FileMill v0.2.0

Sheets-link delivery, always-on scheduling, and reply-naming, on top of the v0.1.1 hardening pass.

New

• Sheets-link delivery — an address can be routed to sheets-link instead of an attachment: the output is uploaded to Google Drive, converted to a Sheet, and shared by link. Live for iwk@ end to end, including a 30-day retention sweep of published files.
• Report naming in replies — a transformer can declare a label in transformers.yaml; the reply (both the sheets-link sentence and each job line) names the report by that label instead of the raw operation name, and two operations that only differ in output layout share one label.
• Runs at boot, not just at logon — the scheduled task now starts before anyone signs in, with a supervisor that auto-restarts the worker on crash (escalating backoff).
• CI — build/vet/test now run on every push and PR (windows-latest).

Reliability

• Fixed a worker crash on SQLITE_BUSY under concurrent load.
• Stopped retrying permanently-rejected attachments (was causing a retry storm); the rejection is now logged with the sender.
• The webhook now exits fatally if its port can't be bound, instead of silently listening on nothing.
• Email submissions are now keyed on message + recipient, so the same message to two addresses no longer collides.
• A route with no layout configured no longer logs a spurious delivery-mismatch warning.

Internal / Docs

• Repo prepared for a public GitHub audience: real config/*.yaml gitignored with .example templates, personal domain and paths scrubbed from docs and code, MIT LICENSE added, README rewritten (setup order, job.json walkthrough, badges).
• A second example transformer (uppercase) replaces internal references to the private workerlist project in public-facing docs.

Verified

• go build, go vet, go test ./... clean.
• The documented "Run your first job" walkthrough (submit → run --once → jobs get) verified end to end with the uppercase example.

Known gaps (tracked)

• Catch up on missed mail at startup — issue #2.
• Persistent crash-loop alerting — issue #7.
• Error alerting to an operator address is designed (ERROR-ALERTING-PLAN.md) but not built.

FileMill v0.1.1

Hardening and observability release, on top of the working v0.1.0 email pipeline.

New

• --version / -v flag — prints the build version (overridable at build time via -ldflags "-X main.version=..."). The version now also appears in the webhook startup line, so you can tell at a glance which binary is running.
• Configurable send timeout — send_timeout_seconds in email.yaml (default 30s).

Reliability

• Outbound Mailgun send now uses a bounded HTTP client and a request context, so a hung connection can't stall the delivery loop forever and shutdown can abort an in-flight send.
• Mailgun's error-response body is included in send errors (the real reason a bare status code hides).
• The webhook server shuts down gracefully on exit (10s drain) instead of cutting in-flight requests; safe because intake is idempotent.
• Replies no longer emit a malformed In-Reply-To header when inbound mail had no Message-Id.

Internal

• Job-status strings replaced with store.Status* constants across the store, delivery loop, and job runner.

Verified

• go vet / go test ./... clean; live workerlist round-trip still passes; the running instance confirmed on real hardware.

Known gaps (tracked)

• Catch up on missed mail at startup — issue #2.
• Self-restart on crash, external heartbeat, error alerting to support@ — on the backlog.

FileMill v0.1.0

First tagged release of FileMill — a local-first file-transformation harness that runs independent transformer programs over a JSON file contract, with email as the first input/output adapter.

Highlights

• Email pipeline (Mailgun): an inbound webhook turns an emailed attachment into a job; once the job finishes, a threaded reply is sent back to the sender with the transformer output attached. Verified live end-to-end through the real transformer (PDF in → schedule.xlsx reply).
• Job engine: SQLite-backed queue with transactional job claiming and a running → interrupted recovery sweep on startup; transformers run as independent subprocesses over the contract JSON (job.json / result.json).
• internal/mailgun: signed-webhook verification (HMAC + timestamp window), a consolidated trust boundary, commit-point atomic intake (idempotent on Mailgun retry), a single HTTP failure taxonomy, and a durable outbound delivery loop.
• Observability: webhook activity is logged to filemill.log (arrival logged unconditionally); a startup line reports the listening address.

Operational notes

• Mailgun route action must be forward("<webhook URL>"), not store(notify=...) — the latter doesn't deliver attachments inline. See EMAIL-PIPELINE.md.
• The webhook + delivery loop run only in continuous mode (filemill run), not filemill run --once.

Known gaps / planned

• Error alerting to an operator address is designed but not built — see ERROR-ALERTING-PLAN.md.
• Deferred internal/mailgun robustness items (outbound HTTP timeout, threading-header fix, large-attachment fetch-from-storage, etc.) are tracked for a follow-up.