code/cl8y-wallet-security
Watch
4
0
Fork
You've already forked cl8y-wallet-security
 0
Code Issues 6 Pull requests 1 Projects Releases Packages 3 Wiki Activity

Enable isolated Mailu email delivery with owned acceptance and recovery evidence #16

Merged
PlasticDigits merged 34 commits from bb/portal-mail-gateway-thr_ywz2dcyd3p into main 2026-11-01 03:12:11 +00:00
Conversation 1 Commits 34 Files changed 44 +2944 -35
PlasticDigits commented 2026-10-31 05:42:08 +00:00
Owner

Delivers scoped production email notifications through the isolated Mailu gateway and adds reviewed custody, acceptance and receiver-retirement tooling. The fixed retained source44 gateway passed identity/resource/network/egress guards and current Mailu receiver source-IP proof. Only the dedicated sender credential is available to the private worker; API/PostgreSQL stay off the notification network and API has no SMTP secret.

Production email now runs on coordinator-released source 4fbe039, migration6. Reviewed hook 5c6e750 removed the owned-recipient allowlist only after actual owned delivery and fresh schema6 off-host recovery passed. Matching API/worker health reports readiness with pending0/failed0. Exactly one owned API/IMAP trial verified double opt-in, code replay denial, an assignment warning with its exact deadline and the old verified channel's removal warning: three distinct owned messages, no real-recipient operator test, direct SQL/outbox synthesis, chain transaction or raw payload/credential output.

The fresh off-host restore preserved all three actual SMTP sent/first-attempt rows plus full timer/outbox/contact metadata; the owned profile existed with zero active source sessions before scratch authentication invalidation. Post-acceptance cleanup disabled only the smoke receiver and revoked its exact token/current custody credential. The normal sender remains enabled with its verified gateway /32; all portal/outbox/profile/checkpoint/mailbox evidence was preserved. Independent source/runtime/delivery/recovery/cleanup reviews passed, with focused scope, lifecycle, CAS/compensation, parser and private recovery checks.

Final receipt: scoped email production acceptance, with immutable links to actual delivery and schema6 recovery evidence. Runtime app source stays distinct from this operator/source increment; no extra provider trial accompanied production activation.

Telegram remains unavailable without a dedicated portal credential or authorized creation identity; unrelated bots were untouched. Issue #3 remains open for Telegram and does not inherit full-portal/chain acceptance from email success.

Delivers scoped production email notifications through the isolated Mailu gateway and adds reviewed custody, acceptance and receiver-retirement tooling. The fixed retained source44 gateway passed identity/resource/network/egress guards and current Mailu receiver source-IP proof. Only the dedicated sender credential is available to the private worker; API/PostgreSQL stay off the notification network and API has no SMTP secret. Production email now runs on coordinator-released source `4fbe039`, migration6. Reviewed hook `5c6e750` removed the owned-recipient allowlist only after actual owned delivery and fresh schema6 off-host recovery passed. Matching API/worker health reports readiness with pending0/failed0. Exactly one owned API/IMAP trial verified double opt-in, code replay denial, an assignment warning with its exact deadline and the old verified channel's removal warning: three distinct owned messages, no real-recipient operator test, direct SQL/outbox synthesis, chain transaction or raw payload/credential output. The fresh off-host restore preserved all three actual SMTP sent/first-attempt rows plus full timer/outbox/contact metadata; the owned profile existed with zero active source sessions before scratch authentication invalidation. Post-acceptance cleanup disabled only the smoke receiver and revoked its exact token/current custody credential. The normal sender remains enabled with its verified gateway `/32`; all portal/outbox/profile/checkpoint/mailbox evidence was preserved. Independent source/runtime/delivery/recovery/cleanup reviews passed, with focused scope, lifecycle, CAS/compensation, parser and private recovery checks. Final receipt: [scoped email production acceptance](https://git.cl8y.com/code/cl8y-wallet-security/src/commit/dc4897b0b77724b0d9670050122ebc8fdd755924/deploy/receipts/2026-11-01-email-production-final.json), with immutable links to actual delivery and schema6 recovery evidence. Runtime app source stays distinct from this operator/source increment; no extra provider trial accompanied production activation. Telegram remains unavailable without a dedicated portal credential or authorized creation identity; unrelated bots were untouched. Issue #3 remains open for Telegram and does not inherit full-portal/chain acceptance from email success.
PlasticDigits changed title from Add a fixed read-only gateway and sealer metadata observer to Add scoped gateway metadata and bounded topology diagnostics 2026-10-31 06:20:36 +00:00
PlasticDigits changed title from Add scoped gateway metadata and bounded topology diagnostics to Activate isolated Mailu gateway and prepare owned notification acceptance 2026-11-01 01:44:26 +00:00
PlasticDigits changed title from Activate isolated Mailu gateway and prepare owned notification acceptance to Enable isolated Mailu email delivery with owned acceptance and recovery evidence 2026-11-01 02:43:24 +00:00
PlasticDigits commented 2026-11-01 03:12:09 +00:00
Author
Owner

Parent integration verified exact reviewed head dc4897b0b77724b0d9670050122ebc8fdd755924 and independently accepted scoped actual evidence. No additional tests or sends were run for integration; full acceptance remains separately tracked for Telegram, chain activation and operator reboot availability. Source merge preserves the pinned live application image4fbe039.

Parent integration verified exact reviewed head `dc4897b0b77724b0d9670050122ebc8fdd755924` and independently accepted scoped actual evidence. No additional tests or sends were run for integration; full acceptance remains separately tracked for Telegram, chain activation and operator reboot availability. Source merge preserves the pinned live application image4fbe039.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
code/cl8y-wallet-security!16
No description provided.