Closing three inbound mail bugs and finding a bigger one
Value
3.5
■■■□ of 4
Time
1h 02m
active
Elapsed
2h 38m
wall-clock span
Commits
0
from this session
Cost
$13.02
model spend
Tokens
103k
uncached in, plus out
Tool calls
167
by the agent
Outcomes
10
6 left open
Summary
Written by the summariserRob asked the agent to pick up the remaining backlog items. The agent triaged the 14 open tasks, then worked the three that needed outside evidence (MSS-0449, MSS-0448, MSS-0299) once Rob approved named actions.
The agent triaged the 14 open backlog tasks and found none could move without Rob. After Rob approved specific read-only actions, it measured duplicate journal reports in production, about 1,046 surplus rows out of 2,106, and traced them to Microsoft 365 configuration rather than the product, so MSS-0449 was closed. After Rob re-authorised GAM, it found Google dual-delivered the rig mail but Cloudflare's MX rejected each copy for an SPF failure, so MSS-0448 was closed. For MSS-0299 it read real Microsoft and Google authentication headers, fixed a strict-parsing rejection and two parser bugs, and added fixtures built from the real headers with fictional domains. A CI identifier-policy failure was cleared by teaching the scanner the RFC 8601 property form, and the final push went green. Two new tasks were raised: MSS-0450, which is queued, and MSS-0451, where most journal reports from DMARC-enforcing senders are rejected at the edge and no fix direction has been chosen.
What came out of it
- MSS-0449 marked Done. Journal duplicates come from the M365 setup: a transport rule BCCs each message to the Google archive address and the Global journal rule writes one report per delivered copy. The product cannot create the duplicate itself.
- Production count-only read: 2,106 journal-wrapper rows since 2026-09-06, roughly 1,046 of them surplus twins.
- MSS-0450 created: collapse journal reports of the same original message and correct the inflated counts (product dedupe plus backfill, as Rob chose).
- MSS-0451 created: Cloudflare Email Routing rejected 54 of the last 62 journal reports with 550 5.7.1 DMARC checks failed, before the Worker. Reports from p=reject senders were all rejected and p=none senders got through.
- MSS-0448 marked Done. Google dual-delivered all three rig messages, but Cloudflare MX rejected every copy with a 550 5.7.1 SPF failure because the rig's SPF is -all and it does not sign with DKIM. The doc-0003 capture procedure now requires aligned DKIM and an SPF record that is not -all for rig senders.
- MSS-0299 marked Done. Real Microsoft headers (40 messages, 12 with ARC) were all rejected by strict RFC 8601 parsing; the relaxed Microsoft dialect now applies only on the Microsoft journal route when the authserv-id is mx.microsoft.com. Also fixed header.d=none being stored as the domain none, and Google's header.i=@domain signer being ignored. Domain contract doc-0004 amended to match.
- Commit [commit] pushed (MSS-0299 Microsoft half); hosted CI passed (run 37234496153).
- Commit [commit] pushed with the Google fixture; its CI failed on the public-identifier policy scan.
- Commit [commit] pushed: the scanner now exempts RFC 8601 ptype.property= tokens while still flagging bare smtp.<name> hostnames, with a failing-first test. CI went green (run 37241288442).
- Local gate passed with 4,216 tests; CodeRabbit reported 0 findings on each push.
This session was about clearing what was left of the dmarc-reporties backlog. Most of the 14 open tasks couldn't move without something only I could do, such as approving a look at live data or signing into the Google side. So I had my coding agent scope the two newest bugs and wait for named approval before touching anything live.
The first was journal reports arriving twice. Counting rows with read-only queries, about 1,046 of the 2,106 journal rows since early September were surplus copies. The product wasn't creating them. The cause was in my Microsoft 365 setup: a transport rule copies each message to my Google archive, and the journal rule then writes one report per delivered copy. That one is closed. A follow-up task will merge the duplicates and correct the counts.
The missing Google copy turned out to be a rejection. Google did deliver the test messages I sent, but Cloudflare's mail server refused every copy on an SPF check. My test domain has a strict SPF policy and doesn't sign with DKIM, so the copies hard-failed. I still don't know why an earlier batch got through. The capture procedure now says a sender like this needs aligned DKIM and a less strict SPF record.
The third task was reading authentication results. I pulled real headers from both mailboxes. The strict parser rejected every Microsoft message, and I fixed a few more quirks along the way: a "none" value was being stored as a domain, and Google's signer domain was being dropped. The test fixtures are built from those real headers with fictional domains. The first CI run failed on my identifier policy check, so I taught the scanner the standard form of these tokens, and the final push went green.
The bigger problem is still open. Cloudflare refused 54 of the last 62 journal reports, and every one from a sender whose DMARC policy is set to reject was among them. That means most journalled mail never reaches the product. I haven't picked a fix direction yet, and that's what I'll decide next. Ten other tasks stay parked until volume, time or my own action moves them.
Left open
- MSS-0450 is queued and not started.
- MSS-0451 has no chosen fix direction yet; Rob was to pick one after the options are written up.
- Why the rig copies arrived while the MSS-0448 copies were rejected is not established.
- The release and deploy runs for [commit] were still in progress at the last check; no deployment of [commit] is recorded.
- Ten parked tasks remain, waiting on volume, time, natural failure or Rob's own actions. MSS-0371 (inbound evidence retention) becomes eligible on 2026-10-06.
- MSS-0139 (identifier sweep before going public) stays parked because Rob has paused going public indefinitely.