IOC Mail 0.1.0 — architecture

One native Windows service hosts Kestrel HTTPS API + static UI and seven bounded
TCP listeners. .NET is published self-contained; SQLite native library ships
inside the installer. ClamAV is a separate supervised native process on loopback.

Source modules
server           configuration, bootstrap, TLS, security, bounded wire I/O
smtp             SMTP state machine, mail pipeline, durable outgoing queue
imap             basic IMAP4rev1 commands and MIME fetch
pop3             POP3/STLS and per-session deletion marks
webmail          browser client, compose, drafts, attachments, search
admin            real admin API client; explicit implementation-status page
antispam         SPF subset, DKIM verifier, message heuristics
antivirus        clamd INSTREAM, FreshClam updates, process supervision
api              scoped REST handlers, OpenAPI specification
database         parameterized SQLite operations, WAL, FTS5, mailbox metadata
windows-service  hosted TCP listeners; WindowsServices lifetime in server
installer        self-extracting WinForms EXE, GUI bootstrap, service/ACL/firewall
tray             Windows notification icon, service controls, uninstaller
updater          explicit status; no running updater or trust key
docs             operator/user documentation, limits and test evidence
tests            protocol/security integration harness

Storage:
  Data/config.json       non-password configuration
  Data/mail.db           users, hashes, folders, messages, queue, sessions, audit
  Data/mail/*.eml         immutable MIME objects shared by mailbox references
  Data/keys/domain.pem   DKIM private key; restricted filesystem ACL
  Data/keys/domain.txt   DKIM TXT value
  Data/tls.pfx           private TLS identity; protected by directory ACL
  Data/antivirus         signatures + daemon configuration + rotated logs
  Data/backups           consistent database and object snapshots, unencrypted

Message acceptance validates recipient ownership, authenticated identity,
quotas and configured limits, scans MIME through real ClamAV, optionally signs
DKIM, then commits all mailbox references and outgoing queue rows in one SQLite
transaction. A file is flushed before its references commit. SMTP 250 is sent
only after acceptance completes. Quarantined inbound mail is accepted for local
administrative review; quarantined submitted mail returns 554.

Identity:
Cookie session tokens and API keys are random 256-bit values; DB stores SHA256
digests. Cookie is Secure, HttpOnly, SameSite=Strict, with 8-hour absolute lifetime.
Mutations require a custom request header, exact same-origin validation and
session-bound CSRF token, unless a valid API key authenticates the request.
All object lookups for ordinary users include user ID; DomainAdmin lookups
enforce owned domain and cannot create other administrators.

TLS:
Windows Schannel TLS 1.2 / 1.3 where the OS supports it. STARTTLS resets SMTP
authentication and envelope state; plaintext AUTH/LOGIN/PASS is denied.
Self-signed initial certificate valid for 90 days. PFX import, restart required.
Windows MachineKeySet is used for Schannel-compatible private key handles;
without PersistKeySet, temporary key containers are cleaned up on disposal.

Limits:
64 simultaneous protocol connections; four parallel message pipelines;
100 recipients/message; default message size 25 MiB, configurable 1..100 MiB.
MIME parsing loads one bounded message, never the entire mailbox into RAM.
Mailbox metadata pagination is 100 records. IMAP mailbox selection loads
metadata for that mailbox: this is not a proven large-scale implementation.
SQLite write operations are serialised; no HA or 10,000-user claim.
Current rate windows are fixed rather than sliding, except brute-force window.

Known engineering work:
Full IMAP protocol conformance and concurrency edge cases; bounded metadata
index paging; official RFC conformance suite; backpressure under storage fault;
DKIM key rotation; full SPF + DMARC policy + public suffix logic; queue DSNs;
at-rest encryption and encrypted backups; ACME; signed updates; installer
rollback/upgrade transactions; independent penetration and load testing.
