UAI Mail Agent-First Rebuild Plan (Phase 0 Done; Phase 2 VPS Loopback)

Phase 0 done. Phase 2 host is VPS loopback only. No Mac Docker. No containers started. No live MX. Owner-gated Phase 2+.

Body

UAI Mail — Agent-First Rebuild Plan (Executable)

Status: Phase 0 DONE. Phase 2 host updated 2026-07-04 to VPS loopback (mail_phase2 = no_docker). Owner chose rebuild agent surface (option B). No live start without owner. Production Mailu remains stopped. No DNS/MX/TLS/firewall changes.

Canonical product name: UAI Mail.

LEGACY names: Mailu, umail, UR-Mail, urmail, United-AI Mail. Mailu remains preserve-source / optional sandbox substrate only — not the long-term AI product surface.

Goals

1. AI agents send and receive through a controlled agent surface.
2. All agent paths are approved (tool-brokered), attributable, and logged.
3. No raw credentials to models.
4. Mailboxes from Mac archives restorable into the surface later.
5. Cadence approved-send hooks aligned (LEGACY tool ids may remain during transition).

Preserve inputs (Mac archives)

Root segments (join locally; digests in Mac sha256 sidecars only):

• UAI-preserved-artifacts / wipe-readiness-2026-07-03 / umail /
• Data archive: mailu-data-20260703 T225000Z.tar.gz
• Config archive: mailu-config-20260703 T225000Z.tar.gz
• Manifest: mailu-full-archive-manifest-20260703 T225000Z.txt

Sandbox sketch (Phase 0) segments:

• UAI-preserved-artifacts / wipe-readiness-2026-07-03 / umail / sandbox-agent-first /
• Symlink: /tmp / uai-mail-sandbox-agent-first

Exact joined paths live in local receipt notes/uai-mail-rebuild-phase0- 20260703.md

Loopback port map (sandbox only)

All binds are 127.0.0.1 with non-standard host ports. Never 0.0.0.0. Never public 25/465/587.

Phase 0 — Plan expansion and sandbox sketch (DONE this run)

Exact commands (run from the umail preserve directory; join segments above for SANDBOX):

# SANDBOX = join preserve segments + sandbox-agent-first
cd "$PRESERVE"
shasum -a 256 -c mailu-data-*.tar.gz.sha256
shasum -a 256 -c mailu-config-*.tar.gz.sha256
bash scripts/phase0-verify.sh
bash scripts/phase3-import-inventory.sh
# DO NOT: docker compose up

Scripts live under sandbox-agent-first/scripts/. Phase 0 results:

• phase0_verify=PASS (loopback-only compose; no mailu.env secrets file)
• archive members=1873; 8 maildir localparts (path names only)
• docker not required for Phase 0; containers not started
• Files: docker-compose.yml, mailu.env.example (placeholders), docs/agent-api-contract.md, PHASES.md, scripts/*

Phase 1 — Design agent API (design artifact present)

Contract file: sandbox docs/agent-api-contract.md

• LEGACY tool: email.umail.approved_send
• Target: uai_mail.approved_send, uai_mail.approved_receive
• Metadata-only model context; audit fields; rate limits; failure modes
• Secrets ownership: operator/secrets store only — never models

Exit: contract accepted (this plan); no capability-map live card yet.

Phase 2 — VPS loopback substrate (owner-gated; PLAN ONLY; NOT run)

Owner 2026-07-04: mail_phase2 = no_docker. Do not plan Mac Docker.

Phase 2 host is the VPS with 127.0.0.1-only binds (same port map above). Use a temp workdir under /root or /tmp (never live /mailu). Upload the Mac sketch; local placeholders only in mailu.env. Owner gate required before compose up. Health only via loopback HTTP port 18080 and SMTP port 10025 from the VPS. Then compose down.

Hard rules: never bind 0.0.0.0 for smtp/submission; never open public 25/465/587; never change DNS/MX/TLS/firewall; production Mailu stays stopped.

Local plan receipt: notes / uai-mail-vps-loopback-sandbox-plan / 20260704.md

Phase 3 — Mailbox import (inventory only so far)

bash scripts/phase3-import-inventory.sh
# Owner-gated extract later into sandbox data/ — no body print

Inventory (paths only): cadence@, midnight@, noreply@, scott@, scribe@, skip@, sunshine@, weekendwow@ (united-ai.ca).

Phase 4 — Cadence hook alignment (checklist; not executed)

• Map LEGACY email.umail.approved_send to uai_mail.approved_send
• Add uai_mail.approved_receive (metadata default)
• Keep Cadence mail env credentials out of model context
• Sandbox proof against loopback submission port

Phase 5 — Cutover (owner-gated only)

Production listeners, DNS/MX/TLS/firewall, capability-map UAI Mail card. Archives retained. Exit: owner-approved cutover receipt.

Hard rules

• No live start without owner. Live Mailu remains stopped.
• No DNS/MX/TLS/firewall/route changes without owner.
• No secrets, certs, DKIM private material, or mailbox bodies in Explorer.
• Sandbox ports: loopback only, non-standard host ports.
• Mailu / umail / UR-Mail names are LEGACY.

Decision linkage

• uai_mail_ai_access = rebuild_agent_surface
• mail_phase2 = no_docker (VPS loopback plan)
• Choice record: uai-doc-plans-uai-mail-ai- access
• This runbook: uai-doc-plans-uai-mail-agent-first- rebuild
• Local receipt: notes/uai-mail-rebuild-phase0- 20260703.md (workspace handoff notes)

Implementation status