MAS-WP-0005-T02: SCP-5 and SCP-7 spec text; v0.1.1 errata complete

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 252470@bnt-lap001
Assistant-Session: ad628c8f-4be2-4979-94c9-76c7ed6f8241

mas-v0.1-spec/CHANGELOG.md

@@ -6,7 +6,7 @@
   unquoted form; canonical parsers still reject the quoted form (§4).
   Fixture p1-040 note updated.
 
-## v0.1.1 (errata, in progress)
+## v0.1.1 (errata)
 
 Errata from the reference experiment and the live provider test
 (mail-address-semantics MAS-WP-0002/0003). Proposals and evidence:
@@ -23,6 +23,14 @@ Errata from the reference experiment and the live provider test
   address the intake for a declared resource type (§7). An opaque target
   equal to a type name has no intake semantics without it.
 
+- **SCP-5, intake auto-reply bounds.** New §14 item 10: auto-replies to
+  intake or interaction addresses SHOULD require an authenticated sender,
+  MUST be volume-bounded, and MUST NOT go to automated mail.
+- **SCP-7, case-robust identifiers (recommendation).** §6.2: generators
+  SHOULD use identifiers whose meaning does not depend on case, and
+  receivers SHOULD match them case-insensitively. The statute field
+  `resource_id_case` is deferred to v0.2.
+
 ## v0.1
 
 Initial draft.

mas-v0.1-spec/SPECIFICATION.md

@@ -219,6 +219,12 @@ exposed and enumeration is undesirable.
 
 High entropy does not transform an identifier into an authorization token.
 
+Forwarders, mailing lists and web forms commonly change the case of
+local-parts. Generators SHOULD use resource identifiers whose meaning does
+not depend on letter case, for example lower-case only or a
+case-insensitive alphabet such as Crockford base32, and receivers SHOULD
+then match them case-insensitively.
+
 ## 7. Interaction semantics
 
 The recommended P2 initiation pattern is:
@@ -403,6 +409,13 @@ interaction, and generators MUST NOT emit both simultaneously.
 8. Authentication remains external to MAS.
 9. A statute endpoint is security-relevant configuration and SHOULD be
    protected with the same care as other origin-wide metadata.
+10. A receiver that automatically replies to mail sent to an intake or
+    interaction address turns any forged sender into outbound mail to a
+    third party. Such a receiver SHOULD reply only when the sender is
+    authenticated (for example DMARC alignment pass), MUST bound the volume
+    of such replies (rate limits or caps), and MUST NOT reply to automated
+    mail (`Auto-Submitted` other than `no`, or `Precedence` `bulk`, `list`
+    or `junk`).
 
 ## 15. Conformance classes
 

workplans/MAS-WP-0005-spec-errata-v0-1-1.md

@@ -70,7 +70,7 @@ SCP-6 split rules), and record which proposals are accepted.
 
 ```task
 id: MAS-WP-0005-T02
-status: progress
+status: done
 priority: high
 state_hub_task_id: "eb4c83d0-5b2c-5b7c-a6e3-57b85fe78334"
 ```
@@ -117,6 +117,10 @@ its own task.
   151 tests pass. The live statute needs a redeploy to carry
   `intake_for`; until then the new ticket service would not recognise
   the intake.
+- 2026-10-18 SCP-5 (§14 item 10) and SCP-7 (§6.2 recommendation) spec text
+  done. The reference service already meets the SCP-5 MUSTs (cap, no
+  replies to automated mail); the SHOULD (authenticated sender) is T05.
+  CHANGELOG marked v0.1.1. T02 done.
 
 ## Reference service: case-robust ticket ids
 
@@ -157,3 +161,34 @@ Draft the statute object `alternate_syntax` (enables the fixed stand-ins
 `--` for `=` and `---` for `!`),
 the destination transforms (see SCP-6), and
 `equivalence.resource_id_case`, with policy semantics and fixtures.
+
+## SCP-5: reply only to authenticated senders
+
+```task
+id: MAS-WP-0005-T05
+status: todo
+priority: medium
+```
+
+Implement the SHOULD part of spec §14 item 10 in the reference stack:
+- Postfix adds `Authentication-Results` (e.g. via OpenDMARC or rspamd
+  milter) on the live MX;
+- `mas-gateway` passes the DMARC verdict into the event (event schema
+  addition);
+- the ticket service sends intake auto-replies only on DMARC pass and
+  records unauthenticated requests without replying.
+
+Decided 2026-10-18 to keep this out of the v0.1.1 errata code.
+
+## Redeploy the live MX with v0.1.1
+
+```task
+id: MAS-WP-0005-T06
+status: todo
+priority: medium
+```
+
+Build and deploy an image with the v0.1.1 parser, the `intake_for`
+statute and the case-insensitive ticket service. Then re-run a smoke test
+(intake create, resource correlate, lower-case correlate).
+