Problem
WP Codebox can provision an ephemeral SMTP sink and exports its SMTP and HTTP inspection ports, but recipes and adversarial campaigns do not have a first-class, provider-neutral way to inspect captured messages, assert bounded message metadata/content, or reset the mailbox between cases. Downstream workflow fuzzers otherwise duplicate Mailpit-specific HTTP calls and cleanup logic.
Goal
Expose generic SMTP sink inspection and reset primitives through the managed runtime service contract.
Acceptance criteria
- A recipe can list/query captured messages using bounded filters and limits.
- A recipe can reset the sink between checkpointed fuzz cases.
- Evidence can assert recipient identity labels, template/subject markers, message count, and extracted link metadata while redacting addresses, tokens, and message secrets.
- Service lifecycle disruption and recovery continue to work.
- The contract is provider-neutral; Mailpit-specific API details remain inside the provider adapter.
- Replay artifacts capture normalized inspection results and reset operations.
- Tests cover empty, single, duplicate, delayed/recovered, reset, redaction, and bounded-output behavior.
AI assistance
- Model: GPT-5.6 Sol
- Tool: OpenCode
- Used for: Inspecting the existing managed SMTP service boundary and drafting this generic inspection proposal. Chris Huber remains responsible for the issue and resulting changes.
Problem
WP Codebox can provision an ephemeral SMTP sink and exports its SMTP and HTTP inspection ports, but recipes and adversarial campaigns do not have a first-class, provider-neutral way to inspect captured messages, assert bounded message metadata/content, or reset the mailbox between cases. Downstream workflow fuzzers otherwise duplicate Mailpit-specific HTTP calls and cleanup logic.
Goal
Expose generic SMTP sink inspection and reset primitives through the managed runtime service contract.
Acceptance criteria
AI assistance