← back to Ticket System
Verify George banner suppression through committed helpers and MIME
0ea2f476fa41ac15a7eaa568c130e59ccd6a9d89 · 2026-09-10 12:47:35 -0700 · Steve
Files touched
A data/codex-yoloforever/cycle-20260910-EAt7mw/george-extracted-helpers.txtA data/codex-yoloforever/cycle-20260910-EAt7mw/george-fixture.cjsA data/codex-yoloforever/cycle-20260910-EAt7mw/george-results.jsonA data/codex-yoloforever/cycle-20260910-EAt7mw/george-zero-cost.json
Diff
commit 0ea2f476fa41ac15a7eaa568c130e59ccd6a9d89
Author: Steve <steve@designerwallcoverings.com>
Date: Thu Sep 10 12:47:35 2026 -0700
Verify George banner suppression through committed helpers and MIME
---
.../george-extracted-helpers.txt | 67 +++++
.../cycle-20260910-EAt7mw/george-fixture.cjs | 91 +++++++
.../cycle-20260910-EAt7mw/george-results.json | 289 +++++++++++++++++++++
.../cycle-20260910-EAt7mw/george-zero-cost.json | 23 ++
4 files changed, 470 insertions(+)
diff --git a/data/codex-yoloforever/cycle-20260910-EAt7mw/george-extracted-helpers.txt b/data/codex-yoloforever/cycle-20260910-EAt7mw/george-extracted-helpers.txt
new file mode 100644
index 00000000..59ad9642
--- /dev/null
+++ b/data/codex-yoloforever/cycle-20260910-EAt7mw/george-extracted-helpers.txt
@@ -0,0 +1,67 @@
+function encodeMimeHeader(s) {
+ if (!s) return s;
+ // eslint-disable-next-line no-control-regex
+ return /[^\x00-\x7F]/.test(s)
+ ? `=?UTF-8?B?${Buffer.from(s, 'utf8').toString('base64')}?=`
+ : s;
+}
+
+// Tag every outbound body with a "where-it's-from" header — so Steve can spot
+// at a glance which job/script/agent triggered the email. Source comes from
+// req.body.source (preferred), req.body.job, req.headers['x-george-source'],
+// or falls back to the user-agent string.
+function inferSource(body, req) {
+ if (body && (body.no_source_tag || body.noSourceTag)) return ''; // opt out of the From-job banner
+ if (req?.headers?.['x-george-no-tag']) return '';
+ // TK-11365 (2026-09-10): the banner is an INTERNAL provenance aid and must never reach an
+ // outside party. It was opt-OUT, so any caller that forgot no_source_tag prepended an internal
+ // job label to vendor/customer mail - proven in prod on a real customer (4 emails opening
+ // "From job: kelly-reply-tk10830") and found on 14 of 15 queued vendor drafts. The MCP tool
+ // gmail_create_draft does not even expose no_source_tag, so the opt-out was unreachable from
+ // the agent path. Now: if ANY recipient is external, no banner. Internal mail keeps it.
+ try {
+ const b = body || {};
+ const ext = _recips(b.to, b.cc, b.bcc).filter(a => !_isInternal(a));
+ if (ext.length) return '';
+ } catch (e) { /* helpers defined later in file; fall through to normal behaviour */ }
+ const raw = body.source || body.job || body.from_job || body.origin
+ || req?.headers?.['x-george-source']
+ || req?.headers?.['user-agent']
+ || 'unspecified';
+ return String(raw).slice(0, 120);
+}
+function withSourceFooter(htmlBody, source) {
+ if (!source) return htmlBody || ''; // empty source -> no banner (customer-facing send)
+ const ts = new Date().toLocaleString('en-US', { timeZone: 'America/Los_Angeles', month: 'short', day: 'numeric', year: 'numeric', hour: 'numeric', minute: '2-digit' });
+ const tag = `<div style="font-family:ui-monospace,Menlo,monospace;font-size:10px;letter-spacing:.10em;text-transform:uppercase;color:#7a766f;padding:8px 12px;background:rgba(212,160,74,0.08);border-left:3px solid #d4a04a;margin-bottom:18px;border-radius:2px"><strong style="color:#d4a04a">From job:</strong> ${escapeHtml(source)} <span style="color:#a8a39c">·</span> ${ts}</div>`;
+ return tag + (htmlBody || '');
+}
+function escapeHtml(s) { return String(s).replace(/[&<>"']/g, c => ({ '&':'&','<':'<','>':'>','"':'"',"'":''' }[c])); }
+
+// Build a UTF-8-clean RFC 2822 message: encoded subject, MIME-Version, base64 body (76-char lines per RFC 2045).
+// inReplyTo / references are RFC Message-Id values (Gmail returns these from messages.get headers).
+function buildRawMessage({ from, to, cc, bcc, subject, body, inReplyTo, references }) {
+ const bodyB64 = Buffer.from(body, 'utf8').toString('base64').replace(/(.{76})/g, '$1\r\n');
+ const refsHeader = references && references.length ? references.join(' ') : (inReplyTo || null);
+ const headerLines = [
+ from ? `From: ${from}` : null,
+ to ? `To: ${to}` : null,
+ cc ? `Cc: ${cc}` : null,
+ bcc ? `Bcc: ${bcc}` : null,
+ `Subject: ${encodeMimeHeader(subject)}`,
+ inReplyTo ? `In-Reply-To: ${inReplyTo}` : null,
+ refsHeader ? `References: ${refsHeader}` : null,
+ 'MIME-Version: 1.0',
+ 'Content-Type: text/html; charset=UTF-8',
+ 'Content-Transfer-Encoding: base64',
+ ].filter(Boolean);
+ const message = headerLines.join('\r\n') + '\r\n\r\n' + bodyB64;
+ return Buffer.from(message, 'utf8').toString('base64url');
+}
+
+
+function _envFile(key) { try { const m = require('fs').readFileSync(require('path').join(__dirname, '.env'), 'utf8').match(new RegExp('^' + key + '=(.+)$', 'm')); return m ? m[1].trim() : ''; } catch (e) { return ''; } }
+const INTERNAL_DOMAINS = (process.env.GEORGE_INTERNAL_DOMAINS || _envFile('GEORGE_INTERNAL_DOMAINS') || 'designerwallcoverings.com').toLowerCase().split(',').map(s => s.trim()).filter(Boolean);
+const INTERNAL_ADDRS = (process.env.GEORGE_INTERNAL_ADDRS || _envFile('GEORGE_INTERNAL_ADDRS') || 'steveabramsdesigns@gmail.com,theagentabrams@gmail.com,wallsandfabrics@gmail.com').toLowerCase().split(',').map(s => s.trim()).filter(Boolean);
+function _recips(...vals) { const out = []; for (const v of vals) { if (!v) continue; const arr = Array.isArray(v) ? v : String(v).split(','); for (const a of arr) { const m = String(a).match(/[\w.+-]+@[\w.-]+\.\w+/); if (m) out.push(m[0].toLowerCase()); } } return out; }
+function _isInternal(addr) { const dom = (addr.split('@')[1] || ''); return INTERNAL_ADDRS.includes(addr) || INTERNAL_DOMAINS.includes(dom); }
diff --git a/data/codex-yoloforever/cycle-20260910-EAt7mw/george-fixture.cjs b/data/codex-yoloforever/cycle-20260910-EAt7mw/george-fixture.cjs
new file mode 100644
index 00000000..424b9ce3
--- /dev/null
+++ b/data/codex-yoloforever/cycle-20260910-EAt7mw/george-fixture.cjs
@@ -0,0 +1,91 @@
+// Offline verification only. Never imports server.js or supplies network/credentials to its VM.
+const fs = require('fs');
+const path = require('path');
+const vm = require('vm');
+const cp = require('child_process');
+const crypto = require('crypto');
+const assert = require('assert/strict');
+const repo = process.argv[2] || '/Users/macstudio3/Projects/george-gmail';
+const out = process.argv[3] || __dirname;
+const commit = 'e7ccd8a94c764d8a358391923a2c5f9132607a6e';
+const hash = b => crypto.createHash('sha256').update(b).digest('hex');
+const before = fs.readFileSync(path.join(repo, 'server.js'));
+const pinned = cp.execFileSync('git', ['-C', repo, 'show', `${commit}:server.js`]);
+assert.deepEqual(before, pinned, 'working server.js must exactly equal pinned commit');
+const src = pinned.toString('utf8');
+const ranges = [
+ ['mime_and_banner', 'function encodeMimeHeader(s)', '// Look up RFC Message-Id'],
+ ['recipient_dependencies', 'function _envFile(key)', 'function externalSendGuard(req)'],
+];
+const spans = ranges.map(([name, start, end]) => {
+ const a = src.indexOf(start), b = src.indexOf(end, a);
+ assert(a >= 0 && b > a);
+ const text = src.slice(a, b);
+ return { name, startByte: Buffer.byteLength(src.slice(0, a)), endByte: Buffer.byteLength(src.slice(0, b)), sha256: hash(text), text };
+});
+const helpers = spans.map(s => s.text).join('\n');
+// Fixed fixture policy; the actual environment and .env are intentionally not read.
+const context = vm.createContext({ Buffer, process: { env: {
+ GEORGE_INTERNAL_DOMAINS: 'designerwallcoverings.com',
+ GEORGE_INTERNAL_ADDRS: 'steveabramsdesigns@gmail.com,theagentabrams@gmail.com,wallsandfabrics@gmail.com'
+} } });
+vm.runInContext(helpers, context, { timeout: 1000 });
+const results = [];
+function check(name, body, expectedBanner, headers = {}, extra) {
+ let observed;
+ try {
+ const payload = { subject: 'Fixture — UTF-8', body: '<p>Fixture café</p>', source: 'fixture-job', ...body };
+ const source = context.inferSource(payload, { headers });
+ const html = context.withSourceFooter(payload.body, source);
+ const raw = context.buildRawMessage({ ...payload, body: html });
+ const mime = Buffer.from(raw, 'base64url').toString('utf8');
+ const split = mime.indexOf('\r\n\r\n');
+ const decoded = Buffer.from(mime.slice(split + 4), 'base64').toString('utf8');
+ observed = { source, banner: decoded.includes('From job:'), recipientsParsed: Array.from(context._recips(payload.to, payload.cc, payload.bcc)), mimeHeaders: mime.slice(0, split), decodedHtml: decoded };
+ assert.equal(decoded, html, 'MIME HTML must survive encoding exactly');
+ assert.equal(observed.banner, expectedBanner, 'recipient policy banner expectation');
+ assert(decoded.endsWith(payload.body));
+ assert(mime.includes('Content-Transfer-Encoding: base64'));
+ assert(mime.includes('Subject: =?UTF-8?B?'));
+ if (extra) extra(observed);
+ results.push({ name, verdict: 'PASS', observed });
+ } catch (e) { results.push({ name, verdict: 'FAIL', reason: e.message, observed }); }
+}
+const inside = 'staff@designerwallcoverings.com', outside = 'customer@example.net';
+check('external_to', { to: outside }, false);
+check('external_cc', { to: inside, cc: outside }, false);
+check('external_bcc', { to: inside, bcc: outside }, false);
+check('mixed_comma_list', { to: `${inside}, ${outside}` }, false);
+check('mixed_array', { to: [inside, outside] }, false);
+check('uppercase_display_name', { to: 'Customer <CUSTOMER@EXAMPLE.NET>' }, false);
+check('internal_domain_only', { to: inside }, true);
+check('internal_allowlisted_gmail', { to: 'steveabramsdesigns@gmail.com' }, true);
+check('unlisted_gmail', { to: 'fixture-other@gmail.com' }, false);
+check('body_snake_optout', { to: inside, no_source_tag: true }, false);
+check('body_camel_optout', { to: inside, noSourceTag: true }, false);
+check('header_optout', { to: inside }, false, { 'x-george-no-tag': '1' });
+check('source_escaping', { to: inside, source: '<script>"&\'fixture' }, true, {}, o => {
+ assert(o.decodedHtml.includes('<script>"&'fixture'));
+ assert(!o.decodedHtml.includes('<script>'));
+});
+check('source_length', { to: inside, source: 'x'.repeat(150) }, true, {}, o => assert.equal(o.source.length, 120));
+check('external_header_source', { to: outside, source: null }, false, { 'x-george-source': 'header-job' });
+check('quoted_display_internal_email_external_mailbox', { to: `"${inside}" <${outside}>` }, false);
+check('array_member_comma_list', { to: [`${inside}, ${outside}`] }, false);
+check('malformed_truthy_to_not_validated_here', { to: 'not-an-address' }, true);
+check('object_to_not_supported_by_raw_builder', { to: { name: 'Customer', address: outside } }, true);
+const after = fs.readFileSync(path.join(repo, 'server.js'));
+assert.deepEqual(after, before, 'source must remain unchanged');
+const report = {
+ status: 'partial', correlation: 'M-02829', timestamp: new Date().toISOString(), riskTier: 'R1 isolated; production R3 skipped',
+ commit, sourceHashBefore: hash(before), sourceHashAfter: hash(after), extractedSpans: spans.map(({ text, ...s }) => s),
+ fixturePolicy: 'Synthetic configured internal allowlist; no actual env, credentials, server import or network capabilities supplied.',
+ commands: [`node ${__filename} ${repo} ${out}`, `git -C ${repo} show ${commit}:server.js`],
+ results, passed: results.filter(r => r.verdict === 'PASS').length, failed: results.filter(r => r.verdict === 'FAIL').length,
+ skips: ['No live send/draft/API/auth path exercised.', 'No proof that running service loaded this commit.', 'Attachment nodemailer boundary not exercised.', 'Actual configured internal allowlist not inspected.', 'Malformed input is characterized, not asserted to be accepted by Gmail.'],
+ cleanup: 'All fixtures retained. No service or source changes.'
+};
+fs.writeFileSync(path.join(out, 'george-extracted-helpers.txt'), helpers);
+fs.writeFileSync(path.join(out, 'george-results.json'), JSON.stringify(report, null, 2) + '\n');
+console.log(JSON.stringify({ status: report.status, passed: report.passed, failed: report.failed, defects: results.filter(r => r.verdict === 'FAIL').map(r => r.name), sourceHash: hash(after) }));
+process.exitCode = report.failed ? 1 : 0;
diff --git a/data/codex-yoloforever/cycle-20260910-EAt7mw/george-results.json b/data/codex-yoloforever/cycle-20260910-EAt7mw/george-results.json
new file mode 100644
index 00000000..7a50860e
--- /dev/null
+++ b/data/codex-yoloforever/cycle-20260910-EAt7mw/george-results.json
@@ -0,0 +1,289 @@
+{
+ "status": "partial",
+ "correlation": "M-02829",
+ "timestamp": "2026-09-10T19:46:54.946Z",
+ "riskTier": "R1 isolated; production R3 skipped",
+ "commit": "e7ccd8a94c764d8a358391923a2c5f9132607a6e",
+ "sourceHashBefore": "dfba20d1c329580b8cd83442f31a128068035196a570c608d2a20aceab9402d1",
+ "sourceHashAfter": "dfba20d1c329580b8cd83442f31a128068035196a570c608d2a20aceab9402d1",
+ "extractedSpans": [
+ {
+ "name": "mime_and_banner",
+ "startByte": 59891,
+ "endByte": 63513,
+ "sha256": "0f25e48321ccf6f29752cf94dc0b649c2e4d059fe052777bf2628ce8dc5be654"
+ },
+ {
+ "name": "recipient_dependencies",
+ "startByte": 65329,
+ "endByte": 66402,
+ "sha256": "8d7c13dd1ad8269dcce46683879e7ea16c2f7362da77a07e1ae8ea4d58d8858f"
+ }
+ ],
+ "fixturePolicy": "Synthetic configured internal allowlist; no actual env, credentials, server import or network capabilities supplied.",
+ "commands": [
+ "node /Users/macstudio3/Projects/ticket-system/data/codex-yoloforever/cycle-20260910-EAt7mw/george-fixture.cjs /Users/macstudio3/Projects/george-gmail /Users/macstudio3/Projects/ticket-system/data/codex-yoloforever/cycle-20260910-EAt7mw",
+ "git -C /Users/macstudio3/Projects/george-gmail show e7ccd8a94c764d8a358391923a2c5f9132607a6e:server.js"
+ ],
+ "results": [
+ {
+ "name": "external_to",
+ "verdict": "PASS",
+ "observed": {
+ "source": "",
+ "banner": false,
+ "recipientsParsed": [
+ "customer@example.net"
+ ],
+ "mimeHeaders": "To: customer@example.net\r\nSubject: =?UTF-8?B?Rml4dHVyZSDigJQgVVRGLTg=?=\r\nMIME-Version: 1.0\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Transfer-Encoding: base64",
+ "decodedHtml": "<p>Fixture café</p>"
+ }
+ },
+ {
+ "name": "external_cc",
+ "verdict": "PASS",
+ "observed": {
+ "source": "",
+ "banner": false,
+ "recipientsParsed": [
+ "staff@designerwallcoverings.com",
+ "customer@example.net"
+ ],
+ "mimeHeaders": "To: staff@designerwallcoverings.com\r\nCc: customer@example.net\r\nSubject: =?UTF-8?B?Rml4dHVyZSDigJQgVVRGLTg=?=\r\nMIME-Version: 1.0\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Transfer-Encoding: base64",
+ "decodedHtml": "<p>Fixture café</p>"
+ }
+ },
+ {
+ "name": "external_bcc",
+ "verdict": "PASS",
+ "observed": {
+ "source": "",
+ "banner": false,
+ "recipientsParsed": [
+ "staff@designerwallcoverings.com",
+ "customer@example.net"
+ ],
+ "mimeHeaders": "To: staff@designerwallcoverings.com\r\nBcc: customer@example.net\r\nSubject: =?UTF-8?B?Rml4dHVyZSDigJQgVVRGLTg=?=\r\nMIME-Version: 1.0\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Transfer-Encoding: base64",
+ "decodedHtml": "<p>Fixture café</p>"
+ }
+ },
+ {
+ "name": "mixed_comma_list",
+ "verdict": "PASS",
+ "observed": {
+ "source": "",
+ "banner": false,
+ "recipientsParsed": [
+ "staff@designerwallcoverings.com",
+ "customer@example.net"
+ ],
+ "mimeHeaders": "To: staff@designerwallcoverings.com, customer@example.net\r\nSubject: =?UTF-8?B?Rml4dHVyZSDigJQgVVRGLTg=?=\r\nMIME-Version: 1.0\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Transfer-Encoding: base64",
+ "decodedHtml": "<p>Fixture café</p>"
+ }
+ },
+ {
+ "name": "mixed_array",
+ "verdict": "PASS",
+ "observed": {
+ "source": "",
+ "banner": false,
+ "recipientsParsed": [
+ "staff@designerwallcoverings.com",
+ "customer@example.net"
+ ],
+ "mimeHeaders": "To: staff@designerwallcoverings.com,customer@example.net\r\nSubject: =?UTF-8?B?Rml4dHVyZSDigJQgVVRGLTg=?=\r\nMIME-Version: 1.0\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Transfer-Encoding: base64",
+ "decodedHtml": "<p>Fixture café</p>"
+ }
+ },
+ {
+ "name": "uppercase_display_name",
+ "verdict": "PASS",
+ "observed": {
+ "source": "",
+ "banner": false,
+ "recipientsParsed": [
+ "customer@example.net"
+ ],
+ "mimeHeaders": "To: Customer <CUSTOMER@EXAMPLE.NET>\r\nSubject: =?UTF-8?B?Rml4dHVyZSDigJQgVVRGLTg=?=\r\nMIME-Version: 1.0\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Transfer-Encoding: base64",
+ "decodedHtml": "<p>Fixture café</p>"
+ }
+ },
+ {
+ "name": "internal_domain_only",
+ "verdict": "PASS",
+ "observed": {
+ "source": "fixture-job",
+ "banner": true,
+ "recipientsParsed": [
+ "staff@designerwallcoverings.com"
+ ],
+ "mimeHeaders": "To: staff@designerwallcoverings.com\r\nSubject: =?UTF-8?B?Rml4dHVyZSDigJQgVVRGLTg=?=\r\nMIME-Version: 1.0\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Transfer-Encoding: base64",
+ "decodedHtml": "<div style=\"font-family:ui-monospace,Menlo,monospace;font-size:10px;letter-spacing:.10em;text-transform:uppercase;color:#7a766f;padding:8px 12px;background:rgba(212,160,74,0.08);border-left:3px solid #d4a04a;margin-bottom:18px;border-radius:2px\"><strong style=\"color:#d4a04a\">From job:</strong> fixture-job <span style=\"color:#a8a39c\">·</span> Sep 10, 2026, 12:46 PM</div><p>Fixture café</p>"
+ }
+ },
+ {
+ "name": "internal_allowlisted_gmail",
+ "verdict": "PASS",
+ "observed": {
+ "source": "fixture-job",
+ "banner": true,
+ "recipientsParsed": [
+ "steveabramsdesigns@gmail.com"
+ ],
+ "mimeHeaders": "To: steveabramsdesigns@gmail.com\r\nSubject: =?UTF-8?B?Rml4dHVyZSDigJQgVVRGLTg=?=\r\nMIME-Version: 1.0\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Transfer-Encoding: base64",
+ "decodedHtml": "<div style=\"font-family:ui-monospace,Menlo,monospace;font-size:10px;letter-spacing:.10em;text-transform:uppercase;color:#7a766f;padding:8px 12px;background:rgba(212,160,74,0.08);border-left:3px solid #d4a04a;margin-bottom:18px;border-radius:2px\"><strong style=\"color:#d4a04a\">From job:</strong> fixture-job <span style=\"color:#a8a39c\">·</span> Sep 10, 2026, 12:46 PM</div><p>Fixture café</p>"
+ }
+ },
+ {
+ "name": "unlisted_gmail",
+ "verdict": "PASS",
+ "observed": {
+ "source": "",
+ "banner": false,
+ "recipientsParsed": [
+ "fixture-other@gmail.com"
+ ],
+ "mimeHeaders": "To: fixture-other@gmail.com\r\nSubject: =?UTF-8?B?Rml4dHVyZSDigJQgVVRGLTg=?=\r\nMIME-Version: 1.0\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Transfer-Encoding: base64",
+ "decodedHtml": "<p>Fixture café</p>"
+ }
+ },
+ {
+ "name": "body_snake_optout",
+ "verdict": "PASS",
+ "observed": {
+ "source": "",
+ "banner": false,
+ "recipientsParsed": [
+ "staff@designerwallcoverings.com"
+ ],
+ "mimeHeaders": "To: staff@designerwallcoverings.com\r\nSubject: =?UTF-8?B?Rml4dHVyZSDigJQgVVRGLTg=?=\r\nMIME-Version: 1.0\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Transfer-Encoding: base64",
+ "decodedHtml": "<p>Fixture café</p>"
+ }
+ },
+ {
+ "name": "body_camel_optout",
+ "verdict": "PASS",
+ "observed": {
+ "source": "",
+ "banner": false,
+ "recipientsParsed": [
+ "staff@designerwallcoverings.com"
+ ],
+ "mimeHeaders": "To: staff@designerwallcoverings.com\r\nSubject: =?UTF-8?B?Rml4dHVyZSDigJQgVVRGLTg=?=\r\nMIME-Version: 1.0\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Transfer-Encoding: base64",
+ "decodedHtml": "<p>Fixture café</p>"
+ }
+ },
+ {
+ "name": "header_optout",
+ "verdict": "PASS",
+ "observed": {
+ "source": "",
+ "banner": false,
+ "recipientsParsed": [
+ "staff@designerwallcoverings.com"
+ ],
+ "mimeHeaders": "To: staff@designerwallcoverings.com\r\nSubject: =?UTF-8?B?Rml4dHVyZSDigJQgVVRGLTg=?=\r\nMIME-Version: 1.0\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Transfer-Encoding: base64",
+ "decodedHtml": "<p>Fixture café</p>"
+ }
+ },
+ {
+ "name": "source_escaping",
+ "verdict": "PASS",
+ "observed": {
+ "source": "<script>\"&'fixture",
+ "banner": true,
+ "recipientsParsed": [
+ "staff@designerwallcoverings.com"
+ ],
+ "mimeHeaders": "To: staff@designerwallcoverings.com\r\nSubject: =?UTF-8?B?Rml4dHVyZSDigJQgVVRGLTg=?=\r\nMIME-Version: 1.0\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Transfer-Encoding: base64",
+ "decodedHtml": "<div style=\"font-family:ui-monospace,Menlo,monospace;font-size:10px;letter-spacing:.10em;text-transform:uppercase;color:#7a766f;padding:8px 12px;background:rgba(212,160,74,0.08);border-left:3px solid #d4a04a;margin-bottom:18px;border-radius:2px\"><strong style=\"color:#d4a04a\">From job:</strong> <script>"&'fixture <span style=\"color:#a8a39c\">·</span> Sep 10, 2026, 12:46 PM</div><p>Fixture café</p>"
+ }
+ },
+ {
+ "name": "source_length",
+ "verdict": "PASS",
+ "observed": {
+ "source": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
+ "banner": true,
+ "recipientsParsed": [
+ "staff@designerwallcoverings.com"
+ ],
+ "mimeHeaders": "To: staff@designerwallcoverings.com\r\nSubject: =?UTF-8?B?Rml4dHVyZSDigJQgVVRGLTg=?=\r\nMIME-Version: 1.0\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Transfer-Encoding: base64",
+ "decodedHtml": "<div style=\"font-family:ui-monospace,Menlo,monospace;font-size:10px;letter-spacing:.10em;text-transform:uppercase;color:#7a766f;padding:8px 12px;background:rgba(212,160,74,0.08);border-left:3px solid #d4a04a;margin-bottom:18px;border-radius:2px\"><strong style=\"color:#d4a04a\">From job:</strong> xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx <span style=\"color:#a8a39c\">·</span> Sep 10, 2026, 12:46 PM</div><p>Fixture café</p>"
+ }
+ },
+ {
+ "name": "external_header_source",
+ "verdict": "PASS",
+ "observed": {
+ "source": "",
+ "banner": false,
+ "recipientsParsed": [
+ "customer@example.net"
+ ],
+ "mimeHeaders": "To: customer@example.net\r\nSubject: =?UTF-8?B?Rml4dHVyZSDigJQgVVRGLTg=?=\r\nMIME-Version: 1.0\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Transfer-Encoding: base64",
+ "decodedHtml": "<p>Fixture café</p>"
+ }
+ },
+ {
+ "name": "quoted_display_internal_email_external_mailbox",
+ "verdict": "FAIL",
+ "reason": "recipient policy banner expectation\n\ntrue !== false\n",
+ "observed": {
+ "source": "fixture-job",
+ "banner": true,
+ "recipientsParsed": [
+ "staff@designerwallcoverings.com"
+ ],
+ "mimeHeaders": "To: \"staff@designerwallcoverings.com\" <customer@example.net>\r\nSubject: =?UTF-8?B?Rml4dHVyZSDigJQgVVRGLTg=?=\r\nMIME-Version: 1.0\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Transfer-Encoding: base64",
+ "decodedHtml": "<div style=\"font-family:ui-monospace,Menlo,monospace;font-size:10px;letter-spacing:.10em;text-transform:uppercase;color:#7a766f;padding:8px 12px;background:rgba(212,160,74,0.08);border-left:3px solid #d4a04a;margin-bottom:18px;border-radius:2px\"><strong style=\"color:#d4a04a\">From job:</strong> fixture-job <span style=\"color:#a8a39c\">·</span> Sep 10, 2026, 12:46 PM</div><p>Fixture café</p>"
+ }
+ },
+ {
+ "name": "array_member_comma_list",
+ "verdict": "FAIL",
+ "reason": "recipient policy banner expectation\n\ntrue !== false\n",
+ "observed": {
+ "source": "fixture-job",
+ "banner": true,
+ "recipientsParsed": [
+ "staff@designerwallcoverings.com"
+ ],
+ "mimeHeaders": "To: staff@designerwallcoverings.com, customer@example.net\r\nSubject: =?UTF-8?B?Rml4dHVyZSDigJQgVVRGLTg=?=\r\nMIME-Version: 1.0\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Transfer-Encoding: base64",
+ "decodedHtml": "<div style=\"font-family:ui-monospace,Menlo,monospace;font-size:10px;letter-spacing:.10em;text-transform:uppercase;color:#7a766f;padding:8px 12px;background:rgba(212,160,74,0.08);border-left:3px solid #d4a04a;margin-bottom:18px;border-radius:2px\"><strong style=\"color:#d4a04a\">From job:</strong> fixture-job <span style=\"color:#a8a39c\">·</span> Sep 10, 2026, 12:46 PM</div><p>Fixture café</p>"
+ }
+ },
+ {
+ "name": "malformed_truthy_to_not_validated_here",
+ "verdict": "PASS",
+ "observed": {
+ "source": "fixture-job",
+ "banner": true,
+ "recipientsParsed": [],
+ "mimeHeaders": "To: not-an-address\r\nSubject: =?UTF-8?B?Rml4dHVyZSDigJQgVVRGLTg=?=\r\nMIME-Version: 1.0\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Transfer-Encoding: base64",
+ "decodedHtml": "<div style=\"font-family:ui-monospace,Menlo,monospace;font-size:10px;letter-spacing:.10em;text-transform:uppercase;color:#7a766f;padding:8px 12px;background:rgba(212,160,74,0.08);border-left:3px solid #d4a04a;margin-bottom:18px;border-radius:2px\"><strong style=\"color:#d4a04a\">From job:</strong> fixture-job <span style=\"color:#a8a39c\">·</span> Sep 10, 2026, 12:46 PM</div><p>Fixture café</p>"
+ }
+ },
+ {
+ "name": "object_to_not_supported_by_raw_builder",
+ "verdict": "PASS",
+ "observed": {
+ "source": "fixture-job",
+ "banner": true,
+ "recipientsParsed": [],
+ "mimeHeaders": "To: [object Object]\r\nSubject: =?UTF-8?B?Rml4dHVyZSDigJQgVVRGLTg=?=\r\nMIME-Version: 1.0\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Transfer-Encoding: base64",
+ "decodedHtml": "<div style=\"font-family:ui-monospace,Menlo,monospace;font-size:10px;letter-spacing:.10em;text-transform:uppercase;color:#7a766f;padding:8px 12px;background:rgba(212,160,74,0.08);border-left:3px solid #d4a04a;margin-bottom:18px;border-radius:2px\"><strong style=\"color:#d4a04a\">From job:</strong> fixture-job <span style=\"color:#a8a39c\">·</span> Sep 10, 2026, 12:46 PM</div><p>Fixture café</p>"
+ }
+ }
+ ],
+ "passed": 17,
+ "failed": 2,
+ "skips": [
+ "No live send/draft/API/auth path exercised.",
+ "No proof that running service loaded this commit.",
+ "Attachment nodemailer boundary not exercised.",
+ "Actual configured internal allowlist not inspected.",
+ "Malformed input is characterized, not asserted to be accepted by Gmail."
+ ],
+ "cleanup": "All fixtures retained. No service or source changes."
+}
diff --git a/data/codex-yoloforever/cycle-20260910-EAt7mw/george-zero-cost.json b/data/codex-yoloforever/cycle-20260910-EAt7mw/george-zero-cost.json
new file mode 100644
index 00000000..4300302c
--- /dev/null
+++ b/data/codex-yoloforever/cycle-20260910-EAt7mw/george-zero-cost.json
@@ -0,0 +1,23 @@
+{
+ "canonicalGuard": "ZERO_COST_REQUIRED",
+ "DTD_ZERO_COST": "1",
+ "providerCallsMade": 0,
+ "claudeInvocations": 0,
+ "entrypoints": [
+ {
+ "path": "/Users/macstudio3/.agents/skills/dtd/scripts/panel.sh",
+ "guardForcesZero": true,
+ "guardOffset": 756,
+ "firstKeyLoadOffset": 1545,
+ "zeroBranchSkipsKeyLoading": true
+ },
+ {
+ "path": "/Users/macstudio3/.agents/skills/dtd/scripts/post-decision-codex.sh",
+ "guardForcesZero": true,
+ "guardOffset": 858,
+ "firstKeyLoadOffset": 1265,
+ "zeroBranchSkipsKeyLoading": true
+ }
+ ],
+ "note": "Personally inspected both full installed scripts. Canonical guard occurs before credential reads and forces zero even absent inherited environment. DTD already completed by parent at /private/tmp/dtd-cycle1934-george.eUve5X; no additional panel invoked."
+}
← 93baa344 auto-data-snapshot: 2026-09-10T12:25:41 (1 data files) — dat
·
back to Ticket System
·
Record George verifier handoff and preserved source ticket o 172876c3 →