From the security review of 2026-10-12: the allow list matches the
envelope sender, which nobody authenticates. Help's Filter lists topic
says so and points to client addresses and networks.
check.py: 32 screens, 0 violations.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Owner, 2026-10-12, on Inbound > Filter lists as built: "Note хочется
вынести в лист, подсказку, раскрывающийся блок. Тип в отдельную колонку.
Ещё полезно будет дать статистику использования правила, чтобы удалять
устаревшие." Drawn, then accepted ("Да") together with counting the
matches from the Inbound log.
- Kind is a column of its own; the tag no longer wraps under the
value.
- Note and Added leave the table for the entry's sheet, opened by the
kind tag (of his three - sheet, tooltip, disclosure - the sheet: it
exists and works under a finger).
- Matched: how often the entry decided a message, or "never". The
sheet adds the window ("in the last 90 days") and the last match.
A fifth column for the last match did not fit half the page width.
Help, Filter lists: what Matched counts and what "never" suggests.
check.py: 32 screens, 0 violations; outlines.json unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Guards and mockups only, ahead of the pages (inbound-antispam-panel
6/12). The owner agreed the feature ("Следующая по дорожной карте -
inbound-antispam-panel" / "Да", 2026-10-11) and started this step
("Начинай"), so the two screens are no longer "drawn but not built":
- guard_panel_test.go: in-log and in-filter-lists removed from
deferredScreens. From here TestLegacyRatchetMatchesTheEngine wants
the engine to have both pages - red until the next commit.
- guard_routes_test.go: the four routes join routes.inbound, so they
must exist with the relay on and answer 404 with it off.
Two mockup details brought to what the kit can draw, found when the
pages were built from it:
- help: the two new topics are one paragraph with a break in it, as
every topic is (panel.css has no gap between paragraphs of a topic);
- in-filter-lists: the directory in "Files" is mono at the text size -
the kit's inline code has no small variant.
check.py: 32 screens, 0 violations; outlines.json unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Mockup-first step of inbound-antispam-panel 6/12. The two screens were
drawn for the redesign before the feature existed; this brings them to
what steps 3-5 built.
in-log: the lead says where rows come from and how long they are kept;
a help link in the box head; Why is the engine and the detail as the
journal holds them (rspamd: action, score / threshold, weighted
symbols; postfix and a refusing filter: the reply text). No row
invents what the journal cannot hold: the "selfpost - upstream timed
out" tempfail and the Review link to a quarantine page that does not
exist are gone, a refused message has no subject, an allow-listed one
shows SELFPOST_ALLOW_FROM(-100.00).
in-filter-lists: Remove is a POST - the kit's row action, not a link;
a domain entry is shown as stored, without "@"; "Where the lists go"
names the directory and its six files instead of allow.map / deny.map,
says rspamd rereads them by itself and that Deny wins.
settings: "Keep inbound log rows, days" in the Log retention box.
help: two topics under Inbound, Inbound log and Filter lists, and a
sentence in Settings.
outlines.json rewritten: Help's Inbound box has six topics, was four.
check.py: 32 screens, 0 violations.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Owner, 2026-10-11: the key is needed and the panel's archive must be the console's. The box no longer says a certificate file may be left out; Help says the key has to be readable by the panel (group 998 on the host) and that the panel refuses, naming the file, until it is.
check.py: 0 violations; outlines.json unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Owner, 2026-10-11: the user has to be told why. The box gives the reason in a sentence - the queue cannot be copied reliably while the server is running; the Help topic explains it (Postfix keeps moving messages, a copy could hold one twice or miss it), what follows (waiting mail is not carried over, a restored server starts with an empty queue) and what to do to keep the queue (stop the container, archive the project directory).
check.py: 0 violations; outlines.json unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Owner, 2026-10-11: the queue is left out of the command's archive as well as the panel's. The Help topic no longer says selfpost-backup takes it; the command still takes the private key the panel cannot read.
check.py: 0 violations; outlines.json unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Owner, 2026-10-11: the archive made from the panel comes without the Postfix queue (variant 1). The Full backup box and the Help topic say so, and name the other thing the panel may not read - a certificate file, usually the private key - and the command that takes both.
check.py: 0 violations; outlines.json unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The owner's decision (2026-10-10): help is needed by almost every
section, not by Overview and Outbound alone. The Help mockup had six
topics while other screens already linked to topics it did not have
(#dmarc, #inbound).
- src/help.html: seventeen topics in five boxes - Overview (checks,
certificate, rdns), Outbound (dns, apps, limits, log, queue, dmarc),
Inbound (inbound, upstream, recipients, filter), Server (backup,
users, settings), Account (account) - one paragraph each, and the
side menu lists them by group.
- A box head gets the sp-help link where a topic now exists: health,
out-domain-settings, out-app, out-log, out-message, out-queue, the
three DMARC screens, in-domains, in-domain, backup, users, user,
settings. No link on boxes that explain themselves (confirmations,
the shown-once password, sign-in) and at most one per box.
- outlines.json regenerated (check.py --write): only help changed -
Outbound holds six topics, and Inbound, Server and Account are new
boxes. 0 violations.
The dns, dmarc and account topics describe the report-address scheme the
owner decided the same day (no reports / the SelfPost address / a typed
address, no user default); the account and out-domain-settings mockups
are redrawn for it in the change that follows.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Owner's instruction (2026-10-09): in the kit Sign out had no hover tint and
stood out among Account and Help. The cause was in the design, not in the
implementation: the mockups drew Sign out as a link, the panel signs out
with a POST, and Bulma tints only a.navbar-item.
- build.py: Sign out is a form with a submit button carrying navbar-item,
as the real shell has to write it; all pages rebuilt.
- theme.css: the form stretches the button across the menu and the button
is handed Bulma's own hover / focus / active variables, so it answers
like the entries above it. No width, no colour of its own.
check.py: 32 screens, 48 sp- classes, 0 violation(s); outlines.json unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Review pass over `1.4.0`…`1.9.1`: port 25 no longer shares the submission milter chain, DMARC reports are validated before they are stored, and the auto rate limit is correct for a non-default level-1 window. Schema migration `0010` (index only). Upgrading is a tag bump.
Added:
- SQLite migration `0010_send_log_app_login_index.sql` —
- DMARC aggregate reports are accepted as **zip** as well as gzip or plain XML
- e2e: `checkPort25ConfigCombinations` regenerates the Postfix configuration
Changed:
- README hero line and a **Positioning** block in `docs/product.md` record the
Fixed:
- The setup account's password is hashed at bcrypt cost `12` like every other
- Login/setup rate limiter: protecting blocked buckets from eviction is now
- `postqueue -p` output is bounded to 4 MiB (the timeout alone left the size of
- [schema-migrations.md](docs/schema-migrations.md): the schema section was
- postqueue reader is now time-bounded: `postqueue -p` runs under a 5-second
… (11 more in CHANGELOG)
Changed:
- [roadmap.md](docs/roadmap.md) now carries everything the 2026-08-19 code
- Extracted `internal/configsafe` — the empty-value and forbidden-character
- Build, deploy and migration comments no longer cite the archived
- Dropped the `parseDomainRateLimitForm` / `parseAppRateLimitForm` pass-through
- Extracted shared helpers: `internal/atomicfile` (atomic temp-write+rename) and
… (7 more in CHANGELOG)
Removed:
- Unused legacy asset `docs/assets/icon.png` (superseded by the four brand SVGs
- Plan documents for already-shipped features: `domain-stats-auto-ratelimit`,
Full detail: CHANGELOG.md (1.9.2).
mixandClaude Opus 5.5