Repository navigation
Stage mail storage and verification before administration activation #5365
Description
🤖 Generated by the Agentic Engineer
Description
Private mail administration needs its verification and retained-storage prerequisites delivered before the application is enabled. Combining both changes in #5351 prevents the existing production deployment sequence from finishing.
Steps to Reproduce
- Start the normal protected deployment with the new mail publisher policy and administration activation in the same change.
- Application reconciliation waits for mail to become healthy.
- The node configuration update that installs the required verification rule runs after that reconciliation.
Expected Behavior
The reviewed verification, credential and storage prerequisites converge before a separate deployment enables mail administration. Existing images retain their signer requirements, and the standard deployment sequence stays intact.
Actual Behavior
The dependent service cannot finish startup during the same deployment. Recovery restores application health, but retained storage needs an explicit owner in reviewed main. No public mailbox migration or routing cutover has occurred.
Environment
The repository's protected production merge queue and current private-mail administration candidate #5351.
Acceptance Criteria
- Deliver verification, credential and retained-storage prerequisites separately while production mail activation remains disabled.
- Verify the retained namespace and claim are owned by Flux through recovery, with their existing identities and data preserved.
- Verify the exact declared verification decisions on every node after the normal protected deployment.
- Verify production health and then deliver feat(mail): activate Stalwart administration and Homepage entry #5351 against that prerequisite, with observed browser acceptance.
Related to #5030. Part of devantler-tech/monorepo#4053.
Metadata
Metadata
Assignees
Labels
Type
Fields
Priority
Effort
Projects
- Status
Activity
chore: agent-claim #5365 nonce=d6695a925a8fb8390cec85780856d988
devantler commentedon Oct 26, 2026
The prerequisite is isolated in draft #5367, with administration activation retained in #5351. The old policy fails the credential and signer checks; the staged policy passes the full routing, preparation, credential-bridge, inventory and liveness regressions. Priority High reflects the migration it unblocks; Effort Medium includes two protected deployments and observed verification. Service class is Standard, with first work recorded on 2026-10-26.
[-]Deliver mail verification prerequisites before administration activation[/-][+]Stage mail storage and verification before administration activation[/+]devantler commentedon Oct 26, 2026
Prerequisite #5367 merged as 2684b3b after protected deployment 40329484074 passed. Production readback matches the complete declared node verification policy. The retained namespace and claim preserve their original identities, full storage specifications and deletion protection, and both are now recorded in the apps inventory.
The complete original-window orphan scan is still unverified: the local reader intentionally lacks the required inventory access. No access was widened and an incomplete read was not accepted as a pass. #5351 now includes a dispatch-only, main-only read-only workflow that runs this fixed recovery check with the existing CI access, serializes with deployments and emits only a bounded verdict. Its new signed head f32489f is awaiting CI and current-head review. Administration deployment, the CI recovery verdict and real browser acceptance remain outstanding, so this issue stays open.
devantler commentedon Oct 26, 2026
The prerequisite deployment in #5367 and administration deployment in #5351 are delivered. The protected production run 40358814150 passed at
b576bca638aa9778a40336e4d8ddfd2e7d96cd07; the original-window read-only recovery check 40363885703 independently returned PASS.The retained namespace and claim keep their existing identities and Flux ownership. All seven current nodes have the exact nine declared verification rules running, and the post-acceptance live-health probe passes. In the real browser, Stalwart appears on Homepage, its link opens the live interface, and the maintainer signed in successfully to Accounts management.
All four acceptance criteria are met. This deployment-ordering bug is complete. #5030 and #5376 remain open for their remaining mail, migration and backup acceptance.