audit 5: findings of the two reviews

- The e2e's numeric-settings test ran a container that passed every gate
  and never ended: the good values are checked beside a bad one after
  them; each run is named, bounded to a minute and removed.
- The gates refuse a value under the parameter's minimum (a zero window
  kills anvil, a zero milter timeout smtpd) and one past an int, in
  seconds for a time value (src/global/conv_time.c, src/anvil/anvil.c).
- OpenDKIM waits, five seconds at most, for the relay's socket.
- The relay marks its lines `syslog: `, writes control characters out,
  reads into a queue at once and drops past 200 lines a second, saying
  how many (security F1, F2; a stuck relay would hold OpenDKIM in
  syslog(3)).
- smtp_tls_mandatory_protocols >=TLSv1.2 too.
- extract-cert.sh keeps the old files' group and sets its trap before
  mktemp.
- crashexit spares cert-reload; architecture.md "four times running" and
  what else exits the container; security.md the restart after five panel
  exits and the /dev/log socket.
- Measured against the technical review: smtpd has the selfpost group
  (Groups 104 998), so it did reach the supervisor socket before this
  stage.
Accepted, reasons in the plan: the logrotate state file in the postfix
user's directory, envdoc_test's reading of `${VAR:-}` only, crashexit's
window pruning untested.

Tested on the test server: go vet + go test of 27 packages, make e2e (all
pass, 592 s) on this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/audit-2026-10-12.md

@@ -1418,31 +1418,99 @@ documented in security.md.
 
 ### Stage 5 — image and Postfix hardening (M17–M19, M21, L30–L32) → `2.6.0`
 
-- [ ] **Supervisor socket**: a group of its own (`supervisor`), panel only;
+- [x] **Supervisor socket**: a group of its own (`supervisor`), panel only;
    `postfix`/`opendkim` keep `selfpost` for the file paths. — **Opus**
-- [ ] **OpenDKIM**: `Syslog yes` (supervisord captures it) or `Logfile`;
+   *Done 2026-10-15:* `groupadd --system supervisor`, the panel its one
+   member; `[unix_http_server] chown=root:supervisor`. e2e: every program
+   RUNNING, the panel still reloads OpenDKIM and Postfix through it.
+- [x] **OpenDKIM**: `Syslog yes` (supervisord captures it) or `Logfile`;
    `Canonicalization relaxed/simple`; `OversignHeaders From`. e2e: DKIM still
    verifies; a message with two `From:` is refused before signing anyway.
    — **Opus**
-- [ ] **Postfix**: `smtpd_tls_protocols = >=TLSv1.2`, `smtpd_tls_mandatory_protocols`
+   *Done 2026-10-15,* read in OpenDKIM 2.11.0~beta2's source first: neither
+   way worked - syslog(3) writes to `/dev/log`, which nobody served in the
+   container, and there is no `Logfile` option. `internal/syslogrelay`
+   (`panel -syslog-relay=/run/syslog/log`, program `syslog-relay` before
+   OpenDKIM, `/dev/log` a link to it from the entrypoint) passes the lines
+   to stdout, severity error and worse marked. `Syslog yes`,
+   `Canonicalization relaxed/simple`, `OversignHeaders From` (RFC 6376
+   § 3.4, § 8.15). e2e: OpenDKIM's start line in the container log; the
+   DKIM-verify steps pass. The two-`From:` refusal is the sender check's
+   (2.4.0, 2.5.2), unchanged.
+- [x] **Postfix**: `smtpd_tls_protocols = >=TLSv1.2`, `smtpd_tls_mandatory_protocols`
    likewise, `disable_vrfy_command = yes`, `smtpd_banner = $myhostname ESMTP`;
    integer validation of `RATE_LIMIT_*`, `*_SIZE_LIMIT`, `MILTER_*_TIMEOUT` at
    the top of `postfix-config.sh` with a clear exit. — **Opus**
-- [ ] **logrotate state under `/data/log/.logrotate.status`** (`-s`), group-
+   *Done 2026-10-15:* the four settings (proto/postconf.proto: `>=version`
+   since 3.6); `need_number` / `need_time` (a whole number, a time value
+   with s m h d w) for the six counts and sizes and the three milter
+   timeouts. e2e: `postconf -h` reads them back; `TestNumericSettingsGate`
+   starts the image with three bad values and one good set.
+- [x] **logrotate state under `/data/log/.logrotate.status`** (`-s`), group-
    readable as the directory is. — **Opus**
-- [ ] **entrypoint**: normalise the three DMARC maps with the other five;
+   *Done 2026-10-15:* `logrotate -s /data/log/.logrotate.status`
+   (logrotate.8.in: "-s, --state statefile"); the entrypoint's
+   `find /data/log -type f -exec chmod 0640` covers it. e2e: the file is
+   there after the start.
+- [x] **entrypoint**: normalise the three DMARC maps with the other five;
    remove the dead `set-permissions` branch. — **Opus**
-- [ ] **`extract-cert.sh`**: `set -o pipefail` under `bash`, check both outputs
+   *Done before this stage:* the maps since the review of stage 3 (every
+   file beside `queue/` in `/data/postfix`, H1 there), the branch since
+   stage 2c (assumptions C-P34).
+- [x] **`extract-cert.sh`**: `set -o pipefail` under `bash`, check both outputs
    are non-empty PEM before moving them into place, create `0600` first.
    — **Opus**
-- [ ] **`crashexit`**: subscribe to `PROCESS_STATE_EXITED` with a restart-count
+   *Done 2026-10-15:* bash, `set -euo pipefail`, `umask 077`; jq's
+   `first(...) // empty` per field, refused when empty or not PEM; `mktemp`
+   beside the target, `chmod 0640`, `mv`; the files that were there stay on
+   any refusal. Run on the test server with a stand-in jq (the host has
+   none): a good pair, a missing domain, a non-PEM field. Executable in
+   git.
+- [x] **`crashexit`**: subscribe to `PROCESS_STATE_EXITED` with a restart-count
    threshold, or raise `startsecs` so a crash after 1 s still reaches FATAL;
    say in architecture.md what actually exits the container. — **Opus**
-- [ ] **`envdoc_test` made real**: parse `envDefault|envInt|os.Getenv("…")` out of
+   *Done 2026-10-15:* `PROCESS_STATE_FATAL,PROCESS_STATE_EXITED`; five
+   `expected:0` exits of one program in 600 s shut down, as FATAL does;
+   `syslog-relay` joins the spared. `build/crashexit_test.go` runs the
+   script under python with `CRASHEXIT_DRYRUN`. architecture.md says what
+   exits the container.
+- [x] **`envdoc_test` made real**: parse `envDefault|envInt|os.Getenv("…")` out of
    `cmd/panel/*.go` and `${VAR` out of `build/*.sh`, parse the key tables out
    of guide.md and architecture.md, compare. — **Opus**
-- [ ] Docs: architecture § Image and processes, § Configuration; security.md
+   *Done 2026-10-15:* read from cmd/panel and internal (tests aside) and
+   build/*.sh (`${VAR:-…}`), documented in guide.md § Environment variables
+   and architecture.md's internal list; both ways. It found `ANTISPAM_DIR`
+   documented nowhere (added).
+- [x] Docs: architecture § Image and processes, § Configuration; security.md
    § Process. — **Sonnet**
+   *Done 2026-10-15* with the steps: the programs table (`syslog-relay`),
+   what exits the container, `ANTISPAM_DIR`; security.md § Output and
+   process (the socket's group).
+
+*Changed by the reviews of stage 5 (2026-10-15; technical and security):*
+the e2e's numeric-settings test ran a container that passed every gate and
+never ended (the first run of the stage's e2e hung on it): the good values
+are now checked beside a bad one after them, and the runs are named,
+bounded to a minute and removed. The gates refuse what is under a
+parameter's minimum (a zero window kills anvil, a zero milter timeout
+smtpd and cleanup - src/anvil/anvil.c, src/smtpd/smtpd.c) and what passes an
+int, in seconds for a time value (src/global/conv_time.c reads one unit and
+refuses an overflow). OpenDKIM waits, five seconds at most, for the relay's
+socket. The relay marks its lines `syslog: `, writes control characters
+out (a forged second line), reads at once into a queue and drops past 200
+lines a second or a full queue, saying how many - a relay that stopped
+reading would have held OpenDKIM in syslog(3). `smtp_tls_mandatory_protocols`
+too. extract-cert.sh keeps the old files' group (a cron run as root handed
+the key to root's group) and sets its trap before mktemp. `cert-reload`
+joins the spared programs. security.md: the restart after five panel exits,
+and the relay's socket. Measured, against the technical review's guess:
+smtpd runs with the `selfpost` group among its groups (Uid 101, Groups
+104 998 on the test server), so before this stage it did reach the
+supervisor socket. Accepted, with the reason: the logrotate state file in
+the `postfix` user's directory - that user can stop rotation through the
+log it owns anyway; envdoc_test reads `${VAR:-}` and the Go helpers, not
+bare `$VAR` or python (none today); the 600 s pruning in crashexit is not
+tested (the count and the spared are).
 
 ### Stage 6 — documentation and roadmap sweep (no product code, no cut)