From c3800edb6b1786a3c433b8feb836bf7e40040023 Mon Sep 17 00:00:00 2001 From: tegwick Date: Mon, 28 Sep 2026 11:27:00 +0200 Subject: [PATCH] Record native SMTP credential delivery and accepted email proof Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a0e6f1-443f-7783-9920-a16b2ffc467f --- contracts/alert-acknowledgment.json | 8 ++++++-- history/2026-09-28-alert-acknowledgment.md | 10 ++++++++++ workplans/RTEL-WP-0002-signal-contract.md | 7 +++++++ 3 files changed, 23 insertions(+), 2 deletions(-) diff --git a/contracts/alert-acknowledgment.json b/contracts/alert-acknowledgment.json index d2fe194..d7595ad 100644 --- a/contracts/alert-acknowledgment.json +++ b/contracts/alert-acknowledgment.json @@ -37,7 +37,11 @@ "acknowledgment_resolves_alert": false, "acknowledgment_silences_alert": false, "from_address": "platform@coulomb.social", - "from_mailbox_status": "password-added-by-founder-native-verification-pending", + "from_mailbox_status": "smtp-authenticated-and-projected", "smtp_kv_path": "platform/workloads/railiance-telemetry/smtp", - "smtp_password_field": "SMTP_PASSWORD" + "smtp_password_field": "SMTP_PASSWORD", + "smtp_kv_version_verified": 2, + "smtp_test_message_id": "", + "smtp_test_accepted": true, + "recipient_delivery_confirmed": false } diff --git a/history/2026-09-28-alert-acknowledgment.md b/history/2026-09-28-alert-acknowledgment.md index cd6f068..d9bcec1 100644 --- a/history/2026-09-28-alert-acknowledgment.md +++ b/history/2026-09-28-alert-acknowledgment.md @@ -48,3 +48,13 @@ Founder subsequently confirmed the password was added. Scoped SMTP delivery resources installed; attended reader admission/authentication helper prepared and tested (ten custody tests total). Native password/SMTP verification remains pending attended login; this report is not a credential readback claim. + +Attended receipt now verified: KV version 2, IONOS authentication passed, exact +reader admitted, coding-agent deny boundary passed, password unmodified. Native +ClusterSecretStore and ExternalSecret are Ready/SecretSynced. Initial in-cluster +SMTP test failed under existing telemetry egress isolation. Added TCP/587 only +for Alertmanager/test pods to smtp.ionos.de's node-resolved 213.165.67.113/32 and +213.165.67.97/32; dry-run/diff passed. Separate retry Job completed and IONOS +accepted Message-ID . No +Kubernetes Secret values were read. Inbox receipt and audit-backed alert +acknowledgment remain unproved; browser client/PDP/audit admission remains open. diff --git a/workplans/RTEL-WP-0002-signal-contract.md b/workplans/RTEL-WP-0002-signal-contract.md index 950bd8a..a505d9f 100644 --- a/workplans/RTEL-WP-0002-signal-contract.md +++ b/workplans/RTEL-WP-0002-signal-contract.md @@ -143,3 +143,10 @@ OpenBao entry. Exact SMTP ESO ServiceAccount/ClusterSecretStore/ExternalSecret installed after server dry-run/diff; OpenBao reader admission still needs the attended helper. Ten custody tests pass. SMTP authentication is not yet verified and the live alert route remains disabled. No task/workplan added. + +SMTP custody gate now passed: attended verification of KV version 2 and IONOS +authentication; exact reader admitted, ESO Ready, password preserved. Scoped +egress installed after the first transport test exposed namespace isolation. +The corrected native test Job completed and SMTP accepted the test email. +Recipient inbox receipt and actual alert acknowledgment remain distinct pending +evidence, along with browser client/PDP/audit admission and other T04 gates.