← back to George Gmail
auto-data-snapshot: 2026-08-28T20:07:34 (3 data files) — package-lock.json package.json verification/e2e-proof.json
615c56044404c60794e6e55053831437f8842a86 · 2026-08-28 20:07:44 -0700 · auto-commit-fleet
Files touched
M package-lock.jsonM package.jsonA verification/e2e-proof.json
Diff
commit 615c56044404c60794e6e55053831437f8842a86
Author: auto-commit-fleet <steve@designerwallcoverings.com>
Date: Fri Aug 28 20:07:44 2026 -0700
auto-data-snapshot: 2026-08-28T20:07:34 (3 data files) — package-lock.json package.json verification/e2e-proof.json
---
package-lock.json | 27 +++++++++++++++++++++-
package.json | 6 +++--
verification/e2e-proof.json | 55 +++++++++++++++++++++++++++++++++++++++++++++
3 files changed, 85 insertions(+), 3 deletions(-)
diff --git a/package-lock.json b/package-lock.json
index 6b9c990..9aaacc7 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -11,7 +11,8 @@
"express": "^4.18.2",
"googleapis": "^164.1.0",
"helmet": "^8.1.0",
- "nodemailer": "^8.0.5"
+ "nodemailer": "^8.0.5",
+ "parse5": "7.3.0"
}
},
"node_modules/@isaacs/cliui": {
@@ -360,6 +361,18 @@
"node": ">= 0.8"
}
},
+ "node_modules/entities": {
+ "version": "6.0.1",
+ "resolved": "https://registry.npmjs.org/entities/-/entities-6.0.1.tgz",
+ "integrity": "sha512-aN97NXWF6AWBTahfVOIrB/NShkzi5H7F9r1s9mD3cDj4Ko5f2qhhVoYMibXF7GlLveb/D2ioWay8lxI97Ven3g==",
+ "license": "BSD-2-Clause",
+ "engines": {
+ "node": ">=0.12"
+ },
+ "funding": {
+ "url": "https://github.com/fb55/entities?sponsor=1"
+ }
+ },
"node_modules/es-define-property": {
"version": "1.0.1",
"resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz",
@@ -1088,6 +1101,18 @@
"integrity": "sha512-UEZIS3/by4OC8vL3P2dTXRETpebLI2NiI5vIrjaD/5UtrkFX/tNbwjTSRAGC/+7CAo2pIcBaRgWmcBBHcsaCIw==",
"license": "BlueOak-1.0.0"
},
+ "node_modules/parse5": {
+ "version": "7.3.0",
+ "resolved": "https://registry.npmjs.org/parse5/-/parse5-7.3.0.tgz",
+ "integrity": "sha512-IInvU7fabl34qmi9gY8XOVxhYyMyuH2xUNpb2q8/Y+7552KlejkRvqvD19nMoUW/uQGGbqNpA6Tufu5FL5BZgw==",
+ "license": "MIT",
+ "dependencies": {
+ "entities": "^6.0.0"
+ },
+ "funding": {
+ "url": "https://github.com/inikulin/parse5?sponsor=1"
+ }
+ },
"node_modules/parseurl": {
"version": "1.3.3",
"resolved": "https://registry.npmjs.org/parseurl/-/parseurl-1.3.3.tgz",
diff --git a/package.json b/package.json
index 761d108..cc9b8c9 100644
--- a/package.json
+++ b/package.json
@@ -4,12 +4,14 @@
"description": "George the Gmail Agent — secure email access for DW-Agents",
"main": "server.js",
"scripts": {
- "start": "node server.js"
+ "start": "node server.js",
+ "test": "node test/send-preflight.test.js"
},
"dependencies": {
"express": "^4.18.2",
"googleapis": "^164.1.0",
"helmet": "^8.1.0",
- "nodemailer": "^8.0.5"
+ "nodemailer": "^8.0.5",
+ "parse5": "7.3.0"
}
}
diff --git a/verification/e2e-proof.json b/verification/e2e-proof.json
new file mode 100644
index 0000000..eea70ed
--- /dev/null
+++ b/verification/e2e-proof.json
@@ -0,0 +1,55 @@
+{
+ "intent": "Introduce Phase-1 outbound message classification and fail-closed commercial preflight without breaking legacy transactional, reply, vendor, or operational mail",
+ "risk_tier": "R3",
+ "environment": "isolated George process on localhost:64847; live pm2 George untouched; no Gmail send/draft API invoked",
+ "timestamp": "2026-08-28T20:06:00-07:00",
+ "ticket": "TK-10942-george-outbound-preflight-phase1",
+ "baseline": "The first uncommitted implementation incorrectly applied marketing controls to every external message; parent and compliance review stopped it before commit",
+ "commands": [
+ "node test/send-preflight.test.js",
+ "node --check server.js && node --check lib/send-preflight.js",
+ "PORT=64847 node server.js",
+ "authenticated localhost POST /api/send-preflight for malformed external, compliant commercial, and internal-only payloads",
+ "npm audit --json",
+ "git diff --check"
+ ],
+ "assertions": [
+ {
+ "boundary": "classification",
+ "verdict": "PASS",
+ "evidence": "internal recipients are server-derived exempt; explicit commercial/compliance_required is blocking; legacy external and caller-claimed transactional/reply remain report-only pending migration"
+ },
+ {
+ "boundary": "commercial content validation",
+ "verdict": "PASS",
+ "evidence": "parse5 parsed-tree tests reject hidden/comment/malformed compliance content, empty or hidden labels, attacker recipients, and BCC injection while canonical info@ opt-out passes"
+ },
+ {
+ "boundary": "real local API",
+ "verdict": "PASS",
+ "evidence": "malformed external payload returned 422 with shouldBlock=true and five structured failures; compliant explicit commercial returned 200 with six passing checks; internal-only returned 200 server-derived exemption"
+ },
+ {
+ "boundary": "legacy send safety",
+ "verdict": "PASS",
+ "evidence": "legacy external sends without classification are report-only and preserve the existing external approval-token guard; no live George restart or Gmail mutation occurred"
+ },
+ {
+ "boundary": "dependency audit",
+ "verdict": "PARTIAL",
+ "evidence": "parse5 7.3.0 introduced no advisory; npm audit reports one pre-existing high nodemailer advisory requiring a semver-major upgrade, deferred as the next verified security seed"
+ }
+ ],
+ "negative_checks": [
+ "commercial missing footer/suppression/audience evidence",
+ "misleading Re subject without server-verified reply",
+ "hidden and malformed HTML compliance content",
+ "empty or hidden-only opt-out label",
+ "mailto BCC and additional-recipient injection",
+ "unknown preflight class defaults to commercial evaluation",
+ "caller-claimed reply or transactional class cannot bypass into blocking enforcement"
+ ],
+ "cleanup": "isolated localhost server stopped with Ctrl-C; live pm2 process and Gmail state unchanged",
+ "known_limit": "Phase 1 does not yet fail closed on unclassified legacy external traffic; caller inventory, server-verified reply/correlation evidence, and staged migration are required before universal enforcement",
+ "verdict": "PASS_WITH_KNOWN_LIMIT"
+}
← 6261e6d auto-data-snapshot: 2026-08-28T14:34:59 (1 data files) — dat
·
back to George Gmail
·
Add staged outbound compliance preflight ed923bc →