PHASE-006: reader integrity, safe message repair, and 1.3.4-rc.1 live acceptance

.github/workflows/ci.yml

@@ -131,5 +131,5 @@ jobs:
       - name: Release verification
         run: |
           python scripts/verify_release.py \
-            dist/mailstack-1.3.3-source.zip \
-            --checksum dist/mailstack-1.3.3-source.zip.sha256
+            dist/mailstack-1.3.4-rc.1-source.zip \
+            --checksum dist/mailstack-1.3.4-rc.1-source.zip.sha256

.github/workflows/release.yml

@@ -63,7 +63,7 @@ jobs:
           path: |
             dist/*.zip
             dist/*.sha256
-            docs/RELEASE_NOTES_1.3.3.md
+            docs/RELEASE_NOTES_1.3.4.md
             docs/FORENSIC_AUDIT_REPORT.md
           if-no-files-found: error
 
@@ -121,7 +121,7 @@ jobs:
             --verify-tag
             --target "$GITHUB_SHA"
             --title "MailStack ${RELEASE_VERSION}"
-            --notes-file docs/RELEASE_NOTES_1.3.3.md
+            --notes-file docs/RELEASE_NOTES_1.3.4.md
           )
           if [[ "$RELEASE_PRERELEASE" == "true" ]]; then
             args+=(--prerelease --latest=false)

CHANGELOG.md

@@ -2,6 +2,26 @@
 
 All notable repository-level changes are recorded here. Application history before the open-source conversion remains in `mailbox-app/CHANGELOG.md`.
 
+## Unreleased — PHASE-006 reader integrity and repair
+
+### Corrected
+
+- Prevented stripped HTML `<style>`/head/active blocks from leaking CSS text into the visible message body while preserving the deny-by-default sanitizer posture.
+- Removed blocked remote image nodes so tracking/remote images do not leave broken-image residue in the protected reader.
+- Removed the permanent protected-rendering banner from the normal reader while retaining sandbox, no-referrer, sanitizer, URL and active-content restrictions.
+- Added a bounded, idempotent existing-message body repair path that re-parses verified Maildir source without delete/re-ingest behavior and preserves message identity/state/attachments.
+- Disabled the unused Gunicorn control interface through source-level configuration rather than weakening systemd filesystem confinement.
+
+### Verification state
+
+- Local PHASE-006 focused qualification: 60 tests passed; targeted Ruff, Bandit, Django system check and migration-drift gates passed.
+- PHASE-006 implementation commit `90175b7a4549cb67d874692081bd5b0484eddccc` passed GitHub Actions CI run `32183300485`.
+- Owner approved `1.3.4-rc.1` as the PHASE-006 live-acceptance pre-release identity; PR/main/tag publication and controlled live acceptance remain pending.
+
+### Compatibility
+
+- No database migration, Postfix/Dovecot/LMTP/Maildir routing change, authorization redesign, outbound feature, broad UI redesign, installer change, or version bump is included.
+
 ## 1.3.3 — PHASE-005A qualification correction
 
 ### Corrected

VERSION

@@ -1 +1 @@
-1.3.3
+1.3.4-rc.1

design/DESIGN_MANIFEST.json

@@ -561,7 +561,7 @@
     "unsupported_features_inactive": true
   },
   "project": "MailStack",
-  "release_version": "1.3.3",
+  "release_version": "1.3.4-rc.1",
   "schema_version": 1,
   "source_archive": {
     "archive_crc": "PASS",