claude-mail: retire secret phrase — allowlist + DKIM is the gate

4294bd680900c5188dffdf1eca261028fbabe40c · 2026-07-16 09:12:56 -0700 · Steve

Steve 2026-07-16: allowlisted senders (Dave + all George agent accounts) no
longer need the Dust2026 subject phrase. The allowlist already hard-rejects
non-allowlisted senders, so the phrase was a redundant second factor on trusted
mail. Gate is now: on the allowlist AND DKIM/DMARC-aligned. (.env ALLOWED_SENDERS
gained theagentabrams@gmail.com; .env is gitignored so not in this commit.)

Files touched

M lib.js

Diff

commit 4294bd680900c5188dffdf1eca261028fbabe40c
Author: Steve <steve@designerwallcoverings.com>
Date:   Thu Jul 16 09:12:56 2026 -0700

    claude-mail: retire secret phrase — allowlist + DKIM is the gate
    
    Steve 2026-07-16: allowlisted senders (Dave + all George agent accounts) no
    longer need the Dust2026 subject phrase. The allowlist already hard-rejects
    non-allowlisted senders, so the phrase was a redundant second factor on trusted
    mail. Gate is now: on the allowlist AND DKIM/DMARC-aligned. (.env ALLOWED_SENDERS
    gained theagentabrams@gmail.com; .env is gitignored so not in this commit.)
---
 lib.js | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/lib.js b/lib.js
index 59af214..dfbf2cf 100644
--- a/lib.js
+++ b/lib.js
@@ -29,10 +29,10 @@ const cfg = {
 };
 
 // ---- Sender gate -----------------------------------------------------------
-// Returns { ok: bool, reason: string }. Three independent locks:
-//  1) From address in allowlist
-//  2) Subject contains the secret phrase (as [ok:PHRASE] or bare PHRASE)
-//  3) Inbound mail passed DKIM or DMARC (anti-spoof) — unless REQUIRE_AUTH_PASS=false
+// Returns { ok: bool, reason: string }. Two locks (Steve 2026-07-16 — secret
+// phrase retired, "allowlist = enough"):
+//  1) From address in allowlist (hard-rejects everyone else)
+//  2) Inbound mail passed DKIM or DMARC (anti-spoof) — unless REQUIRE_AUTH_PASS=false
 function gate(parsed) {
   const from = (parsed.from?.value?.[0]?.address || '').toLowerCase();
   if (!from) return { ok: false, reason: 'no From address' };

← 3edd995 auto-save: 2026-07-16T09:12:20 (1 files) — lib.js · back to Claude Mail · chore: version bump v1.1.0 (session close — retire secret ph 8ab0622 →