release: MailStack 1.3.0-rc.4

.github/ISSUE_TEMPLATE/question.yml

@@ -10,7 +10,7 @@ body:
     id: version
     attributes:
       label: MailStack version
-      placeholder: "1.3.0-rc.1"
+      placeholder: "1.3.0-rc.4"
     validations:
       required: true
   - type: dropdown

.github/workflows/ci.yml

@@ -125,5 +125,5 @@ jobs:
       - name: Release verification
         run: |
           python scripts/verify_release.py \
-            dist/mailstack-1.3.0-rc.1-source.zip \
-            --checksum dist/mailstack-1.3.0-rc.1-source.zip.sha256
+            dist/mailstack-1.3.0-rc.4-source.zip \
+            --checksum dist/mailstack-1.3.0-rc.4-source.zip.sha256

CHANGELOG.md

@@ -26,12 +26,44 @@ All notable repository-level changes are recorded here. Application history befo
 - Established `MAILSTACK-1.3.0-RC1-DOCS-BASELINE-001` as the protected feature and documentation baseline.
 - Added the root `documents/` user-documentation hub with a user manual, task-based how-to guide, administrator guide, baseline record and mandatory phase history.
 - Added deterministic documentation index and manifest synchronization, phase scaffolding, contract tests and CI policy enforcement so maintained feature changes cannot merge without the required user documentation and changelog updates.
+- Corrected the RC4 Windows audit harness so Git Bash maps installer-only `python3` calls to the exact Python interpreter running the local test process, without changing the Ubuntu production installer or requiring a machine-wide Windows alias.
 
 ### Compatibility
 
 - Preserved `VIBMAIL_*` environment variables, `vibmail-*` service names, `/etc/vibmail` paths, database identifiers, source directories, and legacy deployment contracts.
 - No application behavior, database migration operations, mail-flow, authentication, authorization, or deployment contract was intentionally changed. Legacy protocol headers such as `X-VibMail-CSRF` remain unchanged.
 
+## 1.3.0-rc.3 — 2026-08-17
+
+### Security
+
+- Upgraded the locked transitive `sqlparse` runtime from 0.5.5 to 0.6.0 after GitHub Actions run `32053931714` identified CVE-2026-71491, CVE-2026-59894, CVE-2026-59893, and CVE-2026-54284.
+- Kept Django at 5.2.16; its declared `sqlparse>=0.3.1` dependency accepts sqlparse 0.6.0, and MailStack's Python 3.12 runtime satisfies sqlparse 0.6.0's Python 3.10+ requirement.
+- Preserved all PHASE-003 installation, recovery, LMTP, ingestion, UI, route, schema, and deployment behavior; this maintenance delta changes only the vulnerable dependency pin plus required release metadata and verification records.
+
+### CI
+
+- Corrected RC2 qualification records that could be read as if the current PHASE-003 dependency audit had passed. The RC2 branch passed structural/documentation/installer/operations gates but stopped at the blocking online advisory gate.
+- Regenerated deterministic documentation, design, and forensic inventories for RC3. Full dependency-backed GitHub Actions requalification remains mandatory before merge or release.
+
+## 1.3.0-rc.2 — 2026-08-17
+
+### Fixed
+
+- Prevented the installer from changing the host-wide `/var/log` mode and added explicit least-privilege log-path checks.
+- Isolated installer-launched Django management commands from stale parent-shell database and Django environment variables.
+- Prepared the mailbox provisioning runtime lock directory before clean/repair bootstrap commands.
+- Made reviewed repair resumable with explicit idempotent initial-administrator and system-mailbox preservation while retaining strict duplicate rejection by default.
+- Persisted root-only initial administrator credentials immediately after administrator creation so later installer failures do not lose the generated password.
+- Fixed Postfix-to-Dovecot LMTP delivery by configuring the static userdb with `allow_all_users=yes` while preserving Postfix SQL recipient validation.
+- Allowed official one-shot dry-run ingestion verification to run beside the live ingestion worker without taking the exclusive worker lock or mutating ServiceHeartbeat state.
+- Qualified the two conservative MariaDB uniqueness warnings against the existing `utf8mb4_unicode_ci` and unique-column deployment contract without changing schema or migrations.
+
+### Operations
+
+- Added SSH session-resilience guidance and a non-blocking installer warning when a mutating run starts outside `tmux`/`screen`.
+- Synchronized the live-staging fixes back into the canonical source so fresh deployments require no manual copies of the acceptance hotfixes.
+
 ## 1.3.0-rc.1 — 2026-06-30
 
 ### Preserved

CITATION.cff

@@ -2,8 +2,8 @@ cff-version: 1.2.0
 message: "If you use MailStack, cite the software release and link to the canonical source repository."
 title: "MailStack"
 type: software
-version: "1.3.0-rc.1"
-date-released: 2026-06-30
+version: "1.3.0-rc.4"
+date-released: 2026-08-17
 authors:
   - name: "Vib Tools"
 repository-code: "https://github.com/vibtools/MailStack"

CONTRIBUTING.md

@@ -38,6 +38,8 @@ python scripts/forensic_audit.py --root . --full
 
 The full gate runs tests, coverage, Ruff, Bandit, Django checks, contact-service tests and source-safety checks.
 
+On Windows, the repository audit tools require a real Bash runtime for shell syntax and installer-plan checks. They automatically prefer Git for Windows/Git Bash over the WSL `bash.exe` launcher and probe the runtime before use. Install Git for Windows or set `BASH_EXECUTABLE` to a known-good Bash path when using a custom shell. A broken WSL or Docker Desktop VM must not be mistaken for a MailStack shell-script failure.
+
 ## Pull requests
 
 1. Open an issue for significant behavior, schema or deployment changes.

README.md

@@ -28,7 +28,7 @@
 
 It combines **Postfix**, **Dovecot LMTP**, **Django**, **MariaDB**, **Maildir**, **Gunicorn**, and **Nginx** in a hardened single-node reference deployment. MailStack provides a private browser-based inbox, administrator-managed users, object-level mailbox access, safe email rendering, protected attachments, live inbox updates, operational audit logs, backup and restore tooling, a public website, and an isolated contact service.
 
-> **Release status:** `v1.3.0-rc.1` remains a release candidate. Source, test, security, template, and release tooling are present, but clean Ubuntu 24.04 VPS acceptance and real external SMTP/LMTP verification are required before stable promotion.
+> **Release status:** `v1.3.0-rc.4` remains a release candidate. Clean Ubuntu 24.04 installation and real external SMTP/LMTP delivery have been exercised during the PHASE-003 hardening campaign; backup/restore, restart-recovery, legal, and final release-owner acceptance still gate stable promotion.
 
 ## Why MailStack
 
@@ -211,8 +211,8 @@ Build and verify a deterministic source release:
 ```bash
 python scripts/build_release.py --root .
 python scripts/verify_release.py \
-  dist/mailstack-1.3.0-rc.1-source.zip \
-  --checksum dist/mailstack-1.3.0-rc.1-source.zip.sha256
+  dist/mailstack-1.3.0-rc.4-source.zip \
+  --checksum dist/mailstack-1.3.0-rc.4-source.zip.sha256
 ```
 
 ## Security

ROADMAP.md

@@ -26,6 +26,11 @@ This roadmap is directional. Security, data integrity and backward compatibility
 - Keep planned and future-review screens inactive until architecture and security phases approve them
 - Require responsive, accessibility, security, regression, documentation and CI evidence for each page
 
+## 1.3 RC hardening
+
+- PHASE-003 qualifies clean-install, reviewed partial-install repair, live-safe verification, and real external SMTP-to-LMTP delivery fixes discovered during Ubuntu 24.04 staging acceptance.
+- Keep 1.3.0-rc.4 as a release candidate until backup/restore, restart-recovery, final security/legal, and release-owner acceptance are complete.
+
 ## 1.3 stable
 
 - Promote the verified release candidate without feature removal

SECURITY.md

@@ -6,7 +6,10 @@ Security fixes are applied to the latest tagged release candidate or stable rele
 
 | Version | Support status |
 |---|---|
-| 1.3.0-rc.1 | Supported release candidate |
+| 1.3.0-rc.4 | Supported release candidate |
+| 1.3.0-rc.3 | Superseded release candidate |
+| 1.3.0-rc.2 | Superseded release candidate |
+| 1.3.0-rc.1 | Superseded release candidate |
 | 1.2.x | Legacy deployment assets retained; security support is best-effort |
 | Older versions | Unsupported |
 

VERSION

@@ -1 +1 @@
-1.3.0-rc.1
+1.3.0-rc.4

deployment/templates/dovecot/99-vibmail.conf.tpl

@@ -11,7 +11,7 @@ ssl_key = </etc/letsencrypt/live/{{CERT_NAME}}/privkey.pem
 
 userdb {
   driver = static
-  args = uid=5000 gid=5000 home=/var/vmail/%d/%n
+  args = uid=5000 gid=5000 home=/var/vmail/%d/%n allow_all_users=yes
 }
 
 service lmtp {

design/DESIGN_MANIFEST.json

@@ -561,7 +561,7 @@
     "unsupported_features_inactive": true
   },
   "project": "MailStack",
-  "release_version": "1.3.0-rc.1",
+  "release_version": "1.3.0-rc.4",
   "schema_version": 1,
   "source_archive": {
     "archive_crc": "PASS",

docs/BUILD.md

@@ -20,8 +20,8 @@ python scripts/forensic_audit.py --root . --full
 ```bash
 python scripts/build_release.py --root .
 python scripts/verify_release.py \
-  dist/mailstack-1.3.0-rc.1-source.zip \
-  --checksum dist/mailstack-1.3.0-rc.1-source.zip.sha256
+  dist/mailstack-1.3.0-rc.4-source.zip \
+  --checksum dist/mailstack-1.3.0-rc.4-source.zip.sha256
 ```
 
 The builder normalizes archive timestamps, preserves executable permissions, writes a source manifest, excludes generated/runtime artifacts and emits a SHA-256 checksum.

docs/DEPENDENCY_REVIEW.md

@@ -11,6 +11,7 @@
 | gunicorn | 25.1.0 | MIT | WSGI server |
 | mysqlclient | 2.2.7 | GPL-2.0-or-later | MariaDB/MySQL adapter |
 | python-dotenv | 1.2.2 | BSD-3-Clause | Environment loading |
+| sqlparse | 0.6.0 | BSD-3-Clause | Django SQL parsing dependency |
 | WhiteNoise | 6.11.0 | MIT | Static-file fallback |
 
 Transitive runtime versions are pinned in `mailbox-app/requirements/locked.txt`. Development tooling is pinned in `requirements/development.txt` and includes pytest, coverage, Ruff, Bandit and pip-audit.
@@ -24,4 +25,10 @@ No obvious conflict was identified between the declared direct dependency licens
 
 ## Vulnerability review
 
-`pip check` passes. Django is pinned to 5.2.16, the July 2026 security maintenance release for the 5.2 LTS line. The blocking network-enabled `pip-audit` gate passed in GitHub Actions run `30133728843` for commit `1e1737edea2e6c922265a15d8584b56671820c65` and remains mandatory for future changes.
+Django remains pinned to 5.2.16, the July 2026 security maintenance release for the 5.2 LTS line.
+GitHub Actions run `32053931714` on PHASE-003 RC2 passed the structural and repository gates but the
+blocking `pip-audit` step found CVE-2026-71491, CVE-2026-59894, CVE-2026-59893, and CVE-2026-54284
+in `sqlparse==0.5.5`. RC3 introduced and RC4 preserves `sqlparse==0.6.0`, the upstream security release fixing those findings.
+Django 5.2.16 permits `sqlparse>=0.3.1`, and sqlparse 0.6.0 supports Python 3.10+, including
+MailStack's required Python 3.12 runtime. `pip check` and the network-enabled blocking `pip-audit`
+gate remain mandatory for RC4 qualification; no advisory is ignored or suppressed.

docs/FORENSIC_AUDIT_REPORT.md

@@ -1,9 +1,9 @@
-# Forensic audit report — MailStack 1.3.0 RC1
+# Forensic audit report — MailStack 1.3.0 RC3
 
-**Baseline audit date:** 2026-07-25
-**Release version:** `1.3.0-rc.1`
+**PHASE-003 audit date:** 2026-08-17
+**Release version:** `1.3.0-rc.4`
 **Target runtime:** Ubuntu Server 24.04 LTS and CPython 3.12
-**Release classification:** CI-qualified and clean-clone-qualified open-source release candidate
+**Release classification:** locally structurally qualified release candidate; dependency-backed RC3 CI requalification pending
 
 ## Executive disposition
 
@@ -26,13 +26,13 @@
 | Installer and operations contract tests | PASS |
 | Template rendering and placeholder validation | PASS |
 | Forensic file/symbol inventory | PASS |
-| Deterministic release ZIP, manifest and checksum | PASS in GitHub CI |
-| Online dependency advisory query | PASS in GitHub CI |
-| Clean Ubuntu 24.04 full-stack acceptance | PENDING external VPS |
-| Real inbound SMTP/LMTP acceptance | PENDING external VPS |
+| Deterministic release ZIP, manifest and checksum | PENDING RC4 CI; deterministic local build/verification required before patch handoff |
+| Online dependency advisory query | PENDING RC4 rerun — RC2 run `32053931714` failed on sqlparse 0.5.5; RC3/RC4 pin 0.6.0 |
+| Clean Ubuntu 24.04 RC3 full-stack acceptance | PENDING exact-RC3 clean VPS requalification |
+| Real inbound SMTP/LMTP acceptance | PASS in staging after equivalent PHASE-003 LMTP hotfix; exact-RC3 clean requalification pending |
 | Copyright ownership/license confirmation | PENDING release owner |
 
-**OPEN_SOURCE_RELEASE_CANDIDATE:** PASS
+**OPEN_SOURCE_RELEASE_CANDIDATE:** PENDING RC4 CI
 **PRODUCTION_ACCEPTANCE:** PENDING
 
 ## Audited scope
@@ -96,10 +96,11 @@ See `FEATURE_MATRIX.md` for the feature-by-feature verification record.
 15. The complete 25-image UI and logo archive is preserved with stable IDs, SHA-256 hashes, PNG structural validation, scope classification, and CI enforcement.
 16. PHASE-002 adds the frozen runtime design tokens, responsive authenticated and sign-in shells, local SVG assets, accessible navigation behavior, and focused UI contract gates without changing page business logic.
 17. Cross-platform verification now closes contact-service SQLite handles deterministically, preserves POSIX-only permission assertions, and subjects the standalone contact service to Ruff and Bandit in both the full forensic gate and CI.
+18. RC3 updates the vulnerable transitive sqlparse 0.5.5 lock to upstream 0.6.0 after the blocking PHASE-003 CI advisory scan identified four 2026 CVEs; no advisory suppression or application behavior change is introduced.
 
 ## Automated evidence
 
-- Django tests: **195 passed, 1 capability-based skip, 0 failed**
+- Last completed pre-RC3 Django suite: **195 passed, 1 capability-based skip, 0 failed**; RC3 full rerun pending
 - Application coverage: **94.99%**; minimum: **85%**
 - Ruff: **PASS**
 - Bandit: **PASS**
@@ -121,7 +122,12 @@ The authoritative repository qualification is GitHub Actions run `30133728843` o
 
 Verified controls include root-only generated secrets, strict configuration validation, Argon2 password hashing, CSRF and secure-cookie controls, login throttling, object-level mailbox authorization, safe HTML sanitization, protected attachments, receive-only SMTP, no public registration, no IMAP/POP3/submission in the reference deployment, MariaDB least privilege, systemd sandboxing, safe archive extraction, checksum verification and fail-closed CI/release gates.
 
-The network-enabled `pip-audit` command passed as a blocking step in GitHub Actions run `30133728843`. Future dependency changes must continue to pass the locked dependency, `pip check`, and online advisory gates.
+The historical pre-PHASE-003 `pip-audit` gate passed in GitHub Actions run `30133728843`.
+For the current PHASE-003 branch, run `32053931714` failed at the blocking advisory step because
+`sqlparse==0.5.5` was newly reported for CVE-2026-71491, CVE-2026-59894, CVE-2026-59893, and
+CVE-2026-54284. RC3 pins upstream sqlparse 0.6.0, which contains those security fixes. The RC3
+dependency audit, `pip check`, and all downstream CI gates remain mandatory; no vulnerability is
+ignored or waived.
 
 ## Performance review
 
@@ -141,6 +147,28 @@ mail-flow, ingestion schema, deployment-template, or package change. Local depen
 and coverage passed; the final overwrite verifier must pass before commit, and GitHub Actions must
 pass before remote qualification.
 
+## PHASE-003 audit boundary
+
+PHASE-003 changes only installer/recovery behavior, the Dovecot LMTP static-userdb template,
+one-shot ingestion verification semantics, narrowly qualified production MariaDB warnings, focused
+management-command/test contracts, release metadata, and required documentation. It adds no database
+migration, dependency, UI page, URL, permission model, outbound mail path, or data transformation.
+
+The structural forensic gate passes with zero blocking findings after regenerating the deterministic
+file inventory. RC4 additionally centralizes verified Bash runtime discovery for repository-level
+installer, operations, and forensic tooling: Windows prefers Git for Windows Bash over the WSL
+launcher, while Linux keeps the system Bash contract. This prevents an unavailable WSL/Docker
+Desktop backing disk from being reported as multiple MailStack shell syntax defects. A subsequent
+Windows run proved Git Bash selection was correct but exposed a second host-compatibility edge: the
+Windows Python installation provided `python` but no Git-Bash-visible `python3` command. The RC4
+audit harness now uses a process-local `BASH_ENV` bridge to map `python3` to the exact interpreter
+running the test harness on Windows only; `install.sh` and Ubuntu's production `python3` behavior
+remain unchanged. Dependency-free documentation, design, UI-foundation, template, installer,
+operations, Python compile, and shell-syntax gates pass locally. Dependency-backed
+Django/Ruff/Bandit/coverage and full-forensic qualification remain blocking in GitHub Actions because
+the local artifact builder does not contain or have network access to the pinned development
+environment.
+
 ## External acceptance gates
 
 Before stable promotion:
@@ -149,8 +177,8 @@ Before stable promotion:
 2. Preserve the successful GitHub CI baseline and require every subsequent release commit to pass all blocking gates.
 3. Install on a clean isolated Ubuntu Server 24.04 VPS.
 4. Verify DNS, MX, PTR/rDNS, TLS, firewall, unknown-recipient rejection, LMTP delivery, ingestion, authorization, contact delivery, backup, restore and restart recovery.
-5. Publish the first version as `v1.3.0-rc.1`; promote to stable only after acceptance.
+5. Publish `v1.3.0-rc.4` only after its blocking CI gates pass; promote to stable only after the remaining acceptance gates pass.
 
 ## Final classification
 
-The repository is approved for public publication as **MailStack 1.3.0 RC1**, not yet as a proven stable production release.
+The repository remains a **MailStack 1.3.0 RC4 release candidate**, not yet a proven stable production release. PHASE-003 source qualification is complete only when its blocking GitHub Actions run passes.