FileMill v0.1.0

First tagged release of FileMill — a local-first file-transformation harness that runs independent transformer programs over a JSON file contract, with email as the first input/output adapter.

Highlights

• Email pipeline (Mailgun): an inbound webhook turns an emailed attachment into a job; once the job finishes, a threaded reply is sent back to the sender with the transformer output attached. Verified live end-to-end through the real transformer (PDF in → schedule.xlsx reply).
• Job engine: SQLite-backed queue with transactional job claiming and a running → interrupted recovery sweep on startup; transformers run as independent subprocesses over the contract JSON (job.json / result.json).
• internal/mailgun: signed-webhook verification (HMAC + timestamp window), a consolidated trust boundary, commit-point atomic intake (idempotent on Mailgun retry), a single HTTP failure taxonomy, and a durable outbound delivery loop.
• Observability: webhook activity is logged to filemill.log (arrival logged unconditionally); a startup line reports the listening address.

Operational notes

• Mailgun route action must be forward("<webhook URL>"), not store(notify=...) — the latter doesn't deliver attachments inline. See EMAIL-PIPELINE.md.
• The webhook + delivery loop run only in continuous mode (filemill run), not filemill run --once.

Known gaps / planned

• Error alerting to an operator address is designed but not built — see ERROR-ALERTING-PLAN.md.
• Deferred internal/mailgun robustness items (outbound HTTP timeout, threading-header fix, large-attachment fetch-from-storage, etc.) are tracked for a follow-up.