[PR] fix(mail): resolve security draft CC before backend calls [magpie]

["andreahlert (via GitHub)" <gi...@apache.org>]

andreahlert opened a new pull request, #1200:
URL: https://github.com/apache/magpie/pull/1200

   ## Summary
   
   When `security_list` is missing or blank, security reply drafts can lose their security CC. This change resolves the recipient in the shared mail-source contract before creating a draft, and applies the same rule to import, sync, invalidate, and CVE allocation.
   
   The resolver uses the project list when configured. Otherwise, it warns and records `cc_fallback`, using `security_inbox.foundation_security_address` through project, organization, and framework precedence. If neither address is available, draft creation stops. Mailbox searches retain the existing `<security-list>` meaning.
   
   OAuth and MCP draft recipes now reject missing or blank resolved CC values before invoking a backend. Documentation, the lifecycle spec, 13 configuration eval cases, and 11 recipe regression tests are included. Local agent artifacts are also excluded in `.gitignore`.
   
   ## Type of change
   
   - [x] Skill change, with new eval fixtures
   - [x] Tool / bridge contract
   - [x] Documentation
   - [x] Python regression tests
   
   ## Test plan
   
   - [x] `prek run --all-files`, including workspace lint, typing, tests, and documentation checks
   - [x] OAuth draft package: 92 tests passed, including 11 new recipe tests
   - [x] New security-CC eval step: 13/13 passed with Haiku
   - [x] New evals exercise missing/blank/template values, precedence, explicit null, deduplication, and stale fallback reset
   
   A broader model-eval run during development returned 118/147 passing, with 29 failures outside the new CC step. Those failing cases had identical assembled prompts and fixtures on clean main; one failure was reproduced there, while other sampled failures varied between runs. This is not a claim that the complete model-eval suites are green. The final focused CC eval run passed all 13 cases.
   
   ## RFC-AI-0004 compliance
   
   - [x] Vendor neutrality: the fallback comes from configuration, with ASF defaults supplied by its organization
   - [x] Write-access discipline: this changes draft creation only; existing human approval gates remain
   
   ## Linked issues
   
   Closes [#181](https://github.com/apache/magpie/issues/181).
   
   ## Notes for reviewers
   
   An explicitly null or blank project-level foundation address disables that fallback rather than inheriting the organization value. This is a deliberate configuration choice for review, not a previously agreed requirement from the issue.
   
   The shared resolver governs draft CC only; it does not redirect mailbox reads to a foundation inbox.
   
   ## AI assistance disclosure
   
   This change was developed with AI assistance from OpenAI Codex.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix(mail): resolve security draft CC before backend calls [magpie]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk merged PR #1200:
URL: https://github.com/apache/magpie/pull/1200


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org