---
id: TASK-HIGH.6
title: rtasks email checklist — HMAC-signed clickable AC items from email
status: Done
assignee: []
created_date: '2026-03-16 19:28'
updated_date: '2026-03-16 19:28'
labels:
  - rtasks
  - email
  - checklist
  - backlog
dependencies: []
parent_task_id: TASK-HIGH
---

## Description

<!-- SECTION:DESCRIPTION:BEGIN -->
Email checklist micro-service integrated into rspace-online rtasks module. Sends emails with HMAC-signed links for each backlog task acceptance criterion. Clicking a link toggles the AC in the markdown file and re-renders a confirmation page. Routes: GET /rtasks/check/:token (verify + toggle + render), POST /api/rtasks/send (build + send email). Uses Web Crypto HMAC-SHA256 tokens, direct markdown AC parsing, Nodemailer via Mailcow SMTP (noreply@rmail.online). Mounted at top-level in server/index.ts to bypass space auth middleware.
<!-- SECTION:DESCRIPTION:END -->

## Implementation Notes

<!-- SECTION:NOTES:BEGIN -->
Implemented and deployed. Routes at /rtasks/check/:token and /api/rtasks/send. Infisical secrets: RTASKS_HMAC_SECRET, RTASKS_API_KEY. SMTP via mailcowdockerized-postfix-mailcow-1 as noreply@rmail.online. Volume mount /opt/dev-ops:/repos/dev-ops for task file access. E2E tested successfully — email sends, link toggles AC, page re-renders. Commits: integrated into rspace-online (not standalone).
<!-- SECTION:NOTES:END -->