History

tegwick e19d557a4c Test MAS addresses against real Postfix; close MAS-WP-0002, add MAS-WP-0003 - experiments/postfix-probe: Postfix 3.7 -> pipe -> mas-gateway -> ticket service in Docker; 14 address forms x 5 configurations. 13/14 arrive byte-identical everywhere; quoted "ticket=PR42" is unquoted in transit. Legacy bang/percent rewrites never fire for MAS addresses. - docs/experiment-review.md: Email infrastructure section with results - MAS-WP-0003: provider-side live test on a real subdomain (needs DNS/MX) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 623586@bnt-lap001 Assistant-Session: 10b30928-5b3b-4c11-9934-5ecca07367d8		2026-10-08 00:51:27 +02:00
..
results	Test MAS addresses against real Postfix; close MAS-WP-0002, add MAS-WP-0003	2026-10-08 00:51:27 +02:00
capture.py	Test MAS addresses against real Postfix; close MAS-WP-0002, add MAS-WP-0003	2026-10-08 00:51:27 +02:00
Dockerfile	Test MAS addresses against real Postfix; close MAS-WP-0002, add MAS-WP-0003	2026-10-08 00:51:27 +02:00
entrypoint.sh	Test MAS addresses against real Postfix; close MAS-WP-0002, add MAS-WP-0003	2026-10-08 00:51:27 +02:00
probe.py	Test MAS addresses against real Postfix; close MAS-WP-0002, add MAS-WP-0003	2026-10-08 00:51:27 +02:00
README.md	Test MAS addresses against real Postfix; close MAS-WP-0002, add MAS-WP-0003	2026-10-08 00:51:27 +02:00

README.md

Postfix probe

A real Postfix delivers MAS addresses through the pipe transport to mas-gateway and on to the reference ticket service. A capture proxy (capture.py) records the envelope recipient each event carried, so the probe can tell whether Postfix rewrote anything.

docker build -t mas-postfix-probe experiments/postfix-probe
python3 experiments/postfix-probe/probe.py --profile defaults            # relay domain
python3 experiments/postfix-probe/probe.py --profile local-domain        # domain in mydestination
python3 experiments/postfix-probe/probe.py --profile local-domain-safe   # + swap_bangpath/percent_hack off

The other profiles are defaults-local and mas-safe-local. The repo is mounted read-only. In results/ a = mark means the address arrived unchanged and ! means it was rewritten. Findings are in docs/experiment-review.md under Email infrastructure.

The Postfix side is the master.cf entry in entrypoint.sh:

mas  unix  -  n  n  -  -  pipe
  flags=Rq user=mas argv=/usr/local/bin/mas-gateway --statute <statute>
  pipe --app-url http://127.0.0.1:8024/mas-events --recipient ${recipient}

Set mas_destination_recipient_limit = 1 so each pipe invocation handles one recipient.