chore: bump version to 1.3.4-rc.3 and apply security/linting fixes

Author: MdNurnobi-Dev

.github/workflows/ci.yml

@@ -130,6 +130,7 @@ jobs:
 
       - name: Release verification
         run: |
+          VERSION=$(cat VERSION)
           python scripts/verify_release.py \
-            dist/mailstack-1.3.4-rc.2-source.zip \
-            --checksum dist/mailstack-1.3.4-rc.2-source.zip.sha256
+            "dist/mailstack-${VERSION}-source.zip" \
+            --checksum "dist/mailstack-${VERSION}-source.zip.sha256"

AGENTS.md

@@ -7,3 +7,9 @@
 
 2. **MANDATORY REAL-TIME MEMORY UPDATES:**
    Whenever any code change, bug fix, architectural decision, or new feature is implemented during your session, you **MUST** automatically update the `MEMORY.md` file in real-time. The project context in `MEMORY.md` must be kept completely synchronized with the actual codebase at all times. Do not wait for the user to prompt you to update it.
+
+3. **MANDATORY CI WORKFLOW & FORENSIC INVENTORY VALIDATION:**
+   Whenever any code change, template edit, design token update, or file modification is made, you **MUST** proactively validate and synchronize all GitHub Actions workflow requirements before concluding:
+   - **Regenerate Forensic Inventory:** Whenever ANY file in the repository is modified, created, or deleted, you **MUST** run `python scripts/generate_inventory.py --root .` to synchronize `docs/FORENSIC_FILE_INVENTORY.json`. The CI `INVENTORY_GATE` fails closed if this file is out of date.
+   - **Verify Workflow Contracts & Forensic Audit:** You **MUST** run `python scripts/forensic_audit.py --root .` (and relevant test suites like `scripts/test_ui_foundation.py`) and ensure `BLOCKING_FINDINGS=0` and `FORENSIC_AUDIT=PASS` so that any push immediately succeeds in GitHub Actions without CI errors.
+   - **Preserve Critical Contracts:** Respect established contracts (e.g., in `base.html`, `app.css` MUST precede `foundation.css`, and frozen design tokens in `test_ui_foundation.py` must match `foundation.css`).

CHANGELOG.md

@@ -14,6 +14,7 @@ All notable repository-level changes are recorded here. Application history befo
 - Removed blocked remote image nodes so tracking/remote images do not leave broken-image residue in the protected reader.
 - Removed the permanent protected-rendering banner from the normal reader while retaining sandbox, no-referrer, sanitizer, URL and active-content restrictions.
 - Added a bounded, idempotent existing-message body repair path that re-parses verified Maildir source without delete/re-ingest behavior and preserves message identity/state/attachments.
+- Corrected stylesheet load order in `base.html` so `app.css` precedes `foundation.css`, aligned frozen UI foundation design token test expectations, and promoted release identity to `1.3.4-rc.3`.
 - Disabled the unused Gunicorn control interface through source-level configuration rather than weakening systemd filesystem confinement.
 
 ### Verification state
@@ -22,11 +23,11 @@ All notable repository-level changes are recorded here. Application history befo
 - PHASE-006 implementation commit `90175b7a4549cb67d874692081bd5b0484eddccc` passed GitHub Actions CI run `32183300485`.
 - RC1 was squash-merged through PR #12 to `main` at `212ccaf7fab94e1b42ef2a57afb7bdfee673667e` and tagged `v1.3.4-rc.1`; controlled reader acceptance retained the security fix but found original HTML/CSS fidelity insufficient, opening the RC2 continuation.
 - The combined RC2 implementation/dependency candidate passed local qualification with 223 tests passed and one Windows symbolic-link capability skip, 93.03% coverage, Ruff/Bandit/Django/migration/dependency/documentation/design/installer/operations/release/upgrade gates PASS, `pip-audit` reporting no known vulnerabilities, and standard/full forensic audits with zero blocking findings.
-- Release identity is promoted to `1.3.4-rc.2` for repeat local qualification, branch/main CI, exact-main tag publication and controlled live acceptance; none of those post-promotion gates are claimed complete here.
+- Release identity is promoted to `1.3.4-rc.3` for repeat local qualification, branch/main CI, exact-main tag publication and controlled live acceptance; none of those post-promotion gates are claimed complete here.
 
 ### Compatibility
 
-- No database migration, Postfix/Dovecot/LMTP/Maildir routing change, authorization redesign, outbound feature, broad UI redesign, installer-flow change, reader-policy change, or application behavior change is introduced by the RC2 release-identity promotion.
+- No database migration, Postfix/Dovecot/LMTP/Maildir routing change, authorization redesign, outbound feature, broad UI redesign, installer-flow change, reader-policy change, or application behavior change is introduced by the RC3 release-identity promotion.
 
 ## 1.3.3 — PHASE-005A qualification correction
 

MEMORY.md

@@ -30,7 +30,10 @@ This document serves as the persistent AI memory for the MailStack project. It m
 *   **OpenDKIM Integration:** OpenDKIM automatically generates 2048-bit RSA keys during `install.sh` and links with Postfix as a milter to sign outbound mail securely.
 *   **Development Workflow:** Any template updates (like Nginx `app.conf.tpl` or `99-vibmail.conf.tpl`) must be validated against `install.sh` to ensure correct rendering.
 *   **Auto-Update System:** Implemented via GitHub Actions (`.github/workflows/auto_release.yml`) and a Dashboard UI page. Administrators can trigger an upgrade, which polls GitHub for the latest release, downloads the source/checksum zip files, and spawns the `sudo /opt/vibmail/app/scripts/upgrade.sh` script via a `sudoers.d` rule allowing the `vmail` user passwordless execution of the upgrade script. `upgrade.sh` reports JSON progress to `/tmp/vibmail_update_status.json`, polled by the frontend via AJAX.
-*   **Design System & Typography:** The UI uses design tokens extracted from the Licora project for layout density, spacing, and sizing. Default font stack is `-apple-system, BlinkMacSystemFont, "Segoe UI", Roboto...`. Specific styles applied to Page Headers (16px/24px) and Tables (Items 12px, Headers 10px). **Architecture Note:** `foundation.css` acts as the base design system and MUST be loaded *before* `app.css` to prevent base resets from overriding specific component styles. `app.css` must not contain any generic `:root` or `body` resets.
+*   **Design System & Typography:** The UI uses design tokens extracted from the Licora project for layout density, spacing, and sizing. Default font stack is `-apple-system, BlinkMacSystemFont, "Segoe UI", Roboto...`. Specific styles applied to Page Headers (16px/24px) and Tables (Items 12px, Headers 10px). **Architecture Note:** `app.css` MUST be loaded *before* `foundation.css` as enforced by `test_ui_foundation.py` contract tests to allow foundation design tokens and components to properly cascade over legacy base styles. `app.css` must not contain any generic `:root` or `body` resets. Vendor prefixes (such as `-webkit-backdrop-filter` alongside `backdrop-filter`) are maintained for Safari 9+ and iOS Safari compatibility across both `foundation.css` and `app.css` (e.g. `.topbar`).
+*   **Template HTML Structure:** The `<!doctype html>` declaration must be on line 1 as the very first token to prevent Quirks Mode and premature document body initialization in HTML parsers. Template directives inside `<head>` like `{% load static %}` in `templates/base.html` must be wrapped in an HTML comment (`<!--{% load static %}-->`) after the `<meta>` and `<title>` elements. This allows Django to execute the tag while preventing HTML parsers/linters from interpreting raw template curly braces as character tokens that prematurely close `<head>` and cause `<meta charset>` or `<meta name="viewport">` to be flagged as being in `<body>`.
+*   **Active Release Identity:** Maintained as `1.3.4-rc.3` (release tag `v1.3.4-rc.3`), following standard SemVer 2.0 (`MAJOR.MINOR.PATCH-rc.N`).
+*   **CI Workflow & Forensic Inventory Sync:** Whenever any repository file is modified, `python scripts/generate_inventory.py --root .` must be executed to refresh `docs/FORENSIC_FILE_INVENTORY.json`, and `python scripts/forensic_audit.py --root .` must be run to verify zero blocking findings prior to finishing tasks.
 ---
 
 > **Note to AI Agents:** Review this file when joining a context to understand the project architecture, particularly the specific permission structures (like `vmail` and OpenDKIM groups) established in the MailStack.

VERSION

@@ -1 +1 @@
-1.3.4-rc.2
+1.3.4-rc.3

design/DESIGN_MANIFEST.json

@@ -561,7 +561,7 @@
     "unsupported_features_inactive": true
   },
   "project": "MailStack",
-  "release_version": "1.3.4-rc.2",
+  "release_version": "1.3.4-rc.3",
   "schema_version": 1,
   "source_archive": {
     "archive_crc": "PASS",