Tickessa 0.10.0
Published on the reference installation on 4 September 2026.
Version 0.10.0 adds the safe route from future automatic AI replies to a person. Technical delivery enables neither AI nor auto-send; automatic sending requires its own narrow approval.
Account-free review
An automatic reply can include I would like a personal review in plain text and HTML. Recipients need no account. A normal email reply is an equivalent fallback.
Scanner-safe confirmation
Opening the link only displays a confirmation page. Explicit confirmation reopens the ticket, so mail/security link scanners cannot request review accidentally.
Permanent automation stop
Confirmation sets Personal review requested, places the ticket in its queue and informs authorised agents. Further automatic replies remain permanently blocked. The next reply must be written personally or fully reviewed and sent manually.
Successful sending marks review answered without removing the thread block.
Protected token
Links use 256 random bits without internal IDs; the database stores only a SHA-256 hash. Internal message copies, events and notifications exclude the plaintext link. Links expire after 30 days by default and can be revoked beforehand.
Invalid, revoked and expired links change nothing. Confirmation is idempotent without duplicate events or notifications.
Technical changes
- Migration
028_personal_review_requests.sql: ticket state, expiry, revocation, deduplicated notifications and content-free rate limits. - Separate non-indexable
/pruefung/{token}page. - Strict separation of read-only public preview and same-origin confirmation.
- Personal-review queue, ticket markers and detail notice.
- IMAP recognises ordinary replies to the last automatic message as review requests.
- PWA excludes review paths from offline caching.