EMAIL

Three reasons to own the mail plane rather than outsource to a SaaS provider: (1) injection defence — most of the high-profile 2025 prompt-injection CVEs entered through email, and a hosted provider does not let you put a CaMeL quarantine between the body and the agent; (2) shared-inbox UX — teams managing support@, sales@, billing@ need assignment, internal comments, and snooze, which Gmail / M365 implement only via shaky third-party add-ons; (3) data residency — Vietnamese tenants under Decree 53 must keep certain customer data on Vietnamese soil, which most hosted mail providers cannot promise. Stalwart gives us a credible Rust mail server, a Missive-style UX gives us the shared-inbox primitive, and CaMeL gives us a proof-shaped boundary against indirect prompt injection.

EchoLeak (CVE-2025-32711, May 2025) was the canonical demonstration: a malicious email tricked Microsoft 365 Copilot into exfiltrating data with zero user clicks. The attack class continued through April 2026. The lesson is not "patch the LLM" — it is "do not let the LLM see the raw body". CaMeL is the architecture that enforces that, and EMAIL is the module where that enforcement lives.

A structured decomposition of EMAIL's scope. Every cell traces back to PRD §9.4 and §11.2.3.

EMAIL has four planes: the protocol plane (Stalwart, talking SMTP / IMAP / JMAP outbound and inbound to the world); the policy plane (CaMeL filter + DKIM / SPF / DMARC verify + per-tenant ACL); the UX plane (the Missive-style SPA + an htmx-light fallback for slow networks); and the AI plane (draft, summarise, categorise — all routed through AI Gateway with the privileged CUO persona). The diagram shows the canonical inbound path with the CaMeL boundary highlighted.

Internal components

Metadata lives in PostgreSQL with row-level security keyed by tenant_id; bodies and attachments live in S3 + KMS, addressed by content-hash. Threads are normalised on JMAP threadId, not on Reply-To header heuristics. Shared inboxes are a separate table with their own ACL; a Member can be a participant in many inboxes, and an inbox can be managed by many Members.

Indexing & search strategy

Four surfaces: JMAP for IETF-standard mail clients, a GraphQL federated subgraph for the CyberOS SPA, MCP tools for the CUO agent, and a small REST admin surface for DKIM rotation and Trust-Center reports.

GraphQL subgraph (federated)

extend schema
  @link(url: "https://specs.apollo.dev/federation/v2.5", import: ["@key", "@requiresScopes"])

type Mailbox @key(fields: "id") {
  id: ID!
  address: String!
  displayName: String!
  kind: MailboxKind!
  unread: Int!
  threads(status: ThreadStatus, limit: Int = 50, cursor: String): ThreadConnection!
    @requiresScopes(scopes: [["email.read"]])
}

type SharedInbox @key(fields: "id") {
  id: ID!
  address: String!
  displayName: String!
  defaultAssignee: Subject
  unassignedCount: Int!
  threads(status: ThreadStatus, assignee: ID, limit: Int = 50): ThreadConnection!
    @requiresScopes(scopes: [["email.shared.read"]])
}

type Thread @key(fields: "id") {
  id: ID!
  subject: String!
  participants: [String!]!
  messageCount: Int!
  lastMessageAt: DateTime!
  status: ThreadStatus!
  assignment: Assignment
  tags: [String!]!
  comments: [InternalComment!]!
  summary: AISummary
  messages(limit: Int = 50): [Message!]!
}

type Message @key(fields: "id") {
  id: ID!
  from: String!
  to: [String!]!
  cc: [String!]
  subject: String!
  receivedAt: DateTime!
  bodyPreview: String!   # CaMeL gist · NOT raw body
  attachments: [Attachment!]!
  dmarc: DMARCResult!
}

type AISummary {
  threadId: ID!
  summary: String!
  citations: [Citation!]!
  generatedAt: DateTime!
}

enum MailboxKind { PERSONAL SHARED }
enum ThreadStatus { ACTIVE SNOOZED DONE }
enum DMARCResult { PASS FAIL NONE }

type Mutation {
  assignThread(threadId: ID!, assigneeId: ID!): Boolean!
    @requiresScopes(scopes: [["email.shared.assign"]])
  snoozeThread(threadId: ID!, until: DateTime!): Boolean!
  resolveThread(threadId: ID!): Boolean!
  addInternalComment(threadId: ID!, body: String!): InternalComment!
  draftReply(threadId: ID!, intent: ReplyIntent): DraftReplyResult!
    @requiresScopes(scopes: [["email.compose"]])
  sendMessage(input: SendMessageInput!): Message!
    @requiresScopes(scopes: [["email.send"]])
}

REST + admin surface

MCP tool catalogue

Flow 1 — Inbound message with CaMeL scan

Flow 2 — Outbound message with DKIM signing

Flow 3 — AI-drafted reply (CyberSkill voice, Vietnamese-aware)

Flow 4 — Shared-inbox assignment

Flow 5 — Gmail → CyberOS migration

Inbound and outbound messages traverse separate state machines, but every state transition emits a BRAIN audit row.

Outbound state machine

PRD §11.2 NFRs that EMAIL must satisfy. Cross-referenced at nfr-catalog.html#email.

EMAIL leans on AUTH (every JMAP / GraphQL call), BRAIN (audit + opt-in summary), AI (CaMeL extraction + draft generation), MCP (CUO tools), and OBS (DMARC reports + traces). It is leaned on by CRM (activity auto-log), PROJ ("promote to task"), CUO (assignment categoriser), and KB (publishing a doc as an email digest).

Email is a magnet for regulators. EMAIL must satisfy PDPL, GDPR, RFC compliance, and Decree-13 personal data processing log requirements.

EMAIL carries the second-highest single-module risk weight after AUTH; injection attacks here propagate to every downstream module. Tracked in the risk register.

EMAIL health rolls up into 10 KPIs covering deliverability, injection-defence efficacy, AI-feature quality, and shared-inbox UX.

EMAIL is owned by the CCO seat. Today (CCO vacant), the CEO is interim accountable; the CTO owns engineering; the CSO is consulted on every CaMeL-touching change.

A single admin CLI cyberos-email for tenant operators. Destructive commands always write a chained audit row before exit.

1. Create a shared inbox

$ cyberos-email shared-inbox create \
    --tenant cyberskill \
    --address support@cyberskill.world \
    --display "CyberSkill Support" \
    --default-assignee linh@cyberskill.world

[shared-inbox created]
  id:        01HZK1Y2J3K4M5N6P7Q8R9S0T1
  address:   support@cyberskill.world
  audit:     brain seq=14902 chain=1a2b…3c4d

2. Rotate per-tenant DKIM key

$ cyberos-email dkim rotate --tenant cyberskill --reason "quarterly-scheduled"

[rotate]   new selector: cyberos-2026-q2
[kms]      old selector cyberos-2026-q1 retained for verification (30 d)
[dns]      _domainkey.cyberskill.world TXT record updated
[audit]    brain seq=14905 chain=5d6e…7f80

3. Import from Gmail

$ cyberos-email import gmail \
    --user stephen@cyberskill.world \
    --since 2024-01-01 \
    --rate-limit 1000/min

[import]   authenticating via XOAUTH2 …
[import]   selecting [Gmail]/All Mail … 12,481 messages
[import]   walking threads (CaMeL extracting on the fly) …
[import]   complete · 12,481 messages · 47 injection-flagged · 0 errors
[audit]    brain seq=14952 chain=9a8b…7c6d

4. View DMARC aggregate report

$ cyberos-email dmarc report --tenant cyberskill --since 7d

domain                  policy   sent     pass     fail   pct
cyberskill.world        reject   8,213    8,201      12   99.85%
↳ google.com            -        4,102    4,098       4   99.90%
↳ outlook.com           -        2,108    2,103       5   99.76%
↳ proton.me             -        1,003    1,000       3   99.70%
↳ other                 -        1,000    1,000       0   100.00%

5. Run CaMeL red-team replay

$ cyberos-email redteam replay --corpus echoleak-v3 --output report.json

[replay]   corpus: echoleak-v3 (412 messages)
[replay]   running quarantined extraction …
[replay]   ✓ 410 / 412 injection attempts blocked (99.51%)
[replay]   ✗ 2 escapes — see report.json#escapes
[audit]    brain seq=14958 chain=ef01…2345

6. Export DSAR bundle

$ cyberos-email dsar-export --subject stephen@cyberskill.world --output stephen.zip

[dsar]   subject:    stephen@cyberskill.world
[dsar]   threads:    1,247
[dsar]   messages:   8,213 (3,142 inbound · 5,071 outbound)
[dsar]   attachments: 412 (412 MB)
[dsar]   summaries:  1,247 (CaMeL gist)
[dsar]   written:    stephen.zip (478 MB)
[audit]  brain seq=14961 chain=6a7b…8c9d

7. Install ManageSieve rule

$ cyberos-email sieve install --mailbox stephen@cyberskill.world --file my.sieve

require ["fileinto", "imap4flags"];
if address :is "from" "noreply@github.com" {
  fileinto "GitHub";
  setflag "\\Seen";
  stop;
}

[sieve]    parsed · 1 rule
[sieve]    installed at priority 100
[audit]    brain seq=14963 chain=2b3c…4d5e