feat: add governed Mail DSAR coverage

2026-08-20 23:58:21 +02:00
parent a044fee379
commit 34bd5be8d4
4 changed files with 997 additions and 1 deletions
@@ -19,6 +19,15 @@ This repository owns:

 Core owns auth, tenants, RBAC evaluation, database/session primitives, secret helpers, CSRF/API helpers, and shell layout.

+Mail publishes `privacy.dsar.mail` for Core's governed data-subject-request
+workflow. It isolates matching mailbox header parties and returns bounded index,
+personal-profile, delivery, reconciliation, and bounce metadata. SMTP/IMAP
+configuration and credentials, encrypted messages and envelopes, folder/UID
+locators, worker and idempotency state, diagnostics, and opaque evidence are
+excluded. Delivery and bounce outcomes remain retained evidence; mailbox and
+profile changes require coordinated Mail and external-provider review, so the
+provider does not perform direct erasure.
+
 ## Profile and credential ownership

 Mail profiles are separate governed definitions. Mail owns their SMTP/IMAP