Skip to content

PHASE-006: high-fidelity reader RC2 and 1.3.4-rc.2 - #13

Merged
victorsteele merged 1 commit into
mainfrom
phase-006-reader-fidelity-rc2
Aug 20, 2026
Merged

PHASE-006: high-fidelity reader RC2 and 1.3.4-rc.2#13
victorsteele merged 1 commit into
mainfrom
phase-006-reader-fidelity-rc2

Conversation

@victorsteele

@victorsteele victorsteele commented Aug 19, 2026

Copy link
Copy Markdown
Contributor

Summary

Promotes the PHASE-006 reader-fidelity continuation to 1.3.4-rc.2 after the RC1 security fix proved too destructive for original-email HTML/CSS presentation fidelity.

This PR:

  • preserves bounded, allowlisted inline CSS and sanitized <style> rules, including safe responsive @media rules;
  • keeps active content, remote CSS/resources, tracking images, unsafe functions, imports, fonts, forms, scripts and email-provided iframes blocked;
  • preserves the existing sandbox / no-referrer / CSP security boundary;
  • adds focused parser, repair, security and reader regression fixtures/tests;
  • fixes head-container suppression so safe <style> can survive without leaking non-display <head> text;
  • advances the pinned Django 5.2 LTS runtime from 5.2.16 to security-maintenance release 5.2.17 and synchronizes deployment/version contracts;
  • removes Bandit B105 false positives by renaming CSS token-kind locals without weakening Bandit policy;
  • promotes release identity and CI artifact verification to 1.3.4-rc.2.

Root cause

RC1 intentionally tightened HTML sanitization but removed all <style> content and inline style attributes, which protected the reader while materially reducing original-email fidelity. The RC2 implementation restores only a bounded safe CSS subset while retaining the existing deny-by-default rendering and browser-isolation controls.

During RC2 qualification, two additional issues were found and closed: head-container text leakage caused by preserving <head> for style extraction, and a Django 5.2.16 security advisory requiring the 5.2.17 patch release.

Scope / compatibility

No database migration, route/authorization redesign, Postfix/Dovecot/LMTP/Maildir routing change, outbound-mail feature, installer-flow redesign, broad UI redesign, CSP weakening, iframe sandbox weakening, or repair-architecture change is included.

Validation

Local qualified candidate:

  • full pytest: 223 passed, 1 skipped on Windows (symlink capability skip);
  • coverage: 93.03% (threshold 85%);
  • Ruff: PASS;
  • Bandit: PASS;
  • pip check: PASS;
  • pip-audit: no known vulnerabilities;
  • Django system check: PASS;
  • migration drift: none;
  • documentation, design, inventory, installer, operations, release-workflow and upgrade/rollback gates: PASS;
  • standard and full forensic audits: BLOCKING_FINDINGS=0;
  • deterministic RC2 source archive SHA256: ec173734af099029a6282a6a0e5ff07c8f18262c561a4d3638d84963e68b2f41.

GitHub Actions branch CI run 32299484598 on commit 1cc49ffb8b1e391c7901766c17dcec4689f563ed completed successfully:

  • Linux pytest: 224 passed;
  • coverage: 93.03%;
  • dependency audit: no known vulnerabilities;
  • Ruff/Bandit: PASS;
  • Django checks and migration gate: PASS;
  • full forensic gate: PASS with zero blockers;
  • deterministic release build: PASS;
  • release verification: PASS;
  • RC2 archive SHA256 matched the locally qualified artifact exactly.

Review state

Created as a draft intentionally. Merge, tag, GitHub Release publication and production/live acceptance remain separate gated steps.

@victorsteele ChatGPT Codex Connector

victorsteele commented Aug 20, 2026

Copy link
Copy Markdown
Contributor Author

CI forensic audit — run 32299914821

Root cause [CONFIRMED]

The PR CI cancellation was an infrastructure/network stall during System build dependencies, not a MailStack source/test failure.

Evidence:

  • PR merge-ref checkout succeeded (b8be38d, merging 1cc49ff into 212ccaf).
  • Python 3.12 setup/cache restore succeeded.
  • sudo apt-get update then stalled on the GitHub-hosted Ubuntu runner's azure.archive.ubuntu.com mirror path.
  • The workflow has timeout-minutes: 30; the job was cancelled at that timeout before Python dependencies, source audit, tests, security gates, Django checks, release build, or release verification could run.
  • Exact commit 1cc49ffb8b1e391c7901766c17dcec4689f563ed already passed push/branch CI run 32299484598 on the same workflow and runner image: 224 tests passed, 93.03% coverage, dependency audit/Ruff/Bandit/Django/forensic/release gates PASS.

Scope lock

Remediation scope is CI rerun only on the unchanged PR head 1cc49ffb8b1e391c7901766c17dcec4689f563ed.

Explicitly out of scope unless the rerun produces a new concrete reproducible failure:

  • application/source changes;
  • dependency/version changes;
  • CI workflow changes or timeout expansion;
  • database/mail-flow/authorization/runtime architecture changes;
  • release identity or documentation churn.

PR #13 remains the canonical RC2 PR; no duplicate PR should be created. Next gate: rerun the cancelled quality-and-security job and require a clean PR CI PASS before any merge action.

@victorsteele
victorsteele marked this pull request as ready for review August 20, 2026 21:59
@victorsteele
victorsteele merged commit f0f471f into main Aug 20, 2026
2 of 3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@victorsteele