spamtest reads the server's verdict, never the sender's claim of it

The spamtest test (RFC 3685) with RFC 5235's :percent, advertised as
"spamtest spamtestplus" over ManageSieve. A user can finally write
"if spamtest :value ge 10, file into Junk" instead of matching on
diagnostic headers.

The design decision that matters: the verdict comes from the message's
spam FLAG alone, handed into the evaluator by the delivery path
(Message::GetFlagSpam). The X-hMailServer verdict headers are
deliberately NOT consulted - a sender can write them into their own
message, inbound mail is not stripped of them, and a test that read
them would let senders steer recipients' filters in both directions,
including downgrading a real verdict with a forged low score. The
first draft of this change consulted them as a fallback; writing the
spoofing control is what killed it.

That control then earned its keep twice in one hour: it also caught a
stale binary still running the header-trusting draft, by filing a
message whose only "verdict" was sender-written.

Grounding on the flag fixes the granularity honestly. The pipeline
persists no score for mail it does not classify (AddSpamScoreHeaders
runs only on classification), so a graded 2..9 midrange would be
derived from nothing real. The values are 0 - the RFC's "no
information", which also covers tested-but-clean, recorded nowhere -
and 10, or 100 under :percent.

virustest is deliberately absent and still refused at upload: infected
mail is blocked or stripped before delivery, a script never sees a
message with a virus verdict, and a test that always answered "not
scanned" would be advertised and inert - the exact trap the
capability-line rule exists to prevent.

The fixture's verdicts come from the real antispam pipeline (the SURBL
permanent test point, as AntiSpam.Basics uses) with every
verdict-header option off.

Suite: 1533/1533.

Author: chrisholloway5

Roadmap.md

@@ -57,7 +57,7 @@ strong and where it is thin far more honestly than any prose summary.
 | [Transport security and deliverability](#transport-security-and-deliverability) | 43 | – | 4 | 1 |
 | [IMAP](#imap) | 58 | – | 17 | 3 |
 | [POP3](#pop3) | 21 | – | 6 | – |
-| [Sieve, ManageSieve and rules](#sieve-managesieve-and-rules) | 54 | 0 | 10 | – |
+| [Sieve, ManageSieve and rules](#sieve-managesieve-and-rules) | 55 | 0 | 9 | – |
 | [Authentication and cryptography](#authentication-and-cryptography) | 57 | 0 | 18 | – |
 | [Anti-spam, anti-virus and content control](#anti-spam-anti-virus-and-content-control) | 54 | – | 13 | – |
 | [Storage, accounts and data model](#storage-accounts-and-data-model) | 86 | – | 10 | – |
@@ -72,7 +72,7 @@ strong and where it is thin far more honestly than any prose summary.
 | [Future-proofing: standards and protocols](#future-proofing-standards-and-protocols) | 2 | – | 4 | 2 |
 | [Future-proofing: platform and supply chain](#future-proofing-platform-and-supply-chain) | 5 | 1 | 2 | 2 |
 | [Future-proofing: deployment and operations](#future-proofing-deployment-and-operations) | 4 | 1 | 4 | – |
-| **Total** | **629** | **12** | **139** | **15** |
+| **Total** | **630** | **12** | **138** | **15** |
 
 Three things stand out and are worth naming rather than leaving to be inferred.
 **Storage and the administration surface are the best-covered areas**, and the
@@ -448,7 +448,7 @@ the source, not from documentation.
 
 ### Sieve, ManageSieve and rules
 
-54 shipped · 0 underway · 10 not started · 0 deferred
+55 shipped · 0 underway · 9 not started · 0 deferred
 
 | | Capability | Detail |
 |:-:|---|---|
@@ -510,7 +510,7 @@ the source, not from documentation.
 | ⬜ | reject / ereject (RFC 5429) | Not implemented. **The hazard this row used to describe is gone and the correction matters more than the gap:** neither is in the known-command allowlist and `require "reject"` is refused, so a script that tries to reject mail is rejected AT UPLOAD with a message naming the unsupported extension. The author is told; mail is not silently kept while they believe it is being refused. `SieveSyntax.cs` asserts exactly that script is refused. Implementing them means an SMTP-time refusal for `ereject` and an RFC 3834 bounce for `reject`. |
 | ✅ | relational (RFC 5231) | Not implemented. No :count or :value match types, and no i;ascii-numeric comparator to make them meaningful — SplitArguments recognises only is/contains/matches **Shipped in dc9301a.** |
 | ✅ | RENAMESCRIPT and UNAUTHENTICATE | **Both shipped 16 August 2026.** RENAMESCRIPT was owed rather than optional: the capability response has always claimed VERSION "1.0", which promises the core RFC 5804 commands, and this one was answered with NO "Unknown command". The case that justifies it existing is renaming the ACTIVE script - the manual GETSCRIPT/PUTSCRIPT/DELETESCRIPT route cannot do that at all, because the active script refuses deletion - and the active status follows the new name (`SieveStorage::RenameScript` reads the active name before the move and rewrites it after). Renaming onto a taken name is refused rather than overwriting. UNAUTHENTICATE (RFC 5804 2.14.1) drops the session to the unauthenticated state keeping the connection and is now advertised; the auth-failure counter deliberately carries over so the command is not a way to reset auto-ban bookkeeping mid-connection. Both proven in the round-trip test, including a fresh AUTHENTICATE after UNAUTHENTICATE finding the renamed script still active. |
-| ⬜ | spamtest / spamtestplus / virustest (RFC 5235) | Not implemented, and again the underlying data exists: messages already carry a spam flag and SpamAssassin/AV scores from the antispam pipeline, but no Sieve test can read them |
+| ✅ | spamtest / spamtestplus / virustest (RFC 3685 / RFC 5235) | **spamtest and spamtestplus shipped 16 August 2026; virustest deliberately not.** The verdict comes from the message's spam FLAG alone, handed into the evaluator by the delivery path (`Message::GetFlagSpam`) - NOT from the X-hMailServer verdict headers, which a sender can write into their own message and inbound mail is not stripped of; a test reading them would let senders steer recipients' filters in both directions, including downgrading a real verdict with a forged low score. The spoofing control in `SieveSpamtestDelivery.cs` delivers exactly that forgery and asserts it files nothing - the same test that caught a stale binary still trusting headers during development. Grounding on the flag also fixes the granularity honestly: the pipeline persists no score for unclassified mail (`AddSpamScoreHeaders` runs only on classification), so the values are 0 (no verdict) and 10 (classified; 100 under `:percent`), nothing between - a graded midrange would be derived from nothing real. End-to-end verdicts in the fixture come from the REAL antispam pipeline via the SURBL permanent test point, with every verdict-header option off. virustest stays absent and refused at upload: infected mail is blocked or stripped before delivery, so a script never sees a message with a virus verdict, and a test that always answered "not scanned" would be advertised and inert - the exact trap the capability rule exists to prevent. |
 | ⬜ | Structured response codes | Partial. `(QUOTA/MAXSIZE)` is emitted by HAVESPACE, PUTSCRIPT and CHECKSCRIPT when a script exceeds the 1 MB limit, and `(ENCRYPT-NEEDED)` by AUTHENTICATE when the connecting range requires TLS on a cleartext connection. Still missing: (WARNINGS), (QUOTA/MAXSCRIPTS), (NONEXISTENT), (ALREADYEXISTS), (TAG), (REFERRAL) and the BYE response codes, so most refusals are still a bare NO with a quoted human string that a client can only show verbatim.
 | ✅ | subaddress (RFC 5233) | Not implemented. Address parts stop at :all/:localpart/:domain; :user and :detail are not recognised, so plus-addressing cannot be filtered on **Shipped in dc9301a.** |
 | ✅ | TLS | STARTTLS (RFC 5804 2.2) is offered whenever a TLS certificate is available on an IMAP, POP3 or SMTP port, and the SSL context comes from `SslContextInitializer` - the same function, cipher list, TLS version floor and key-exchange groups (including the hybrid post-quantum KEMs) as SMTP/POP3/IMAP, so this listener cannot drift from them. It can now also be *required* before a password: the per-IP-range `RequireTLSForAuth` that POP3, IMAP and SMTP already honour is read in `IsConnectionAllowed_`, and on a cleartext connection from such a range the capability line advertises `"SASL" ""` and `AUTHENTICATE` is answered `NO (ENCRYPT-NEEDED)` before the mechanism is validated, before the inline response is parsed and before a literal is read - so the password never crosses the wire, and the connection is dropped rather than desynchronized if a literal was announced. With no certificate the requirement fails closed (no STARTTLS, no mechanism) and is explained once per service start in the application log. Declared gap: no implicit-TLS variant - RFC 5804 defines no such port and no client asks for one, so that is deliberate rather than pending. Covered end to end by `Sieve/ManageSieveTls.cs`.

hmailserver/source/Server/Common/Sieve/ManageSieveServer.cpp

@@ -263,7 +263,17 @@ namespace HM
       // it), and :index/:last select among repeated header fields for the header,
       // address and date tests. End-to-end tests in SieveDateDelivery.cs include
       // zone conversion proven by filing on an hour the raw header does not state.
-      const char *AdvertisedSieveExtensions = "fileinto copy relational subaddress vacation vacation-seconds imap4flags body mailbox regex ihave environment date index";
+      // spamtest and spamtestplus moved in on 16 August 2026, under the same rule.
+      // The delivery-side step is twofold: LocalDelivery passes the message's own
+      // spam FLAG into the evaluator (so the test works with every header option
+      // off), and the graded value is derived from the verdict headers when the
+      // administrator writes them, anchored on the mark threshold - at the score
+      // that classifies a message, the answer is 10 (or 100 under :percent).
+      // virustest is deliberately NOT here: infected mail is blocked or stripped
+      // before delivery, so a script never sees a message with a virus verdict,
+      // and advertising a test that always answers "not scanned" is the inert-
+      // capability trap this list exists to prevent.
+      const char *AdvertisedSieveExtensions = "fileinto copy relational subaddress vacation vacation-seconds imap4flags body mailbox regex ihave environment date index spamtest spamtestplus";
 
       AnsiString EscapeQuoted(const String &value)
       {

hmailserver/source/Server/Common/Sieve/SieveEvaluator.cpp

@@ -10,6 +10,7 @@
 #include "../Application/Application.h"
 #include "../Application/Configuration.h"
 #include "../Util/Time.h"
+#include "../AntiSpam/AntiSpamConfiguration.h"
 
 #ifdef _DEBUG
 #define DEBUG_NEW new(_NORMAL_BLOCK, __FILE__, __LINE__)
@@ -96,6 +97,12 @@ namespace HM
       mailbox_exists_ = callback;
    }
 
+   void
+   SieveEvaluator::SetClassifiedAsSpam(bool classified)
+   {
+      classified_as_spam_ = classified;
+   }
+
    bool
    SieveEvaluator::GetEnvironmentItem_(const String &name, String &value)
    {
@@ -907,6 +914,9 @@ namespace HM
       if (name == _T("environment"))
          return EvaluateComparisonTest_(test, message, ValueSource::Environment);
 
+      if (name == _T("spamtest"))
+         return EvaluateSpamTest_(test, message);
+
       if (name == _T("date"))
          return EvaluateDateTest_(test, message, false);
 
@@ -1202,6 +1212,45 @@ namespace HM
       values.push_back(selected);
    }
 
+   bool
+   SieveEvaluator::EvaluateSpamTest_(const std::shared_ptr<SieveTest> &test, const SieveMessage &message)
+   {
+      SieveArgumentSet set;
+      String ignored;
+      if (!SieveParser::SplitArguments(test->arguments, set, ignored))
+         return false;
+
+      if (set.stringLists.size() != 1 || set.stringLists[0].empty())
+         return false;
+
+      // The verdict comes from the message's spam FLAG alone, handed in by the
+      // delivery path. The verdict HEADERS are deliberately not consulted: a
+      // sender can write X-hMailServer-Spam and X-hMailServer-Reason-Score into
+      // their own message, and inbound mail is not stripped of them - so a test
+      // reading them would let senders steer recipients' filters in both
+      // directions, including downgrading a real verdict with a forged low score.
+      // The flag cannot be forged from outside; it exists only in this process.
+      //
+      // This also decides the granularity honestly: the pipeline persists no
+      // score for mail it did NOT classify (AddSpamScoreHeaders runs only on
+      // classification), so a graded 2..9 midrange has nothing real to be
+      // derived from. The answer is 10 (100 under :percent) for classified mail
+      // and "0" - the RFC's "no information" - for everything else, including
+      // tested-but-clean, which the pipeline records nowhere.
+      String value;
+      if (!classified_as_spam_)
+         value = _T("0");
+      else if (set.percentGiven)
+         value = _T("100");
+      else
+         value = _T("10");
+
+      std::vector<String> values;
+      values.push_back(value);
+
+      return MatchValuesAgainstKeys_(set, values, set.stringLists[0]);
+   }
+
    bool
    SieveEvaluator::EvaluateDateTest_(const std::shared_ptr<SieveTest> &test, const SieveMessage &message, bool currentDate)
    {

hmailserver/source/Server/Common/Sieve/SieveEvaluator.h

@@ -115,6 +115,12 @@ namespace HM
       // through to their non-conditional branches rather than acting on a guess.
       void SetMailboxExists(std::function<bool(const String &)> callback);
 
+      // The server's own spam classification for the message being delivered, from
+      // the delivery path (Message::GetFlagSpam). The spamtest value can also be
+      // derived from the verdict headers when the administrator has them on; this
+      // flag is the channel that works when they are off.
+      void SetClassifiedAsSpam(bool classified);
+
    private:
       // Where the values a test compares against come from.
       enum class ValueSource { Header, Address, Envelope, Flags, Body, Environment };
@@ -131,6 +137,9 @@ namespace HM
       // match against that item false, which is the RFC's unknown-item behaviour.
       static bool GetEnvironmentItem_(const String &name, String &value);
 
+      // spamtest (RFC 3685 / RFC 5235).
+      bool EvaluateSpamTest_(const std::shared_ptr<SieveTest> &test, const SieveMessage &message);
+
       // date / currentdate (RFC 5260).
       bool EvaluateDateTest_(const std::shared_ptr<SieveTest> &test, const SieveMessage &message, bool currentDate);
 
@@ -212,5 +221,6 @@ namespace HM
       SieveResult *result_;
 
       std::function<bool(const String &)> mailbox_exists_;
+      bool classified_as_spam_ = false;
    };
 }

hmailserver/source/Server/Common/Sieve/SieveParser.cpp

@@ -164,6 +164,13 @@ namespace HM
          // registration, though they ship together.
          L"date",
          L"index",
+         // RFC 3685 / RFC 5235: the server's own spam verdict as a graded value.
+         // virustest is deliberately absent - this server's antivirus pipeline
+         // blocks or strips infected mail before delivery, so a message reaching a
+         // script has no virus verdict to report, and a test that always answered
+         // "not scanned" would be advertised and inert.
+         L"spamtest",
+         L"spamtestplus",
          L"comparator-i;ascii-casemap",
          L"comparator-i;octet",
          L"comparator-i;ascii-numeric"
@@ -342,6 +349,11 @@ namespace HM
                // :index :last (RFC 5260 6): count from the end.
                result.lastGiven = true;
             }
+            else if (tag == _T("percent"))
+            {
+               // spamtest :percent (RFC 5235).
+               result.percentGiven = true;
+            }
 
             continue;
          }
@@ -482,7 +494,8 @@ namespace HM
       {
          L"address", L"allof", L"anyof", L"exists", L"false", L"header",
          L"not", L"size", L"true", L"envelope", L"hasflag", L"body",
-         L"mailboxexists", L"ihave", L"environment", L"date", L"currentdate"
+         L"mailboxexists", L"ihave", L"environment", L"date", L"currentdate",
+         L"spamtest"
       };
 
       for (const wchar_t *candidate : known)
@@ -1539,6 +1552,25 @@ namespace HM
          return true;
       }
 
+      if (name == _T("spamtest"))
+      {
+         if (!NeedExtension_(_T("spamtest"), _T("the 'spamtest' test"), test->line, errorMessage))
+            return false;
+
+         if (!CheckTags_(set, _T("comparator is contains matches value count regex percent"),
+                         _T("'spamtest'"), errorMessage))
+            return false;
+
+         if (set.percentGiven &&
+             !NeedExtension_(_T("spamtestplus"), _T("':percent'"), test->line, errorMessage))
+            return false;
+
+         if (!ValidateMatchArguments_(set, _T("'spamtest'"), test->line, errorMessage, 1))
+            return false;
+
+         return true;
+      }
+
       if (name == _T("ihave"))
       {
          if (!NeedExtension_(_T("ihave"), _T("the 'ihave' test"), test->line, errorMessage))

hmailserver/source/Server/Common/Sieve/SieveParser.h

@@ -126,6 +126,9 @@ namespace HM
       bool indexGiven = false;
       bool lastGiven = false;
 
+      // spamtest :percent (RFC 5235).
+      bool percentGiven = false;
+
       // Positional string-list arguments, in order.
       std::vector<std::vector<String>> stringLists;
    };

hmailserver/source/Server/Common/Sieve/SieveScript.cpp

@@ -70,7 +70,8 @@ namespace HM
                          const String &rawMessage,
                          const SieveEnvelope &envelope,
                          SieveResult &result,
-                         std::function<bool(const String &)> mailboxExists)
+                         std::function<bool(const String &)> mailboxExists,
+                         bool classifiedAsSpam)
    {
       String errorMessage;
 
@@ -88,6 +89,7 @@ namespace HM
       SieveMessage message(rawMessage);
       SieveEvaluator evaluator;
       evaluator.SetMailboxExists(mailboxExists);
+      evaluator.SetClassifiedAsSpam(classifiedAsSpam);
       return evaluator.Evaluate(sieveScript.GetCommands(), message, envelope, result);
    }
 }

hmailserver/source/Server/Common/Sieve/SieveScript.h

@@ -52,7 +52,8 @@ namespace HM
                              const String &rawMessage,
                              const SieveEnvelope &envelope,
                              SieveResult &result,
-                             std::function<bool(const String &)> mailboxExists = nullptr);
+                             std::function<bool(const String &)> mailboxExists = nullptr,
+                             bool classifiedAsSpam = false);
 
    private:
       std::vector<std::shared_ptr<SieveCommand>> commands_;

hmailserver/source/Server/SMTP/LocalDelivery.cpp

@@ -456,7 +456,7 @@ namespace HM
       };
 
       SieveResult sieveResult;
-      String actions = SieveScript::Evaluate(script, rawMessage, envelope, sieveResult, mailboxExists);
+      String actions = SieveScript::Evaluate(script, rawMessage, envelope, sieveResult, mailboxExists, message->GetFlagSpam());
 
       // A script that fails to parse must never break delivery; fall through to a
       // normal keep. (The structured result is already at its defaults in that case,