB each, and exact-provider-IP
|
|
temporary egress with owned-policy cleanup even on failure. Raw evidence remains
|
|
private; no bearer handles or message bodies enter public receipts. The fixed
|
|
review and explicit approval receipt are in coulomb-social/docs/release/
|
|
platform-mail-controlled-check-2026-11-02.md and
|
|
platform-mail-controlled-check-approval-2026-11-02.json. No blanket inbox read is
|
|
authorized. Builder custody/30-day copied-raw retention continues under resolved
|
|
decision112e14bb-4b5d-46d7-b365-84628f72f115.
|