84e8de2900
source: repo-manager reason: deterministic projection registration Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a06bfe-2a55-7ed3-bacd-879977b099bf
41 lines
1.6 KiB
Markdown
41 lines
1.6 KiB
Markdown
---
|
|
id: HARNESS-WP-ADHOC-2026-09-04
|
|
type: workplan
|
|
title: "Restore Binky mail-scan OpenBao runtime discovery"
|
|
domain: infotech
|
|
repo: rein-aharness
|
|
status: finished
|
|
owner: codex
|
|
topic_slug: activity-core
|
|
created: "2026-09-04"
|
|
updated: "2026-09-04"
|
|
state_hub_workstream_id: "50b8f702-8095-5172-9787-29c49221779c"
|
|
---
|
|
|
|
# Restore Binky mail-scan OpenBao runtime discovery
|
|
|
|
## Repair and verify the claim-loop runtime
|
|
|
|
```task
|
|
id: HARNESS-WP-ADHOC-2026-09-04-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "264b9177-f4b7-5bf7-8118-e2a71af1ddc8"
|
|
```
|
|
|
|
Make the railiance01 claim-loop discover the existing host-installed OpenBao
|
|
client and the already-provisioned Binky mail AppRole directory. Preserve
|
|
explicit environment overrides, install the corrected launcher/unit, and prove
|
|
an AppRole login plus allowlisted IMAP field presence without exposing values.
|
|
|
|
Completed 2026-09-04. The launcher now supplies non-secret defaults for
|
|
`BAO_ADDR`, `VAULT_ADDR`, and `EXECUTOR_APPROLE_DIR`, and ensures
|
|
`~/.local/bin` is present in `PATH`; explicit overrides remain authoritative.
|
|
The corrected wrapper and unit were installed on railiance01 and the claim loop
|
|
restarted cleanly. Its child environment resolves OpenBao v2.5.4 at the
|
|
expected address and the existing mode-0600 AppRole files. A capabilities-safe
|
|
smoke proved `read` on `tenants/data/binky/company-email/imap`, `deny` on the
|
|
sibling Qonto path, and field presence for `IMAP_USERNAME` and `IMAP_PASSWORD`
|
|
without printing either value. Focused launcher and mail-scan tests passed
|
|
5 tests. Pre-change live launcher and unit backups carry suffix
|
|
`.pre-bao-fix-20260904`.
|