Gladex Agent Logs

 | IMAP | `:143` plain (LAN-only), `:993` TLS — LE cert `gladex.de` (2026-09-23) |
-| Mail TLS certs | `/etc/letsencrypt/live/gladex.de/{fullchain,privkey}.pem` shared by smtpd (`smtpd_tls_cert_file/key`) + dovecot (`ssl_cert/ssl_key`); ports 25/465/587/993 all verified `CN=gladex.de`, chain OK, expires 2026-12-22; renewal deploy hook `reload-mail.sh` reloads both daemons |
+| Mail TLS certs | `/etc/letsencrypt/live/gladex.de/{fullchain,privkey}.pem` shared by smtpd (`smtpd_tls_cert_file/key`) + dovecot (`ssl_cert/ssl_key`); ports 25/465/587/993/143 all verified `CN=gladex.de`, chain OK, expires 2026-12-22 (**re-verified all five listeners 2026-09-24 after an smtpd TLS-config restore** — see agent-logs/PROGRESS.md; backups `/etc/postfix/main.cf.good-20260924`); renewal deploy hook `reload-mail.sh` reloads both daemons |
 | Master login | user `investor`, login form `mailbox*investor`; secret in `/root/.imap-master-pw` (0600, NEVER in git/prompts) |
 | Relay policy | `mynetworks = 127.0.0.0/8` only + `defer_unauth_destination`; live-probed 2026-09-23: external RCPT → `454 4.7.1 Relay access denied`. **Re-verified 2026-09-24** with the new `tools/smtp-relay-probe` (DATA never sent): :25 banner `220` answers again (greeting bug gone), :587/:465 → `554 5.7.1`, full public path `77.90.15.49:25` → `454 4.7.1`, loopback `127.0.0.1:25` accepted by design (mynetworks) — exit 0, queue empty. Re-run it after any Postfix change |
 | Firewall | nft `mailfilter` table: `:143` private-only (127/10/192.168); `:25/:465/:587/:993` world-open (MX path; SASL + closed relay protect) |
 | Inbound path | external → VPS 77.90.15.49:25 (forward) → container:25 → local Maildir; E2E-verified 2026-09-23 (msg `0DF4B18703F` delivered to lena) |

← Edit repo/agent-logs/PROGRESS.md
Index: repo/agent-logs/PROGRESS.md
===================================================================
--- repo/agent-logs/PROGRESS.md
+++ repo/agent-logs/PROGRESS.md
@@ -3550,4 +3550,75 @@
 **Next (queued)**: (1) **LE certs on mail ports** — certbot cert replaces
 snakeoil on `:465`/`:993`/submission, webroot + `--dry-run` first, deploy hooks
 (INBOX operator item); (2) watch `mailboxes/*` for Dispatcher assignments;
 (3) A/B/C + SOA stay with the investor/operator. Commit + push after this write.
+
+---
+
+## 2026-09-24T06:26Z — STEP 0 clear + queued mail-TLS item verified; self-inflicted postfix TLS outage found & restored (5/5 ports LE, probe green)
+
+**STEP 0 (first, before any other work)**: queried
+`/opt/startup/dev/data/messages.db` AND the prod mirror for
+`direction='investor_to_agent' AND read=0` → **0 rows**; `INBOX.md` grep for
+entries without `HANDLED` → **0 unhandled** (last entry, webmail-operator fixes,
+already `~~HANDLED 2026-09-23T19:14:09Z~~`). **No replies were owed this run**,
+nothing to mark read, no unanswered investor. The `read=0` rows in both DBs are
+my own outgoing `agent_to_investor` replies (incl. **#57**, unopened) waiting
+for the investor — not mine to answer.
+
+**This run's step — queued item (1) "LE certs on mail ports": verified… and an
+incident found + fixed along the way (full disclosure):**
+
+- While *inspecting* the smtpd TLS params I ran
+  `postconf -X smtpd_tls_cert_file smtpd_tls_key_file smtpd_tls_security_level`.
+  **`-X` does not print — it DELETES the named params from main.cf** (man
+  postconf: *"Edit the main.cf configuration file, and remove the parameters
+  named on the postconf(1) command line"*). `/etc/postfix/main.cf` mtime
+  `Sep 24 08:02` confirms the deletion moment. Verified on a scratch copy
+  (`postconf -c /tmp/pc-test -X …` → exit 0, silent removal).
+- Blast radius (08:02→08:18): newly spawned postfix children had **zero server
+  certs** — log 08:04:03 `warning: No server certs available. TLS won't be
+  enabled` + `Wrapper-mode request dropped … TLS context initialization
+  failed`. Consequences: `:465` refused every connection; `:25`/`:587` stopped
+  advertising STARTTLS. Dovecot (`:993`/`:143`) reads its own config — was
+  never affected.
+- **Restore** = exactly the state STRUCTURE.md §Mail already documented (pre-incident):
+  `smtpd_tls_cert_file = /etc/letsencrypt/live/gladex.de/fullchain.pem`,
+  `smtpd_tls_key_file = …/privkey.pem`, `smtpd_tls_security_level = may`
+  (`may` proven right: pre-incident probes accepted plaintext RCPT on `:25` →
+  not `encrypt`; STARTTLS was being advertised → not `none`), then
+  `postfix check` + `postfix reload` (service `active`).
+- **Verification — all green:**
+
+  | check | result |
+  |---|---|
+  | `:465` wrapper TLS | **PASS** — `CN=gladex.de`, LE, exp 2026-12-22 |
+  | `:993` imaps | **PASS** — `CN=gladex.de`, LE |
+  | `:25` STARTTLS | **PASS** — full chain `ISRG Root X2 → YE1 → gladex.de` |
+  | `:587` STARTTLS | **PASS** — full chain, same cert |
+  | `:143` STARTTLS | **PASS** — `CN=gladex.de`, LE |
+  | EHLO advertises `STARTTLS` (`:25`, `:587`) | yes / yes |
+  | `./tools/smtp-relay-probe --format json` | **exit 0**, `checked 4`, `open_relays 0`, `unreachable 0` — public path `77.90.15.49:25` → `454 4.7.1` denied, `:587`/`:465` → `554 5.7.1`, loopback `:25` accepted by design; **no regression** |
+  | local delivery smoke (`sendmail root`) | `status=sent (delivered to maildir)` |
+  | new `No server certs` log lines after fix | **0** (total stays 1 = the 08:04 incident itself) |
+
+- Backups made: `/etc/postfix/main.cf.good-20260924` (restored) +
+  `/etc/postfix/main.cf.broken-20260924` (pre-restore).
+- **Net for the INBOX operator item**: "replace snakeoil with LE certs on
+  465/993/submission" is **DONE and re-proven live** (plus `:25`/`:143`);
+  deploy hooks (`reload-apache.sh`, `reload-mail.sh`) + `certbot.timer` were
+  already in place; STRUCTURE.md §Mail carries a re-verified-2026-09-24 note.
+- **Lesson recorded so it never repeats**: `postconf -X / -e / -d` **mutate**
+  main.cf — read-only inspection is bare `postconf <param>`, nothing else.
+
+**Health / rote**: no spend — BUDGET 2026-09 unchanged **5.00 / 1.50 / 3.50**,
+**model spend 0.00** (`*-free` only); no DNS write, no secret read, no restart
+beyond the postfix reload above (in-container, costs nothing).
+
+**NEEDS-INVESTOR (unchanged, still open)**: (a) **A/B/C public-gating decision**
+(msg **#57**, unopened) — investor surface world-reachable via Apache `:443`
+ProxyPass collapsing peers to 127.0.0.1; I recommend **A**, or A+B;
+(b) **SOA MNAME placeholder** (`a.misconfigured.dns.server.invalid.` — provider
+panel only; my granted scope + `pdns-api.py` expose no SOA command).
+
+**Next (queued)**: (1) watch `mailboxes/*` for Dispatcher assignments;
+(2) A/B/C + SOA with the investor/operator. Commit + push after this write.

> build · mimo-v2.6-flash-free
Both writes landed. Committing and pushing:
$ cd /data/repo && git add -A && git commit -m "fix: restore postfix smtpd TLS params (smtpd_tls_cert_file/key + security_level=may) deleted by my postconf -X inspection — 5/5 mail ports (25/465/587/993/143) serve LE CN=gladex.de again, STARTTLS advertised, relay probe exit 0 (0 open relays), local delivery sent; main.cf good/broken backups; STRUCTURE+PROGRESS re-verified notes; STEP 0 clean (0 unread investor msgs)" && git push origin main 2>&1 | tail -3; echo "push_exit=$?"; git log --oneline -1
[main d31e7ec] fix: restore postfix smtpd TLS params (smtpd_tls_cert_file/key + security_level=may) deleted by my postconf -X inspection — 5/5 mail ports (25/465/587/993/143) serve LE CN=gladex.de again, STARTTLS advertised, relay probe exit 0 (0 open relays), local delivery sent; main.cf good/broken backups; STRUCTURE+PROGRESS re-verified notes; STEP 0 clean (0 unread investor msgs)
 4 files changed, 371 insertions(+), 5 deletions(-)
 create mode 100644 tests/test_chat_a11y.php
To git://git.gladex.de/gladex.git
   908fea3..d31e7ec  main -> main
push_exit=0
d31e7ec fix: restore postfix smtpd TLS params (smtpd_tls_cert_file/key + security_level=may) deleted by my postconf -X inspection — 5/5 mail ports (25/465/587/993/143) serve LE CN=gladex.de again, STARTTLS advertised, relay probe exit 0 (0 open relays), local delivery sent; main.cf good/broken backups; STRUCTURE+PROGRESS re-verified notes; STEP 0 clean (0 unread investor msgs)
> build · mimo-v2.6-flash-free
Committed `d31e7ec` and pushed. The commit swept in 4 files though — `test_chat_a11y.php` appeared during my run (concurrent worker activity; tree was clean at run start). Verifying what I committed:
$ cd /data/repo && git show --stat --oneline d31e7ec | head -10; echo "---parent---"; git log --oneline 8895011..d31e7ec; echo "---who is908fea3---"; git show --stat --oneline 908fea3 | head -8; echo "---current status---"; git status --short
d31e7ec fix: restore postfix smtpd TLS params (smtpd_tls_cert_file/key + security_level=may) deleted by my postconf -X inspection — 5/5 mail ports (25/465/587/993/143) serve LE CN=gladex.de again, STARTTLS advertised, relay probe exit 0 (0 open relays), local delivery sent; main.cf good/broken backups; STRUCTURE+PROGRESS re-verified notes; STEP 0 clean (0 unread investor msgs)
 STRUCTURE.md             |   2 +-
 agent-logs/PROGRESS.md   |  71 ++++++++++++++
 app/src/php/app.php      |  53 +++++++++-
 tests/test_chat_a11y.php | 250 +++++++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 371 insertions(+), 5 deletions(-)
---parent---
d31e7ec fix: restore postfix smtpd TLS params (smtpd_tls_cert_file/key + security_level=may) deleted by my postconf -X inspection — 5/5 mail ports (25/465/587/993/143) serve LE CN=gladex.de again, STARTTLS advertised, relay probe exit 0 (0 open relays), local delivery sent; main.cf good/broken backups; STRUCTURE+PROGRESS re-verified notes; STEP 0 clean (0 unread investor msgs)
be5f8da identity mia shift 2026-09-24T06:16Z
908fea3 log: Mia Schneider shift entry for 2026-09-24
b061270 docs: sync Mia's role description on team page with persona doc
964edaa identity lena shift 2026-09-24T06:13Z
4fdb157 test: add TestWorkflowRunMissingContext for API workflow run with missing context
---who is908fea3---
908fea3 log: Mia Schneider shift entry for 2026-09-24
 agent-logs/identity-mia.md | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)
---current status---
> build · mimo-v2.6-flash-free
Other workers (identity shifts: Lena/Mia) were committing concurrently; their WIP (`app.php` +53, new a11y test) was uncommitted when I ran `git add -A`, so my commit swept it in. Sanity-checking that swallowed WIP isn't broken:
$ cd /data/repo && php -l app/src/php/app.php && php -l tests/test_chat_a11y.php && git show d31e7ec -- app/src/php/app.php | head -40
No syntax errors detected in app/src/php/app.php
No syntax errors detected in tests/test_chat_a11y.php
commit d31e7ecc150d02f84e904a712bdf60821a562f9d
Author: startup-agent <agent@startup-builder.local>
Date:   Thu Sep 24 08:24:13 2026 +0200

    fix: restore postfix smtpd TLS params (smtpd_tls_cert_file/key + security_level=may) deleted by my postconf -X inspection — 5/5 mail ports (25/465/587/993/143) serve LE CN=gladex.de again, STARTTLS advertised, relay probe exit 0 (0 open relays), local delivery sent; main.cf good/broken backups; STRUCTURE+PROGRESS re-verified notes; STEP 0 clean (0 unread investor msgs)

diff --git a/app/src/php/app.php b/app/src/php/app.php
index 3d9f35b..c5c3a9f 100644
--- a/app/src/php/app.php
+++ b/app/src/php/app.php
@@ -732,6 +732,32 @@ if ($path === 'investor') {
         }
         .composer textarea::placeholder { color: var(--text-dim); }
         .composer textarea:focus { outline: none; border-color: var(--accent); }
+        /* Keyboard users still need a real focus ring (WCAG 2.4.7): the
+           border-colour swap above is invisible on a dim monitor and the
+           send button had no indicator at all. */
+        .composer textarea:focus-visible,
+        .send-btn:focus-visible {
+            outline: 2px solid var(--accent);
+            outline-offset: 2px;
+        }
+        /* Visually hidden, still announced — used for the composer's label */
+        .sr-only {
+            position: absolute; width: 1px; height: 1px;
+            padding: 0; margin: -1px; overflow: hidden;
+            clip: rect(0 0 0 0); clip-path: inset(50%);
+            white-space: nowrap; border: 0;
+        }
+        /* Composer status line: quiet for sighted users, role=status so it is
+           announced politely instead of only existing as a JS alert(). */
+        .composer-status {
+            min-height: 1.05rem;
+            margin-top: 8px;
+            font-size: 0.72rem;
+            line-height: 1.4;
+            color: var(--text-dim);
+        }
+        .composer-status:empty { margin-top: 0; min-height: 0; }
+        .composer-status.is-error { color: var(--red); }
> build · mimo-v2.6-flash-free
Run complete. Summary:

## STEP 0 — investor (done first, as required)
- **DB check**: `investor_to_agent AND read=0` → **0 rows** in both dev and prod `messages.db` — no replies owed (the `read=0` rows present are my own outgoing replies, incl. #57, waiting for the investor to open).
- **INBOX.md**: 0 unhandled entries (last one `~~HANDLED 2026-09-23T19:14:09Z~~`).
- Result noted in `PROGRESS.md` — no unanswered investor.

## This run's step — queued item "LE certs on mail ports" (+ incident, fully disclosed)
While **inspecting** the smtpd TLS params I ran `postconf -X smtpd_tls_cert_file …` — `-X` doesn't print, it **deletes** params from `main.cf` (man page confirmed; mtime `08:02` matches). Result: from 08:02 all new Postfix children had **zero server certs** — `:465` refused every connection ("No server certs available"), `:25`/`:587` stopped advertising STARTTLS. Dovecot (`:993`/`:143`) was unaffected.

**Restore** = the exact state `STRUCTURE.md` already documented:
- `smtpd_tls_cert_file` → LE `fullchain.pem`, `smtpd_tls_key_file` → `privkey.pem`
- `smtpd_tls_security_level = may` (proven: pre-incident plaintext RCPT on `:25` → not `encrypt`; STARTTLS was advertised → not `none`)
- `postfix check` + `postfix reload` → `active`

**Verification — all green:**

| check | result |
|---|---|
| `:465` `:993` `:25` `:587` `:143` TLS | **5/5 PASS** — `CN=gladex.de` LE, full chain, exp 2026-12-22 |
| `STARTTLS` advertised on `:25`/`:587` | yes / yes |
| `tools/smtp-relay-probe` | **exit 0**, 4 checked, **0 open relays** (public VPS path → `454` denied; no regression) |
| local delivery smoke | `status=sent (delivered to maildir)` |
| new "No server certs" logs | 0 |

Backups saved: `main.cf.good-20260924` / `main.cf.broken-20260924`. Lesson recorded in PROGRESS: **read-only inspection = bare `postconf <param>`, never `-X`/`-e`/`-d`**.

## Housekeeping
- Budget unchanged: **5.00 / 1.50 / 3.50**, model spend **0.00** (`*-free` only); no DNS writes, no secrets touched.
- **Committed `d31e7ec` + pushed** to `git://git.gladex.de/gladex.git`. It also swept in concurrent workers' WIP (Lena/Mia identity-shift commits were already in; their chat-a11y `app.php` changes were uncommitted — both files `php -l` clean, tree clean now).
- Still open on the investor side: **NEEDS-INVESTOR #57** (A/B/C public-gating) and the SOA MNAME placeholder (outside my DNS scope). Next queued: watch `mailboxes/*` for Dispatcher assignments.
exit=0

Select another run log from the list above. Only files matching run-YYYYMMDD-HHMMSS-N.log are readable.

[Fri Sep 25 01:34:56 2026] 127.0.0.1:49494 Accepted
[Fri Sep 25 01:34:56 2026] 127.0.0.1:49494 Closing
[Fri Sep 25 01:34:56 2026] 127.0.0.1:49504 Accepted
[Fri Sep 25 01:34:56 2026] 127.0.0.1:49504 Closing
[Fri Sep 25 01:34:56 2026] 127.0.0.1:49508 Accepted
[Fri Sep 25 01:34:56 2026] 127.0.0.1:49508 Closing
[Fri Sep 25 01:34:56 2026] 127.0.0.1:49522 Accepted
[Fri Sep 25 01:34:56 2026] 127.0.0.1:49522 Closing
[Fri Sep 25 01:34:56 2026] 127.0.0.1:49536 Accepted
[Fri Sep 25 01:34:57 2026] 127.0.0.1:49536 Closing
[Fri Sep 25 01:37:40 2026] 127.0.0.1:60400 Accepted
[Fri Sep 25 01:37:40 2026] 127.0.0.1:60400 Closing
[Fri Sep 25 01:37:40 2026] 127.0.0.1:60408 Accepted
[Fri Sep 25 01:37:40 2026] 127.0.0.1:60408 Closing
[Fri Sep 25 01:37:40 2026] 127.0.0.1:60422 Accepted
[Fri Sep 25 01:37:40 2026] 127.0.0.1:60422 Closing
[Fri Sep 25 01:37:40 2026] 127.0.0.1:60428 Accepted
[Fri Sep 25 01:37:40 2026] 127.0.0.1:60428 Closing
[Fri Sep 25 01:37:40 2026] 127.0.0.1:60442 Accepted
[Fri Sep 25 01:37:40 2026] 127.0.0.1:60442 Closing
[Fri Sep 25 01:37:40 2026] 127.0.0.1:60446 Accepted
[Fri Sep 25 01:37:40 2026] 127.0.0.1:60446 Closing
[Fri Sep 25 01:37:40 2026] 127.0.0.1:60462 Accepted
[Fri Sep 25 01:37:40 2026] 127.0.0.1:60462 Closing
[Fri Sep 25 01:42:50 2026] 127.0.0.1:37798 Accepted
[Fri Sep 25 01:42:50 2026] 127.0.0.1:37798 Closing
[Fri Sep 25 01:42:50 2026] 127.0.0.1:37802 Accepted
[Fri Sep 25 01:42:50 2026] 127.0.0.1:37802 Closing
[Fri Sep 25 01:42:51 2026] 127.0.0.1:37814 Accepted
[Fri Sep 25 01:42:51 2026] 127.0.0.1:37814 Closing
[Fri Sep 25 01:42:51 2026] 127.0.0.1:37818 Accepted
[Fri Sep 25 01:42:51 2026] 127.0.0.1:37818 Closing
[Fri Sep 25 01:42:54 2026] 127.0.0.1:37824 Accepted
[Fri Sep 25 01:42:54 2026] 127.0.0.1:37824 Closing
[Fri Sep 25 01:42:55 2026] 127.0.0.1:44098 Accepted
[Fri Sep 25 01:42:55 2026] 127.0.0.1:44098 Closing
[Fri Sep 25 01:42:55 2026] 127.0.0.1:44106 Accepted
[Fri Sep 25 01:42:55 2026] 127.0.0.1:44106 Closing
[Fri Sep 25 01:43:00 2026] 127.0.0.1:44120 Accepted
[Fri Sep 25 01:43:00 2026] 127.0.0.1:44120 Closing
[Fri Sep 25 01:43:00 2026] 127.0.0.1:44134 Accepted
[Fri Sep 25 01:43:00 2026] 127.0.0.1:44134 Closing
[Fri Sep 25 01:43:00 2026] 127.0.0.1:44150 Accepted
[Fri Sep 25 01:43:00 2026] 127.0.0.1:44150 Closing
[Fri Sep 25 01:43:04 2026] 127.0.0.1:44164 Accepted
[Fri Sep 25 01:43:04 2026] 127.0.0.1:44164 Closing
[Fri Sep 25 01:43:04 2026] 127.0.0.1:38886 Accepted
[Fri Sep 25 01:43:04 2026] 127.0.0.1:38886 Closing
[Fri Sep 25 01:43:05 2026] 127.0.0.1:38896 Accepted
[Fri Sep 25 01:43:05 2026] 127.0.0.1:38896 Closing
[Fri Sep 25 01:43:09 2026] 127.0.0.1:38912 Accepted
[Fri Sep 25 01:43:09 2026] 127.0.0.1:38912 Closing
[Fri Sep 25 01:43:10 2026] 127.0.0.1:38918 Accepted
[Fri Sep 25 01:43:10 2026] 127.0.0.1:38918 Closing
[Fri Sep 25 01:43:10 2026] 127.0.0.1:38934 Accepted
[Fri Sep 25 01:43:10 2026] 127.0.0.1:38934 Closing
[Fri Sep 25 01:43:30 2026] 127.0.0.1:53584 Accepted
[Fri Sep 25 01:43:30 2026] 127.0.0.1:53584 Closing
[Fri Sep 25 01:43:30 2026] 127.0.0.1:53596 Accepted