MAILRAFT / PRODUCT

Roadmap

What we are building next, in the order we are building it, with the gate each phase has to pass before the next starts. Dates are intentionally omitted; evidence is not.

Phase 1 — Strengthen evidence (shipped)

• Live visual + boundary gate: pnpm verify:live.
• Font and icon license parity enforced at build.
• Evidence Envelope v1 schema enforced across all evidence Markdown.

Phase 2 — SES outbound (blocked)

• Earlier production-access requests were denied. Current AWS approval is unverified; application sandbox acceptance and production approval remain required. General sending is disabled.
• Least-privilege sandbox send policy.
• DB-authorized tenant SES activation gate (additive, forward-only migration history).
• Fail-closed dry-run gate: pnpm ses:dry-run.

Phase 3 — Deliverability (verification gates)

• Mail plan: SPF, DKIM, DMARC, MAIL FROM.
• Reality probe: pnpm verify:dns.
• Unit-tested DNS validators.

Phase 4 — Open or click and separated streams

• SES Configuration Set event destinations per stream.
• Consent and suppression per stream.
• Per-tenant and per-user tracking opt-out.

Phase 5 — Gmail private pilot

• Owner Gmail readonly consent, read, refresh and disconnect acceptance.
• Grounded draft and strict human approval.
• Scope progression requires per-step owner ADR.

Phase 6 — Microsoft 365 parallel lane

• Mail.Read inbound.
• Scope progression to Mail.ReadWrite or Mail.Send under per-step owner ADR.

Phase 7 — Yahoo and generic IMAP/SMTP

• Yahoo OAuth with app-password fallback.
• Shared mailbox-adapter contract.

Phase 8 — MCP React Views pilot

• Authenticated remote MCP transport.
• React Views for inbox, drafts, approvals, knowledge.

Phase 9 — AI quality and SMS escalation

• Live-model evaluation on grounded drafts.
• Owner ADR on SMS primary and fallback.
• One deduplicated SMS per crucial action.

Phase 10 — Platform strengthening (continuous)

• Production migrations with ledger and advisory lock.
• Backup and restore health gate per release.
• Vaultwarden rotation schedule under owner authority.

Phase 11 — Launch readiness and compliance

• CAN-SPAM, CASL and Tanzania PDPA posture.
• Formal privacy policy, DPA and status page.
• Pricing surface wired to billing when approved.

How we gate phases

• No adjective-only claim.
• Live proof per phase, recorded under docs/evidence/.
• Pre-ship gate: pnpm check + verify:live.