[devantler]

🤖 Generated by the Agentic Engineer

Why

Mail administration needs to open reliably even when the mail service cannot download its interface from the internet.

What

Bundle the verified Stalwart interface with the mail initializer and refuse unexpected administration settings. This prepares administration for activation; the public service and Homepage entry remain part of the mail rollout.

Part of #5030

[devantler]

🤖 Generated by the Agentic Engineer

Validation for source 9cb8818c1f42374dd6063835f8ff865354ea75e5:

• Package tests with the race detector, Go vet, ShellCheck, workflow syntax validation and whitespace checks passed.
• The publication tests execute both actual workflow producer scripts. Altered bundle/license downloads and reused output files are refused before publication.
• The owned pinned-image test first exposed the missing asset and unreadable parent directory; the corrected image serves the checksum-pinned bundle and license to UID 2000.
• A disposable native Stalwart run successfully executed the real bootstrap/readback, served both interface pages and all their referenced scripts/styles, accepted authenticated management and refused the same request unauthenticated.

That local container test is additional evidence; the hosted Docker fixture on an internal network is still required and is running in CI. It also exercises unexpected-application refusal and identity/history preservation on replay. No production activation, DNS, Homepage or client acceptance is claimed here.

[devantler]

🤖 Generated by the Agentic Engineer

Hosted native testing at 9cb8818c1f42374dd6063835f8ff865354ea75e5 stopped on an unsupported Application/query description filter in the negative fixture's cleanup. The unexpected-application refusal itself had already executed.

Signed follow-up 3cb083e562cc27cacf68d646152d44fc98a05bbc selects only the owned negative application from the complete bounded query/get, requiring both returned identities and an unambiguous match before deletion. The refusal and bootstrap fences remain in place.

The focused pinned-server run now proves: positive bootstrap, extra-application refusal, bootstrap refusal, actual cleanup through the bounded inventory, and preservation of the original administration identity. ShellCheck and whitespace checks pass. The complete hosted suite must pass at this new head before review or promotion; the previous failed run is not counted.

[devantler]

🤖 Generated by the Agentic Engineer

The supplementary static pass found a cache-pinning issue before provider review: Stalwart could reuse an old cached ZIP while bootstrap successfully verified a different file at the permanent local URL.

The native regression reproduced that exact failure. Cache fix 48db231fe86a2f9566c0c9f904054d087a51a613 names the image file and configured resource URL by the verified SHA-256, so a pin change invalidates the native cache while preserving Application identity. The image derives the filename from the actual staged ZIP; the initializer derives its expected path from the reviewed pin.

The regression now positively primes a previous cached interface, reconciles with the real image, requires all pinned served assets and confirms the original Application identity. Its native RED and GREEN were observed. Race tests, vet, ShellCheck, whitespace checks and UID 2000 asset/license readability passed. Static re-review found no further actionable issues.

Current signed head is 699cc89b128e5f2328d149fb203792a41a075a1d, including a non-destructive merge of reviewed main b9e9577c32c5ab7ecc1a355e5b898a7fa93b4336. Complete hosted Docker CI at this head remains required; earlier green checks are not carried forward.

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai full review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

---

Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 18 minutes.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 17 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: devantler-tech/platform
• Branch: codex/private-mail-webui-5030-23e2
• File: .coderabbit.yaml
• Commit: 699cc89
• Layers: Repository YAML (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 2f71fc7f-9138-433d-9f13-7526596d232f

Commits

Reviewing files that changed from the base of the PR and between b9e9577 and 699cc89.

Files selected for processing: 16

• .github/workflows/publish-private-mail-bootstrap.yaml
• docs/adr/private-mail.md
• scripts/private-mail-config/Dockerfile
• scripts/private-mail-config/application.go
• scripts/private-mail-config/application_test.go
• scripts/private-mail-config/bootstrap.go
• scripts/private-mail-config/bootstrap_test.go
• scripts/private-mail-config/config.go
• scripts/private-mail-config/inventory-request.json
• scripts/private-mail-config/inventory.go
• scripts/private-mail-config/inventory_test.go
• scripts/private-mail-config/publication_test.go
• scripts/private-mail-config/readback.go
• scripts/private-mail-config/stage-webui.sh
• scripts/private-mail-config/webui-pins.json
• scripts/tests/test-private-mail-configuration.sh

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devantler]

🤖 Generated by the Agentic Engineer

CodeRabbit's authenticated command reply refused this exact-head request at 07:44:43 UTC on 2026-10-25 because its included review allowance was exhausted. The stated recovery is 18 minutes after that event. The current-PR review objects, conversation, threads and checks contain no delivered review or finding for this request; the no-gate guard returns ADMIT. This is a service limit, not a clean review. Continuing to the next provider under the existing review policy; no paid review is authorized.

[devantler]

🤖 Generated by the Agentic Engineer

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-25T07:47:46.052266Z	699cc89	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep it up!

Reviewed commit: 699cc89b12

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[devantler]

🤖 Generated by the Agentic Engineer

Readiness for signed head 699cc89b128e5f2328d149fb203792a41a075a1d:

• Full hosted CI run 40172462114 and the bootstrap build verification passed at this head. The actual native Docker job finished with PASS: native mail configuration, cached UI upgrade, replay, TLS and account restrictions.
• The cache regression first reproduced the stale-interface failure, then passed with digest-qualified asset identity. Native evaluation exercised the real initializer, pinned served pages and referenced assets, authenticated management, unauthenticated refusal, replay preserving identity/history, and extra-application refusal. Local race/vet/ShellCheck and image UID/asset checks also passed.
• Codex's completed clean receipt identifies this head. Complete conversation, reviews and threads were read: zero unresolved threads, zero review-body findings and no outstanding maintainer direction. The supplementary static cache finding has been fixed and re-reviewed.
• Native state is MERGEABLE/CLEAN. Every readable required gate passed. The configured code_quality ruleset has no readable per-head verdict and remains explicitly UNVERIFIED in the completeness helper; the native protected merge path adjudicates it. CodeRabbit's rate-limit status is service state, not a review; its refusal and progression are recorded above.

This source slice prepares verified offline administration assets. It does not claim a deployed mailbox, public route, Homepage tile, mail-app migration or production browser acceptance; those remain tracked by #5030. Proceeding through the protected queue at this exact head.

[devantler]

🤖 Generated by the Agentic Engineer

The first queue attempt 40176242046 deployed successfully, but its required aggregate never executed: the hosted runner's setup timed out three times while resolving action downloads. The native timeline records removal for failed_checks at 08:55:12 UTC, rather than a source failure or queue timeout.

Fresh preflight still binds signed source 699cc89b128e5f2328d149fb203792a41a075a1d, successful branch checks, the existing clean Codex receipt, complete feedback with zero unresolved findings/threads, and MERGEABLE/CLEAN. Retrying the protected queue once for this evidenced runner-network transient. No required check is skipped or weakened, and the existing membership/recovery jobs are left intact.

[devantler]

🤖 Generated by the Agentic Engineer

Post-merge publication verified for merged source 8eab8a8281a54ea0770b76b22655991d19fbd006: protected-main publication run succeeded and published ghcr.io/devantler-tech/platform-private-mail-bootstrap@sha256:4b4bf8edc487089ec3bbc5c8f84e5554d3af4b1cd63319a754fca69fa269227b.

An independent anonymous pull and Cosign verification passed for that exact digest, the reviewed main-workflow identity, GitHub OIDC issuer, transparency record and merged source revision. Separately verified the index, runtime, configuration and attestation hashes, the matching source label, SPDX 2.3 inventory with 107 packages, and SLSA v1 maximum BuildKit provenance bound to the runtime digest and source revision. The first independent inspector expected the older SLSA predicate version and correctly refused it; inspection of the actual statement established the v1 schema, which the corrected verifier validates explicitly.

This is publication evidence. Deployment, authenticated administration from Homepage, migration, direct delivery and the remaining real-mail acceptance criteria are still open under #5030.

[devantler]

🤖 Generated by the Agentic Engineer

Actual published-image evaluation also passed for immutable digest sha256:4b4bf8edc487089ec3bbc5c8f84e5554d3af4b1cd63319a754fca69fa269227b, using fresh disposable .test inputs. The initializer accepted read-only group-readable inputs, verified native configuration and exited after a clean recovery shutdown. A separate normal server, with no recovery variables, private-input mount or initializer temporary directory, authenticated the permanent administrator and refused unauthenticated management with 401.

Both administration and account pages, including every script/style referenced by their entry pages, matched the committed verified bundle. The expected native base-path rewrite was checked explicitly. The owned proof server was stopped and deleted successfully. This supplementary evaluation used Apple's Linux container runtime; the PR's hosted native proof used Docker. Neither is deployed Homepage/browser acceptance, which remains open with the rest of #5030.