pdurlej/platform

Fork 0

docs(mail): record Gmail Radar runtime state #738

Closed

codex wants to merge 1 commit from codex/gmail-radar-runtime-docs into main

codex commented

2026-06-07 16:06:07 +02:00

Collaborator

Summary

Passes Gmail OAuth env placeholders through to gmail-triage-mcp.
Records that Gmail Radar is live for p_durlej_me in metadata/header-only mode.
Updates the mail loop runbook maintenance checklist with the current OAuth env mapping.

Safety

No secret values are added.
No mailbox bodies, snippets, attachments, auth headers, or tokens are included.
Gmail Radar remains documented as metadata/header-only.
Label/archive/write behavior remains explicitly unproven and out of scope.

Validation

PYTHONPATH=control-plane uv run --project control-plane python -m platformctl.cli validate all --json passed.

Spec sources read

compose/apps/compose.yaml — scoped runtime env wiring for gmail-triage-mcp.
runbooks/mail-loops.md — operator-facing Gmail/Missive/Fastmail runtime map.

Non-goals

No runtime deploy or service restart.
No Gmail scope expansion.
No secret rotation or migration.
No mailbox content access.

## Summary - Passes Gmail OAuth env placeholders through to `gmail-triage-mcp`. - Records that Gmail Radar is live for `p_durlej_me` in metadata/header-only mode. - Updates the mail loop runbook maintenance checklist with the current OAuth env mapping. ## Safety - No secret values are added. - No mailbox bodies, snippets, attachments, auth headers, or tokens are included. - Gmail Radar remains documented as metadata/header-only. - Label/archive/write behavior remains explicitly unproven and out of scope. ## Validation - `PYTHONPATH=control-plane uv run --project control-plane python -m platformctl.cli validate all --json` passed. ## Spec sources read - `compose/apps/compose.yaml` — scoped runtime env wiring for `gmail-triage-mcp`. - `runbooks/mail-loops.md` — operator-facing Gmail/Missive/Fastmail runtime map. ## Non-goals - No runtime deploy or service restart. - No Gmail scope expansion. - No secret rotation or migration. - No mailbox content access.

codex added 1 commit

2026-06-07 16:06:07 +02:00

docs(mail): record Gmail Radar runtime state

canary-required / collect-diff (pull_request) Successful in 5s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 22s

Details

canary-required / canary (pull_request) Has been skipped

Details

base-is-main / guard (pull_request) Successful in 1s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 4s

Details

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 4s

Details

patchwarden-client-dry-run / dry-run (pull_request) Successful in 19s

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 1m42s

Details

a56742c51e

patchwarden commented

2026-06-07 16:08:37 +02:00

First-time contributor

Patchwarden PR sanity

Status: eligible_sanity_clean
PR: 738
Commit: a56742c51ea2caabf004bc4d6f2723f9c0dd5500
Security-sensitive label: present
Authority: advisory model review plus deterministic blockers only
3+3 canary: still alive; this does not replace it

Deterministic findings

No deterministic findings.

Model reviewers

`global-glm` / `glm-5.1:cloud`

Status: ok
Verdict: OK
medium OAuth client secret passed to container runtime
- Evidence: compose/apps/compose.yaml line +1329 adds GMAIL_GOOGLE_OAUTH_CLIENT_SECRET: ${GMAIL_GOOGLE_OAUTH_CLIENT_SECRET:-} alongside CLIENT_ID and REFRESH_TOKEN
- Next: Confirm that Infisical or equivalent vault injects this at runtime and that the container image does not log env vars on startup. The pattern is consistent with existing ACCESS_TOKEN vars, but client_secret is a higher-sensitivity credential than access tokens.

`global-deepseek` / `deepseek-v4-pro:cloud`

Status: ok
Verdict: OK
Findings: none

`redteam` / `kimi-k2.6:cloud`

Status: ok
Verdict: OK
Findings: none

Policy notes

GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot.
Optional red-team model is enabled only when PLATFORMCTL_PR_SANITY_REDTEAM_MODEL is configured.
Auto-merge is not enabled here.

# Patchwarden PR sanity - Status: `eligible_sanity_clean` - PR: `738` - Commit: `a56742c51ea2caabf004bc4d6f2723f9c0dd5500` - Security-sensitive label: `present` - Authority: advisory model review plus deterministic blockers only - 3+3 canary: still alive; this does not replace it ## Deterministic findings No deterministic findings. ## Model reviewers ### `global-glm` / `glm-5.1:cloud` - Status: `ok` - Verdict: `OK` - **`medium`** OAuth client secret passed to container runtime - Evidence: `compose/apps/compose.yaml line +1329 adds `GMAIL_GOOGLE_OAUTH_CLIENT_SECRET: ${GMAIL_GOOGLE_OAUTH_CLIENT_SECRET:-}` alongside CLIENT_ID and REFRESH_TOKEN` - Next: Confirm that Infisical or equivalent vault injects this at runtime and that the container image does not log env vars on startup. The pattern is consistent with existing ACCESS_TOKEN vars, but client_secret is a higher-sensitivity credential than access tokens. ### `global-deepseek` / `deepseek-v4-pro:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ### `redteam` / `kimi-k2.6:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ## Policy notes - GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot. - Optional red-team model is enabled only when `PLATFORMCTL_PR_SANITY_REDTEAM_MODEL` is configured. - Auto-merge is not enabled here.

codex added the

class/security-sensitive

domain:docs

domain:runtime

merge/manual-security-sensitive

labels

2026-06-11 08:15:07 +02:00

~~patchwarden referenced this pull request 2026-06-11 11:41:06 +02:00~~

docs(status): refresh platform situation #791

pdurlej commented

2026-06-17 23:17:20 +02:00

Owner

PR-zero queue collapse: closing this parked security-sensitive Gmail Radar/runtime-state PR without merge. It is secret-adjacent and stale relative to the current queue; if still needed, reopen as a fresh, narrow security-sensitive PR with current runtime evidence and explicit non-secret scope. No runtime, OAuth, mailbox, or secret mutation was performed.

pdurlej closed this pull request

2026-06-17 23:17:20 +02:00