[Privacy] Provide governed Mail DSAR coverage #22

New Issue

2026-08-20T23:54:47+02:00

zemion commented

2026-08-20 23:54:47 +02:00

Goal

Contribute Mail-owned personal data to Core’s governed data-subject-request workflow without exposing credentials, encrypted payloads, provider locators, or unrelated correspondents.

Acceptance criteria

publish privacy.dsar.mail through the module manifest;
search the effective tenant using corroborated email, membership, and namespaced Mail references;
isolate matching mailbox header parties and include only safe message-index metadata;
include safe personal-profile metadata and delivery/bounce evidence while excluding ciphertext, credentials, endpoints, folder/UID locators, worker claims, idempotency material, diagnostics, and opaque evidence;
classify immutable delivery/bounce/reconciliation evidence separately from mailbox/profile manual review;
preserve Mail and external mailbox lifecycle boundaries rather than performing unsafe direct erasure;
document user/admin behavior and test tenant isolation, minimization, Core discovery, and disabled-module coverage.

## Goal Contribute Mail-owned personal data to Core’s governed data-subject-request workflow without exposing credentials, encrypted payloads, provider locators, or unrelated correspondents. ## Acceptance criteria - publish `privacy.dsar.mail` through the module manifest; - search the effective tenant using corroborated email, membership, and namespaced Mail references; - isolate matching mailbox header parties and include only safe message-index metadata; - include safe personal-profile metadata and delivery/bounce evidence while excluding ciphertext, credentials, endpoints, folder/UID locators, worker claims, idempotency material, diagnostics, and opaque evidence; - classify immutable delivery/bounce/reconciliation evidence separately from mailbox/profile manual review; - preserve Mail and external mailbox lifecycle boundaries rather than performing unsafe direct erasure; - document user/admin behavior and test tenant isolation, minimization, Core discovery, and disabled-module coverage.

zemion added the module/mail

type

task

area/db area/governance area/security codex/ready

labels 2026-08-20 23:54:47 +02:00

zemion commented

2026-08-20 23:58:53 +02:00

Implemented and pushed as 34bd5be feat: add governed Mail DSAR coverage.

Evidence:

bounded tenant-scoped matching by normalized mailbox/bounce email, membership, and namespaced Mail references
matching From/To/Cc isolation; unrelated correspondents/messages and other tenants excluded
safe personal-profile, message-index, delivery-command, attempt, reconciliation, and bounce projections
SMTP/IMAP configuration and credentials, encrypted messages/envelopes, refusal detail, folder/UID and endpoint locators, idempotency/worker state, diagnostics, error text, and opaque evidence excluded
immutable delivery/reconciliation/bounce classifications; mailbox/profile changes left to coordinated Mail and external-provider lifecycle controls with no unsafe direct erasure
static administrator/capability documentation and active/disabled Core workflow coverage
focused DSAR tests: 4 passed
full Mail suite: 141 passed, 22 subtests passed
manifest registry: 68/68

Implemented and pushed as `34bd5be feat: add governed Mail DSAR coverage`. Evidence: - bounded tenant-scoped matching by normalized mailbox/bounce email, membership, and namespaced Mail references - matching From/To/Cc isolation; unrelated correspondents/messages and other tenants excluded - safe personal-profile, message-index, delivery-command, attempt, reconciliation, and bounce projections - SMTP/IMAP configuration and credentials, encrypted messages/envelopes, refusal detail, folder/UID and endpoint locators, idempotency/worker state, diagnostics, error text, and opaque evidence excluded - immutable delivery/reconciliation/bounce classifications; mailbox/profile changes left to coordinated Mail and external-provider lifecycle controls with no unsafe direct erasure - static administrator/capability documentation and active/disabled Core workflow coverage - focused DSAR tests: `4 passed` - full Mail suite: `141 passed, 22 subtests passed` - manifest registry: `68/68`

zemion closed this issue

2026-08-20 23:58:53 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-mail#22