# Integration Verification

This document records sanitized evidence from the authorized integration run performed on 2026-08-25. It contains no account names, passwords, cookies, `sid` values, server ids, message subjects, contact data, or private response bodies.

## Scope and safeguards

- Target deployment: `https://mail.dlut.edu.cn/`
- Credentials came from the ignored local `.env` only in temporary Web test scripts.
- Test records used a unique random `piweb_` prefix.
- Temporary scripts lived under `/tmp` and were never added to the repository or package scripts.
- Node.js default TLS certificate verification remained enabled.
- Web API verification and IMAP delivery verification ran as separate phases.

## Web API phase

A temporary script instantiated `CoremailWebClient` directly with the authorized test credential and configurable target Base URL.

Verified operations, in order:

1. Web login and authenticated group query
2. Contact creation
3. Contact retrieval by returned server id
4. Contact update
5. First group creation with the contact as a member
6. Second group creation
7. Group listing and id lookup
8. Contact movement from the first group to the second
9. Member addition
10. Member removal
11. Group rename and membership replacement
12. Scheduled-message creation for cancellation
13. Scheduled-message listing and id correlation
14. Cancellation before delivery, returning `cancelled`
15. A separate self-addressed scheduled-message creation
16. Scheduled-message listing before handoff to IMAP verification
17. Contact and group cleanup

All operations completed successfully. During protocol discovery, an earlier unsupported ISO schedule-date representation produced `FA_INVALID_DATE`; the production client now serializes Coremail's local `YYYY-MM-DD HH:mm:ss` form. An earlier group deletion returned `FA_GROUP_NOT_EMPTY`; the production client now cleans non-empty groups before deletion.

## IMAP delivery phase

The delivery check used `CoremailClient` in a separate temporary process. It loaded the existing IMAP/SMTP configuration and its independent `service=pi-coremail` Secret Service credential. The Web `.env` password was not reused as formal IMAP configuration.

Verified operations:

1. Independent IMAP and SMTP authentication check
2. Polling the Inbox for the unique scheduled-message subject with a ten-minute timeout
3. Successful receipt approximately 272 seconds after the IMAP phase started
4. Cleanup of test messages from Inbox, Drafts, and Sent

Cleanup removed:

- 1 Inbox message
- 6 Drafts messages, including cancellation/protocol-discovery artifacts
- 1 Sent message

A final Web query found no remaining randomly prefixed contacts, groups, or scheduled tasks. Cleanup reported no failures.

## Interactive tmux extension phase

A later authorized verification loaded both working-tree extensions temporarily in a dedicated tmux window:

```text
pi --no-extensions --no-builtin-tools \
  -e ./extensions/coremail.ts \
  -e ./extensions/coremail-web.ts \
  --no-session --approve
```

The account came from the ignored `.env`. Password input used the masked TUI and a short-lived tmux paste buffer; the password never appeared in captured pane output. The run verified:

- `/coremail status`
- `/coremail-web login|status|logout`, including Web logout isolation from the IMAP/SMTP account and a successful Web re-login
- Contacts list/create/get/update/delete
- Groups list/create/update/delete and member add/remove/move
- Reserved-group and invalid-input rejection
- Scheduled create/list/cancel, ISO 8601 list output after reload, and canceled-draft cleanup
- IMAP folders/list/search/read/set-seen/delete
- Draft create/read/update/send/delete with the updated folder-scoped UID
- Direct SMTP send and independent self-receipt through Inbox search
- Sent-copy cleanup
- Attachment send/read/download, byte-for-byte round-trip, mode `0600`, and no-overwrite rejection

All interactive operations passed after four issues discovered by the TUI run were corrected:

1. Suggested hosts no longer duplicate an existing `mail.` account subdomain.
2. Scheduled-list server-local timestamps are normalized to ISO 8601.
3. Downloaded attachments are created with mode `0600`.
4. Secret Service lookup retries once after a transient empty result observed on the first status command.

All randomly prefixed contacts, groups, schedules, drafts, Inbox messages, and Sent messages were removed. A final Web logout restored the pre-run state with no Web config or Web credential while preserving the independent IMAP/SMTP config and credential. Temporary attachment files, tmux paste buffers, and the tmux window were removed after verification.

## Scheduled attachment phase

A later authorized attachment verification used temporary scripts outside the repository. Protocol discovery confirmed the Coremail compose sequence without retaining authentication artifacts:

1. Initialize a compose session.
2. Call `upload:prepare` for each local attachment.
3. Upload the bytes to Coremail's deployment-relative upload endpoint as multipart data.
4. Include the returned attachment ids and metadata in `mbox:compose` when scheduling.

The live Web phase verified both supported workflows:

- Creating a new scheduled message with a local attachment
- Listing a server draft by Web id and scheduling that existing attached draft
- Cancelling each workflow and confirming through separate IMAP reads that the restored drafts retained byte-identical attachments

A temporary tmux-loaded pi session then exercised the published `coremail_web` tool surface itself: `drafts_list`, `scheduled_from_draft`, attachment-bearing `schedule`, `scheduled_list`, and `scheduled_cancel`. It used the companion `coremail` tool to create the initial attached draft, verify both restored drafts contained attachments, and delete them. A final tool-level audit reported zero matching draft or scheduled-message residue.

A final Web phase scheduled one attached message from each workflow for real self-delivery. A separate IMAP phase received both messages, verified that each contained a byte-identical attachment, and removed the test messages from Inbox and Sent. Final Web and IMAP checks found no matching schedules, drafts, Inbox messages, or Sent messages.

The run used random test prefixes. This record omits the account, password, cookies, `sid`, compose ids, draft ids, scheduled-message ids, subjects, attachment contents, and private response bodies. Temporary HAR files, browser state, compiled output, scripts, and attachment fixtures were removed after verification.

## Slash Command completion phase

A temporary tmux-loaded pi session verified both command menus without executing account mutations:

- `/coremail` and `/coremail-web` displayed `login [account] | status | logout` syntax in the Slash Command list.
- Typing a command followed by a space displayed all three argument completions with action-specific descriptions.
- Typing an account prefix after `login` offered the currently configured account without reading or displaying any password.

The temporary window was removed after the check.

## Offline and package verification

After the integration run:

```text
pnpm check: 7 test files passed, 32 tests passed
npm pack --ignore-scripts --dry-run: both extension entries present; .env absent
```

The temporary integration scripts, compiled output, state files, and package inspection artifacts were removed from `/tmp` after verification.