mixandClaude Opus 5.5
c3d99b1f15
test / test (push) Canceled after 0s
Agreed with the owner, one question at a time; documents only, no code. - csrf-tokens -> origin-strict (agreed): no tokens, the origin check refuses a request with neither header. security.md's ADR records the decision and when tokens are built after all. - structured-logging, contributing: dropped, each with what brings it back (new roadmap section "Dropped, with the condition for return"). - template-data-typing: done by 2.0.0; its last map (healthChecks) is a step of the audit's stage 4. - preflight -> health-setup-checks (certificate name, Postfix's greeting, trusted proxy as lines on Health) and test-email, both agreed. The port check is dropped with its reason; plans/preflight.md removed. - password-reset: agreed; a reset link goes only to a confirmed e-mail, so the item builds confirmation first. - phone-desktop-mode: agreed, after stages 1 and 2 of the audit. - backup-reauth (agreed): the account password before a backup or a domain export, out of review-2026-08-followups. - from-header-binding, Not done: the Delivery log box is required on a refused message's page, with the line Postfix wrote, for all three kinds of refusal (audit stage 1); the Outbound log gets a filter by status and by day (audit stage 4). The audit's checklist is 48 lines (was 45). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>