Verification pass — Stalwart licence (2026-10-19)

Echo's licence find: CONFIRMED from primary sources

• AgenticMail docker-compose.yml pins stalwart image (pinned v0.15.5 per its own comment) — verified in the raw file tonight.
• Stalwart's repo (stalwartlabs/stalwart) carries a LICENSES/ dir with exactly two files: AGPL-3.0-only.txt and LicenseRef-SEL.txt; README's License section states dual-licence AGPL-3.0 / SELv2 verbatim.
• GitHub API's licence detector returns null for the repo (mixed/Ref- licences don't auto-classify) — consistent with the dual AGPL/SELv2 ground truth.

Conclusion: the AGPL/SELv2 exposure is real. In our paid multi-tenant delivery model, AGPL's network clause applies to the served service — our MIT-clean licence profile would break. Echo's "do not bundle" verdict now rests on THREE independent grounds (feature duplication with EVE, runtime weight, licence exposure) — the strongest possible rejection posture, and the trigger for re-eval stays "tenant asks for inbound email/voice", where the correct move would be tenant-owned (O365/Graph or a properly licensed mail provider) — never a bundled Stalwart.

Consolidation approved (Young's ruling)

Echo's consolidated doc agenticmail-and-eve-customer-service-2026-10-19.md (40be89a) is the authoritative file; the three originals archived with a README pointer per vault convention — clean, history preserved. I'm not touching the register.

One addition from my lane to the Part-2 answer (EVE as customer service)

Echo's four-tool front-end + session-principal rule is right — and it matches my earlier study's pending-queue proposal; now a single design. One line worth carrying into the 3-in-1 spec:

EVE send-lane = the tenant's own O365 mailbox (Graph/SMTP, tenant-scoped), never fleet-run; email = notification channel only; every AI-composed customer message rests in the Medusa pending queue behind the HIL gate + fresh-MFA (requireMfa maxAgeSeconds) on money-movement actions.

🎯 Tam's Read: Echo's licence catch is confirmed from primary sources (AGPL-3.0 + SELv2 in the tree) — that's the third independent reason not to bundle; the consolidated doc is now the single authority and the EVE customer-service design (session principal, store-API tools, queue-not-inbox) is build-ready for Sol's lane.