v0.4.3

Added

• GET /api/pgp/bootstrap returns accountAddresses: the account's sending
  address, then its verified send-as aliases. Clients use it to leave the
  account's own addresses out of Reply All when the IMAP login is not an email
  address (#452). suggestedUserIDs is unchanged.

• AI agent access over MCP at /mcp (Streamable HTTP, bearer token). Users
  create tokens under Security → AI agents (GET/POST /api/agent-tokens,
  PUT/DELETE /api/agent-tokens/{id}; create and widen need step-up) with
  Read only or Read and organize access. Tools search, list and read mail and
  threads, list folders and labels, apply and remove labels, move, archive and
  save drafts; nothing sends or deletes. Encrypted mail is metadata only. The
  agent skill is served at /agent/skills/kypost/SKILL.md. Tokens unused for
  90 days, and all tokens on a sealed-backup restore, are revoked. /mcp
  refuses any request with an Origin and sends no CORS headers; token
  changes need the session, its CSRF token and KyPost's own origin.

• KYPOST_DISABLE_AI_SORTING=true turns off automatic labels instance-wide
  and keeps the bundled Ollama and its model pull from starting. Filter rules
  still run, and other new mail gets the fallback label.

• Docker build arg INSTALL_OLLAMA=false builds the image without Ollama.

• KyCalendar pairing (KYPOST_KYCALENDAR_URL, KYPOST_KYCALENDAR_SECRET_FILE,
  KYPOST_KYCALENDAR_ALLOW_PRIVATE; off by default). With a user's opt-in
  (Settings → Mail → KyCalendar), KyCalendar sends invitations, cancellations
  and replies from their own mailbox through the signed
  POST /api/calendar/itip/send, and receives the DKIM-aligned invitations
  that arrive there. New POST /api/calendar/rsvp answers an invitation
  through KyCalendar from the server-side copy; clients fall back to
  calendarReply when it answers kycalendar_off. Contract:
  docs/KYCALENDAR.md.

Fixed

• Built with Go 1.27.3, which distrusts compromised intermediate certificates
  in crypto/x509 (GO-2026-6809). Outbound SMTP over TLS verified server
  certificates with the affected code.

• Remove the pre-launch README’s obsolete Busnes-app owner-move upgrade section.

• Correct the PGP documentation: server-protected key custody is retired, not
  a selectable mode. Describe the retained legacy migration path and distinguish
  it from client-sealed recovery and pickup copies. No key-handling code changes.
  SECURITY.md and CONTRIBUTING.md now say the same, and name the legacy
  master key by its real file, pgp-private-key.key.

• Server → Backup no longer renders a blank page before the first local copy:
  the status API answered localCopies: null for an empty or missing
  KYPOST_BACKUP_DIR and now answers []; the page also tolerates null.

• A failed Save Draft is shown as Draft not saved: … instead of
  Send failed: ….

• Launch-video bugs:

  • The phone-layout mailbox nav no longer repeats folders. It hid rows by
    exact name only, so "Sent Items" and the Scheduled heading showed beside
    the quick nav. It now uses the server's special-use role and the usual
    alias names, and its Drafts/Junk/Sent/Trash links open the account's
    real folders.
  • A keyless account's forced first-login password change no longer warns
    that PGP recovery status is unavailable.
  • Security → Encryption asks for the account password in a masked page
    dialog instead of the browser's clear-text window.prompt.
  • The read and compose PGP unlock dialogs no longer share the input id
    pgp-unlock-password.
  • GET /api/imap/config and the admin per-user IMAP config no longer return
    the server's on-disk path and keyPath, and Mail settings no longer
    show them.
  • With automatic labels off, mail that already carries one of the account's
    labels keeps it instead of also getting the fallback label.
  • The classifier warm-up no longer pulls a model Ollama already has. The
    pull wrote into the models directory, so a pre-populated cache the
    container could not write failed every warm-up and stalled
    classification.

Changes

• Dependabot updates now ship on their own: once a day, if any merged, a
  v0.4.3.N release and image are published and :stable follows it. The
  version lives in backend/internal/appversion/VERSION alone; release images
  report the full four-part version, source builds the three-part line.

• Admin → Single Sign-On: the KySignOn Preset button no longer fills in a
  specific issuer address. It still enables SSO, sets the client ID to
  kypost and turns on auto-provisioning; enter your own KySignOn issuer URL.
  The issuer placeholder is now https://auth.example.com.

• Docs: the README quick start pulls the published image instead of building
  from source, and names the Ollama memory cap (KYPOST_MEM_LIMIT, now in
  docs/CONFIGURATION.md). docs/Reverse_Proxy_Networking.md covers starting
  KyPost when KyIdentity or KyNotes already created kypost-net.
  docs/INSTALLER_SETUP.md points to secret file references and the directory
  webhook needed for offboarding.

What's Changed

• chore(deps): bump pinned Ollama to 0.40.4 by @github-actions[bot] in #424
• docs: lead the README with what KyPost is, move the TLS note out by @Yoshiofthewire in #427
• docs: add a manual image verification procedure by @Yoshiofthewire in #426
• chore(deps): bump pinned Ollama to 0.40.5 by @github-actions[bot] in #428
• feat: add KYPOST_DISABLE_AI_SORTING and INSTALL_OLLAMA build arg by @Yoshiofthewire in #429
• feat: KyCalendar invitation mail (send, inbound, RSVP) by @Yoshiofthewire in #430
• fix: blank Backup page and draft-save error label; install docs from a test run by @Yoshiofthewire in #431
• Polish KyPost interface while preserving controls and settings by @Yoshiofthewire in #432
• docs: clarify standalone installation and test coverage by @Yoshiofthewire in #433
• Make KyPost own shared suite network bootstrap by @Yoshiofthewire in #434
• Shorten KyPost README and correct retired PGP documentation by @Yoshiofthewire in #435
• feat(mcp): add AI agent access to mail over MCP by @Yoshiofthewire in #437
• docs: stop offering retired server-protected PGP custody by @Yoshiofthewire in #438
• Remove the founder's personal urlxl hostnames from SSO config and tests by @Yoshiofthewire in #439
• Bootstrap: return accountAddresses for Reply All (#452) by @Yoshiofthewire in #453
• Build with Go 1.27.3 (GO-2026-6809) by @Yoshiofthewire in #455
• Fix KyPost-Server bugs found while filming the launch videos by @Yoshiofthewire in #454
• chore(deps): Bump github.com/go-jose/go-jose/v4 from 4.1.5 to 4.1.6 in /backend in the go group across 1 directory by @dependabot[bot] in #441
• ci: read the rspamd image pin from docker-compose.rspamd.yml by @Yoshiofthewire in #457
• Change relay URLs in .env.example by @Yoshiofthewire in #458
• chore(deps): Bump the npm-build group across 1 directory with 3 updates by @dependabot[bot] in #442
• fix(backend): log a serve error that arrives after shutdown by @Yoshiofthewire in #462
• chore(ci): Bump github.com/golangci/golangci-lint/v2 from 2.14.0 to 2.15.0 in /tools in the tools group across 1 directory by @dependabot[bot] in #445
• chore(deps): Bump the npm-runtime group across 1 directory with 2 updates by @dependabot[bot] in #443
• chore(deps): Bump the npm-lint group across 1 directory with 2 updates by @dependabot[bot] in #447
• chore(deps): Bump the relay group across 2 directories with 2 updates by @dependabot[bot] in #460
• chore(ci): Bump github/codeql-action/upload-sarif from 4.38.3 to 4.39.0 in the actions group across 1 directory by @dependabot[bot] in #448
• chore(deps): bump rspamd/rspamd from 4.2.0 to 4.2.2 by @Yoshiofthewire in #463
• chore(deps): bump pinned Ollama to 0.40.7 by @github-actions[bot] in #436
• Bump Node to 26.12.1 (CVE-2026-111497) by @Yoshiofthewire in #464
• Release Dependabot changes daily as vX.Y.Z.N by @Yoshiofthewire in #465
• deps(go-imap fork): x/net 0.61, x/text 0.43, x/sys 0.49 by @Yoshiofthewire in #466
• release: v0.4.3 by @Yoshiofthewire in #467
• docs(apns): name org.kysecurity.mail as the iOS bundle ID by @Yoshiofthewire in #468

Full Changelog: v0.4.2...v0.4.3