Add scoped Mailu SMTP delivery with durable uncertainty

PlasticDigits commented

2026-10-31 03:37:46 +00:00

Owner

Adds a fixed Mailu SMTP transport for issue #3, with required STARTTLS and hostname validation, a dedicated envelope sender, and worker-only scoped credentials. Migration 6 persists the transport and first-attempt timestamp on each outbox row so SMTP crashes/expired leases become visible delivery_uncertain; provider changes cannot replay pinned rows through another transport. All pending/blocked/sending Resend retries expire after 23 hours; never-attempted blocked rows remain eligible for a fresh first send. An explicit default-off worker delivery switch prevents credentials alone activating SMTP. API readiness remains disabled until deployment acceptance.

Includes a bounded enrollment tool that prepares a disabled, non-admin/non-spoofing sender and TEST-NET-restricted mailbox token, storing only the scoped token in exact portal OpenBao custody with CAS=0. Live disabled preparation/readback succeeded, with zero sends. No live portal/env/network changes are included. Gateway and runtime integration remain owned by the deployment thread; independent review is required before enablement.

Validation: locked Cargo check; 2 synthetic SMTP tests covering STARTTLS refusal, wrong hostname, post-DATA disconnect, accepted DATA followed by QUIT4xx, and fixed headers/envelope; worker retry unit test; disposable PostgreSQL17 outbox/lease/aged-provider-switch integration (0.60s, final pin bc40b1b6b8); 2 synthetic enrollment scope/idempotence tests. No real recipients or production messages.

Issue #3 stays open. Remaining acceptance: separately reviewed gateway/runtime egress and observed source IP, scoped sender activation and owned delivery proof, independent portal Telegram bot enrollment capability. Live source e445 and the deployment hostname hook remain unchanged.

Adds a fixed Mailu SMTP transport for issue #3, with required STARTTLS and hostname validation, a dedicated envelope sender, and worker-only scoped credentials. Migration 6 persists the transport and first-attempt timestamp on each outbox row so SMTP crashes/expired leases become visible `delivery_uncertain`; provider changes cannot replay pinned rows through another transport. All pending/blocked/sending Resend retries expire after 23 hours; never-attempted blocked rows remain eligible for a fresh first send. An explicit default-off worker delivery switch prevents credentials alone activating SMTP. API readiness remains disabled until deployment acceptance. Includes a bounded enrollment tool that prepares a disabled, non-admin/non-spoofing sender and TEST-NET-restricted mailbox token, storing only the scoped token in exact portal OpenBao custody with CAS=0. Live disabled preparation/readback succeeded, with zero sends. No live portal/env/network changes are included. Gateway and runtime integration remain owned by the deployment thread; independent review is required before enablement. Validation: locked Cargo check; 2 synthetic SMTP tests covering STARTTLS refusal, wrong hostname, post-DATA disconnect, accepted DATA followed by QUIT4xx, and fixed headers/envelope; worker retry unit test; disposable PostgreSQL17 outbox/lease/aged-provider-switch integration (0.60s, final pin bc40b1b6b8120875221e342eff8418de4b3a541d); 2 synthetic enrollment scope/idempotence tests. No real recipients or production messages. Issue #3 stays open. Remaining acceptance: separately reviewed gateway/runtime egress and observed source IP, scoped sender activation and owned delivery proof, independent portal Telegram bot enrollment capability. Live source e445 and the deployment hostname hook remain unchanged.

PlasticDigits added 1 commit

2026-10-31 03:37:46 +00:00

Add scoped Mailu SMTP transport with durable delivery uncertainty 6fe52e0ba4

PlasticDigits referenced this pull request

2026-10-31 03:38:39 +00:00

Email and Telegram warnings on security timer starts with deduplication and low-noise delivery #3

PlasticDigits referenced this pull request

2026-10-31 03:40:23 +00:00

Rust/PostgreSQL wallet security service: signed identity, delayed assignments and chain reconciliation #1

PlasticDigits referenced this pull request

2026-10-31 03:40:25 +00:00

TypeScript security dashboard: verified wallets, settings, timers and recovery visibility #2