antispam: rspamd strips a sender's own verdict for every client

rspamd 3.11.1's milter_headers skips its verdict routines - removes none
of the sender's X-Spamd-Result / X-Rspamd-Action, adds none - for a client
it counts as local (loopback, a unix socket, local_addrs: the private
ranges) or one that authenticated (skip_local, skip_authenticated, both on
by default; milter_headers.lua skip_wanted(), lua_ip.c lua_ip_is_local()).
The custom routine that signs X-SelfPost-Filter is never put through
skip_wanted(), so it signed the sender's own verdict, and Inbound > Log
showed it as rspamd's. Every sender is private when Docker's proxy relays
port 25 from the bridge gateway. Both options set to false.

Tried 2026-10-14 in a throwaway rspamd/rspamd:3.11.1-3 on the test server
(rspamc --ucl, a message carrying its own verdict headers): old config,
from 10.0.0.5 and as an authenticated user, the milter reply removed and
added neither and added the signature; new config, both removed and
rspamd's own added, as from 203.0.113.9.

Also: the sender rules take the envelope only (extract_from = "smtp"; by
default a bounce's From: header is used - tried: a bounce whose From:
domain is denied was refused before, is not now; a denied sender is
refused either way); the image pinned to 3.11.1-3, the build read (3.11 and
3.11.1 move with each rebuild); the prefilter lines no longer read go.
architecture.md and security.md say so. Assumptions C-R7, B-R1, C-R4,
C-R12, C-R5.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -5,6 +5,33 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
 
 ## [Unreleased]
 
+### Security
+
+- **A sender on a private address could have his own spam verdict signed.**
+  rspamd's header module by default leaves a message's verdict headers
+  alone - removes none, adds none - when the client counts as local (a
+  private range, which every client has when Docker's proxy relays port 25)
+  or authenticated, while the routine that signs a verdict for SelfPost runs
+  for every message. Such a sender's `X-Spamd-Result` and `X-Rspamd-Action`
+  then reached Inbound > Log as rspamd's. `milter_headers.conf` now turns
+  both exceptions off; tried against rspamd 3.11.1 before and after
+  (audit 2026-10-12, stage 2c; assumptions C-R7). Copy the new
+  `antispam/rspamd/` files next to your compose fragment.
+
+### Fixed
+
+- **A bounce is judged by the filter lists as the panel counts it.**
+  rspamd's sender rules took a bounce's `From:` header when the envelope
+  sender was empty, so a bounce could be refused or allowed by an entry the
+  Filter lists page never showed as used. They now look at the envelope
+  sender only (assumptions C-R4).
+
+### Changed
+
+- **The rspamd image is pinned to one build**, `rspamd/rspamd:3.11.1-3`:
+  `3.11` and `3.11.1` move with every rebuild (assumptions C-R12). The rules
+  lose their `prefilter = true` lines, which rspamd 3.11.1 does not read.
+
 ## [2.5.1] - 2026-10-14
 
 Stage 2b of the 2026-10-12 audit: the log tailer and what the panel shows of