chore/docs: move to GitHub as the single home; drop archived-spec references

Codeberg is being retired as the project's public site, so every reference now
points at GitHub. That includes the Go module path (codeberg.org/mix/selfpost →
github.com/mixeme/selfpost): leaving an import path on a host that is going
away would break `go get` and `go install`, so this is not only a docs change.
Touches go.mod, test/e2e/go.mod, all imports, Makefile MODULE, the -ldflags
version stamp in build/Dockerfile and docs/development.md, the licence headers
in the SVG/HTML assets, and README (no more primary/mirror pair).

Comments no longer cite the archived specification. "spec 7.6.1", "spec 5.1"
and friends pointed into docs/archive/specification-v1.0.md, which is marked as
not a source of truth; each is now a reference to the live document that owns
the subject — architecture.md (with section), product.md, security.md or the
README. The review only asked for the 7.x refs (code-review.md § 4), but 4/5/6/
8/9 had the same defect, so they went too. Comments only, no behaviour change.

Also closes the remaining review items: architecture.md gained a Code layers
section with the layer diagram (A2), and TestParseDelivery gained the exotic
mail.log cases (§ 3).

Fixes a bug that last test found: the delivery-line pattern matched status=
greedily, taking the *last* occurrence on the line. Postfix appends the remote
server's reply verbatim, so a rejection whose reply quoted "status=sent" was
filed as a delivered message in the send log. It now takes the first status=
after the recipient, which is the real field.

R7 (CONTRIBUTING.md) moved to roadmap 2.x — one developer, no external PR flow,
so the file would have no audience yet. R1 (compose image tag) and the git tag
stay in roadmap § v1.x as the release-commit steps.

gofmt/go vet clean on both modules; go test ./... green except the three known
Windows-only failures (file perms, backslash paths, renaming an open file).
Not exercised on the dev server — no Docker locally.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

internal/domain/dkim.go

@@ -1,8 +1,8 @@
 // Package domain owns SelfPost's sending-domain model: per-domain DKIM key
 // generation, the OpenDKIM KeyTable/SigningTable that drive signing, and the
 // orchestration that keeps the SQLite registry, the on-disk keys and OpenDKIM
-// in agreement (spec 4.1, 6). Key material lives under /data so it survives
-// container restarts (spec 6.1, 9).
+// in agreement (architecture.md § OpenDKIM). Key material lives under /data so
+// it survives container restarts (architecture.md § OpenDKIM).
 package domain
 
 import (
@@ -46,7 +46,7 @@ func writePrivateKeyPEM(path string, key *rsa.PrivateKey) error {
 
 // loadPrivateKeyPEM reads and parses a PKCS#1 RSA private key written by
 // writePrivateKeyPEM. It is used to recompute the public DNS record on demand,
-// keeping the private key file the single source of truth (spec 7.2.10).
+// keeping the private key file the single source of truth (product.md).
 func loadPrivateKeyPEM(path string) (*rsa.PrivateKey, error) {
 	data, err := os.ReadFile(path)
 	if err != nil {
@@ -63,7 +63,7 @@ func loadPrivateKeyPEM(path string) (*rsa.PrivateKey, error) {
 	return key, nil
 }
 
-// DKIMRecord is the DNS TXT record a user must publish for a domain (spec 7.2.10).
+// DKIMRecord is the DNS TXT record a user must publish for a domain (product.md).
 type DKIMRecord struct {
 	// Name is the record's host, e.g. "selfpost._domainkey.example.com".
 	Name string
@@ -89,7 +89,7 @@ func dkimRecord(selector, domainName string, pub *rsa.PublicKey) (DKIMRecord, er
 // writeFileAtomic writes data to path via a temp file in the same directory
 // followed by a rename, so readers only ever see the complete old or new file.
 // It is the single safe-write primitive for DKIM keys and OpenDKIM tables
-// (spec 7.6.4).
+// (security.md).
 func writeFileAtomic(path string, data []byte, perm os.FileMode) error {
 	dir := filepath.Dir(path)
 	tmp, err := os.CreateTemp(dir, ".tmp-*")

internal/domain/opendkim.go

@@ -12,9 +12,9 @@ import (
 )
 
 // OpenDKIM manages the on-disk OpenDKIM state the panel is responsible for
-// (spec 6): per-domain signing keys under keysDir and the KeyTable/SigningTable
-// that map domains to those keys. After rewriting the tables it asks OpenDKIM to
-// reload them.
+// (architecture.md § OpenDKIM): per-domain signing keys under keysDir and the
+// KeyTable/SigningTable that map domains to those keys. After rewriting the
+// tables it asks OpenDKIM to reload them.
 type OpenDKIM struct {
 	keysDir          string
 	keyTablePath     string
@@ -50,8 +50,8 @@ func (o *OpenDKIM) keyPath(domainName, selector string) string {
 
 // EnsureKey makes sure a signing key exists for the domain. An existing key is
 // reused untouched — critical because overwriting it would silently invalidate
-// the DKIM record already published in DNS (spec 6.1). Returns whether a new key
-// was generated.
+// the DKIM record already published in DNS (architecture.md § OpenDKIM).
+// Returns whether a new key was generated.
 func (o *OpenDKIM) EnsureKey(domainName, selector string) (bool, error) {
 	if err := assertConfigSafe(domainName, selector); err != nil {
 		return false, err
@@ -77,8 +77,8 @@ func (o *OpenDKIM) EnsureKey(domainName, selector string) (bool, error) {
 	return true, nil
 }
 
-// RemoveKey deletes a domain's key directory (spec 6.5). A missing directory is
-// not an error.
+// RemoveKey deletes a domain's key directory (architecture.md § OpenDKIM). A
+// missing directory is not an error.
 func (o *OpenDKIM) RemoveKey(domainName string) error {
 	if err := assertConfigSafe(domainName, "x"); err != nil {
 		return err
@@ -89,10 +89,11 @@ func (o *OpenDKIM) RemoveKey(domainName string) error {
 	return nil
 }
 
-// ExportKey returns a domain's DKIM private key as PKCS#1 PEM, for carrying in a
-// domain export so the receiving instance signs with the same key and the DNS
-// TXT record never has to change (spec 7.5.B). It re-marshals the parsed key
-// rather than returning the raw file, so a malformed on-disk key is caught here.
+// ExportKey returns a domain's DKIM private key as PKCS#1 PEM, for carrying in
+// a domain export so the receiving instance signs with the same key and the
+// DNS TXT record never has to change (architecture.md § Persistence). It
+// re-marshals the parsed key rather than returning the raw file, so a
+// malformed on-disk key is caught here.
 func (o *OpenDKIM) ExportKey(domainName, selector string) ([]byte, error) {
 	if err := assertConfigSafe(domainName, selector); err != nil {
 		return nil, err
@@ -105,11 +106,12 @@ func (o *OpenDKIM) ExportKey(domainName, selector string) ([]byte, error) {
 	return pem.EncodeToMemory(block), nil
 }
 
-// ImportKey writes an imported DKIM private key to disk for a domain (spec
-// 7.5.B). The PEM is parsed and re-marshalled through the same writer used for
-// generated keys, so only a well-formed PKCS#1 RSA key is ever stored. Unlike
-// EnsureKey it overwrites: an import (re-)creates the domain with exactly this
-// key, which is the whole point of keeping the published DNS record valid.
+// ImportKey writes an imported DKIM private key to disk for a domain
+// (architecture.md § Persistence). The PEM is parsed and re-marshalled through
+// the same writer used for generated keys, so only a well-formed PKCS#1 RSA
+// key is ever stored. Unlike EnsureKey it overwrites: an import (re-)creates
+// the domain with exactly this key, which is the whole point of keeping the
+// published DNS record valid.
 func (o *OpenDKIM) ImportKey(domainName, selector string, pemKey []byte) error {
 	if err := assertConfigSafe(domainName, selector); err != nil {
 		return err
@@ -130,7 +132,7 @@ func (o *OpenDKIM) ImportKey(domainName, selector string, pemKey []byte) error {
 }
 
 // Record returns the published DKIM DNS record for a domain, recomputed from the
-// private key on disk (spec 7.2.10).
+// private key on disk (product.md).
 func (o *OpenDKIM) Record(domainName, selector string) (DKIMRecord, error) {
 	key, err := loadPrivateKeyPEM(o.keyPath(domainName, selector))
 	if err != nil {
@@ -140,10 +142,10 @@ func (o *OpenDKIM) Record(domainName, selector string) (DKIMRecord, error) {
 }
 
 // Rebuild regenerates KeyTable and SigningTable from the full domain set and
-// reloads OpenDKIM (spec 6.2). Full regeneration (rather than incremental
-// edits) keeps the files a pure function of the registry, so add and delete
-// share one idempotent path. Both files are written atomically before the
-// reload signal is sent.
+// reloads OpenDKIM (architecture.md § OpenDKIM). Full regeneration (rather
+// than incremental edits) keeps the files a pure function of the registry, so
+// add and delete share one idempotent path. Both files are written atomically
+// before the reload signal is sent.
 func (o *OpenDKIM) Rebuild(domains []SigningDomain) error {
 	keyTable, signingTable, err := renderTables(o.keysDir, domains)
 	if err != nil {
@@ -158,17 +160,18 @@ func (o *OpenDKIM) Rebuild(domains []SigningDomain) error {
 	return o.reload()
 }
 
-// Reload asks OpenDKIM to re-read its tables without regenerating them. It backs
-// the panel's manual reload button (spec 7.2.12).
+// Reload asks OpenDKIM to re-read its tables without regenerating them. It
+// backs the panel's manual reload button (architecture.md § Panel HTTP
+// surface).
 func (o *OpenDKIM) Reload() error {
 	return o.reload()
 }
 
 // renderTables builds the KeyTable and SigningTable byte contents for a domain
 // set, sorted by name so the output is deterministic. Every domain is
-// re-checked for shell/config-injection safety before being written (spec
-// 7.6.4) — validation upstream already guarantees this, but the table writer
-// refuses to emit anything unsafe as a hard backstop.
+// re-checked for shell/config-injection safety before being written
+// (security.md) — validation upstream already guarantees this, but the table
+// writer refuses to emit anything unsafe as a hard backstop.
 func renderTables(keysDir string, domains []SigningDomain) (keyTable, signingTable []byte, err error) {
 	sorted := append([]SigningDomain(nil), domains...)
 	sort.Slice(sorted, func(i, j int) bool { return sorted[i].Name < sorted[j].Name })
@@ -191,9 +194,9 @@ func renderTables(keysDir string, domains []SigningDomain) (keyTable, signingTab
 
 // assertConfigSafe rejects any domain/selector value that could break out of a
 // single table line. Domains are already whitelisted to [a-z0-9.-] and selectors
-// to a similar set before they reach here (spec 7.6.2); this is defence in depth
+// to a similar set before they reach here (security.md); this is defence in depth
 // against a validation gap ever letting whitespace, a newline or a field
-// separator through into a config file (spec 7.6.4).
+// separator through into a config file (security.md).
 func assertConfigSafe(domainName, selector string) error {
 	for _, v := range []string{domainName, selector} {
 		if v == "" {
@@ -210,10 +213,10 @@ func assertConfigSafe(domainName, selector string) error {
 // OpenDKIM process SIGUSR1, which makes it re-read KeyTable/SigningTable
 // (opendkim's documented reload signal). The panel runs unprivileged and cannot
 // signal another user's process directly, so it goes through the supervisor
-// control socket, reachable via the shared `selfpost` group (spec 7.6.3, 7.6.8).
+// control socket, reachable via the shared `selfpost` group (security.md).
 //
 // Arguments are fixed literals — no user input is interpolated into the command,
-// and it never goes through a shell (spec 7.6.3).
+// and it never goes through a shell (security.md).
 func reloadViaSupervisor() error {
 	cmd := exec.Command("supervisorctl",
 		"-c", "/etc/supervisor/supervisord.conf",

internal/domain/service.go

@@ -3,7 +3,7 @@ package domain
 import (
 	"fmt"
 
-	"codeberg.org/mix/selfpost/internal/store"
+	"github.com/mixeme/selfpost/internal/store"
 )
 
 // Applications is the slice of the application service the domain service needs
@@ -19,18 +19,20 @@ type Applications interface {
 	// and reloads Postfix.
 	Resync() error
 	// Secret returns an application's stored password, for a domain export
-	// (spec 7.5.B).
+	// (architecture.md § Persistence).
 	Secret(login string) (string, error)
 	// ImportApplication re-creates an application (registry row + SASL account)
-	// from a domain-export file, without rebuilding the sender map (spec 7.5.B).
+	// from a domain-export file, without rebuilding the sender map
+	// (architecture.md § Persistence).
 	ImportApplication(domainID int64, login, mode string, addresses []string, password string) error
 }
 
 // Service coordinates the places a sending domain lives: the SQLite registry,
 // the on-disk DKIM keys and OpenDKIM's tables, plus — on deletion — the SASL
 // database and Postfix sender map its applications touch. Callers (the web
-// handlers) validate user input first; Service keeps the stores in agreement and
-// drives the OpenDKIM/Postfix reloads (spec 6, 7.2.2-4, 7.2.10).
+// handlers) validate user input first; Service keeps the stores in agreement
+// and drives the OpenDKIM/Postfix reloads (architecture.md § OpenDKIM,
+// product.md).
 type Service struct {
 	store    *store.Store
 	odk      *OpenDKIM
@@ -39,14 +41,15 @@ type Service struct {
 }
 
 // NewService builds the domain service. selectorDefault is the DKIM selector
-// assigned to new domains (spec 8: DKIM_SELECTOR_DEFAULT); it is
-// operator-configured, not user input. apps is used only on deletion, to clear
-// the SASL accounts and sender-map bindings of the domain's applications.
+// assigned to new domains (README § Environment variables:
+// DKIM_SELECTOR_DEFAULT); it is operator-configured, not user input. apps is
+// used only on deletion, to clear the SASL accounts and sender-map bindings of
+// the domain's applications.
 func NewService(st *store.Store, odk *OpenDKIM, apps Applications, selectorDefault string) *Service {
 	return &Service{store: st, odk: odk, apps: apps, selector: selectorDefault}
 }
 
-// List returns all domains with application counts (spec 7.2.2).
+// List returns all domains with application counts (product.md).
 func (s *Service) List() ([]store.Domain, error) {
 	return s.store.ListDomains()
 }
@@ -57,7 +60,7 @@ func (s *Service) Get(id int64) (store.Domain, error) {
 }
 
 // Add registers a new sending domain: it records the row, ensures a DKIM key
-// exists on disk, and regenerates + reloads the OpenDKIM tables (spec 7.2.3).
+// exists on disk, and regenerates + reloads the OpenDKIM tables (product.md).
 // name must already be normalised and validated by the caller. A duplicate
 // returns store.ErrDomainExists.
 //
@@ -91,7 +94,7 @@ func (s *Service) rollbackAdd(id int64) {
 	_ = s.store.DeleteDomain(id)
 }
 
-// Delete removes a domain and everything bound to it (spec 7.2.4, 6.5). The
+// Delete removes a domain and everything bound to it (product.md). The
 // order matters: the applications' SASL accounts are cleared first, while their
 // logins are still in the registry; then the registry rows (applications and
 // their addresses) go via the DB cascade; then the OpenDKIM tables and the
@@ -107,8 +110,9 @@ func (s *Service) Delete(id int64) error {
 		return fmt.Errorf("clear SASL accounts for %s: %w", d.Name, err)
 	}
 	// Drop the domain's own level-2 limit and those of its applications while the
-	// application rows still exist (the cleanup query joins them). rate_limits has
-	// no cascade of its own (ref_id is a plain integer, spec 7.4/9).
+	// application rows still exist (the cleanup query joins them). rate_limits
+	// has no cascade of its own (ref_id is a plain integer, README § Rate
+	// limiting; architecture.md § Persistence).
 	if err := s.store.DeleteRateLimitsForDomain(id); err != nil {
 		return fmt.Errorf("clear rate limits for %s: %w", d.Name, err)
 	}
@@ -129,19 +133,19 @@ func (s *Service) Delete(id int64) error {
 	return nil
 }
 
-// DKIMRecord returns the DNS TXT record to publish for a domain (spec 7.2.10).
+// DKIMRecord returns the DNS TXT record to publish for a domain (product.md).
 func (s *Service) DKIMRecord(d store.Domain) (DKIMRecord, error) {
 	return s.odk.Record(d.Name, d.DKIMSelector)
 }
 
-// RateLimit returns the domain-level differentiated rate limit (spec 7.4), and
-// whether one is configured, for the domain's edit form.
+// RateLimit returns the domain-level differentiated rate limit (README § Rate
+// limiting), and whether one is configured, for the domain's edit form.
 func (s *Service) RateLimit(domainID int64) (store.RateLimit, bool, error) {
 	return s.store.GetRateLimit(store.RateLimitScopeDomain, domainID)
 }
 
 // SaveRateLimit stores the domain-level rate limit. The caller has validated the
-// IPs and numbers (spec 7.6.2); the milter reads the row live, so no reload is
+// IPs and numbers (security.md); the milter reads the row live, so no reload is
 // needed.
 func (s *Service) SaveRateLimit(domainID int64, ips []string, maxMessages, windowSeconds int) error {
 	return s.store.SetRateLimit(store.RateLimit{
@@ -154,14 +158,15 @@ func (s *Service) SaveRateLimit(domainID int64, ips []string, maxMessages, windo
 }
 
 // ClearRateLimit removes the domain-level rate limit, falling back to level 1
-// only (spec 7.4).
+// only (README § Rate limiting).
 func (s *Service) ClearRateLimit(domainID int64) error {
 	return s.store.DeleteRateLimit(store.RateLimitScopeDomain, domainID)
 }
 
-// Resync regenerates the OpenDKIM tables from the registry and reloads OpenDKIM.
-// It backs the manual reload button (spec 7.2.12) and doubles as a recovery path
-// if the tables ever drift from the database.
+// Resync regenerates the OpenDKIM tables from the registry and reloads
+// OpenDKIM. It backs the manual reload button (architecture.md § Panel HTTP
+// surface) and doubles as a recovery path if the tables ever drift from the
+// database.
 func (s *Service) Resync() error {
 	return s.resync()
 }

internal/domain/transfer.go

@@ -3,19 +3,20 @@ package domain
 import (
 	"fmt"
 
-	"codeberg.org/mix/selfpost/internal/buildinfo"
-	"codeberg.org/mix/selfpost/internal/store"
+	"github.com/mixeme/selfpost/internal/buildinfo"
+	"github.com/mixeme/selfpost/internal/store"
 )
 
-// FormatDomainExport identifies a single-domain export file (spec 7.5.B).
+// FormatDomainExport identifies a single-domain export file (architecture.md §
+// Persistence).
 const FormatDomainExport = "selfpost-domain-export"
 
 // DomainExport is the serialisable form of one sending domain, for moving it
-// between two independently running SelfPost instances (spec 7.5.B). It carries
-// the DKIM private key (so the published DNS record stays valid) and each
-// application's working password (so credentials transfer without regeneration).
-// The file is therefore as sensitive as a full backup and must be handled as a
-// secret.
+// between two independently running SelfPost instances (architecture.md §
+// Persistence). It carries the DKIM private key (so the published DNS record
+// stays valid) and each application's working password (so credentials
+// transfer without regeneration). The file is therefore as sensitive as a full
+// backup and must be handled as a secret.
 type DomainExport struct {
 	Format         string      `json:"format"`
 	Version        string      `json:"version"`
@@ -35,8 +36,8 @@ type AppExport struct {
 
 // Export builds the transferable representation of a domain: its DKIM key, its
 // selector and every application with its address mode and working password
-// (spec 7.5.B). The returned struct is marshalled to JSON by the caller and
-// offered as a secret download.
+// (architecture.md § Persistence). The returned struct is marshalled to JSON
+// by the caller and offered as a secret download.
 func (s *Service) Export(id int64) (DomainExport, error) {
 	d, err := s.store.GetDomain(id)
 	if err != nil {
@@ -73,17 +74,18 @@ func (s *Service) Export(id int64) (DomainExport, error) {
 	return exp, nil
 }
 
-// Import re-creates a domain from an export file on this instance (spec 7.5.B):
-// it stores the imported DKIM key (so the published DNS record needs no change),
-// registers the domain and rebuilds the OpenDKIM tables, then re-creates each
-// application with its working password and rebuilds the Postfix sender map.
+// Import re-creates a domain from an export file on this instance
+// (architecture.md § Persistence): it stores the imported DKIM key (so the
+// published DNS record needs no change), registers the domain and rebuilds the
+// OpenDKIM tables, then re-creates each application with its working password
+// and rebuilds the Postfix sender map.
 //
-// exp.Domain must already be normalised and validated by the caller (spec
-// 7.6.2); the selector is checked for config-injection safety here. A domain or
-// login that already exists is rejected (store.ErrDomainExists /
-// store.ErrLoginExists) rather than merged. If any step fails, everything the
-// import created is rolled back, so a partial import never leaves the instance
-// in an inconsistent state.
+// exp.Domain must already be normalised and validated by the caller
+// (security.md); the selector is checked for
+// config-injection safety here. A domain or login that already exists is
+// rejected (store.ErrDomainExists / store.ErrLoginExists) rather than merged.
+// If any step fails, everything the import created is rolled back, so a
+// partial import never leaves the instance in an inconsistent state.
 func (s *Service) Import(exp DomainExport) (store.Domain, error) {
 	if exp.Format != FormatDomainExport {
 		return store.Domain{}, fmt.Errorf("not a SelfPost domain export (format %q)", exp.Format)

internal/domain/transfer_test.go

@@ -5,7 +5,7 @@ import (
 	"fmt"
 	"testing"
 
-	"codeberg.org/mix/selfpost/internal/store"
+	"github.com/mixeme/selfpost/internal/store"
 )
 
 // fakeApps stands in for *app.Service in the domain-transfer tests: it records