Owner, 2026-10-18: "Надо почистить документы от устаревшего и сделанного."
- Deleted, shipped: plans/delivery-log-storage, from-header-binding,
inbound-antispam-panel, inbound-upstream-result, panel-dkim-signing,
panel-notifications, and the own-mta-builds analysis (its three rows
shipped as 2.6.1, 2.7.0, 2.8.0). What outlived them moved first: when a
filter-list counter is worth a migration, and the notifications' "when"
table, into architecture.md; the sender check's own-process trigger into
security.md. Code comments that cited them point at architecture.md or
security.md; CHANGELOG keeps their names, unlinked.
- Kept, marked closed: audit-2026-10-12, assumptions-2026-10-14 and
security-audit-2026-10-17 - the code cites their finding ids in 50-84
files. Their file:line refs are of the tree each audited.
- roadmap.md: open work only - stage H of the security audit (the owner's),
go-milter-upstream (the owner posts), and queue-table, which the
redesign left undecided and only its own shipped section still named;
Dropped and Ideas as they were. 2.x versioning instead of 1.x.
- development.md: the 47-row planned-version-cuts table (history, in the
CHANGELOG) gone; a stage's last step now removes its roadmap item and
plan. Docs map lists the closed audits.
- panel-redesign.md: the done checklist out; Room for roadmap items says
which drawn screens are unbuilt and why.
- Stale facts fixed: schema-migrations.md and architecture.md at schema 14
(0013's users columns and user_links, 0014's secure TLS mode);
security.md's accepted risk "profile saved without the password" - the
e-mail asks for it since 2.14.0.
Tests: go build, go vet; go test of cmd and the touched internal packages
pass except logtail's three Windows-bound rotation tests (rename of an open
file; CI is Linux). Only comments changed in Go.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
docs/own-mta-builds-2026-10-15.md weighs patched builds of Postfix and
OpenDKIM against what the panel works around. No Postfix limit needs a
patch (the panel reads it through the interfaces it offers); every limit
worked around is OpenDKIM's, a project with no release since 2018, three
2026 CVEs open in every Debian suite and no one answering (read in
dev/upstream: dkim_process_set runs on a tenant's DKIM-Signature header
in signing mode too). Bookworm is in LTS since 2026-07-12 and its Postfix
3.7.11 lacks the June, August and September 2026 upstream security
batches, which carry no CVE ids.
Proposed as candidates: port25-bare-newline (smtpd_forbid_bare_newline
defaults to no on 3.7; our smtp/inet block does not set it), base-trixie
(postfix 3.10.13; 331 citation lines to re-read), panel-dkim-signing
(go-msgauth/dkim in the panel's milter; OpenDKIM, the syslog relay and
the parser port removed, about 1,500 lines).
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
mixandClaude Opus 5.5