MAS-WP-0005-T02: SCP-5 and SCP-7 spec text; v0.1.1 errata complete

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 252470@bnt-lap001
Assistant-Session: ad628c8f-4be2-4979-94c9-76c7ed6f8241

workplans/MAS-WP-0005-spec-errata-v0-1-1.md

@@ -70,7 +70,7 @@ SCP-6 split rules), and record which proposals are accepted.
 
 ```task
 id: MAS-WP-0005-T02
-status: progress
+status: done
 priority: high
 state_hub_task_id: "eb4c83d0-5b2c-5b7c-a6e3-57b85fe78334"
 ```
@@ -117,6 +117,10 @@ its own task.
   151 tests pass. The live statute needs a redeploy to carry
   `intake_for`; until then the new ticket service would not recognise
   the intake.
+- 2026-10-18 SCP-5 (§14 item 10) and SCP-7 (§6.2 recommendation) spec text
+  done. The reference service already meets the SCP-5 MUSTs (cap, no
+  replies to automated mail); the SHOULD (authenticated sender) is T05.
+  CHANGELOG marked v0.1.1. T02 done.
 
 ## Reference service: case-robust ticket ids
 
@@ -157,3 +161,34 @@ Draft the statute object `alternate_syntax` (enables the fixed stand-ins
 `--` for `=` and `---` for `!`),
 the destination transforms (see SCP-6), and
 `equivalence.resource_id_case`, with policy semantics and fixtures.
+
+## SCP-5: reply only to authenticated senders
+
+```task
+id: MAS-WP-0005-T05
+status: todo
+priority: medium
+```
+
+Implement the SHOULD part of spec §14 item 10 in the reference stack:
+- Postfix adds `Authentication-Results` (e.g. via OpenDMARC or rspamd
+  milter) on the live MX;
+- `mas-gateway` passes the DMARC verdict into the event (event schema
+  addition);
+- the ticket service sends intake auto-replies only on DMARC pass and
+  records unauthenticated requests without replying.
+
+Decided 2026-10-18 to keep this out of the v0.1.1 errata code.
+
+## Redeploy the live MX with v0.1.1
+
+```task
+id: MAS-WP-0005-T06
+status: todo
+priority: medium
+```
+
+Build and deploy an image with the v0.1.1 parser, the `intake_for`
+statute and the case-insensitive ticket service. Then re-run a smoke test
+(intake create, resource correlate, lower-case correlate).
+