MAS-WP-0004: Postfix integration profile, corpus probe in pytest, Exim notes

Profile in integrations/postfix (install.sh + README), now used by the
live deployment. Probe runs every conformance-corpus local-part and the
relay negatives against it; tests/test_postfix_profile.py runs it where
Docker is available.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5787@bnt-lap001
Assistant-Session: 5db26b82-138b-40cc-9856-4d5eb0f752fd

tests/test_postfix_profile.py

@@ -0,0 +1,62 @@
+"""The Postfix integration profile against a real Postfix (MAS-WP-0004 T02).
+
+Runs only where Docker is available; builds experiments/postfix-probe.
+"""
+
+import importlib.util
+import shutil
+import subprocess
+from pathlib import Path
+
+import pytest
+
+ROOT = Path(__file__).resolve().parents[1]
+PROBE_DIR = ROOT / "experiments/postfix-probe"
+
+
+def _docker_ok():
+    if not shutil.which("docker"):
+        return False
+    return subprocess.run(["docker", "info"], capture_output=True).returncode == 0
+
+
+pytestmark = pytest.mark.skipif(not _docker_ok(), reason="Docker not available")
+
+
+@pytest.fixture(scope="module")
+def probe_results():
+    build = subprocess.run(["docker", "build", "-q", "-t", "mas-postfix-probe", str(PROBE_DIR)],
+                           capture_output=True, text=True)
+    if build.returncode != 0:
+        pytest.skip(f"cannot build probe image: {build.stderr[-300:]}")
+    spec = importlib.util.spec_from_file_location("postfix_probe", PROBE_DIR / "probe.py")
+    probe = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(probe)
+    results, _ = probe.run("mas-profile", 2625, corpus=True)
+    return probe, results
+
+
+def test_never_rewritten(probe_results):
+    # Delivered as sent up to RFC 5321 quoting, or refused at SMTP; never altered.
+    _, results = probe_results
+    for r in results:
+        if "relay_refused" in r or r["smtp"] != "accepted":
+            continue
+        assert r["equivalent"], r
+        if not r["unchanged"] and r["arrived_as"].startswith('"'):
+            assert r["mas_valid"] is False, r  # quoting added only to non-MAS forms
+
+
+def test_p2_forms_delivered(probe_results):
+    _, results = probe_results
+    p2 = [r for r in results if "!" in r["sent"].split("@")[0] and "relay_refused" not in r]
+    assert p2
+    for r in p2:
+        assert r["smtp"] == "accepted" and r["unchanged"], r
+
+
+def test_not_an_open_relay(probe_results):
+    probe, results = probe_results
+    relay = [r for r in results if "relay_refused" in r]
+    assert [r["sent"] for r in relay] == probe.RELAY_NEGATIVES
+    assert all(r["relay_refused"] for r in relay), relay