Gulo Gulo

Gulo Gulo is an OCI-native, mail-first, tenant-isolated groupware platform. The guiding animal is the wolverine (Gulo gulo). Human-facing text uses Gulo Gulo; file names, paths, package names, and other machine-facing identifiers use gulogulo without spaces.

The complete license text is available in LICENSE. A quick note from me, Sythos: I had the Gulo Gulo artwork made with AI because I am honestly hopeless on the artistic side. And, since I have not written a single line of code comments in roughly a third of a century, the documentation for this project is entrusted to Enya, my virtual AI agent. She keeps the paperwork tidy while I focus on making the wolverine do useful things.

Production readiness checklist

This is the checklist from section 30 of the authoritative specification. A check mark means that the repository contains an implementation contract and a passing verification gate for that item; deployment evidence is still required where the item depends on external infrastructure.

LP5 is complete at the bounded synthetic operations and capacity boundary. Its local operations, patch-state, abuse, observability, and capacity contracts passed the integrated GitHub AMD64 Compose proof, followed by the final ARM64 artifact and attestation gate. This remains local-proof evidence, not a claim of production capacity or external service interoperability.

Security

• no open relay;
• TLS and certificate health contract verified;
• ACME renewal state and safe-reload contract tested;
• LDAP uses TLS and minimum bind privilege;
• PostgreSQL protected and backed up;
• secret store and rotation configured;
• CSP, CSRF, and security headers;
• secure web sessions, generic login failures, and login rate limits;
• email HTML sanitization;
• rate and abuse controls contract tested;
• audit has no secrets;
• images have SBOM and verified digest.

Data

• sources of truth documented;
• quota ledger verified;
• 28-day retention tested;
• user backup authorization tested;
• provider backup encrypted;
• restore tested;
• purge idempotent;
• account deletion runbook approved.

Interoperability

• SMTP and IMAP;
• IMAP IDLE;
• Sieve;
• aliases;
• CalDAV contract and conditional object semantics;
• CardDAV contract and conditional object semantics;
• .well-known resources;
• autodiscovery contract with safe manual fallback;
• ICS/vCard validation and metadata export;
• timezone behavior.

Operations

• health and metrics;
• multi-architecture Docker images for Ubuntu 26.04 LTS on amd64 (x86_64) and arm64;
• dual-stack IPv4 and IPv6 network support;
• persistent external mail volumes and restart continuity;
• offline synthetic LP2 LDAP and PostgreSQL dependency proof with verified TLS;
• offline synthetic mail proof with Postfix, Dovecot, Rspamd, and ClamAV;
• offline synthetic web/session/DAV/discovery proof with restart continuity;
• fast amd64-first CI with an explicit multiarch amd64+arm64 final gate;
• tenant-bound DAV ETags and sync tokens;
• OCI build-provenance attestations generated and verified;
• provenance permissions are granted only by push or manual callers, while pull-request validation remains read-only;
• log rotation;
• alerts;
• Postfix queue visibility;
• bounded LP5 operations and capacity proof (AMD64 Compose first, ARM64 final artifact gate);
• fail-closed disposable patch helper and sanitized read-only patch status;
• automatic Rspamd/ClamAV updates;
• provider-only migration contract, compatibility window, and rollback state machine;
• live blue/green rehearsal;
• live rollback rehearsal;
• RPO/RTO approved;
• incident and DR runbooks.

Governance

• roles and delegation policy approved;
• master log access is off by default;
• API/MCP are read-only;
• future features are not enabled;
• ADRs are current;
• deployment documentation is complete.

Repository layout

The tree below is kept current with every repository change. Generated dependencies and build output are intentionally omitted.

gulogulo/
├── .github/
│   └── workflows/
│       ├── commit-tests.yml
│       ├── pr-validation.yml
│       └── quality-gates.yml
├── assets/
│   ├── README.md
│   └── gulo-gulo-calendar-mail.png
├── config/
│   └── schema.v1.json
├── docker/
│   ├── lp1-network/
│   │   ├── Dockerfile
│   │   ├── entrypoint-ca.sh
│   │   └── entrypoint-dns.sh
│   ├── lp2-tls/
│   │   ├── .dockerignore
│   │   ├── Dockerfile
│   │   └── entrypoint-tls.sh
│   ├── lp2-ldap/
│   │   ├── .dockerignore
│   │   ├── Dockerfile
│   │   ├── bootstrap.ldif
│   │   ├── entrypoint-ldap.sh
│   │   └── healthcheck-ldap.sh
│   ├── lp2-postgres/
│   │   ├── .dockerignore
│   │   ├── Dockerfile
│   │   ├── entrypoint-postgres.sh
│   │   └── healthcheck-postgres.sh
│   ├── lp3-clamav/
│   │   ├── .dockerignore
│   │   ├── Dockerfile
│   │   ├── entrypoint-clamav.py
│   │   └── healthcheck-clamav.sh
│   ├── lp3-dovecot/
│   │   ├── .dockerignore
│   │   ├── Dockerfile
│   │   ├── default.sieve
│   │   ├── dovecot.conf
│   │   ├── entrypoint-dovecot.sh
│   │   ├── healthcheck-dovecot.sh
│   │   └── users
│   ├── lp3-postfix/
│   │   ├── .dockerignore
│   │   ├── Dockerfile
│   │   ├── entrypoint-postfix.sh
│   │   ├── healthcheck-postfix.sh
│   │   ├── lp3-aliases.regexp
│   │   ├── lp3-mailboxes.regexp
│   │   └── main.cf
│   ├── lp3-proof/
│   │   ├── .dockerignore
│   │   ├── Dockerfile
│   │   └── proof.py
│   ├── lp3-rspamd/
│   │   ├── .dockerignore
│   │   ├── Dockerfile
│   │   ├── entrypoint-rspamd.py
│   │   └── healthcheck-rspamd.sh
│   └── lp3-tls/
│       ├── .dockerignore
│       ├── Dockerfile
│       └── entrypoint-tls.sh
├── doc/
│   ├── README.md
│   ├── api-and-mcp.md
│   ├── acme-abuse-deployment.md
│   ├── compose-and-fixtures.md
│   ├── configuration.md
│   ├── container-patching.md
│   ├── dav-and-discovery.md
│   ├── identity-and-postgres.md
│   ├── lifecycle-backup-dr.md
│   ├── local-proof-scope.md
│   ├── local-proof-topology.md
│   ├── lp2-local-services.md
│   ├── lp3-local-mail.md
│   ├── lp4-local-web.md
│   ├── lp5-local-operations-capacity.md
│   ├── mail-core.md
│   ├── rbac-admin-mfa.md
│   ├── release-readiness.md
│   ├── server-typescript.md
│   ├── observability.md
│   ├── storage-and-quotas.md
│   ├── upgrade-and-migration.md
│   └── web-foundation.md
├── scripts/
│   ├── m0-smoke.ps1
│   ├── m1-fixture-smoke.ps1
│   ├── lp0-scope-audit.mjs
│   ├── lp1-compose-audit.mjs
│   ├── lp1-proof-check.mjs
│   ├── lp1-proof-smoke.mjs
│   ├── lp2-compose-audit.mjs
│   ├── lp2-compose-smoke.mjs
│   ├── lp2-proof-smoke.mjs
│   ├── lp3-compose-audit.mjs
│   ├── lp3-compose-smoke.mjs
│   ├── lp3-proof-smoke.mjs
│   ├── lp4-compose-audit.ts
│   ├── lp4-compose-smoke.ts
│   ├── lp4-proof-check.ts
│   ├── lp4-web-runtime.ts
│   ├── lp5-capacity-smoke.ts
│   ├── lp5-compose-audit.ts
│   ├── lp5-compose-smoke.ts
│   ├── lp5-proof-check.ts
│   ├── m10-release-audit.mjs
│   ├── container-patch.sh
│   └── runtime, fixture, and patch utilities
├── release/
│   ├── local-proof-scope.json
│   ├── local-proof-topology.json
│   ├── lp2-local-services.json
│   ├── lp3-local-mail.json
│   ├── lp4-local-web.json
│   ├── lp5-local-operations-capacity.json
│   └── v1-release-evidence.template.json
├── src/
│   ├── admin/ (TypeScript RBAC, delegation, quota, and admin tools)
│   ├── auth/ (TypeScript password, TOTP, WebAuthn, and recovery contracts)
│   ├── backup/
│   ├── db/migrations/
│   ├── foundation/
│   ├── integrations/ (TypeScript LDAP, PostgreSQL, tenant, and migration adapters)
│   ├── lifecycle/
│   ├── mail/
│   │   ├── imap-idle.mjs
│   │   ├── imap-idle.test.ts
│   │   ├── imap-idle.ts
│   │   ├── mail-core.mjs
│   │   ├── mail-core.test.mjs
│   │   ├── mail-core.test.ts
│   │   ├── mail-core.ts
│   │   ├── mail-policy.mjs
│   │   ├── mail-policy.ts
│   │   ├── mail-queue.mjs
│   │   ├── mail-queue.ts
│   │   ├── mail-scanners.mjs
│   │   ├── mail-scanners.test.ts
│   │   └── mail-scanners.ts
│   ├── observability/
│   ├── capacity/ (typed bounded local-proof measurement contracts)
│   ├── release/
│   │   ├── index.mjs
│   │   ├── local-proof-scope.mjs
│   │   ├── local-proof-scope.test.mjs
│   │   ├── local-proof-topology.mjs
│   │   ├── local-proof-topology.test.mjs
│   │   ├── release-evidence.mjs
│   │   └── release-evidence.test.mjs
│   ├── ops/
│   │   ├── abuse/ (typed rate and abuse controls)
│   │   ├── acme/ (typed ACME and certificate health contracts)
│   │   └── patch/ (typed sanitized patch-status contract)
│   ├── upgrade/
│   │   ├── compatibility.mjs
│   │   ├── control-plane.mjs
│   │   ├── index.mjs
│   │   ├── rollout.mjs
│   │   └── upgrade-contract.test.mjs
│   ├── runtime/ (TypeScript HTTP runtime and observability)
│   ├── dav/
│   │   ├── caldav/ (strict TypeScript CalDAV contract and tests)
│   │   ├── carddav/ (strict TypeScript CardDAV contract and tests)
│   │   └── discovery/ (strict TypeScript discovery and tests)
│   └── web/
│       ├── backup/ (typed user backup boundary)
│       ├── content/ (typed sanitization, attachment, and timezone policies)
│       ├── realtime/ (typed metadata-only event normalization)
│       └── security/ (typed sessions, cookies, and CSRF)
├── test/
│   └── fixtures/
├── web/
│   ├── README.md
│   ├── build.mjs
│   ├── index.html
│   ├── manifest.json
│   ├── src/
│   └── test/
├── .dockerignore
├── .env.example
├── Dockerfile
├── LICENSE
├── README.md
├── compose.yaml
├── package-lock.json
├── package.json
├── tsconfig.json
├── tsconfig.lp4.json
├── tsconfig.lp5.json
└── tsconfig.server.json

Development and contribution

I keep dependencies, actions, runtimes, images, and external tools on their latest stable releases; the lockfile and the companion docs record the exact versions that were resolved. Please keep secrets, credentials, private keys, and real user data out of commits entirely.

Every pushed commit and every pull request, whether it comes from an internal branch or an external fork, goes through the same read-only quality gates. A change is ready when those checks are green, tenant isolation and source-of- truth boundaries are still intact, and the repository tree in this README has been kept in sync with any files that were added or moved.

That is the whole spirit of the project: make a focused change, explain the interesting bits, run the checks, and leave the next person a tidy trail to follow. Gulo Gulo is released under the MIT License.