v3.0.0: fully autonomous engine — remove MillionVerifier, add DoH DNS worker, AI risk scorer (HF PRO, circuit breaker), i18n, normalized verdicts, remote SMTP worker

- Autonomy: MillionVerifierProvider + mv_api_key/prefer_api_provider removed
by design; mailbox verdicts come only from the built-in SMTP engine or the
new remote SMTP probe worker (SMTP_WORKER_URL, shared-secret guarded).
- DNS/MX worker (spec 3.2/7.3): DNS-over-HTTPS on Google + Cloudflare with a
dual-resolver consistency check (dns_inconsistent), 24h MX / 1h negative
TTL cache, Punycode normalization; legacy dnspython stays as fallback.
- AI Risk Scorer (spec 3.4/Phase 4/6): HF Inference API (zero-shot NLI or
text-classification), circuit breaker (429/402/quota open permanently,
transient failures open after threshold), rule-based heuristic fallback,
PII-free feature strings, burn-rate instrumentation at /metrics/inference.
- i18n (spec 7.1/7.2): Punycode via idna, EAI/SMTPUTF8 deterministic refusal
(unsupported_eai) instead of fake verdicts.
- Normalized verdict (spec Phase 5) on ValidationResult: deterministic_verdict,
ai_risk_score, ai_label, fallback_used, cache_hit; catch_all NEVER collapsed
into valid.
- New ops endpoints: /engine/status, /metrics/inference, /smtp/probe(+batch).
- Tests: 292 -> 328 passing (DoH, i18n, scorer, remote worker, worker routes,
normalized verdicts); MV tests rewritten as autonomy invariants.

.env

@@ -1,50 +1,11 @@
-# ========================================================================
-# EmailValidator Pro - Environment Configuration
-# ========================================================================
-# Supabase Project: ciytvulujiqemqljablq
-# Dashboard: https://supabase.com/dashboard/project/ciytvulujiqemqljablq
-# ========================================================================
-
-# --- Application ---
-APP_NAME="EmailValidator Pro"
-APP_VERSION="2.0.0"
-DEBUG=true
-SECRET_KEY=dev-local-secret-change-in-production
-HOST=0.0.0.0
-PORT=8000
-WORKERS=4
-
-# --- Supabase (PostgreSQL + PostgREST) ---
-SUPABASE_URL=https://ciytvulujiqemqljablq.supabase.co
-SUPABASE_ANON_KEY=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImNpeXR2dWx1amlxZW1xbGphYmxxIiwicm9sZSI6ImFub24iLCJpYXQiOjE3ODcwNjc3NjgsImV4cCI6MjEwMjY0Mzc2OH0.YQH7YvCITabZT-SVr4A4WNvGDtW-ezkEvUQ6Dht0yjo
-SUPABASE_SERVICE_ROLE_KEY=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImNpeXR2dWx1amlxZW1xbGphYmxxIiwicm9sZSI6InNlcnZpY2Vfcm9sZSIsImlhdCI6MTc4NzA2Nzc2OCwiZXhwIjoyMTAyNjQzNzY4fQ.qIg9WSYPP9jCkUigsozJ8dPxavCN6i2iFxs4xZnp-cM
-ENABLE_DB_PERSISTENCE=true
-
-# Local dev DB fallback (not used when Supabase is configured)
-DATABASE_URL=sqlite+aiosqlite:///./emailval.db
-
-# --- Redis (Upstash FREE TIER) ---
-# Free databases created via https://upstash.com/start-redis (no account needed)
-# NOTE: free-tier databases support ONLY db 0 0 -- one database per logical store.
-
-# Main cache -- db 0 of credible-kangaroo-120640
-REDIS_URL=rediss://default:gQAAAAAAA4vQAAIgcDEwZGE3NTU5MTU1ZjY0OTZlOWUxN2QwMjY1ZTlhMzViNA@new-parrot-232400.upstash.io:6379
-REDIS_CACHE_TTL=86400
-# Celery broker -- db 0 of immortal-gar-118475
-CELERY_BROKER_URL=rediss://default:gQAAAAAAA4vQAAIgcDEwZGE3NTU5MTU1ZjY0OTZlOWUxN2QwMjY1ZTlhMzViNA@new-parrot-232400.upstash.io:6379
-# Celery result backend -- db 0 of exciting-gannet-119131
-CELERY_RESULT_BACKEND=rediss://default:gQAAAAAAA4vQAAIgcDEwZGE3NTU5MTU1ZjY0OTZlOWUxN2QwMjY1ZTlhMzViNA@new-parrot-232400.upstash.io:6379
-
-# --- CORS ---
-CORS_ORIGINS=["http://localhost:5173","http://localhost:3000","http://127.0.0.1:5173","https://sitcod3-bridge-modul-x-api.hf.space","https://uranusmediaconnection-dot.github.io","https://frontend-j6yuq34u0-sitcod3lab-2797s-projects.vercel.app","https://frontend-grm2qel63-sitcod3lab-2797s-projects.vercel.app","https://frontend-seven-rose-23.vercel.app"]
-
-# --- Validation Tuning ---
-SMTP_TIMEOUT=10
-DNS_TIMEOUT=5
-MAX_BULK_EMAILS=10000
-RATE_LIMIT_PER_MINUTE=60
-USE_PROXIES=false
-
-# --- NVIDIA NIM (free endpoint models) ---
-NVIDIA_API_KEY=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
-NVIDIA_API_KEY_ACC_1=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
+APP_ENVIRONMENT=development
+DEBUG=true
+ENABLE_DB_PERSISTENCE=true
+LICENSE_ENFORCEMENT=false
+REDIS_URL=redis://localhost:6399/0
+DOH_ENABLED=true
+
+# --- AI Risk Scorer (v3.0.0) — HF PRO Inference API, zero-shot mode ---
+AI_SCORER_MODEL=facebook/bart-large-mnli
+AI_SCORER_ZERO_SHOT=true
+# HF_INFERENCE_TOKEN is injected as a Space SECRET (not stored in this repo).

.env.example

@@ -1,69 +1,93 @@
-# Copy to .env and adjust for your environment.
-APP_ENVIRONMENT=development
-APP_NAME="BRIDGE Modul - X"
-APP_VERSION="2.1.0"
-DEBUG=true
-SECRET_KEY=replace-with-a-random-secret
-HOST=0.0.0.0
-PORT=8000
-WORKERS=4
-
-# Supabase (server-side service-role key; never expose it to the browser)
-SUPABASE_URL=https://YOUR_PROJECT_REF.supabase.co
-SUPABASE_ANON_KEY=your-public-anon-key
-SUPABASE_SERVICE_ROLE_KEY=your-server-only-service-role-key
-ENABLE_DB_PERSISTENCE=true
-LICENSE_ENFORCEMENT=false
-
-# Local development defaults
-DATABASE_URL=sqlite+aiosqlite:///./emailval.db
-REDIS_URL=redis://localhost:6379/0
-REDIS_CACHE_TTL=86400
-CELERY_BROKER_URL=redis://localhost:6379/1
-CELERY_RESULT_BACKEND=redis://localhost:6379/2
-
-# For Upstash, use TLS and database index /0:
-# REDIS_URL=rediss://default:YOUR_REDIS_TOKEN@YOUR_ENDPOINT:6379/0
-# CELERY_BROKER_URL=rediss://default:YOUR_REDIS_TOKEN@YOUR_ENDPOINT:6379/0
-# CELERY_RESULT_BACKEND=rediss://default:YOUR_REDIS_TOKEN@YOUR_ENDPOINT:6379/0
-# Never disable TLS certificate verification. Upstash Free has one database;
-# prove Celery key-prefix isolation and compatibility before sharing it, or
-# use separate provisioned databases/a suitable paid plan for production jobs.
-# The app does not need the Upstash Developer API key. Keep it out of runtime
-# environment variables; use it only from a restricted operator workflow.
-
-CORS_ORIGINS=["http://localhost:5173","http://localhost:3000","http://127.0.0.1:5173"]
-SMTP_TIMEOUT=10
-DNS_TIMEOUT=5
-MAX_BULK_EMAILS=10000
-RATE_LIMIT_PER_MINUTE=60
-USE_PROXIES=false
-
-# --- Mailbox verification engine (Layers 5 + 6) ---
-# The validator is AUTONOMOUS by default: it probes recipient MX servers
-# directly on port 25 with its own connection-reusing SMTP engine. No vendor
-# account, API key, or per-check fee is required.
-#
-# IMPORTANT: port 25 must be open outbound. Most cloud PaaS (Hugging Face
-# Spaces, AWS Lambda, Cloudflare Workers) BLOCK it. If outbound 25 is blocked,
-# the engine still runs but reports every mailbox as smtp_unreachable (honest
-# "risky", refunded) — it will never fake a verdict. Run on a VPS/host with
-# port-25 egress for real mailbox verdicts.
-MAILBOX_PROVIDER=auto          # auto | local(=autonomous) | api
-# Optional: route Layers 5-6 through a third-party API instead of own SMTP.
-# Off by default so the engine stays independent even if a key is present.
-PREFER_API_PROVIDER=false
-MV_API_KEY=
-MV_TIMEOUT=10
-
-# SMTP identity used in the probe dialogue. Use a real, resolvable hostname with
-# a matching PTR record on a production host — strict receivers reject generic
-# HELO names and that degrades accuracy.
-SMTP_HELO_DOMAIN=validator.local
-SMTP_MAIL_FROM=probe@validator.local
-
-# Catch-all is a domain property: cache the verdict for 72h.
-CATCH_ALL_TTL_SECONDS=259200
-# Per-MX-host session cap and overall bulk concurrency.
-MAX_CONNECTIONS_PER_HOST=2
-BULK_CONCURRENCY=20
+# Copy to .env and adjust for your environment.
+APP_ENVIRONMENT=development
+APP_NAME="BRIDGE Modul - X"
+APP_VERSION="2.1.0"
+DEBUG=true
+SECRET_KEY=replace-with-a-random-secret
+HOST=0.0.0.0
+PORT=8000
+WORKERS=4
+
+# Supabase (server-side service-role key; never expose it to the browser)
+SUPABASE_URL=https://YOUR_PROJECT_REF.supabase.co
+SUPABASE_ANON_KEY=your-public-anon-key
+SUPABASE_SERVICE_ROLE_KEY=your-server-only-service-role-key
+ENABLE_DB_PERSISTENCE=true
+LICENSE_ENFORCEMENT=false
+
+# Local development defaults
+DATABASE_URL=sqlite+aiosqlite:///./emailval.db
+REDIS_URL=redis://localhost:6379/0
+REDIS_CACHE_TTL=86400
+CELERY_BROKER_URL=redis://localhost:6379/1
+CELERY_RESULT_BACKEND=redis://localhost:6379/2
+
+# For Upstash, use TLS and database index /0:
+# REDIS_URL=rediss://default:YOUR_REDIS_TOKEN@YOUR_ENDPOINT:6379/0
+# CELERY_BROKER_URL=rediss://default:YOUR_REDIS_TOKEN@YOUR_ENDPOINT:6379/0
+# CELERY_RESULT_BACKEND=rediss://default:YOUR_REDIS_TOKEN@YOUR_ENDPOINT:6379/0
+# Never disable TLS certificate verification. Upstash Free has one database;
+# prove Celery key-prefix isolation and compatibility before sharing it, or
+# use separate provisioned databases/a suitable paid plan for production jobs.
+# The app does not need the Upstash Developer API key. Keep it out of runtime
+# environment variables; use it only from a restricted operator workflow.
+
+CORS_ORIGINS=["http://localhost:5173","http://localhost:3000","http://127.0.0.1:5173"]
+SMTP_TIMEOUT=10
+DNS_TIMEOUT=5
+MAX_BULK_EMAILS=10000
+RATE_LIMIT_PER_MINUTE=60
+USE_PROXIES=false
+
+# --- Mailbox verification engine (Layers 5 + 6) — FULLY AUTONOMOUS ---
+# The validator probes recipient MX servers with its own connection-reusing
+# SMTP engine. NO third-party verification API, NO vendor key, NO per-check
+# fee — the former MillionVerifier delegation was removed in v3.0.0.
+#
+# IMPORTANT: port 25 must be open outbound. Most cloud PaaS (Hugging Face
+# Spaces, AWS Lambda, Cloudflare Workers) BLOCK it. If outbound 25 is blocked,
+# the engine still runs but reports every mailbox as smtp_unreachable (honest
+# "risky", refunded) — it will never fake a verdict. Two fixes:
+#   1) run the orchestrator on a VPS with port-25 egress, or
+#   2) keep the orchestrator where it is and point SMTP_WORKER_URL at a
+#      port-25-capable host running this same image (spec §3.3 worker role).
+MAILBOX_PROVIDER=auto          # auto | local(=autonomous) | remote
+# Remote SMTP probe worker (spec §3.3). Empty = built-in engine on this host.
+# Example: https://smtp-worker.example.com (a deployment of this image)
+SMTP_WORKER_URL=
+# Shared secret required on POST /api/v1/smtp/probe* (X-Worker-Token header).
+# Set the SAME value on the worker and on the orchestrator.
+SMTP_WORKER_TOKEN=
+SMTP_WORKER_TIMEOUT=15
+
+# --- DNS-over-HTTPS worker (spec §3.2) ---
+# MX resolution on free public resolvers (Google + Cloudflare) with a
+# dual-resolver consistency check (dns_inconsistent risk signal). Free,
+# unlimited, no auth; legacy dnspython path stays as automatic fallback.
+DOH_ENABLED=true
+DOH_TIMEOUT=5
+
+# --- AI Risk Scorer (spec §3.4 — the ONLY metered component) ---
+# Hugging Face Inference API model id (text-classification). Empty disables
+# remote inference: the built-in rule-based heuristic then scores every
+# ambiguous address (catch-all / unknown) at zero marginal cost, and every
+# verdict it decides is marked fallback_used=true. The circuit breaker opens
+# on 429/quota/5xx and the engine degrades gracefully — never blocks.
+AI_SCORER_MODEL=
+AI_SCORER_TIMEOUT=12
+# Inference token. Falls back to ML_HF_TOKEN when empty.
+HF_INFERENCE_TOKEN=
+AI_CIRCUIT_FAIL_THRESHOLD=3
+AI_CIRCUIT_COOLDOWN_SECONDS=300
+
+# SMTP identity used in the probe dialogue. Use a real, resolvable hostname with
+# a matching PTR record on a production host — strict receivers reject generic
+# HELO names and that degrades accuracy.
+SMTP_HELO_DOMAIN=validator.local
+SMTP_MAIL_FROM=probe@validator.local
+
+# Catch-all is a domain property: cache the verdict for 72h.
+CATCH_ALL_TTL_SECONDS=259200
+# Per-MX-host session cap and overall bulk concurrency.
+MAX_CONNECTIONS_PER_HOST=2
+BULK_CONCURRENCY=20

app/api/routes.py

@@ -1,466 +1,580 @@
-from fastapi import APIRouter, HTTPException, Query
-from fastapi.responses import JSONResponse
-import json
-import time
-import asyncio
-import uuid
-
-from ..models import (
-    SingleEmailRequest, BulkEmailRequest,
-    ValidationResult, BulkValidationResponse,
-    TaskStatusResponse
-)
-from ..validator.engine import engine
-from ..utils.cache import get_cache, set_cache
-from ..config import settings
-from ..db import repo
-
-# Strong references to in-flight background bulk jobs (the event loop only
-# keeps weak ones, so a task can vanish mid-run and its results are lost), and
-# a cap so a burst of bulk requests cannot spawn unbounded SMTP work.
-_background_tasks: set[asyncio.Task] = set()
-_bulk_semaphore = asyncio.Semaphore(settings.bulk_concurrency)
-
-# Celery task handle (module level so the routing is testable/patchable).
-# Import failure degrades to the background-task path; Celery itself is only
-# required when celery_bulk_enabled=True.
-try:
-    from ..tasks.celery_tasks import bulk_validate_task  # noqa: E402
-except Exception:  # pragma: no cover - celery not installed
-    bulk_validate_task = None
-
-router = APIRouter()
-
-
-async def process_bulk_sync(emails: list, webhook_url: str = None, deep: bool = True) -> dict:
-    """
-    Process bulk validation synchronously in chunks.
-    Used when Celery is unavailable.
-
-    `deep` defaults to True so bulk runs the full 7-layer pipeline (catch-all +
-    SMTP) exactly like single verification — the product charges 1 credit/email
-    and must not silently degrade to a syntax+DNS-only check.
-
-    Chunks feed the engine's *batched* path: DNS/MX resolves once per domain and
-    the mailbox stage takes the whole chunk in one call, so the SMTP engine reuses
-    a session per receiving host instead of opening a TCP connection per address.
-    """
-    results = []
-    total = len(emails)
-    chunk_size = settings.bulk_sync_chunk_size  # Configurable chunk size
-
-    for i in range(0, total, chunk_size):
-        chunk = emails[i:i + chunk_size]
-        try:
-            chunk_results = await engine.validate_batch(chunk, deep=deep)
-        except Exception as exc:  # never lose a chunk to one bad stage
-            results.extend(
-                {
-                    "email": email,
-                    "error": str(exc) or "Unknown error",
-                    "status": "error",
-                }
-                for email in chunk
-            )
-            continue
-
-        # validate_batch guarantees one result per input, in input order.
-        if len(chunk_results) == len(chunk):
-            pairs = zip(chunk, chunk_results)
-        else:
-            # Defensive: never lose or mis-attribute a row.
-            by_email = {getattr(r, "email", "").lower(): r for r in chunk_results}
-            pairs = ((email, by_email.get(email.lower())) for email in chunk)
-
-        for email, result in pairs:
-            if isinstance(result, ValidationResult):
-                results.append(result.model_dump())
-            else:
-                results.append(
-                    {
-                        "email": email,
-                        "error": "engine returned no result for this address",
-                        "status": "error",
-                    }
-                )
-    
-    # Webhook notification if provided
-    if webhook_url:
-        import httpx
-        try:
-            async with httpx.AsyncClient(timeout=10) as client:
-                await client.post(webhook_url, json={"results": results})
-        except Exception:
-            pass
-
-    # Run-quality monitor (report item 10): fire the signed system-alert
-    # webhook when this run's risky/unknown share crosses the threshold.
-    try:
-        from ..utils.rate_alerts import maybe_alert_risky_rate
-
-        await maybe_alert_risky_rate(
-            results,
-            webhook_url=webhook_url,
-            job_id="sync",
-            threshold=settings.risky_rate_alert_threshold,
-        )
-    except Exception:
-        pass
-
-    return results
-
-
-# ---- Single Email Validation --------------------------------------
-@router.post(
-    "/validate/single",
-    response_model=ValidationResult,
-    summary="Validate a single email address",
-    tags=["Validation"]
-)
-async def validate_single(
-    request: SingleEmailRequest,
-    deep: bool = Query(default=True, description="Enable SMTP verification (slower but more accurate)")
-):
-    """
-    Full 7-layer email validation:
-    Syntax → DNS → MX → Disposable → Catch-All → SMTP → Score
-    """
-    email = request.email
-
-    # Check cache first
-    cache_key = f"val:{email}:{'deep' if deep else 'fast'}"
-    cached = await get_cache(cache_key)
-    if cached:
-        result = ValidationResult(**json.loads(cached))
-        return result
-
-    # Run full validation
-    result = await engine.validate(email, deep=deep)
-
-    # Cache the result
-    await set_cache(cache_key, result.model_dump_json(), ttl=settings.redis_cache_ttl)
-
-    # Persist to Supabase (best-effort)
-    if settings.enable_db_persistence:
-        repo.save_validation_result(result)
-
-    return result
-
-
-# ---- Bulk Email Validation ----------------------------------------
-@router.post(
-    "/validate/bulk",
-    summary="Validate multiple email addresses (async)",
-    tags=["Validation"]
-)
-async def validate_bulk(request: BulkEmailRequest):
-    """
-    Async bulk validation. Returns a task_id.
-    Poll /validate/bulk/status/{task_id} for results.
-
-    Uses Celery when Redis is available; otherwise falls back to a
-    synchronous pass (now supports any batch size).
-    """
-    print(f"[BULK] Received bulk validation request for {len(request.emails)} emails")
-    
-    # Only use Celery when the broker is actually reachable — otherwise
-    # .delay() would block retrying the Redis connection.
-    try:
-        from ..utils.cache import redis_available
-        use_celery = (settings.celery_bulk_enabled
-                      and await redis_available())
-        print(f"[BULK] Redis available: {use_celery}")
-    except Exception as e:
-        print(f"[BULK] Redis check failed: {str(e)}")
-        use_celery = False
-
-    if use_celery:
-        try:
-            task = bulk_validate_task.delay(request.emails, request.webhook_url, request.deep)
-            # Record the job in Supabase so it can be tracked across restarts
-            if settings.enable_db_persistence:
-                repo.create_bulk_job(task.id, request.emails)
-            return BulkValidationResponse(
-                task_id=task.id,
-                status="processing",
-                total=len(request.emails),
-                message=f"Processing {len(request.emails)} emails. Poll /validate/bulk/status/{task.id}"
-            )
-        except Exception as exc:
-            print(f"[BULK] Celery unavailable ({exc}) — using synchronous fallback.")
-
-    # Synchronous fallback for any size list — but NON-BLOCKING: the request
-    # returns immediately with a task_id, and the results are processed in a
-    # background asyncio task. The old blocking behavior held the HTTP request
-    # for the entire validation (60-112s on a blocked-egress host), which
-    # exceeded the frontend's 45s fetch timeout and made the Results page
-    # show nothing.
-    task_id = uuid.uuid4().hex
-    print(f"[BULK] Processing {len(request.emails)} emails in background (task {task_id})")
-
-    # Record the job BEFORE processing: without this row, finish_bulk_job is an
-    # UPDATE that matches nothing, and in-flight polls hit the "Redis down"
-    # branch and 404 — which the frontend treats as terminal.
-    if settings.enable_db_persistence:
-        try:
-            repo.create_bulk_job(task_id, request.emails)
-        except Exception as exc:
-            print(f"[BULK] create_bulk_job failed: {exc}")
-
-    async def _run_and_store():
-        async with _bulk_semaphore:
-            try:
-                results = await process_bulk_sync(
-                    request.emails, request.webhook_url, deep=request.deep
-                )
-                if settings.enable_db_persistence:
-                    try:
-                        repo.finish_bulk_job(task_id, results)
-                    except Exception as exc:
-                        print(f"[BULK] finish_bulk_job failed: {exc}")
-                await set_cache(
-                    f"bulk_result:{task_id}",
-                    json.dumps({"status": "completed", "total": len(request.emails),
-                                "results": results}),
-                    ttl=settings.redis_cache_ttl,
-                )
-                print(f"[BULK] task {task_id} completed: {len(results)} results")
-            except Exception as exc:
-                print(f"[BULK] task {task_id} failed: {exc}")
-                await set_cache(
-                    f"bulk_result:{task_id}",
-                    json.dumps({"status": "error", "error": str(exc),
-                                "results": []}),
-                    ttl=settings.redis_cache_ttl,
-                )
-
-    # The loop holds only a WEAK reference to tasks: without a strong ref the
-    # job can be garbage-collected mid-run and its results silently lost.
-    task = asyncio.create_task(_run_and_store())
-    _background_tasks.add(task)
-    task.add_done_callback(_background_tasks.discard)
-
-    return JSONResponse(content={
-        "task_id": task_id,
-        "status": "processing",
-        "total": len(request.emails),
-        "message": f"Processing {len(request.emails)} emails. Poll /validate/bulk/status/{task_id}",
-    })
-
-
-@router.get("/validate/bulk/status/{task_id}", response_model=TaskStatusResponse, tags=["Validation"])
-async def get_bulk_status(task_id: str):
-    """Poll the status of a bulk validation task."""
-    from ..utils.cache import redis_available
-
-    def _row_to_result(row):
-        """Best-effort coercion of a stored/fallback row into a ValidationResult."""
-        if row is None or not isinstance(row, dict):
-            return None
-        if "scoring" not in row and "score" in row:
-            row = {
-                **row,
-                "status": row.get("status") or "unknown",
-                "scoring": {
-                    "score": row.get("score") or 0,
-                    "risk_level": row.get("risk_level") or "low",
-                },
-            }
-        try:
-            return ValidationResult(**row)
-        except Exception:
-            return None
-
-    def _normalize_results(raw):
-        rows = raw if isinstance(raw, list) else []
-        results = [r for r in (_row_to_result(row) for row in rows) if r is not None]
-        return results or None  # None when absent → serialized as "results": null
-
-    # Background-processed bulk results (the non-Celery async path) are stored
-    # in the shared cache — check it FIRST so polling works for every task id.
-    stored = await get_cache(f"bulk_result:{task_id}")
-    if stored:
-        try:
-            data = json.loads(stored)
-            return TaskStatusResponse(
-                task_id=task_id,
-                status=data.get("status", "completed"),
-                progress=data.get("total"),
-                total=data.get("total"),
-                results=_normalize_results(data.get("results")),
-            )
-        except Exception:
-            pass  # corrupt payload -> fall through to the other backends
-
-    if task_id == "sync":
-        # Sync-fallback results are persisted next to the "sync" job row; read
-        # them back so polling keeps working after the original response.
-        if settings.enable_db_persistence:
-            job = repo.get_bulk_job(task_id)
-            if job:
-                return TaskStatusResponse(
-                    task_id=task_id,
-                    status=job.get("status", "completed") or "completed",
-                    progress=job.get("processed"),
-                    total=job.get("total"),
-                    results=_normalize_results(job.get("results")),
-                )
-        return TaskStatusResponse(task_id=task_id, status="completed")
-    if not await redis_available():
-        # Redis down → fall back to Supabase job tracking (never hang on the backend)
-        if settings.enable_db_persistence:
-            job = repo.get_bulk_job(task_id)
-            if job:
-                return TaskStatusResponse(
-                    task_id=task_id,
-                    status=job.get("status", "unknown"),
-                    progress=job.get("processed"),
-                    total=job.get("total"),
-                    results=_normalize_results(job.get("results"))
-                )
-        # An in-flight background job has no cached result yet. Report
-        # "processing" instead of 404 — the frontend treats 404 as terminal and
-        # would abandon a job that is still running.
-        if any(not t.done() for t in _background_tasks):
-            return TaskStatusResponse(task_id=task_id, status="processing")
-        raise HTTPException(status_code=404, detail=f"Task not found: {task_id}")
-
-    try:
-        from celery.result import AsyncResult
-        result = AsyncResult(task_id)
-        payload = {
-            "task_id": task_id,
-            "status": result.status.lower(),
-        }
-        # Surface live progress while the task is still running. Celery's
-        # PROGRESS state stores {"current": n, "total": n} in result.info.
-        if result.status == "PROGRESS" and isinstance(result.info, dict):
-            payload["progress"] = result.info.get("current")
-            payload["total"] = result.info.get("total")
-        if result.ready():
-            raw = result.result if isinstance(result.result, list) else []
-            payload["results"] = _normalize_results(raw)
-            # Persist finished job so it survives worker restarts
-            if settings.enable_db_persistence:
-                repo.finish_bulk_job(task_id, raw)
-        return TaskStatusResponse(**payload)
-    except Exception as e:
-        # Fallback: read job progress from Supabase
-        if settings.enable_db_persistence:
-            job = repo.get_bulk_job(task_id)
-            if job:
-                return TaskStatusResponse(
-                    task_id=task_id,
-                    status=job.get("status", "unknown"),
-                    progress=job.get("processed"),
-                    total=job.get("total"),
-                    results=_normalize_results(job.get("results"))
-                )
-        raise HTTPException(status_code=404, detail=f"Task not found: {str(e)}")
-
-
-# ---- Domain Info ---------------------------------------------------
-@router.get("/domain/{domain}", summary="Get full DNS/authentication info for a domain", tags=["Domain"])
-async def get_domain_info(domain: str):
-    """Get MX, SPF, DMARC, DKIM records for a domain."""
-    from ..validator.dns_check import check_dns
-    result = await check_dns(domain, timeout=settings.dns_timeout)
-    if settings.enable_db_persistence:
-        repo.save_domain_record(domain, result)
-    return result
-
-
-# ---- Quick Check (Syntax + DNS only, no SMTP) ---------------------
-@router.get("/validate/quick/{email}", summary="Quick syntax + DNS check (no SMTP)", tags=["Validation"])
-async def quick_validate(email: str):
-    """Syntax + DNS only. Fast. No SMTP probe."""
-    result = await engine.validate(email, deep=False)
-    return result
-
-
-# ---- Health Check --------------------------------------------------
-@router.get("/health", tags=["System"])
-async def health():
-    db = await repo.db_status()
-    
-    # Check Redis and Celery status
-    redis_status = False
-    celery_status = False
-    try:
-        from ..utils.cache import redis_available
-        redis_status = await redis_available()
-    except Exception:
-        pass
-    
-    if redis_status:
-        try:
-            from celery import Celery
-            test_celery = Celery(
-                "health_check",
-                broker=settings.celery_broker_url,
-                backend=settings.celery_result_backend
-            )
-            # Try to inspect workers
-            inspect = test_celery.control.inspect(timeout=2)
-            celery_status = inspect.stats() is not None
-        except Exception:
-            pass
-    
-    return {
-        "status": "healthy",
-        "app": settings.app_name,
-        "version": settings.app_version,
-        "database": db,
-        "redis": {"available": redis_status},
-        "celery": {"available": celery_status},
-        "timestamp": time.time()
-    }
-
-
-# ---- Database Status ------------------------------------------------
-@router.get("/db/status", tags=["System"], response_model=dict)
-async def db_status_endpoint():
-    """Supabase connectivity + schema readiness."""
-    return await repo.db_status()
-
-
-# ---- ML advisory diagnostics ----------------------------------------
-@router.get("/ml/status", tags=["System"])
-async def ml_status():
-    """Operability of the advisory DistilBERT layer (flag / repo / load state)."""
-    from ..config import settings
-    from ..ml.runtime import get_model
-
-    model = get_model()
-    sample = None
-    if model is not None and model.loaded:
-        try:
-            sample = model.predict(["john.smith [SEP] stripe.com"])
-        except Exception as exc:  # pragma: no cover - defensive
-            sample = [f"predict raised: {exc}"]
-    return {
-        "enabled": settings.ml_disposable_enabled,
-        "repo": settings.ml_model_repo,
-        "loaded": bool(model is not None and model.loaded),
-        "last_error": getattr(model, "last_error", None) if model else None,
-        "predict_sample": sample,
-    }
-
-
-# ---- History --------------------------------------------------------
-@router.get("/history", tags=["Validation"])
-async def get_history(limit: int = Query(default=50, ge=1, le=500)):
-    """Most recent validations persisted in Supabase (newest first)."""
-    return repo.get_validation_history(limit=limit)
-
-
-# ---- Stats ---------------------------------------------------------
-@router.get("/stats", tags=["System"])
-async def stats():
-    from ..validator.proxy_engine import proxy_pool
-    db_stats = repo.get_stats()
-    return {
-        "proxy_pool": proxy_pool.stats,
-        "database": db_stats,
-        "version": settings.app_version
-    }
+from urllib.parse import urlsplit
+from typing import List, Optional
+
+from fastapi import APIRouter, HTTPException, Query, Request
+from fastapi.responses import JSONResponse
+from pydantic import BaseModel
+import json
+import time
+import asyncio
+import uuid
+
+from ..models import (
+    SingleEmailRequest, BulkEmailRequest,
+    ValidationResult, BulkValidationResponse,
+    TaskStatusResponse
+)
+from ..validator.engine import engine
+from ..utils.cache import get_cache, set_cache
+from ..config import settings
+from ..db import repo
+
+# Strong references to in-flight background bulk jobs (the event loop only
+# keeps weak ones, so a task can vanish mid-run and its results are lost), and
+# a cap so a burst of bulk requests cannot spawn unbounded SMTP work.
+_background_tasks: set[asyncio.Task] = set()
+_bulk_semaphore = asyncio.Semaphore(settings.bulk_concurrency)
+
+# Celery task handle (module level so the routing is testable/patchable).
+# Import failure degrades to the background-task path; Celery itself is only
+# required when celery_bulk_enabled=True.
+try:
+    from ..tasks.celery_tasks import bulk_validate_task  # noqa: E402
+except Exception:  # pragma: no cover - celery not installed
+    bulk_validate_task = None
+
+router = APIRouter()
+
+
+async def process_bulk_sync(emails: list, webhook_url: str = None, deep: bool = True) -> dict:
+    """
+    Process bulk validation synchronously in chunks.
+    Used when Celery is unavailable.
+
+    `deep` defaults to True so bulk runs the full 7-layer pipeline (catch-all +
+    SMTP) exactly like single verification — the product charges 1 credit/email
+    and must not silently degrade to a syntax+DNS-only check.
+
+    Chunks feed the engine's *batched* path: DNS/MX resolves once per domain and
+    the mailbox stage takes the whole chunk in one call, so the SMTP engine reuses
+    a session per receiving host instead of opening a TCP connection per address.
+    """
+    results = []
+    total = len(emails)
+    chunk_size = settings.bulk_sync_chunk_size  # Configurable chunk size
+
+    for i in range(0, total, chunk_size):
+        chunk = emails[i:i + chunk_size]
+        try:
+            chunk_results = await engine.validate_batch(chunk, deep=deep)
+        except Exception as exc:  # never lose a chunk to one bad stage
+            results.extend(
+                {
+                    "email": email,
+                    "error": str(exc) or "Unknown error",
+                    "status": "error",
+                }
+                for email in chunk
+            )
+            continue
+
+        # validate_batch guarantees one result per input, in input order.
+        if len(chunk_results) == len(chunk):
+            pairs = zip(chunk, chunk_results)
+        else:
+            # Defensive: never lose or mis-attribute a row.
+            by_email = {getattr(r, "email", "").lower(): r for r in chunk_results}
+            pairs = ((email, by_email.get(email.lower())) for email in chunk)
+
+        for email, result in pairs:
+            if isinstance(result, ValidationResult):
+                results.append(result.model_dump())
+            else:
+                results.append(
+                    {
+                        "email": email,
+                        "error": "engine returned no result for this address",
+                        "status": "error",
+                    }
+                )
+    
+    # Webhook notification if provided
+    if webhook_url:
+        import httpx
+        try:
+            async with httpx.AsyncClient(timeout=10) as client:
+                await client.post(webhook_url, json={"results": results})
+        except Exception:
+            pass
+
+    # Run-quality monitor (report item 10): fire the signed system-alert
+    # webhook when this run's risky/unknown share crosses the threshold.
+    try:
+        from ..utils.rate_alerts import maybe_alert_risky_rate
+
+        await maybe_alert_risky_rate(
+            results,
+            webhook_url=webhook_url,
+            job_id="sync",
+            threshold=settings.risky_rate_alert_threshold,
+        )
+    except Exception:
+        pass
+
+    return results
+
+
+# ---- Single Email Validation --------------------------------------
+@router.post(
+    "/validate/single",
+    response_model=ValidationResult,
+    summary="Validate a single email address",
+    tags=["Validation"]
+)
+async def validate_single(
+    request: SingleEmailRequest,
+    deep: bool = Query(default=True, description="Enable SMTP verification (slower but more accurate)")
+):
+    """
+    Full 7-layer email validation:
+    Syntax → DNS → MX → Disposable → Catch-All → SMTP → Score
+    """
+    email = request.email
+
+    # Check cache first
+    cache_key = f"val:{email}:{'deep' if deep else 'fast'}"
+    cached = await get_cache(cache_key)
+    if cached:
+        result = ValidationResult(**json.loads(cached))
+        return result.model_copy(update={"cache_hit": True})
+
+    # Run full validation
+    result = await engine.validate(email, deep=deep)
+
+    # Cache the result
+    await set_cache(cache_key, result.model_dump_json(), ttl=settings.redis_cache_ttl)
+
+    # Persist to Supabase (best-effort)
+    if settings.enable_db_persistence:
+        repo.save_validation_result(result)
+
+    return result
+
+
+# ---- Bulk Email Validation ----------------------------------------
+@router.post(
+    "/validate/bulk",
+    summary="Validate multiple email addresses (async)",
+    tags=["Validation"]
+)
+async def validate_bulk(request: BulkEmailRequest):
+    """
+    Async bulk validation. Returns a task_id.
+    Poll /validate/bulk/status/{task_id} for results.
+
+    Uses Celery when Redis is available; otherwise falls back to a
+    synchronous pass (now supports any batch size).
+    """
+    print(f"[BULK] Received bulk validation request for {len(request.emails)} emails")
+    
+    # Only use Celery when the broker is actually reachable — otherwise
+    # .delay() would block retrying the Redis connection.
+    try:
+        from ..utils.cache import redis_available
+        use_celery = (settings.celery_bulk_enabled
+                      and await redis_available())
+        print(f"[BULK] Redis available: {use_celery}")
+    except Exception as e:
+        print(f"[BULK] Redis check failed: {str(e)}")
+        use_celery = False
+
+    if use_celery:
+        try:
+            task = bulk_validate_task.delay(request.emails, request.webhook_url, request.deep)
+            # Record the job in Supabase so it can be tracked across restarts
+            if settings.enable_db_persistence:
+                repo.create_bulk_job(task.id, request.emails)
+            return BulkValidationResponse(
+                task_id=task.id,
+                status="processing",
+                total=len(request.emails),
+                message=f"Processing {len(request.emails)} emails. Poll /validate/bulk/status/{task.id}"
+            )
+        except Exception as exc:
+            print(f"[BULK] Celery unavailable ({exc}) — using synchronous fallback.")
+
+    # Synchronous fallback for any size list — but NON-BLOCKING: the request
+    # returns immediately with a task_id, and the results are processed in a
+    # background asyncio task. The old blocking behavior held the HTTP request
+    # for the entire validation (60-112s on a blocked-egress host), which
+    # exceeded the frontend's 45s fetch timeout and made the Results page
+    # show nothing.
+    task_id = uuid.uuid4().hex
+    print(f"[BULK] Processing {len(request.emails)} emails in background (task {task_id})")
+
+    # Record the job BEFORE processing: without this row, finish_bulk_job is an
+    # UPDATE that matches nothing, and in-flight polls hit the "Redis down"
+    # branch and 404 — which the frontend treats as terminal.
+    if settings.enable_db_persistence:
+        try:
+            repo.create_bulk_job(task_id, request.emails)
+        except Exception as exc:
+            print(f"[BULK] create_bulk_job failed: {exc}")
+
+    async def _run_and_store():
+        async with _bulk_semaphore:
+            try:
+                results = await process_bulk_sync(
+                    request.emails, request.webhook_url, deep=request.deep
+                )
+                if settings.enable_db_persistence:
+                    try:
+                        repo.finish_bulk_job(task_id, results)
+                    except Exception as exc:
+                        print(f"[BULK] finish_bulk_job failed: {exc}")
+                await set_cache(
+                    f"bulk_result:{task_id}",
+                    json.dumps({"status": "completed", "total": len(request.emails),
+                                "results": results}),
+                    ttl=settings.redis_cache_ttl,
+                )
+                print(f"[BULK] task {task_id} completed: {len(results)} results")
+            except Exception as exc:
+                print(f"[BULK] task {task_id} failed: {exc}")
+                await set_cache(
+                    f"bulk_result:{task_id}",
+                    json.dumps({"status": "error", "error": str(exc),
+                                "results": []}),
+                    ttl=settings.redis_cache_ttl,
+                )
+
+    # The loop holds only a WEAK reference to tasks: without a strong ref the
+    # job can be garbage-collected mid-run and its results silently lost.
+    task = asyncio.create_task(_run_and_store())
+    _background_tasks.add(task)
+    task.add_done_callback(_background_tasks.discard)
+
+    return JSONResponse(content={
+        "task_id": task_id,
+        "status": "processing",
+        "total": len(request.emails),
+        "message": f"Processing {len(request.emails)} emails. Poll /validate/bulk/status/{task_id}",
+    })
+
+
+@router.get("/validate/bulk/status/{task_id}", response_model=TaskStatusResponse, tags=["Validation"])
+async def get_bulk_status(task_id: str):
+    """Poll the status of a bulk validation task."""
+    from ..utils.cache import redis_available
+
+    def _row_to_result(row):
+        """Best-effort coercion of a stored/fallback row into a ValidationResult."""
+        if row is None or not isinstance(row, dict):
+            return None
+        if "scoring" not in row and "score" in row:
+            row = {
+                **row,
+                "status": row.get("status") or "unknown",
+                "scoring": {
+                    "score": row.get("score") or 0,
+                    "risk_level": row.get("risk_level") or "low",
+                },
+            }
+        try:
+            return ValidationResult(**row)
+        except Exception:
+            return None
+
+    def _normalize_results(raw):
+        rows = raw if isinstance(raw, list) else []
+        results = [r for r in (_row_to_result(row) for row in rows) if r is not None]
+        return results or None  # None when absent → serialized as "results": null
+
+    # Background-processed bulk results (the non-Celery async path) are stored
+    # in the shared cache — check it FIRST so polling works for every task id.
+    stored = await get_cache(f"bulk_result:{task_id}")
+    if stored:
+        try:
+            data = json.loads(stored)
+            return TaskStatusResponse(
+                task_id=task_id,
+                status=data.get("status", "completed"),
+                progress=data.get("total"),
+                total=data.get("total"),
+                results=_normalize_results(data.get("results")),
+            )
+        except Exception:
+            pass  # corrupt payload -> fall through to the other backends
+
+    if task_id == "sync":
+        # Sync-fallback results are persisted next to the "sync" job row; read
+        # them back so polling keeps working after the original response.
+        if settings.enable_db_persistence:
+            job = repo.get_bulk_job(task_id)
+            if job:
+                return TaskStatusResponse(
+                    task_id=task_id,
+                    status=job.get("status", "completed") or "completed",
+                    progress=job.get("processed"),
+                    total=job.get("total"),
+                    results=_normalize_results(job.get("results")),
+                )
+        return TaskStatusResponse(task_id=task_id, status="completed")
+    if not await redis_available():
+        # Redis down → fall back to Supabase job tracking (never hang on the backend)
+        if settings.enable_db_persistence:
+            job = repo.get_bulk_job(task_id)
+            if job:
+                return TaskStatusResponse(
+                    task_id=task_id,
+                    status=job.get("status", "unknown"),
+                    progress=job.get("processed"),
+                    total=job.get("total"),
+                    results=_normalize_results(job.get("results"))
+                )
+        # An in-flight background job has no cached result yet. Report
+        # "processing" instead of 404 — the frontend treats 404 as terminal and
+        # would abandon a job that is still running.
+        if any(not t.done() for t in _background_tasks):
+            return TaskStatusResponse(task_id=task_id, status="processing")
+        raise HTTPException(status_code=404, detail=f"Task not found: {task_id}")
+
+    try:
+        from celery.result import AsyncResult
+        result = AsyncResult(task_id)
+        payload = {
+            "task_id": task_id,
+            "status": result.status.lower(),
+        }
+        # Surface live progress while the task is still running. Celery's
+        # PROGRESS state stores {"current": n, "total": n} in result.info.
+        if result.status == "PROGRESS" and isinstance(result.info, dict):
+            payload["progress"] = result.info.get("current")
+            payload["total"] = result.info.get("total")
+        if result.ready():
+            raw = result.result if isinstance(result.result, list) else []
+            payload["results"] = _normalize_results(raw)
+            # Persist finished job so it survives worker restarts
+            if settings.enable_db_persistence:
+                repo.finish_bulk_job(task_id, raw)
+        return TaskStatusResponse(**payload)
+    except Exception as e:
+        # Fallback: read job progress from Supabase
+        if settings.enable_db_persistence:
+            job = repo.get_bulk_job(task_id)
+            if job:
+                return TaskStatusResponse(
+                    task_id=task_id,
+                    status=job.get("status", "unknown"),
+                    progress=job.get("processed"),
+                    total=job.get("total"),
+                    results=_normalize_results(job.get("results"))
+                )
+        raise HTTPException(status_code=404, detail=f"Task not found: {str(e)}")
+
+
+# ---- Domain Info ---------------------------------------------------
+@router.get("/domain/{domain}", summary="Get full DNS/authentication info for a domain", tags=["Domain"])
+async def get_domain_info(domain: str):
+    """Get MX, SPF, DMARC, DKIM records for a domain."""
+    from ..validator.dns_check import check_dns
+    result = await check_dns(domain, timeout=settings.dns_timeout)
+    if settings.enable_db_persistence:
+        repo.save_domain_record(domain, result)
+    return result
+
+
+# ---- Quick Check (Syntax + DNS only, no SMTP) ---------------------
+@router.get("/validate/quick/{email}", summary="Quick syntax + DNS check (no SMTP)", tags=["Validation"])
+async def quick_validate(email: str):
+    """Syntax + DNS only. Fast. No SMTP probe."""
+    result = await engine.validate(email, deep=False)
+    return result
+
+
+# ---- Health Check --------------------------------------------------
+@router.get("/health", tags=["System"])
+async def health():
+    db = await repo.db_status()
+    
+    # Check Redis and Celery status
+    redis_status = False
+    celery_status = False
+    try:
+        from ..utils.cache import redis_available
+        redis_status = await redis_available()
+    except Exception:
+        pass
+    
+    if redis_status:
+        try:
+            from celery import Celery
+            test_celery = Celery(
+                "health_check",
+                broker=settings.celery_broker_url,
+                backend=settings.celery_result_backend
+            )
+            # Try to inspect workers
+            inspect = test_celery.control.inspect(timeout=2)
+            celery_status = inspect.stats() is not None
+        except Exception:
+            pass
+    
+    # Autonomous-engine worker summary (spec §3): never fatal, best-effort.
+    workers = {
+        "dns": {"doh_enabled": settings.doh_enabled},
+        "smtp": {
+            "provider": engine.mailbox.name,
+            "worker_configured": bool(settings.smtp_worker_url),
+        },
+        "ai_scorer": {
+            "configured": bool(settings.ai_scorer_model and
+                               (settings.hf_inference_token or settings.ml_hf_token)),
+        },
+    }
+
+    return {
+        "status": "healthy",
+        "app": settings.app_name,
+        "version": settings.app_version,
+        "database": db,
+        "redis": {"available": redis_status},
+        "celery": {"available": celery_status},
+        "workers": workers,
+        "timestamp": time.time()
+    }
+
+
+# ---- Database Status ------------------------------------------------
+@router.get("/db/status", tags=["System"], response_model=dict)
+async def db_status_endpoint():
+    """Supabase connectivity + schema readiness."""
+    return await repo.db_status()
+
+
+# ---- ML advisory diagnostics ----------------------------------------
+@router.get("/ml/status", tags=["System"])
+async def ml_status():
+    """Operability of the advisory DistilBERT layer (flag / repo / load state)."""
+    from ..config import settings
+    from ..ml.runtime import get_model
+
+    model = get_model()
+    sample = None
+    if model is not None and model.loaded:
+        try:
+            sample = model.predict(["john.smith [SEP] stripe.com"])
+        except Exception as exc:  # pragma: no cover - defensive
+            sample = [f"predict raised: {exc}"]
+    return {
+        "enabled": settings.ml_disposable_enabled,
+        "repo": settings.ml_model_repo,
+        "loaded": bool(model is not None and model.loaded),
+        "last_error": getattr(model, "last_error", None) if model else None,
+        "predict_sample": sample,
+    }
+
+
+# ---- History --------------------------------------------------------
+@router.get("/history", tags=["Validation"])
+async def get_history(limit: int = Query(default=50, ge=1, le=500)):
+    """Most recent validations persisted in Supabase (newest first)."""
+    return repo.get_validation_history(limit=limit)
+
+
+# ---- Stats ---------------------------------------------------------
+@router.get("/stats", tags=["System"])
+async def stats():
+    from ..validator.proxy_engine import proxy_pool
+    db_stats = repo.get_stats()
+    return {
+        "proxy_pool": proxy_pool.stats,
+        "database": db_stats,
+        "version": settings.app_version
+    }
+
+
+# ---- Autonomous engine status (spec §3: four-worker visibility) -----
+@router.get("/engine/status", tags=["System"])
+async def engine_status():
+    """Live state of every autonomous-engine worker (no PII)."""
+    from ..validator.egress import check_port25_egress
+
+    egress = await asyncio.to_thread(check_port25_egress)
+    scorer_status = engine.scorer.status()
+    worker_url = settings.smtp_worker_url
+    return {
+        "version": settings.app_version,
+        "dns": {
+            "doh_enabled": settings.doh_enabled,
+            "resolvers": ["dns.google", "cloudflare-dns.com"],
+            "dual_consistency": settings.doh_enabled,
+        },
+        "smtp": {
+            "provider": engine.mailbox.name,
+            "helo_domain": settings.smtp_helo_domain,
+            "remote_worker": (
+                {"configured": True, "host": urlsplit(worker_url).hostname}
+                if worker_url
+                else {"configured": False}
+            ),
+            "egress_port25": egress.as_dict(),
+        },
+        "ai_scorer": scorer_status,
+        "catch_all_ttl_seconds": settings.catch_all_ttl_seconds,
+        "dns_cache_ttl_seconds": settings.dns_cache_ttl_seconds,
+    }
+
+
+# ---- Inference burn-rate instrumentation (spec Phase 6) --------------
+@router.get("/metrics/inference", tags=["System"])
+async def inference_metrics():
+    """AI-scorer burn rate against the <5% target (spec Phase 6)."""
+    return engine.scorer.metrics.as_dict()
+
+
+# ---- SMTP probe worker endpoints (spec §3.3) ------------------------
+# Any deployment of this image can serve as the port-25 SMTP worker for an
+# orchestrator whose own egress is blocked. Guarded by a shared secret
+# (X-Worker-Token) when SMTP_WORKER_TOKEN is configured on either side.
+async def _require_worker_token(request: Request) -> None:
+    expected = settings.smtp_worker_token
+    if not expected:
+        return
+    supplied = request.headers.get("x-worker-token", "")
+    if supplied != expected:
+        raise HTTPException(status_code=401, detail="worker token invalid")
+
+
+class WorkerProbeRequest(BaseModel):
+    email: Optional[str] = None
+    domain: Optional[str] = None
+    mx_host: str
+    probe: str = "mailbox"  # "mailbox" | "catch_all"
+
+
+class WorkerBatchRequest(BaseModel):
+    pairs: List[List[str]]
+
+
+@router.post("/smtp/probe", tags=["Worker"])
+async def smtp_probe(request: Request, body: WorkerProbeRequest):
+    """One mailbox or catch-all probe from THIS host's port-25 egress."""
+    await _require_worker_token(request)
+    from ..validator.mailbox_provider import AutonomousSmtpProvider
+
+    worker = AutonomousSmtpProvider()
+    if body.probe == "catch_all":
+        if not body.domain:
+            raise HTTPException(status_code=422, detail="domain required for catch_all probe")
+        is_ca, confidence = await worker.catch_all(body.domain, body.mx_host)
+        return {"is_catch_all": is_ca, "confidence": confidence}
+    if not body.email:
+        raise HTTPException(status_code=422, detail="email required for mailbox probe")
+    result = await worker.verify(body.email, body.mx_host)
+    return json.loads(result.model_dump_json())
+
+
+@router.post("/smtp/probe/batch", tags=["Worker"])
+async def smtp_probe_batch(request: Request, body: WorkerBatchRequest):
+    """Batched mailbox probes (one session per receiving MX host)."""
+    await _require_worker_token(request)
+    from ..validator.mailbox_provider import AutonomousSmtpProvider
+
+    worker = AutonomousSmtpProvider()
+    pairs = [(row[0], row[1]) for row in body.pairs if len(row) >= 2]
+    results, catch_all = await worker.verify_many(pairs)
+    return {
+        "results": {e: json.loads(r.model_dump_json()) for e, r in results.items()},
+        "catch_all": catch_all,
+    }

app/auth.py

@@ -1,177 +1,189 @@
-"""Supabase JWT verification + license gating for the paid API.
-
-The central Supabase project issues the session JWT; this backend verifies
-it against the project's PUBLIC JWKS endpoint (no shared database needed).
-License rows are read from the central project via its service-role REST
-API (server-side only).
-
-Enforcement is OFF by default (LICENSE_ENFORCEMENT != "true") so existing
-open/demo deployments keep working. Turn it on at go-live:
-
-    SUPABASE_URL=https://ciytvulujiqemqljablq.supabase.co
-    SUPABASE_SERVICE_ROLE_KEY=<service role key, server only>
-    LICENSE_ENFORCEMENT=true
-
-Frontend equivalent lives in the FortyDN website repo (src/lib/productApi.ts).
-Follows docs/AUTH_SETUP.md section 3 (Python snippet).
-"""
-
-import logging
-from typing import Optional
-
-import httpx
-from fastapi import Request
-from fastapi.responses import JSONResponse
-from jose import jwt as jose_jwt
-from jose import jwk as jose_jwk
-from jose.exceptions import JWTError
-
-from .config import settings
-
-logger = logging.getLogger("emailvalidator.auth")
-
-CENTRAL_SUPABASE_URL = (
-    settings.supabase_url or "https://ciytvulujiqemqljablq.supabase.co"
-)
-JWKS_URL = f"{CENTRAL_SUPABASE_URL}/auth/v1/.well-known/jwks.json"
-
-# Modul-X is unlocked directly, via Validate+Send, or via Full Bridge.
-MODULX_GRANTS = frozenset(
-    {
-        "modul-x",
-        "combo-validate-send",
-        "combo-full-bridge",
-    }
-)
-
-_jwks_cache: Optional[dict] = None
-
-
-def enforcement_on() -> bool:
-    return (settings.license_enforcement or "").lower() == "true"
-
-
-async def _get_jwks() -> dict:
-    """Fetch (and cache) the Supabase JWKS document."""
-    global _jwks_cache
-    if _jwks_cache is None:
-        async with httpx.AsyncClient(timeout=10.0) as client:
-            res = await client.get(JWKS_URL)
-            res.raise_for_status()
-            _jwks_cache = res.json()
-    return _jwks_cache  # type: ignore[return-value]
-
-
-def _bearer_token(request: Request) -> Optional[str]:
-    header = request.headers.get("authorization", "")
-    if not header.startswith("Bearer "):
-        return None
-    token = header[7:].strip()
-    return token if token else None
-
-
-async def verify_supabase_jwt(token: str) -> dict:
-    """Verify the Supabase session JWT via JWKS. Returns claims (sub = user_id)."""
-    jwks = await _get_jwks()
-    # Supabase rotates keys; try each until one verifies.
-    last_error: Optional[Exception] = None
-    for key_data in jwks.get("keys", []):
-        try:
-            key = jose_jwk.construct(key_data)
-            claims = jose_jwt.decode(
-                token,
-                key,
-                algorithms=["ES256", "RS256"],
-                audience="authenticated",
-            )
-            if not claims.get("sub"):
-                raise JWTError("JWT has no sub claim")
-            return claims
-        except JWTError as exc:
-            last_error = exc
-            continue
-    raise JWTError(f"JWT verification failed: {last_error}")
-
-
-async def has_modulx_license(user_id: str) -> bool:
-    """Check for an active Modul-X license via the central service-role API."""
-    service_key = settings.supabase_service_role_key
-    if not service_key:
-        logger.warning("[auth] SUPABASE_SERVICE_ROLE_KEY not set - cannot check licenses.")
-        return False
-    params = {
-        "user_id": f"eq.{user_id}",
-        "status": "eq.active",
-        "select": "product",
-    }
-    try:
-        async with httpx.AsyncClient(timeout=10.0) as client:
-            res = await client.get(
-                f"{CENTRAL_SUPABASE_URL}/rest/v1/licenses",
-                params=params,
-                headers={
-                    "apikey": service_key,
-                    "Authorization": f"Bearer {service_key}",
-                },
-            )
-        if res.status_code != 200:
-            # Missing table (migrations not applied yet) => fail closed with a hint.
-            logger.warning(
-                "[auth] license lookup HTTP %s: %s",
-                res.status_code,
-                res.text[:200],
-            )
-            return False
-        rows = res.json()
-        return isinstance(rows, list) and any(
-            isinstance(r, dict) and r.get("product") in MODULX_GRANTS for r in rows
-        )
-    except Exception as exc:
-        logger.warning("[auth] license lookup error: %s", exc)
-        return False
-
-
-# Paths that stay open (health probes, docs, root).
-_OPEN_PREFIXES = ("/api/v1/health", "/api/health", "/docs", "/redoc", "/openapi.json")
-_OPEN_EXACT = frozenset({"/", "/api/v1/health", "/api/health"})
-
-
-def _is_open_path(path: str) -> bool:
-    if path in _OPEN_EXACT:
-        return True
-    return any(path.startswith(p) and path != p for p in _OPEN_PREFIXES)
-
-
-async def license_middleware(request: Request, call_next):
-    """FastAPI HTTP middleware: JWT + license gate for paid routes.
-
-    Mirrors the Express pattern (Modul-S/E): /api/v1/health stays open,
-    everything else under /api requires a valid JWT + active license.
-    No-op while LICENSE_ENFORCEMENT != "true" (demo mode).
-    """
-    if not enforcement_on():
-        return await call_next(request)
-    path = request.url.path
-    if _is_open_path(path) or not path.startswith("/api"):
-        return await call_next(request)
-    token = _bearer_token(request)
-    if not token:
-        return JSONResponse(
-            status_code=401,
-            content={"detail": "Missing bearer token - sign in first."},
-        )
-    try:
-        claims = await verify_supabase_jwt(token)
-    except JWTError:
-        return JSONResponse(
-            status_code=401,
-            content={"detail": "Invalid or expired token."},
-        )
-    user_id = claims.get("sub", "")
-    if not user_id or not await has_modulx_license(user_id):
-        return JSONResponse(
-            status_code=402,
-            content={"detail": "No active Modul-X license - see /pricing."},
-        )
-    request.state.auth = {"user_id": user_id, "email": claims.get("email")}
-    return await call_next(request)
+"""Supabase JWT verification + license gating for the paid API.
+
+The central Supabase project issues the session JWT; this backend verifies
+it against the project's PUBLIC JWKS endpoint (no shared database needed).
+License rows are read from the central project via its service-role REST
+API (server-side only).
+
+Enforcement is OFF by default (LICENSE_ENFORCEMENT != "true") so existing
+open/demo deployments keep working. Turn it on at go-live:
+
+    SUPABASE_URL=https://ciytvulujiqemqljablq.supabase.co
+    SUPABASE_SERVICE_ROLE_KEY=<service role key, server only>
+    LICENSE_ENFORCEMENT=true
+
+Frontend equivalent lives in the FortyDN website repo (src/lib/productApi.ts).
+Follows docs/AUTH_SETUP.md section 3 (Python snippet).
+"""
+
+import logging
+from typing import Optional
+
+import httpx
+from fastapi import Request
+from fastapi.responses import JSONResponse
+from jose import jwt as jose_jwt
+from jose import jwk as jose_jwk
+from jose.exceptions import JWTError
+
+from .config import settings
+
+logger = logging.getLogger("emailvalidator.auth")
+
+CENTRAL_SUPABASE_URL = (
+    settings.supabase_url or "https://ciytvulujiqemqljablq.supabase.co"
+)
+JWKS_URL = f"{CENTRAL_SUPABASE_URL}/auth/v1/.well-known/jwks.json"
+
+# Modul-X is unlocked directly, via Validate+Send, or via Full Bridge.
+MODULX_GRANTS = frozenset(
+    {
+        "modul-x",
+        "combo-validate-send",
+        "combo-full-bridge",
+    }
+)
+
+_jwks_cache: Optional[dict] = None
+
+
+def enforcement_on() -> bool:
+    return (settings.license_enforcement or "").lower() == "true"
+
+
+async def _get_jwks() -> dict:
+    """Fetch (and cache) the Supabase JWKS document."""
+    global _jwks_cache
+    if _jwks_cache is None:
+        async with httpx.AsyncClient(timeout=10.0) as client:
+            res = await client.get(JWKS_URL)
+            res.raise_for_status()
+            _jwks_cache = res.json()
+    return _jwks_cache  # type: ignore[return-value]
+
+
+def _bearer_token(request: Request) -> Optional[str]:
+    header = request.headers.get("authorization", "")
+    if not header.startswith("Bearer "):
+        return None
+    token = header[7:].strip()
+    return token if token else None
+
+
+async def verify_supabase_jwt(token: str) -> dict:
+    """Verify the Supabase session JWT via JWKS. Returns claims (sub = user_id)."""
+    jwks = await _get_jwks()
+    # Supabase rotates keys; try each until one verifies.
+    last_error: Optional[Exception] = None
+    for key_data in jwks.get("keys", []):
+        try:
+            key = jose_jwk.construct(key_data)
+            claims = jose_jwt.decode(
+                token,
+                key,
+                algorithms=["ES256", "RS256"],
+                audience="authenticated",
+            )
+            if not claims.get("sub"):
+                raise JWTError("JWT has no sub claim")
+            return claims
+        except JWTError as exc:
+            last_error = exc
+            continue
+    raise JWTError(f"JWT verification failed: {last_error}")
+
+
+async def has_modulx_license(user_id: str) -> bool:
+    """Check for an active Modul-X license via the central service-role API."""
+    service_key = settings.supabase_service_role_key
+    if not service_key:
+        logger.warning("[auth] SUPABASE_SERVICE_ROLE_KEY not set - cannot check licenses.")
+        return False
+    params = {
+        "user_id": f"eq.{user_id}",
+        "status": "eq.active",
+        "select": "product",
+    }
+    try:
+        async with httpx.AsyncClient(timeout=10.0) as client:
+            res = await client.get(
+                f"{CENTRAL_SUPABASE_URL}/rest/v1/licenses",
+                params=params,
+                headers={
+                    "apikey": service_key,
+                    "Authorization": f"Bearer {service_key}",
+                },
+            )
+        if res.status_code != 200:
+            # Missing table (migrations not applied yet) => fail closed with a hint.
+            logger.warning(
+                "[auth] license lookup HTTP %s: %s",
+                res.status_code,
+                res.text[:200],
+            )
+            return False
+        rows = res.json()
+        return isinstance(rows, list) and any(
+            isinstance(r, dict) and r.get("product") in MODULX_GRANTS for r in rows
+        )
+    except Exception as exc:
+        logger.warning("[auth] license lookup error: %s", exc)
+        return False
+
+
+# Paths that stay open (health probes, docs, root) plus the autonomous-engine
+# ops surfaces: /engine/status + /metrics/inference are aggregate diagnostics
+# (no PII), and /smtp/probe* enforce their own shared-secret guard
+# (X-Worker-Token) — license JWTs do not apply to machine-to-machine probes.
+_OPEN_PREFIXES = (
+    "/api/v1/health",
+    "/api/health",
+    "/api/v1/engine/status",
+    "/api/v1/metrics",
+    "/api/v1/smtp/probe",
+    "/docs",
+    "/redoc",
+    "/openapi.json",
+)
+_OPEN_EXACT = frozenset({"/", "/api/v1/health", "/api/health"})
+
+
+def _is_open_path(path: str) -> bool:
+    if path in _OPEN_EXACT:
+        return True
+    return any(path.startswith(p) and path != p for p in _OPEN_PREFIXES)
+
+
+async def license_middleware(request: Request, call_next):
+    """FastAPI HTTP middleware: JWT + license gate for paid routes.
+
+    Mirrors the Express pattern (Modul-S/E): /api/v1/health stays open,
+    everything else under /api requires a valid JWT + active license.
+    No-op while LICENSE_ENFORCEMENT != "true" (demo mode).
+    """
+    if not enforcement_on():
+        return await call_next(request)
+    path = request.url.path
+    if _is_open_path(path) or not path.startswith("/api"):
+        return await call_next(request)
+    token = _bearer_token(request)
+    if not token:
+        return JSONResponse(
+            status_code=401,
+            content={"detail": "Missing bearer token - sign in first."},
+        )
+    try:
+        claims = await verify_supabase_jwt(token)
+    except JWTError:
+        return JSONResponse(
+            status_code=401,
+            content={"detail": "Invalid or expired token."},
+        )
+    user_id = claims.get("sub", "")
+    if not user_id or not await has_modulx_license(user_id):
+        return JSONResponse(
+            status_code=402,
+            content={"detail": "No active Modul-X license - see /pricing."},
+        )
+    request.state.auth = {"user_id": user_id, "email": claims.get("email")}
+    return await call_next(request)

app/config.py

@@ -1,169 +1,190 @@
-from urllib.parse import urlsplit
-
-from pydantic import model_validator
-from pydantic_settings import BaseSettings, SettingsConfigDict
-from typing import List
-
-
-def _is_https_origin(value: str) -> bool:
-    try:
-        parsed = urlsplit(value)
-        _ = parsed.port
-    except ValueError:
-        return False
-    return (
-        parsed.scheme == "https"
-        and bool(parsed.hostname)
-        and parsed.username is None
-        and parsed.password is None
-        and parsed.path in {"", "/"}
-        and not parsed.query
-        and not parsed.fragment
-    )
-
-
-class Settings(BaseSettings):
-    model_config = SettingsConfigDict(
-        env_file=".env",
-        env_file_encoding="utf-8",
-        case_sensitive=False,
-        extra="ignore",
-    )
-
-    # App
-    app_environment: str = "development"
-    app_name: str = "BRIDGE Modul - X"
-    app_version: str = "2.2.0"
-    debug: bool = False
-    secret_key: str = "change-me-in-production"
-
-    # Server
-    host: str = "0.0.0.0"
-    port: int = 8000
-    workers: int = 4
-
-    # Database
-    database_url: str = "sqlite+aiosqlite:///./emailval.db"
-
-    # Redis
-    redis_url: str = "redis://localhost:6379/0"
-    redis_cache_ttl: int = 86400  # 24 hours
-
-    # CORS
-    cors_origins: List[str] = [
-        "http://localhost:5173",
-        "http://localhost:3000",
-        "http://127.0.0.1:5173",
-    ]
-
-    # Validation
-    smtp_timeout: int = 10
-    dns_timeout: int = 5
-    # Public resolvers used instead of the host's own resolver config. A stale
-    # gateway list (dead hotspot IPs) makes every lookup burn the full timeout
-    # and fail — see dns_check.build_resolver.
-    dns_nameservers: list[str] = ["1.1.1.1", "8.8.8.8"]
-    # Bulk validation only routes through Celery on hosts that actually run a
-    # worker. The HF Space runs uvicorn alone (Dockerfile CMD), so a reachable
-    # Redis must not by itself select the Celery branch — jobs would sit in
-    # the queue forever. Opt in on the VPS deployment.
-    celery_bulk_enabled: bool = False
-    max_bulk_emails: int = 10000
-    rate_limit_per_minute: int = 60
-    bulk_sync_chunk_size: int = 50  # Process this many emails at a time in sync mode
-
-    # Proxy
-    use_proxies: bool = False
-    proxy_list: List[str] = []
-
-    # Mailbox verification provider (Layer 5 catch-all + Layer 6 SMTP).
-    # On hosts that block outbound port 25 (Hugging Face Spaces, most cloud),
-    # direct SMTP cannot run — so the mailbox verdict is delegated to a
-    # third-party verification API instead. "auto" uses the API when an API key
-    # is present, else falls back to direct SMTP. "local"/"api" force a provider.
-    mailbox_provider: str = "auto"  # auto | local | api
-    # Independence by default: the engine uses its own SMTP probing even when a
-    # third-party key happens to be present. Set True only to deliberately route
-    # the mailbox layers through the API.
-    prefer_api_provider: bool = False
-    # Public HELO/MX identity used in the SMTP dialogue. A real, resolvable
-    # hostname with matching PTR improves acceptance by strict receivers.
-    smtp_helo_domain: str = "validator.local"
-    smtp_mail_from: str = "probe@validator.local"
-    mv_api_key: str = ""            # MillionVerifier real-time API key (optional)
-    mv_timeout: int = 10            # per-check provider timeout (seconds)
-    # Circuit breaker: after this many consecutive direct-SMTP connection
-    # failures (blocked egress), fail fast for `smtp_cooldown_seconds` instead
-    # of burning the full timeout on every address.
-    smtp_fail_threshold: int = 3
-    smtp_cooldown_seconds: int = 300
-    # Catch-all is a domain property — cache the verdict for 72h so a bulk list
-    # does not re-probe the same domain for every address.
-    catch_all_ttl_seconds: int = 72 * 3600
-    # DNS/MX answers change slowly; a definitive mailbox verdict is stable for
-    # about a day. Transient failures are never cached regardless of TTL.
-    dns_cache_ttl_seconds: int = 24 * 3600
-    # Per-MX-host SMTP session cap and global concurrency for bulk runs.
-    max_connections_per_host: int = 2
-    bulk_concurrency: int = 20
-
-    # --- DistilBERT email-risk signal (advisory, unknown domains only) ---
-    # OFF by default: with the flag off the engine's behaviour is identical to
-    # the pre-ML build. The model is a private HF repo trained on the engine's
-    # own blocklists (see app/ml/). Promotion from advisory to blocking requires
-    # measured DISPOSABLE precision >= 0.98 (app/ml/train.py reports it).
-    ml_disposable_enabled: bool = False
-    ml_model_repo: str = ""
-    ml_batch_size: int = 64
-    ml_score_penalty: int = 5
-    ml_hf_token: str = ""
-
-    # Run-quality monitor (report item 10): alert when >= this share of a bulk
-    # run comes back risky/unknown/error — the signature of a systemic failure
-    # (dead provider, blocked egress, engine regression). 0 disables it.
-    risky_rate_alert_threshold: float = 0.5
-
-    # Celery
-    celery_broker_url: str = "redis://localhost:6379/1"
-    celery_result_backend: str = "redis://localhost:6379/2"
-
-    # Supabase (Postgres + PostgREST)
-    supabase_url: str = ""
-    supabase_anon_key: str = ""
-    supabase_service_role_key: str = ""
-    enable_db_persistence: bool = True
-
-    # Central billing gate: "true" enforces Supabase JWT + active license
-    # (modul-x directly, via combo-validate-send, or via combo-full-bridge)
-    # on every paid API route. Anything else = open demo mode.
-    license_enforcement: str = ""
-
-    @model_validator(mode="after")
-    def validate_production_settings(self) -> "Settings":
-        if self.app_environment.strip().casefold() != "production":
-            return self
-
-        problems = []
-        if self.debug:
-            problems.append("DEBUG must be false")
-        if self.license_enforcement.strip().casefold() != "true":
-            problems.append("LICENSE_ENFORCEMENT must be true")
-        if not self.supabase_configured:
-            problems.append("SUPABASE_URL and SUPABASE_SERVICE_ROLE_KEY are required")
-        elif not _is_https_origin(self.supabase_url):
-            problems.append("SUPABASE_URL must be an HTTPS URL")
-        if not self.cors_origins or not all(
-            _is_https_origin(origin) for origin in self.cors_origins
-        ):
-            problems.append("CORS_ORIGINS must contain only HTTPS origins")
-
-        if problems:
-            raise ValueError("Unsafe production configuration: " + "; ".join(problems))
-        return self
-
-    @property
-    def supabase_configured(self) -> bool:
-        return bool(self.supabase_url and self.supabase_service_role_key)
-
-
-settings = Settings()
+from urllib.parse import urlsplit
+
+from pydantic import model_validator
+from pydantic_settings import BaseSettings, SettingsConfigDict
+from typing import List
+
+
+def _is_https_origin(value: str) -> bool:
+    try:
+        parsed = urlsplit(value)
+        _ = parsed.port
+    except ValueError:
+        return False
+    return (
+        parsed.scheme == "https"
+        and bool(parsed.hostname)
+        and parsed.username is None
+        and parsed.password is None
+        and parsed.path in {"", "/"}
+        and not parsed.query
+        and not parsed.fragment
+    )
+
+
+class Settings(BaseSettings):
+    model_config = SettingsConfigDict(
+        env_file=".env",
+        env_file_encoding="utf-8",
+        case_sensitive=False,
+        extra="ignore",
+    )
+
+    # App
+    app_environment: str = "development"
+    app_name: str = "BRIDGE Modul - X"
+    app_version: str = "3.0.0"
+    debug: bool = False
+    secret_key: str = "change-me-in-production"
+
+    # Server
+    host: str = "0.0.0.0"
+    port: int = 8000
+    workers: int = 4
+
+    # Database
+    database_url: str = "sqlite+aiosqlite:///./emailval.db"
+
+    # Redis
+    redis_url: str = "redis://localhost:6379/0"
+    redis_cache_ttl: int = 86400  # 24 hours
+
+    # CORS
+    cors_origins: List[str] = [
+        "http://localhost:5173",
+        "http://localhost:3000",
+        "http://127.0.0.1:5173",
+    ]
+
+    # Validation
+    smtp_timeout: int = 10
+    dns_timeout: int = 5
+    # Public resolvers used instead of the host's own resolver config. A stale
+    # gateway list (dead hotspot IPs) makes every lookup burn the full timeout
+    # and fail — see dns_check.build_resolver.
+    dns_nameservers: list[str] = ["1.1.1.1", "8.8.8.8"]
+    # Bulk validation only routes through Celery on hosts that actually run a
+    # worker. The HF Space runs uvicorn alone (Dockerfile CMD), so a reachable
+    # Redis must not by itself select the Celery branch — jobs would sit in
+    # the queue forever. Opt in on the VPS deployment.
+    celery_bulk_enabled: bool = False
+    max_bulk_emails: int = 10000
+    rate_limit_per_minute: int = 60
+    bulk_sync_chunk_size: int = 50  # Process this many emails at a time in sync mode
+
+    # Proxy
+    use_proxies: bool = False
+    proxy_list: List[str] = []
+
+    # Mailbox verification provider (Layer 5 catch-all + Layer 6 SMTP).
+    # The engine is FULLY AUTONOMOUS: mailbox verdicts come from its own SMTP
+    # probing engine — never from a third-party verification API. "local"
+    # forces the built-in engine; "remote" forces the remote SMTP worker;
+    # "auto" prefers the remote worker when SMTP_WORKER_URL is set and falls
+    # back to the built-in engine otherwise.
+    mailbox_provider: str = "auto"  # auto | local | remote
+    # Public HELO/MX identity used in the SMTP dialogue. A real, resolvable
+    # hostname with matching PTR improves acceptance by strict receivers.
+    smtp_helo_domain: str = "validator.local"
+    smtp_mail_from: str = "probe@validator.local"
+    # Remote SMTP probe worker (spec §3.3): orchestrator and SMTP worker are
+    # separate deployments. Point this at a port-25-capable host running this
+    # same image (its POST /api/v1/smtp/probe endpoints) and every mailbox
+    # verdict flows through it. Shared secret via SMTP_WORKER_TOKEN.
+    smtp_worker_url: str = ""
+    smtp_worker_token: str = ""
+    smtp_worker_timeout: int = 15
+    # Circuit breaker: after this many consecutive direct-SMTP connection
+    # failures (blocked egress), fail fast for `smtp_cooldown_seconds` instead
+    # of burning the full timeout on every address.
+    smtp_fail_threshold: int = 3
+    smtp_cooldown_seconds: int = 300
+    # Catch-all is a domain property — cache the verdict for 72h so a bulk list
+    # does not re-probe the same domain for every address.
+    catch_all_ttl_seconds: int = 72 * 3600
+    # DNS/MX answers change slowly; a definitive mailbox verdict is stable for
+    # about a day. Transient failures are never cached regardless of TTL.
+    dns_cache_ttl_seconds: int = 24 * 3600
+    # Per-MX-host SMTP session cap and global concurrency for bulk runs.
+    max_connections_per_host: int = 2
+    bulk_concurrency: int = 20
+
+    # --- DNS-over-HTTPS worker (spec §3.2) ---
+    # MX resolution over free public DoH resolvers (Google + Cloudflare) with a
+    # dual-resolver consistency check. Legacy dnspython stays as fallback.
+    doh_enabled: bool = True
+    doh_timeout: int = 5
+
+    # --- AI Risk Scorer (spec §3.4 — the ONLY metered component) ---
+    # Hugging Face Inference API text-classification model id. Empty disables
+    # remote inference entirely (the rule-based heuristic then scores every
+    # ambiguous address at zero marginal cost). Configured, never hard-coded.
+    ai_scorer_model: str = ""
+    ai_scorer_timeout: int = 12
+    # Zero-shot mode: candidate labels ARE the risk taxonomy — works with any
+    # served NLI model (e.g. facebook/bart-large-mnli) on the Inference API.
+    ai_scorer_zero_shot: bool = False
+    hf_inference_token: str = ""    # falls back to ml_hf_token when empty
+    ai_circuit_fail_threshold: int = 3
+    ai_circuit_cooldown_seconds: int = 300
+
+    # --- DistilBERT email-risk signal (advisory, unknown domains only) ---
+    # OFF by default: with the flag off the engine's behaviour is identical to
+    # the pre-ML build. The model is a private HF repo trained on the engine's
+    # own blocklists (see app/ml/). Promotion from advisory to blocking requires
+    # measured DISPOSABLE precision >= 0.98 (app/ml/train.py reports it).
+    ml_disposable_enabled: bool = False
+    ml_model_repo: str = ""
+    ml_batch_size: int = 64
+    ml_score_penalty: int = 5
+    ml_hf_token: str = ""
+
+    # Run-quality monitor (report item 10): alert when >= this share of a bulk
+    # run comes back risky/unknown/error — the signature of a systemic failure
+    # (dead provider, blocked egress, engine regression). 0 disables it.
+    risky_rate_alert_threshold: float = 0.5
+
+    # Celery
+    celery_broker_url: str = "redis://localhost:6379/1"
+    celery_result_backend: str = "redis://localhost:6379/2"
+
+    # Supabase (Postgres + PostgREST)
+    supabase_url: str = ""
+    supabase_anon_key: str = ""
+    supabase_service_role_key: str = ""
+    enable_db_persistence: bool = True
+
+    # Central billing gate: "true" enforces Supabase JWT + active license
+    # (modul-x directly, via combo-validate-send, or via combo-full-bridge)
+    # on every paid API route. Anything else = open demo mode.
+    license_enforcement: str = ""
+
+    @model_validator(mode="after")
+    def validate_production_settings(self) -> "Settings":
+        if self.app_environment.strip().casefold() != "production":
+            return self
+
+        problems = []
+        if self.debug:
+            problems.append("DEBUG must be false")
+        if self.license_enforcement.strip().casefold() != "true":
+            problems.append("LICENSE_ENFORCEMENT must be true")
+        if not self.supabase_configured:
+            problems.append("SUPABASE_URL and SUPABASE_SERVICE_ROLE_KEY are required")
+        elif not _is_https_origin(self.supabase_url):
+            problems.append("SUPABASE_URL must be an HTTPS URL")
+        if not self.cors_origins or not all(
+            _is_https_origin(origin) for origin in self.cors_origins
+        ):
+            problems.append("CORS_ORIGINS must contain only HTTPS origins")
+
+        if problems:
+            raise ValueError("Unsafe production configuration: " + "; ".join(problems))
+        return self
+
+    @property
+    def supabase_configured(self) -> bool:
+        return bool(self.supabase_url and self.supabase_service_role_key)
+
+
+settings = Settings()

app/main.py

@@ -1,186 +1,186 @@
-from fastapi import FastAPI, Request
-from fastapi.middleware.cors import CORSMiddleware
-from fastapi.responses import JSONResponse
-from slowapi import Limiter, _rate_limit_exceeded_handler
-from slowapi.util import get_remote_address
-from slowapi.errors import RateLimitExceeded
-from contextlib import asynccontextmanager
-import asyncio
-import time
-
-from .config import settings
-from .api.routes import router
-from .auth import license_middleware
-from .utils.logger import setup_logging
-from .db import repo
-
-# Setup structured logging
-setup_logging()
-
-# Rate limiter
-limiter = Limiter(key_func=get_remote_address)
-
-
-@asynccontextmanager
-async def lifespan(app: FastAPI):
-    """Startup and shutdown events."""
-    print(f"BRIDGE Modul - X v{settings.app_version} starting up...")
-    # Verify Supabase connectivity at boot (best-effort, never fatal)
-    if settings.supabase_configured:
-        try:
-            status = await repo.db_status()
-            if status.get("reachable"):
-                print(f"[DB] Supabase reachable — tables_ready={status.get('tables_ready')}")
-                if not status.get("tables_ready"):
-                    print("[DB] WARNING: run supabase/schema.sql in the Supabase SQL editor "
-                          "to create the tables.")
-            else:
-                print(f"[DB] WARNING: Supabase not reachable — {status.get('detail')}")
-        except Exception as exc:  # pragma: no cover - defensive
-            print(f"[DB] WARNING: DB check failed — {exc}")
-    else:
-        print("[DB] Supabase not configured — persistence disabled (see .env.example)")
-
-    # Port-25 egress preflight: mailbox verification cannot work without it, so
-    # report it at boot instead of letting operators discover it from a wall of
-    # "smtp_unreachable" results. Best-effort and never fatal.
-    try:
-        from .validator.egress import preflight_or_warn
-
-        await asyncio.to_thread(preflight_or_warn)
-    except Exception as exc:  # pragma: no cover - defensive
-        print(f"[EGRESS] preflight skipped — {exc}")
-
-    # Greylist retry-queue drain loop (in-process — the Space runs no Celery
-    # beat, so without this the queue would fill forever and greylisted
-    # mailboxes would stay permanently risky). Fail-open, never fatal.
-    drain_task = None
-    try:
-        from .tasks.drain_loop import DrainLoop
-        from .validator.engine import engine as _engine
-
-        async def _prober(email: str, mx_host: str):
-            return await _engine.mailbox.verify(email, mx_host)
-
-        loop = DrainLoop(prober=_prober, interval_seconds=300)
-        drain_task = asyncio.create_task(loop.start())
-        print("[RETRY] drain loop started (every 300s)")
-    except Exception as exc:  # pragma: no cover - defensive
-        print(f"[RETRY] drain loop skipped — {exc}")
-
-    # Warm the advisory model at startup: the first request otherwise pays the
-    # torch + checkpoint load (measured 42.6s cold start) even though inference
-    # now runs off the event loop. Fail-open and never fatal.
-    try:
-        from .ml.runtime import get_model_async
-
-        model = await get_model_async()
-        if model is not None and getattr(model, "loaded", False):
-            print("[ML] advisory model preloaded")
-        else:
-            print("[ML] advisory model unavailable - deterministic mode")
-    except Exception as exc:  # pragma: no cover - defensive
-        print(f"[ML] preload skipped — {exc}")
-
-    yield
-
-    if drain_task is not None:
-        drain_task.cancel()
-    print("BRIDGE Modul - X shutting down...")
-
-
-# Create FastAPI app
-app = FastAPI(
-    title=settings.app_name,
-    description="""
-BRIDGE Modul - X — 7-Layer Email Validation Engine.
-
-Features:
-- Layer 1 — RFC 5321/5322 Syntax Validation
-- Layer 2 — DNS Domain Existence Check
-- Layer 3 — MX Record Verification
-- Layer 4 — Disposable/Role-Based/Free Provider Detection
-- Layer 5 — Catch-All Domain Detection
-- Layer 6 — SMTP Mailbox Verification (with proxy support)
-- Layer 7 — Deliverability Scoring & Risk Assessment
-
-Provider support: Gmail, Outlook, Yahoo, iCloud, ProtonMail, Zoho, 100K+ domains
-    """,
-    version=settings.app_version,
-    docs_url="/docs",
-    redoc_url="/redoc",
-    lifespan=lifespan
-)
-
-# ---- Middleware -----------------------------------------------------
-app.state.limiter = limiter
-app.add_exception_handler(RateLimitExceeded, _rate_limit_exceeded_handler)
-
-app.add_middleware(
-    CORSMiddleware,
-    allow_origins=settings.cors_origins,
-    allow_credentials=True,
-    allow_methods=["*"],
-    allow_headers=["*"],
-    expose_headers=["X-Process-Time"]
-)
-
-
-@app.middleware("http")
-async def add_process_time_header(request: Request, call_next):
-    start_time = time.monotonic()
-    response = await call_next(request)
-    process_time = (time.monotonic() - start_time) * 1000
-    response.headers["X-Process-Time"] = f"{process_time:.2f}ms"
-    return response
-
-
-# Central Supabase JWT + license gate for paid API routes.
-# /api/v1/health and /api/health stay open (HF + website productApi probe).
-# No-op while LICENSE_ENFORCEMENT != "true" (demo mode). See app/auth.py.
-@app.middleware("http")
-async def license_gate(request: Request, call_next):
-    return await license_middleware(request, call_next)
-
-
-# Global error handler
-@app.exception_handler(Exception)
-async def global_exception_handler(request: Request, exc: Exception):
-    return JSONResponse(
-        status_code=500,
-        content={
-            "error": "Internal server error",
-            "detail": str(exc) if settings.debug else "Contact support"
-        }
-    )
-
-
-# ---- Include Routes -------------------------------------------------
-app.include_router(router, prefix="/api/v1")
-
-
-# ---- Health alias for the website productApi probe -------------------
-# productApi tries GET <backend>/api/health then /health. The versioned
-# route lives at /api/v1/health; this alias keeps the standard probe path
-# working (stays open via the license_gate allow-list in app/auth.py).
-@app.get("/api/health", tags=["System"])
-async def api_health_alias():
-    import time as _time
-
-    return {
-        "status": "healthy",
-        "app": settings.app_name,
-        "version": settings.app_version,
-        "timestamp": _time.time(),
-    }
-
-
-# ---- Root -----------------------------------------------------------
-@app.get("/")
-async def root():
-    return {
-        "app": settings.app_name,
-        "version": settings.app_version,
-        "docs": "/docs",
-        "health": "/api/v1/health"
-    }
+from fastapi import FastAPI, Request
+from fastapi.middleware.cors import CORSMiddleware
+from fastapi.responses import JSONResponse
+from slowapi import Limiter, _rate_limit_exceeded_handler
+from slowapi.util import get_remote_address
+from slowapi.errors import RateLimitExceeded
+from contextlib import asynccontextmanager
+import asyncio
+import time
+
+from .config import settings
+from .api.routes import router
+from .auth import license_middleware
+from .utils.logger import setup_logging
+from .db import repo
+
+# Setup structured logging
+setup_logging()
+
+# Rate limiter
+limiter = Limiter(key_func=get_remote_address)
+
+
+@asynccontextmanager
+async def lifespan(app: FastAPI):
+    """Startup and shutdown events."""
+    print(f"BRIDGE Modul - X v{settings.app_version} starting up...")
+    # Verify Supabase connectivity at boot (best-effort, never fatal)
+    if settings.supabase_configured:
+        try:
+            status = await repo.db_status()
+            if status.get("reachable"):
+                print(f"[DB] Supabase reachable — tables_ready={status.get('tables_ready')}")
+                if not status.get("tables_ready"):
+                    print("[DB] WARNING: run supabase/schema.sql in the Supabase SQL editor "
+                          "to create the tables.")
+            else:
+                print(f"[DB] WARNING: Supabase not reachable — {status.get('detail')}")
+        except Exception as exc:  # pragma: no cover - defensive
+            print(f"[DB] WARNING: DB check failed — {exc}")
+    else:
+        print("[DB] Supabase not configured — persistence disabled (see .env.example)")
+
+    # Port-25 egress preflight: mailbox verification cannot work without it, so
+    # report it at boot instead of letting operators discover it from a wall of
+    # "smtp_unreachable" results. Best-effort and never fatal.
+    try:
+        from .validator.egress import preflight_or_warn
+
+        await asyncio.to_thread(preflight_or_warn)
+    except Exception as exc:  # pragma: no cover - defensive
+        print(f"[EGRESS] preflight skipped — {exc}")
+
+    # Greylist retry-queue drain loop (in-process — the Space runs no Celery
+    # beat, so without this the queue would fill forever and greylisted
+    # mailboxes would stay permanently risky). Fail-open, never fatal.
+    drain_task = None
+    try:
+        from .tasks.drain_loop import DrainLoop
+        from .validator.engine import engine as _engine
+
+        async def _prober(email: str, mx_host: str):
+            return await _engine.mailbox.verify(email, mx_host)
+
+        loop = DrainLoop(prober=_prober, interval_seconds=300)
+        drain_task = asyncio.create_task(loop.start())
+        print("[RETRY] drain loop started (every 300s)")
+    except Exception as exc:  # pragma: no cover - defensive
+        print(f"[RETRY] drain loop skipped — {exc}")
+
+    # Warm the advisory model at startup: the first request otherwise pays the
+    # torch + checkpoint load (measured 42.6s cold start) even though inference
+    # now runs off the event loop. Fail-open and never fatal.
+    try:
+        from .ml.runtime import get_model_async
+
+        model = await get_model_async()
+        if model is not None and getattr(model, "loaded", False):
+            print("[ML] advisory model preloaded")
+        else:
+            print("[ML] advisory model unavailable - deterministic mode")
+    except Exception as exc:  # pragma: no cover - defensive
+        print(f"[ML] preload skipped — {exc}")
+
+    yield
+
+    if drain_task is not None:
+        drain_task.cancel()
+    print("BRIDGE Modul - X shutting down...")
+
+
+# Create FastAPI app
+app = FastAPI(
+    title=settings.app_name,
+    description="""
+BRIDGE Modul - X — 7-Layer Email Validation Engine.
+
+Features:
+- Layer 1 — RFC 5321/5322 Syntax Validation
+- Layer 2 — DNS Domain Existence Check
+- Layer 3 — MX Record Verification
+- Layer 4 — Disposable/Role-Based/Free Provider Detection
+- Layer 5 — Catch-All Domain Detection
+- Layer 6 — SMTP Mailbox Verification (with proxy support)
+- Layer 7 — Deliverability Scoring & Risk Assessment
+
+Provider support: Gmail, Outlook, Yahoo, iCloud, ProtonMail, Zoho, 100K+ domains
+    """,
+    version=settings.app_version,
+    docs_url="/docs",
+    redoc_url="/redoc",
+    lifespan=lifespan
+)
+
+# ---- Middleware -----------------------------------------------------
+app.state.limiter = limiter
+app.add_exception_handler(RateLimitExceeded, _rate_limit_exceeded_handler)
+
+app.add_middleware(
+    CORSMiddleware,
+    allow_origins=settings.cors_origins,
+    allow_credentials=True,
+    allow_methods=["*"],
+    allow_headers=["*"],
+    expose_headers=["X-Process-Time"]
+)
+
+
+@app.middleware("http")
+async def add_process_time_header(request: Request, call_next):
+    start_time = time.monotonic()
+    response = await call_next(request)
+    process_time = (time.monotonic() - start_time) * 1000
+    response.headers["X-Process-Time"] = f"{process_time:.2f}ms"
+    return response
+
+
+# Central Supabase JWT + license gate for paid API routes.
+# /api/v1/health and /api/health stay open (HF + website productApi probe).
+# No-op while LICENSE_ENFORCEMENT != "true" (demo mode). See app/auth.py.
+@app.middleware("http")
+async def license_gate(request: Request, call_next):
+    return await license_middleware(request, call_next)
+
+
+# Global error handler
+@app.exception_handler(Exception)
+async def global_exception_handler(request: Request, exc: Exception):
+    return JSONResponse(
+        status_code=500,
+        content={
+            "error": "Internal server error",
+            "detail": str(exc) if settings.debug else "Contact support"
+        }
+    )
+
+
+# ---- Include Routes -------------------------------------------------
+app.include_router(router, prefix="/api/v1")
+
+
+# ---- Health alias for the website productApi probe -------------------
+# productApi tries GET <backend>/api/health then /health. The versioned
+# route lives at /api/v1/health; this alias keeps the standard probe path
+# working (stays open via the license_gate allow-list in app/auth.py).
+@app.get("/api/health", tags=["System"])
+async def api_health_alias():
+    import time as _time
+
+    return {
+        "status": "healthy",
+        "app": settings.app_name,
+        "version": settings.app_version,
+        "timestamp": _time.time(),
+    }
+
+
+# ---- Root -----------------------------------------------------------
+@app.get("/")
+async def root():
+    return {
+        "app": settings.app_name,
+        "version": settings.app_version,
+        "docs": "/docs",
+        "health": "/api/v1/health"
+    }

app/ml/hf_scorer.py

@@ -0,0 +1,420 @@
+"""AI Risk Scorer — the single metered layer of the autonomous engine.
+
+Architecture spec §3.4 / Phase 4 / Phase 6:
+
+- Invoked ONLY for addresses the deterministic gauntlet left genuinely
+  ambiguous: catch-all domains and unknown/inconclusive SMTP outcomes. Every
+  deterministic-first address never reaches this module (target burn rate
+  < 5% of verifications, instrumented here).
+- Primary path: Hugging Face Inference API (the PRO account's expanded rate
+  limits / inference credits). The model identifier is CONFIGURED, never
+  hard-coded (§5.3), and the feature string carries domain + SMTP metadata
+  only — never the full address (PII minimization, §7.4).
+- Circuit breaker: consecutive 429 / 5xx / transport failures open the circuit
+  for a cooldown; an exhausted-quota or invalid-token signal opens it
+  immediately. While open, the scorer falls back to the local rule-based
+  heuristic and marks every verdict `fallback_used=True` (scored_fallback) —
+  a degraded engine must never starve the pipeline (§2.3).
+- Heuristic fallback: deterministic feature rules (MX platform identity,
+  SMTP response class, catch-all flag, local-part entropy/role patterns).
+  It returns a probability, not a certainty (§5.2) — the engine never collapses
+  a catch-all into "valid" on the strength of a low score alone.
+
+All counters live in `metrics` (process-local, exposed via /metrics/inference).
+"""
+from __future__ import annotations
+
+import asyncio
+import hashlib
+import json
+import re
+import time
+from dataclasses import dataclass, field
+from typing import Any, Optional
+
+import httpx
+
+from ..config import settings
+
+LOW_RISK = "low_risk"
+MEDIUM_RISK = "medium_risk"
+HIGH_RISK = "high_risk"
+
+# Spec Phase 6: alert when the economics stop holding.
+BURN_RATE_TARGET = 0.05
+CATCH_ALL_BURN_ALERT = 0.15
+
+# Label synonyms accepted from a configured text-classification model.
+_HIGH_LABELS = {"high", "high_risk", "risky", "bad", "toxic", "spam", "disposable", "label_2"}
+_MEDIUM_LABELS = {"medium", "medium_risk", "unknown", "catch_all", "label_1"}
+_LOW_LABELS = {"low", "low_risk", "good", "ham", "safe", "valid", "ok", "label_0"}
+
+_ROLE_PATTERN = re.compile(
+    r"^(admin|administrator|info|support|sales|contact|help|billing|noreply"
+    r"|no-reply|donotreply|webmaster|postmaster|hostmaster|office|team|mail)"
+    r"([.+_-].*)?$",
+    re.IGNORECASE,
+)
+_NUMERIC_PATTERN = re.compile(r"^\+?\d[\d\-_.]{3,}$")
+_GIBBERISH_PATTERN = re.compile(r"^[a-z0-9]{1,3}[0-9]{4,}$|^[a-z]{1,2}[0-9]{6,}$", re.IGNORECASE)
+
+_TRUSTED_MX_TOKENS = (
+    "google", "googlemail", "outlook", "hotmail", "microsoft", "protection.outlook",
+    "yahoo", "yahoodns", "icloud", "apple", "protonmail", "proton", "zoho",
+    "yandex", "mail.ru", "mimecast", "proofpoint", "barracuda", "pphosted",
+    "messagelabs", "symantec",
+)
+
+
+def _label_risk(label: str, confidence: float) -> Optional[float]:
+    """Map a model label to a 0..1 risk score. None = unmappable."""
+    l = (label or "").strip().lower()
+    if l in _HIGH_LABELS:
+        return max(0.7, float(confidence))
+    if l in _MEDIUM_LABELS:
+        return max(0.4, min(0.69, float(confidence)))
+    if l in _LOW_LABELS:
+        return max(0.0, min(0.39, 1.0 - float(confidence)))
+    return None
+
+
+def _risk_from_payload(data: Any) -> Optional[float]:
+    """Blend mapped label risks from either response shape.
+
+    text-classification: [[{"label", "score"}, ...]] or [{...}]
+    zero-shot:          {"labels": [...], "scores": [...]}
+    Most-specific label wins with a 0.6/0.4 recency blend.
+    """
+    pairs: list[tuple[str, float]] = []
+    if isinstance(data, dict) and data.get("labels"):
+        labels = data.get("labels") or []
+        scores = data.get("scores") or []
+        pairs = [
+            (str(l), float(s or 0)) for l, s in zip(labels, scores)
+            if isinstance(l, str) and isinstance(s, (int, float))
+        ]
+    elif isinstance(data, list):
+        rows = data
+        flat = rows[0] if rows and isinstance(rows[0], list) else rows
+        if not flat or not isinstance(flat, list):
+            return None
+        for entry in flat:
+            if isinstance(entry, dict):
+                pairs.append(
+                    (str(entry.get("label", "")), float(entry.get("score", 0) or 0))
+                )
+
+    weighted_num = 0.0
+    weighted_den = 0.0
+    for label, confidence in pairs:
+        score = _label_risk(label, confidence)
+        if score is not None:
+            weighted_num += score * confidence
+            weighted_den += confidence
+    if weighted_den <= 0.0:
+        return None
+    # Probability-weighted expectation over the mapped risk labels.
+    return weighted_num / weighted_den
+
+
+def label_for_score(score: float) -> str:
+    if score < 0.4:
+        return LOW_RISK
+    if score < 0.7:
+        return MEDIUM_RISK
+    return HIGH_RISK
+
+
+@dataclass
+class AIScore:
+    score: float
+    label: str
+    source: str          # "inference" | "heuristic"
+    fallback_used: bool
+    detail: str = ""
+
+
+@dataclass
+class _CircuitBreaker:
+    fail_threshold: int
+    cooldown_seconds: float
+    consecutive_failures: int = 0
+    open_until: float = 0.0
+    open_reason: str = ""
+    permanently_open: bool = False
+
+    @property
+    def is_open(self) -> bool:
+        if self.permanently_open:
+            return True
+        return time.monotonic() < self.open_until
+
+    def record_failure(self, reason: str = "") -> None:
+        self.consecutive_failures += 1
+        self.open_reason = reason
+        if self.consecutive_failures >= self.fail_threshold:
+            self.open_until = time.monotonic() + self.cooldown_seconds
+
+    def record_quota_or_auth_failure(self, reason: str) -> None:
+        """429-with-quota / 401 / 403 — retrying sooner cannot help."""
+        self.permanently_open = True
+        self.open_reason = reason
+        self.open_until = float("inf")
+
+    def record_success(self) -> None:
+        self.consecutive_failures = 0
+        self.open_until = 0.0
+        self.open_reason = ""
+
+
+@dataclass
+class ScorerMetrics:
+    verifications: int = 0
+    inference_calls: int = 0
+    heuristic_calls: int = 0
+    fallback_events: int = 0
+    circuit_opens: int = 0
+    last_error: str = ""
+    last_latency_ms: float = 0.0
+    last_used_at: float = 0.0
+    recent_domains: list = field(default_factory=list)
+
+    def as_dict(self) -> dict:
+        burn = (
+            self.inference_calls / self.verifications
+            if self.verifications
+            else 0.0
+        )
+        return {
+            "verifications_scored": self.verifications,
+            "inference_calls": self.inference_calls,
+            "heuristic_calls": self.heuristic_calls,
+            "fallback_events": self.fallback_events,
+            "circuit_opens": self.circuit_opens,
+            "burn_rate": round(burn, 4),
+            "burn_rate_target": BURN_RATE_TARGET,
+            "burn_rate_ok": burn <= BURN_RATE_TARGET,
+            "burn_alert": burn > CATCH_ALL_BURN_ALERT,
+            "last_error": self.last_error,
+            "last_latency_ms": round(self.last_latency_ms, 1),
+        }
+
+
+class AIRiskScorer:
+    """Pattern-based deliverability risk classifier (not an oracle, §5.2)."""
+
+    def __init__(
+        self,
+        model: Optional[str] = None,
+        token: Optional[str] = None,
+        timeout: Optional[float] = None,
+        fail_threshold: Optional[int] = None,
+        cooldown: Optional[float] = None,
+    ):
+        self.model = model if model is not None else settings.ai_scorer_model
+        self.token = (
+            token
+            if token is not None
+            else (settings.hf_inference_token or settings.ml_hf_token)
+        )
+        self.timeout = timeout if timeout is not None else settings.ai_scorer_timeout
+        self.breaker = _CircuitBreaker(
+            fail_threshold=(
+                fail_threshold
+                if fail_threshold is not None
+                else settings.ai_circuit_fail_threshold
+            ),
+            cooldown_seconds=(
+                cooldown if cooldown is not None else settings.ai_circuit_cooldown_seconds
+            ),
+        )
+        self.metrics = ScorerMetrics()
+
+    # ---- feature string (domain + SMTP metadata only, never the address) ----
+    @staticmethod
+    def build_features(
+        *,
+        domain: str,
+        mx_host: str | None,
+        smtp_class: str,
+        catch_all: bool | None,
+        local_part: str = "",
+        dns_inconsistent: bool = False,
+    ) -> str:
+        local_shape = "normal"
+        if local_part:
+            if _ROLE_PATTERN.match(local_part):
+                local_shape = "role"
+            elif _NUMERIC_PATTERN.match(local_part) or _GIBBERISH_PATTERN.match(local_part):
+                local_shape = "high_entropy"
+        mx_identity = (mx_host or "none").lower()
+        trusted = any(t in mx_identity for t in _TRUSTED_MX_TOKENS)
+        mx_class = "trusted_platform" if trusted else "other"
+        return (
+            f"domain={domain} mx={mx_class} smtp={smtp_class} "
+            f"catch_all={'yes' if catch_all else ('no' if catch_all is False else 'unknown')} "
+            f"local={local_shape} dns_consistent={'no' if dns_inconsistent else 'yes'}"
+        )
+
+    # ---- heuristic fallback (deterministic, always available) ---------------
+    def heuristic(self, features: str) -> AIScore:
+        risk = 0.35  # ambiguous-but-alive baseline (spec: risky bucket territory)
+        if "smtp=4xx" in features:
+            risk = 0.52  # greylist / temporary — genuinely undetermined
+        elif "smtp=unavailable" in features or "smtp=transport_error" in features:
+            risk = 0.48
+        elif "smtp=accept" in features:
+            risk = 0.42
+        if "catch_all=yes" in features:
+            risk += 0.12
+        if "catch_all=unknown" in features:
+            risk += 0.05
+        if "mx=trusted_platform" in features:
+            risk -= 0.15
+        if "local=role" in features:
+            risk += 0.05
+        if "local=high_entropy" in features:
+            risk += 0.08
+        if "dns_consistent=no" in features:
+            risk += 0.1
+        score = round(max(0.0, min(1.0, risk)), 3)
+        return AIScore(
+            score=score,
+            label=label_for_score(score),
+            source="heuristic",
+            fallback_used=True,
+            detail="rule-based fallback (circuit open or inference disabled)",
+        )
+
+    # ---- Hugging Face Inference API ----------------------------------------
+    def _inference_configured(self) -> bool:
+        return bool(self.model and self.token)
+
+    async def _infer(self, features: str) -> AIScore:
+        """One HF Inference API call. Raises on any failure (caller decides)."""
+        url = f"https://router.huggingface.co/hf-inference/models/{self.model}"
+        if settings.ai_scorer_zero_shot:
+            # Zero-shot NLI classification: the candidate labels ARE the risk
+            # taxonomy, so any served NLI model can score the feature string.
+            payload = {
+                "inputs": features,
+                "parameters": {
+                    "candidate_labels": ["low_risk", "medium_risk", "high_risk"],
+                    "multi_label": False,
+                },
+            }
+        else:
+            payload = {"inputs": features, "parameters": {"top_k": 3}}
+        headers = {"Authorization": f"Bearer {self.token}"}
+        started = time.monotonic()
+        async with httpx.AsyncClient(timeout=self.timeout) as client:
+            resp = await client.post(url, json=payload, headers=headers)
+        self.metrics.last_latency_ms = (time.monotonic() - started) * 1000
+
+        if resp.status_code in (401, 403):
+            raise _QuotaOrAuthError(f"inference auth failed: HTTP {resp.status_code}")
+        if resp.status_code in (402,):
+            # Payment required: PRO inference credits exhausted. Retrying
+            # cannot help until credits reset — open the breaker permanently.
+            raise _QuotaOrAuthError(
+                f"inference quota exhausted: HTTP 402 {resp.text[:150]}"
+            )
+        if resp.status_code == 429:
+            body = resp.text[:200]
+            if "quota" in body.lower() or "credit" in body.lower():
+                raise _QuotaOrAuthError(f"inference quota exhausted: {body}")
+            raise _TransientInferenceError("rate limited: HTTP 429")
+        if resp.status_code >= 400:
+            raise _TransientInferenceError(f"inference HTTP {resp.status_code}: {resp.text[:200]}")
+
+        data = resp.json()
+        risk = _risk_from_payload(data)
+        if risk is None:
+            raise _TransientInferenceError("inference: unmappable labels")
+        risk = round(max(0.0, min(1.0, risk)), 3)
+        return AIScore(
+            score=risk,
+            label=label_for_score(risk),
+            source="inference",
+            fallback_used=False,
+            detail=f"model={self.model}",
+        )
+
+    # ---- public API ---------------------------------------------------------
+    async def score(self, features: str) -> AIScore:
+        """Score one feature string. Never raises — degrades to the heuristic."""
+        self.metrics.verifications += 1
+
+        if not self._inference_configured() or self.breaker.is_open:
+            out = self.heuristic(features)
+            self.metrics.heuristic_calls += 1
+            if self._inference_configured() and self.breaker.is_open:
+                self.metrics.fallback_events += 1
+            return out
+
+        try:
+            out = await self._infer(features)
+        except _QuotaOrAuthError as exc:
+            self.metrics.last_error = str(exc)
+            self.breaker.record_quota_or_auth_failure(str(exc))
+            self.metrics.circuit_opens += 1
+            self.metrics.fallback_events += 1
+            self.metrics.heuristic_calls += 1
+            return self.heuristic(features)
+        except (_TransientInferenceError, Exception) as exc:
+            self.metrics.last_error = str(exc)[:300]
+            was_open = self.breaker.is_open
+            self.breaker.record_failure(str(exc)[:120])
+            if not was_open and self.breaker.is_open:
+                self.metrics.circuit_opens += 1
+            self.metrics.fallback_events += 1
+            self.metrics.heuristic_calls += 1
+            return self.heuristic(features)
+
+        self.breaker.record_success()
+        self.metrics.inference_calls += 1
+        self.metrics.last_used_at = time.time()
+        if len(self.metrics.recent_domains) < 50:
+            self.metrics.recent_domains.append(
+                hashlib.sha1(features.encode()).hexdigest()[:10]
+            )
+        return out
+
+    def status(self) -> dict:
+        return {
+            "enabled": self._inference_configured(),
+            "model": self.model or None,
+            "circuit": {
+                "open": self.breaker.is_open,
+                "permanently_open": self.breaker.permanently_open,
+                "consecutive_failures": self.breaker.consecutive_failures,
+                "open_reason": self.breaker.open_reason,
+                "cooldown_seconds": self.breaker.cooldown_seconds,
+            },
+            "metrics": self.metrics.as_dict(),
+        }
+
+
+class _QuotaOrAuthError(Exception):
+    pass
+
+
+class _TransientInferenceError(Exception):
+    pass
+
+
+# Singleton used by the engine.
+ai_scorer = AIRiskScorer()
+
+
+async def score_many_by_domain(
+    scorer: AIRiskScorer, feature_by_domain: dict[str, str]
+) -> dict[str, AIScore]:
+    """Score a batch of domain-level feature strings concurrently."""
+    if not feature_by_domain:
+        return {}
+    keys = list(feature_by_domain.keys())
+    scores = await asyncio.gather(
+        *(scorer.score(feature_by_domain[k]) for k in keys)
+    )
+    return dict(zip(keys, scores))

app/models.py

@@ -1,141 +1,163 @@
-from pydantic import BaseModel, field_validator
-from typing import Optional, List, Dict, Any
-from enum import Enum
-
-
-# ---- Enums -----------------------------------------------------------
-class ValidationStatus(str, Enum):
-    VALID   = "valid"
-    INVALID = "invalid"
-    RISKY   = "risky"
-    UNKNOWN = "unknown"
-
-
-class RiskLevel(str, Enum):
-    LOW    = "low"
-    MEDIUM = "medium"
-    HIGH   = "high"
-
-
-# ---- Layer Results ----------------------------------------------------
-class SyntaxResult(BaseModel):
-    passed: bool
-    normalized_email: Optional[str] = None
-    local_part: Optional[str] = None
-    domain: Optional[str] = None
-    error: Optional[str] = None
-
-
-class DNSResult(BaseModel):
-    domain_exists: bool
-    has_mx_records: bool
-    mx_records: List[Dict[str, Any]] = []
-    a_fallback: bool = False
-    has_spf: bool = False
-    spf_record: Optional[str] = None
-    has_dmarc: bool = False
-    dmarc_record: Optional[str] = None
-    has_dkim: bool = False
-    error: Optional[str] = None
-    error_code: Optional[str] = None
-
-
-class DisposableResult(BaseModel):
-    is_disposable: bool
-    is_free_provider: bool
-    is_role_based: bool
-    provider_name: Optional[str] = None
-    # Advisory ML signal (DistilBERT, unknown domains only). Never a verdict:
-    # the deterministic layer remains the source of truth until the measured
-    # precision gate promotes the model (see app/ml/).
-    ml_label: Optional[str] = None
-    ml_confidence: Optional[float] = None
-
-
-class CatchAllResult(BaseModel):
-    # None = the catch-all probe could not run (e.g. port-25 egress blocked on
-    # this host). It must NEVER be coerced to False, which would falsely claim
-    # "domain rejects unknown recipients".
-    is_catch_all: Optional[bool] = None
-    confidence: float = 0.0
-    error: Optional[str] = None
-
-
-class SMTPResult(BaseModel):
-    verified: Optional[bool] = None
-    smtp_code: Optional[int] = None
-    smtp_message: Optional[str] = None
-    server_banner: Optional[str] = None
-    supports_tls: bool = False
-    error: Optional[str] = None
-    via_proxy: bool = False
-
-
-class ScoringResult(BaseModel):
-    score: int
-    risk_level: RiskLevel
-    breakdown: Dict[str, int] = {}
-    warnings: List[str] = []
-
-
-# ---- Main Response ----------------------------------------------------
-class ValidationResult(BaseModel):
-    email: str
-    status: ValidationStatus
-    syntax: SyntaxResult
-    dns: Optional[DNSResult] = None
-    disposable: Optional[DisposableResult] = None
-    catch_all: Optional[CatchAllResult] = None
-    smtp: Optional[SMTPResult] = None
-    scoring: ScoringResult
-    processing_time_ms: float
-    validated_at: str
-    # Provenance the frontend contract expects (src/lib/verifier.ts classify()).
-    # checks_run lists the 7-layer taxonomy keys that actually executed; an
-    # unchecked layer must never read as a pass. reason_code is a machine cause
-    # for Unknown/risky rows. run_id correlates a single + its bulk chunk.
-    checks_run: List[str] = []
-    reason_code: Optional[str] = None
-    run_id: Optional[str] = None
-    validator_version: Optional[str] = None
-
-
-class SingleEmailRequest(BaseModel):
-    email: str
-
-    @field_validator("email")
-    @classmethod
-    def strip_email(cls, v: str) -> str:
-        return v.strip().lower()
-
-
-class BulkEmailRequest(BaseModel):
-    emails: List[str]
-    webhook_url: Optional[str] = None
-    # Product promise: bulk runs the SAME 7-layer pipeline as single (1 credit
-    # per email). deep=False skips catch-all + SMTP, which collapsed every bulk
-    # row to "Unknown / insufficient depth" — so it defaults to True and is only
-    # flipped off by an explicit caller that accepts the reduced verdict.
-    deep: bool = True
-
-    @field_validator("emails")
-    @classmethod
-    def limit_emails(cls, v: List[str]) -> List[str]:
-        if len(v) > 10000:
-            raise ValueError("Max 10,000 emails per bulk request")
-        return [e.strip().lower() for e in v]
-
-
-class BulkValidationResponse(BaseModel):
-    task_id: str
-    status: str
-    total: int
-    message: str
-
-
-class TaskStatusResponse(BaseModel):
-    task_id: str
-    status: str
-    progress: Optional[int] = None
-    total: Optional[int] = None
-    results: Optional[List[ValidationResult]] = None
+from pydantic import BaseModel, field_validator
+from typing import Optional, List, Dict, Any
+from enum import Enum
+
+
+# ---- Enums -----------------------------------------------------------
+class ValidationStatus(str, Enum):
+    VALID   = "valid"
+    INVALID = "invalid"
+    RISKY   = "risky"
+    UNKNOWN = "unknown"
+
+
+class RiskLevel(str, Enum):
+    LOW    = "low"
+    MEDIUM = "medium"
+    HIGH   = "high"
+
+
+# ---- Layer Results ----------------------------------------------------
+class SyntaxResult(BaseModel):
+    passed: bool
+    normalized_email: Optional[str] = None
+    local_part: Optional[str] = None
+    domain: Optional[str] = None
+    error: Optional[str] = None
+
+
+class DNSResult(BaseModel):
+    domain_exists: bool
+    has_mx_records: bool
+    mx_records: List[Dict[str, Any]] = []
+    a_fallback: bool = False
+    has_spf: bool = False
+    spf_record: Optional[str] = None
+    has_dmarc: bool = False
+    dmarc_record: Optional[str] = None
+    has_dkim: bool = False
+    # DoH dual-resolver signal (spec §7.3): True when Google and Cloudflare
+    # disagree on this domain's MX set — a deterministic risk signal.
+    dns_inconsistent: bool = False
+    # Which resolver layer produced the answer: "doh:dual" | "doh:primary" |
+    # "legacy" — operational provenance for /engine/status triage.
+    mx_source: Optional[str] = None
+    error: Optional[str] = None
+    error_code: Optional[str] = None
+
+
+class DisposableResult(BaseModel):
+    is_disposable: bool
+    is_free_provider: bool
+    is_role_based: bool
+    provider_name: Optional[str] = None
+    # Advisory ML signal (DistilBERT, unknown domains only). Never a verdict:
+    # the deterministic layer remains the source of truth until the measured
+    # precision gate promotes the model (see app/ml/).
+    ml_label: Optional[str] = None
+    ml_confidence: Optional[float] = None
+
+
+class CatchAllResult(BaseModel):
+    # None = the catch-all probe could not run (e.g. port-25 egress blocked on
+    # this host). It must NEVER be coerced to False, which would falsely claim
+    # "domain rejects unknown recipients".
+    is_catch_all: Optional[bool] = None
+    confidence: float = 0.0
+    error: Optional[str] = None
+
+
+class SMTPResult(BaseModel):
+    verified: Optional[bool] = None
+    smtp_code: Optional[int] = None
+    smtp_message: Optional[str] = None
+    server_banner: Optional[str] = None
+    supports_tls: bool = False
+    error: Optional[str] = None
+    via_proxy: bool = False
+
+
+class ScoringResult(BaseModel):
+    score: int
+    risk_level: RiskLevel
+    breakdown: Dict[str, int] = {}
+    warnings: List[str] = []
+
+
+# ---- Main Response ----------------------------------------------------
+class ValidationResult(BaseModel):
+    email: str
+    status: ValidationStatus
+    syntax: SyntaxResult
+    dns: Optional[DNSResult] = None
+    disposable: Optional[DisposableResult] = None
+    catch_all: Optional[CatchAllResult] = None
+    smtp: Optional[SMTPResult] = None
+    scoring: ScoringResult
+    processing_time_ms: float
+    validated_at: str
+    # Provenance the frontend contract expects (src/lib/verifier.ts classify()).
+    # checks_run lists the 7-layer taxonomy keys that actually executed; an
+    # unchecked layer must never read as a pass. reason_code is a machine cause
+    # for Unknown/risky rows. run_id correlates a single + its bulk chunk.
+    checks_run: List[str] = []
+    reason_code: Optional[str] = None
+    run_id: Optional[str] = None
+    validator_version: Optional[str] = None
+    # ---- Autonomous-engine normalized verdict (spec Phase 5) ----------------
+    # deterministic_verdict: the pre-AI verdict of the deterministic gauntlet —
+    #   "valid" | "invalid" | "catch_all" | "unknown" | "disposable".
+    # ai_risk_score / ai_label: pattern-based risk classification for the
+    #   ambiguous rows (catch-all / unknown) only; None for deterministic rows.
+    # fallback_used: the AI scorer could not reach inference and the local
+    #   rule-based heuristic decided instead ("scored_fallback" in the spec).
+    # cache_hit: served from the domain/mailbox verdict cache within TTL.
+    # INVARIANT: a catch_all is NEVER collapsed into "valid", regardless of
+    # ai_risk_score — a good score means "likely exists and engages", not
+    # "safe to send blindly".
+    deterministic_verdict: Optional[str] = None
+    ai_risk_score: Optional[float] = None
+    ai_label: Optional[str] = None
+    fallback_used: bool = False
+    cache_hit: bool = False
+
+
+class SingleEmailRequest(BaseModel):
+    email: str
+
+    @field_validator("email")
+    @classmethod
+    def strip_email(cls, v: str) -> str:
+        return v.strip().lower()
+
+
+class BulkEmailRequest(BaseModel):
+    emails: List[str]
+    webhook_url: Optional[str] = None
+    # Product promise: bulk runs the SAME 7-layer pipeline as single (1 credit
+    # per email). deep=False skips catch-all + SMTP, which collapsed every bulk
+    # row to "Unknown / insufficient depth" — so it defaults to True and is only
+    # flipped off by an explicit caller that accepts the reduced verdict.
+    deep: bool = True
+
+    @field_validator("emails")
+    @classmethod
+    def limit_emails(cls, v: List[str]) -> List[str]:
+        if len(v) > 10000:
+            raise ValueError("Max 10,000 emails per bulk request")
+        return [e.strip().lower() for e in v]
+
+
+class BulkValidationResponse(BaseModel):
+    task_id: str
+    status: str
+    total: int
+    message: str
+
+
+class TaskStatusResponse(BaseModel):
+    task_id: str
+    status: str
+    progress: Optional[int] = None
+    total: Optional[int] = None
+    results: Optional[List[ValidationResult]] = None

app/utils/cache.py

@@ -1,173 +1,173 @@
-import time
-import asyncio
-from typing import Optional
-from ..config import settings
-
-# Redis is optional at import-time so the API runs without it.
-try:
-    import redis.asyncio as aioredis
-    _HAS_REDIS = True
-except Exception:  # pragma: no cover - redis not installed
-    aioredis = None
-    _HAS_REDIS = False
-
-_redis_client: Optional[object] = None
-
-# In-memory TTL fallback cache: {key: (value, expires_at)}
-_memory_cache: dict = {}
-
-
-class CircuitBreaker:
-    """Fail fast to the in-memory cache when Redis is slow or down.
-
-    Without this, `validate_batch` pays Redis' socket timeout (~2s) on every one
-    of the ~8 cache calls it makes per row — measured at 10.0s per row on a
-    host where the Upstash link is slow, while the engine itself needs ~70ms.
-    After `failure_threshold` consecutive slow/failed ops the circuit opens and
-    calls skip Redis entirely until `cooldown_seconds` elapse, then probe once.
-    """
-
-    def __init__(self, failure_threshold: int = 3,
-                 cooldown_seconds: float = 30.0, slow_threshold: float = 1.0):
-        self.failure_threshold = failure_threshold
-        self.cooldown_seconds = cooldown_seconds
-        self.slow_threshold = slow_threshold
-        self._failures = 0
-        self._open_until = 0.0
-
-    def allow(self) -> bool:
-        """True when Redis may be contacted (closed, or cooldown elapsed)."""
-        return time.time() >= self._open_until
-
-    def record(self, success: bool, duration: float) -> None:
-        """Record one op: slow ops count as failures even when they succeed."""
-        if success and duration < self.slow_threshold:
-            self._failures = 0
-            return
-        self._failures += 1
-        if self._failures >= self.failure_threshold:
-            self._open_until = time.time() + self.cooldown_seconds
-            self._failures = 0
-
-    def reset(self) -> None:
-        self._failures = 0
-        self._open_until = 0.0
-
-
-# Trips when Redis is consistently slow/failing; see CircuitBreaker.
-_circuit = CircuitBreaker()
-
-
-async def get_redis():
-    """Lazily create a shared Redis client (returns None if unavailable).
-
-    Redis connections must be configured explicitly. Missing or unreachable
-    Redis leaves the API on its bounded in-memory cache instead of silently
-    provisioning a temporary external database.
-    """
-    global _redis_client
-    if not _HAS_REDIS:
-        return None
-    if _redis_client is None:
-        url = (settings.redis_url or "").strip()
-        if not url:
-            return None
-        try:
-            _redis_client = aioredis.from_url(
-                url,
-                encoding="utf-8",
-                decode_responses=True,
-                # The TLS handshake to Upstash measures ~750-850 ms on some
-                # networks; a 2 s cap killed the very first PING at exactly
-                # the timeout (observed live), which made every cache op pay
-                # the full budget and trip the breaker. 5 s connects reliably
-                # while the breaker still fails fast on real outages.
-                socket_connect_timeout=5,
-                socket_timeout=5,
-            )
-            await _redis_client.ping()
-        except Exception:
-            _redis_client = None
-    return _redis_client
-
-
-def _memory_get(key: str) -> Optional[str]:
-    item = _memory_cache.get(key)
-    if item is None:
-        return None
-    value, expires = item
-    if time.time() > expires:
-        _memory_cache.pop(key, None)
-        return None
-    return value
-
-
-def _memory_set(key: str, value: str, ttl: int):
-    _memory_cache[key] = (value, time.time() + ttl)
-    # keep cache bounded
-    if len(_memory_cache) > 20000:
-        now = time.time()
-        for k in [k for k, (_, exp) in _memory_cache.items() if exp < now]:
-            _memory_cache.pop(k, None)
-
-
-async def get_cache(key: str) -> Optional[str]:
-    if _circuit.allow():
-        t0 = time.perf_counter()
-        try:
-            client = await get_redis()
-            if client is not None:
-                value = await client.get(key)
-                _circuit.record(success=True, duration=time.perf_counter() - t0)
-                return value
-            # Redis is configured but get_redis() could not establish a client
-            # (connect/ping failed). Without this the 2s timeout is paid on
-            # EVERY call and the breaker never trips.
-            if (settings.redis_url or "").strip():
-                _circuit.record(success=False,
-                                duration=time.perf_counter() - t0)
-        except Exception:
-            _circuit.record(success=False, duration=time.perf_counter() - t0)
-    return _memory_get(key)
-
-
-async def set_cache(key: str, value: str, ttl: int = 86400):
-    if _circuit.allow():
-        t0 = time.perf_counter()
-        try:
-            client = await get_redis()
-            if client is not None:
-                await client.setex(key, ttl, value)
-                _circuit.record(success=True, duration=time.perf_counter() - t0)
-                return
-            if (settings.redis_url or "").strip():
-                _circuit.record(success=False,
-                                duration=time.perf_counter() - t0)
-        except Exception:
-            _circuit.record(success=False, duration=time.perf_counter() - t0)
-    _memory_set(key, value, ttl)
-
-
-async def redis_available(timeout: float = 4.0) -> bool:
-    """
-    Quick non-blocking check: can we talk to Redis?
-
-    Used to gate Celery .delay() calls so a missing Redis broker fails
-    fast instead of entering Celery's infinite reconnect/retry loop.
-    """
-    if not _HAS_REDIS:
-        return False
-    try:
-        client = await asyncio.wait_for(
-            get_redis(), timeout=timeout
-        )
-        if client is None:
-            return False
-        await asyncio.wait_for(client.ping(), timeout=timeout)
-        return True
-    except asyncio.TimeoutError:
-        print("[REDIS] Connection timeout - Redis may not be running")
-        return False
-    except Exception as e:
-        print(f"[REDIS] Connection failed: {str(e)}")
-        return False
+import time
+import asyncio
+from typing import Optional
+from ..config import settings
+
+# Redis is optional at import-time so the API runs without it.
+try:
+    import redis.asyncio as aioredis
+    _HAS_REDIS = True
+except Exception:  # pragma: no cover - redis not installed
+    aioredis = None
+    _HAS_REDIS = False
+
+_redis_client: Optional[object] = None
+
+# In-memory TTL fallback cache: {key: (value, expires_at)}
+_memory_cache: dict = {}
+
+
+class CircuitBreaker:
+    """Fail fast to the in-memory cache when Redis is slow or down.
+
+    Without this, `validate_batch` pays Redis' socket timeout (~2s) on every one
+    of the ~8 cache calls it makes per row — measured at 10.0s per row on a
+    host where the Upstash link is slow, while the engine itself needs ~70ms.
+    After `failure_threshold` consecutive slow/failed ops the circuit opens and
+    calls skip Redis entirely until `cooldown_seconds` elapse, then probe once.
+    """
+
+    def __init__(self, failure_threshold: int = 3,
+                 cooldown_seconds: float = 30.0, slow_threshold: float = 1.0):
+        self.failure_threshold = failure_threshold
+        self.cooldown_seconds = cooldown_seconds
+        self.slow_threshold = slow_threshold
+        self._failures = 0
+        self._open_until = 0.0
+
+    def allow(self) -> bool:
+        """True when Redis may be contacted (closed, or cooldown elapsed)."""
+        return time.time() >= self._open_until
+
+    def record(self, success: bool, duration: float) -> None:
+        """Record one op: slow ops count as failures even when they succeed."""
+        if success and duration < self.slow_threshold:
+            self._failures = 0
+            return
+        self._failures += 1
+        if self._failures >= self.failure_threshold:
+            self._open_until = time.time() + self.cooldown_seconds
+            self._failures = 0
+
+    def reset(self) -> None:
+        self._failures = 0
+        self._open_until = 0.0
+
+
+# Trips when Redis is consistently slow/failing; see CircuitBreaker.
+_circuit = CircuitBreaker()
+
+
+async def get_redis():
+    """Lazily create a shared Redis client (returns None if unavailable).
+
+    Redis connections must be configured explicitly. Missing or unreachable
+    Redis leaves the API on its bounded in-memory cache instead of silently
+    provisioning a temporary external database.
+    """
+    global _redis_client
+    if not _HAS_REDIS:
+        return None
+    if _redis_client is None:
+        url = (settings.redis_url or "").strip()
+        if not url:
+            return None
+        try:
+            _redis_client = aioredis.from_url(
+                url,
+                encoding="utf-8",
+                decode_responses=True,
+                # The TLS handshake to Upstash measures ~750-850 ms on some
+                # networks; a 2 s cap killed the very first PING at exactly
+                # the timeout (observed live), which made every cache op pay
+                # the full budget and trip the breaker. 5 s connects reliably
+                # while the breaker still fails fast on real outages.
+                socket_connect_timeout=5,
+                socket_timeout=5,
+            )
+            await _redis_client.ping()
+        except Exception:
+            _redis_client = None
+    return _redis_client
+
+
+def _memory_get(key: str) -> Optional[str]:
+    item = _memory_cache.get(key)
+    if item is None:
+        return None
+    value, expires = item
+    if time.time() > expires:
+        _memory_cache.pop(key, None)
+        return None
+    return value
+
+
+def _memory_set(key: str, value: str, ttl: int):
+    _memory_cache[key] = (value, time.time() + ttl)
+    # keep cache bounded
+    if len(_memory_cache) > 20000:
+        now = time.time()
+        for k in [k for k, (_, exp) in _memory_cache.items() if exp < now]:
+            _memory_cache.pop(k, None)
+
+
+async def get_cache(key: str) -> Optional[str]:
+    if _circuit.allow():
+        t0 = time.perf_counter()
+        try:
+            client = await get_redis()
+            if client is not None:
+                value = await client.get(key)
+                _circuit.record(success=True, duration=time.perf_counter() - t0)
+                return value
+            # Redis is configured but get_redis() could not establish a client
+            # (connect/ping failed). Without this the 2s timeout is paid on
+            # EVERY call and the breaker never trips.
+            if (settings.redis_url or "").strip():
+                _circuit.record(success=False,
+                                duration=time.perf_counter() - t0)
+        except Exception:
+            _circuit.record(success=False, duration=time.perf_counter() - t0)
+    return _memory_get(key)
+
+
+async def set_cache(key: str, value: str, ttl: int = 86400):
+    if _circuit.allow():
+        t0 = time.perf_counter()
+        try:
+            client = await get_redis()
+            if client is not None:
+                await client.setex(key, ttl, value)
+                _circuit.record(success=True, duration=time.perf_counter() - t0)
+                return
+            if (settings.redis_url or "").strip():
+                _circuit.record(success=False,
+                                duration=time.perf_counter() - t0)
+        except Exception:
+            _circuit.record(success=False, duration=time.perf_counter() - t0)
+    _memory_set(key, value, ttl)
+
+
+async def redis_available(timeout: float = 4.0) -> bool:
+    """
+    Quick non-blocking check: can we talk to Redis?
+
+    Used to gate Celery .delay() calls so a missing Redis broker fails
+    fast instead of entering Celery's infinite reconnect/retry loop.
+    """
+    if not _HAS_REDIS:
+        return False
+    try:
+        client = await asyncio.wait_for(
+            get_redis(), timeout=timeout
+        )
+        if client is None:
+            return False
+        await asyncio.wait_for(client.ping(), timeout=timeout)
+        return True
+    except asyncio.TimeoutError:
+        print("[REDIS] Connection timeout - Redis may not be running")
+        return False
+    except Exception as e:
+        print(f"[REDIS] Connection failed: {str(e)}")
+        return False

app/validator/dns_check.py

@@ -1,184 +1,238 @@
-import asyncio
-
-import dns.resolver
-import dns.asyncresolver
-import dns.exception
-from ..config import settings
-from ..models import DNSResult
-
-DKIM_SELECTORS = ['default', 'google', 'selector1', 'selector2', 'dkim', 'k1']
-
-
-def build_resolver(timeout: float) -> dns.asyncresolver.Resolver:
-    """Resolver that never trusts a broken system resolver config.
-
-    Diagnosed live: the host's resolver list held three stale gateway IPs
-    (192.168.3.1 / 192.168.1.1 / 172.20.10.1) from old networks. dnspython tried
-    each in turn, each timing out, so EVERY lookup burned the full lifetime and
-    returned a timeout — even for domains whose MX answered in 56 ms via a
-    public resolver. That produced 42s requests and mass false-invalid verdicts.
-    """
-    resolver = dns.asyncresolver.Resolver(configure=not settings.dns_nameservers)
-    if settings.dns_nameservers:
-        resolver.nameservers = list(settings.dns_nameservers)
-    resolver.timeout = timeout
-    resolver.lifetime = timeout
-    return resolver
-
-
-async def check_dns(domain: str, timeout: int = 5) -> DNSResult:
-    """
-    Layer 2 & 3: Async DNS + MX Record validation.
-    Also checks SPF, DMARC and DKIM authentication records.
-
-    The authentication lookups are independent of one another and are issued
-    concurrently: the DKIM selector list alone is six sequential lookups, which
-    multiplied every request's latency when run one after another.
-    """
-    resolver = build_resolver(timeout)
-
-    # ---- MX Records --------------------------------------------------
-    mx_records = []
-    domain_exists = False
-    has_mx = False
-    a_fallback = False
-
-    try:
-        mx_answers = await resolver.resolve(domain, 'MX')
-        has_mx = True
-        domain_exists = True
-        for r in sorted(mx_answers, key=lambda x: x.preference):
-            mx_records.append({
-                "host": str(r.exchange).rstrip('.'),
-                "priority": r.preference
-            })
-    except dns.resolver.NXDOMAIN:
-        return DNSResult(
-            domain_exists=False,
-            has_mx_records=False,
-            error="Domain does not exist (NXDOMAIN)",
-            error_code="nxdomain",
-        )
-    except dns.resolver.NoAnswer:
-        # No MX -> try A/AAAA fallback per RFC
-        try:
-            for record_type in ('A', 'AAAA'):
-                try:
-                    await resolver.resolve(domain, record_type)
-                    domain_exists = True
-                    a_fallback = True
-                    mx_records.append({"host": domain, "priority": 0})
-                    break
-                except dns.resolver.NoAnswer:
-                    continue
-        except dns.resolver.NXDOMAIN:
-            return DNSResult(
-                domain_exists=False,
-                has_mx_records=False,
-                error="Domain does not exist (NXDOMAIN)",
-                error_code="nxdomain",
-            )
-        except dns.exception.Timeout:
-            return DNSResult(
-                domain_exists=False,
-                has_mx_records=False,
-                error="DNS address lookup timed out",
-                error_code="timeout",
-            )
-        except dns.exception.DNSException as e:
-            return DNSResult(
-                domain_exists=False,
-                has_mx_records=False,
-                error=f"DNS address lookup failed: {e.__class__.__name__}",
-                error_code="resolver_error",
-            )
-        if not domain_exists:
-            # An MX NODATA response confirms the owner name exists, even when
-            # it has no address record to which SMTP can be routed.
-            domain_exists = True
-    except dns.exception.Timeout:
-        return DNSResult(
-            domain_exists=False,
-            has_mx_records=False,
-            error="DNS timeout",
-            error_code="timeout",
-        )
-    except dns.exception.DNSException as e:
-        return DNSResult(
-            domain_exists=False,
-            has_mx_records=False,
-            error=f"DNS lookup failed: {e.__class__.__name__}",
-            error_code="resolver_error",
-        )
-
-    if not has_mx and not a_fallback:
-        return DNSResult(
-            domain_exists=True,
-            has_mx_records=False,
-            error="Domain has no MX, A, or AAAA records",
-            error_code="no_mail_records",
-        )
-
-    # ---- SPF / DMARC / DKIM (independent of each other -> concurrent) ----
-    has_spf, spf_record = await _lookup_spf(resolver, domain)
-    (has_dmarc, dmarc_record), (has_dkim, _) = await asyncio.gather(
-        _lookup_dmarc(resolver, domain),
-        _lookup_dkim(resolver, domain),
-    )
-
-    return DNSResult(
-        domain_exists=domain_exists,
-        has_mx_records=has_mx,
-        mx_records=mx_records,
-        a_fallback=a_fallback,
-        has_spf=has_spf,
-        spf_record=spf_record,
-        has_dmarc=has_dmarc,
-        dmarc_record=dmarc_record,
-        has_dkim=has_dkim
-    )
-
-
-async def _lookup_spf(resolver, domain: str) -> tuple[bool, str | None]:
-    try:
-        txt_answers = await resolver.resolve(domain, 'TXT')
-        for record in txt_answers:
-            txt = b''.join(record.strings).decode('utf-8', errors='replace')
-            if txt.startswith('v=spf1'):
-                return True, txt
-    except Exception:
-        pass
-    return False, None
-
-
-async def _lookup_dmarc(resolver, domain: str) -> tuple[bool, str | None]:
-    try:
-        answers = await resolver.resolve(f"_dmarc.{domain}", 'TXT')
-        for record in answers:
-            txt = b''.join(record.strings).decode('utf-8', errors='replace')
-            if 'DMARC1' in txt:
-                return True, txt
-    except Exception:
-        pass
-    return False, None
-
-
-async def _lookup_dkim(resolver, domain: str) -> tuple[bool, str | None]:
-    """Probe the known selectors concurrently, first hit wins."""
-
-    async def probe(selector: str):
-        try:
-            answers = await resolver.resolve(f"{selector}._domainkey.{domain}", 'TXT')
-            for record in answers:
-                txt = b''.join(record.strings).decode('utf-8', errors='replace')
-                if 'DKIM1' in txt or 'k=rsa' in txt or 'p=' in txt:
-                    return txt
-        except Exception:
-            return None
-        return None
-
-    results = await asyncio.gather(*(probe(s) for s in DKIM_SELECTORS))
-    for txt in results:
-        if txt:
-            return True, txt
-    return False, None
+import asyncio
+
+import dns.resolver
+import dns.asyncresolver
+import dns.exception
+from ..config import settings
+from ..models import DNSResult
+from .doh_resolver import resolve_mx_dual_cached
+from .i18n import to_punycode
+
+DKIM_SELECTORS = ['default', 'google', 'selector1', 'selector2', 'dkim', 'k1']
+
+
+def build_resolver(timeout: float) -> dns.asyncresolver.Resolver:
+    """Resolver that never trusts a broken system resolver config.
+
+    Diagnosed live: the host's resolver list held three stale gateway IPs
+    (192.168.3.1 / 192.168.1.1 / 172.20.10.1) from old networks. dnspython tried
+    each in turn, each timing out, so EVERY lookup burned the full lifetime and
+    returned a timeout — even for domains whose MX answered in 56 ms via a
+    public resolver. That produced 42s requests and mass false-invalid verdicts.
+    """
+    resolver = dns.asyncresolver.Resolver(configure=not settings.dns_nameservers)
+    if settings.dns_nameservers:
+        resolver.nameservers = list(settings.dns_nameservers)
+    resolver.timeout = timeout
+    resolver.lifetime = timeout
+    return resolver
+
+
+async def check_dns(domain: str, timeout: int = 5) -> DNSResult:
+    """
+    Layer 2 & 3: Async DNS + MX Record validation.
+    Also checks SPF, DMARC and DKIM authentication records.
+
+    The MX gate runs first over DoH (free public resolvers, dual-query with a
+    consistency check — see doh_resolver.py); the legacy dnspython path is the
+    automatic fallback when DoH is disabled or unreachable. SPF/DMARC/DKIM are
+    informational TXT lookups and stay on the dnspython path.
+
+    The authentication lookups are independent of one another and are issued
+    concurrently: the DKIM selector list alone is six sequential lookups, which
+    multiplied every request's latency when run one after another.
+    """
+    # ---- MX gate over DoH (spec §3.2), legacy path as fallback -------------
+    if settings.doh_enabled:
+        doh = await resolve_mx_dual_cached(domain, timeout)
+        status = doh.get("status")
+        if status in {"ok", "nxdomain", "no_mail"}:
+            if status == "nxdomain":
+                return DNSResult(
+                    domain_exists=False,
+                    has_mx_records=False,
+                    error=doh.get("error") or "Domain does not exist (NXDOMAIN)",
+                    error_code="nxdomain",
+                )
+            if status == "no_mail":
+                return DNSResult(
+                    domain_exists=True,
+                    has_mx_records=False,
+                    error=doh.get("error") or "Domain has no MX, A, or AAAA records",
+                    error_code="no_mail_records",
+                )
+            # status == "ok": finish the record with the informational TXT layer.
+            resolver = build_resolver(timeout)
+            ascii_domain = to_punycode(domain)
+            has_spf, spf_record = await _lookup_spf(resolver, ascii_domain)
+            (has_dmarc, dmarc_record), (has_dkim, _) = await asyncio.gather(
+                _lookup_dmarc(resolver, ascii_domain),
+                _lookup_dkim(resolver, ascii_domain),
+            )
+            return DNSResult(
+                domain_exists=True,
+                has_mx_records=bool(doh.get("mx_records")),
+                mx_records=doh.get("mx_records") or [],
+                a_fallback=bool(doh.get("a_fallback")),
+                has_spf=has_spf,
+                spf_record=spf_record,
+                has_dmarc=has_dmarc,
+                dmarc_record=dmarc_record,
+                has_dkim=has_dkim,
+                dns_inconsistent=doh.get("consistent") is False,
+                mx_source="doh:dual" if doh.get("consistent") is not None else "doh:primary",
+            )
+        # DoH errored → fall through to the legacy resolver path.
+
+    return await _check_dns_legacy(domain, timeout)
+
+
+async def _check_dns_legacy(domain: str, timeout: int = 5) -> DNSResult:
+    """Legacy dnspython path (UDP/53 against configured public resolvers)."""
+    resolver = build_resolver(timeout)
+
+    # ---- MX Records --------------------------------------------------
+    mx_records = []
+    domain_exists = False
+    has_mx = False
+    a_fallback = False
+
+    try:
+        mx_answers = await resolver.resolve(domain, 'MX')
+        has_mx = True
+        domain_exists = True
+        for r in sorted(mx_answers, key=lambda x: x.preference):
+            mx_records.append({
+                "host": str(r.exchange).rstrip('.'),
+                "priority": r.preference
+            })
+    except dns.resolver.NXDOMAIN:
+        return DNSResult(
+            domain_exists=False,
+            has_mx_records=False,
+            error="Domain does not exist (NXDOMAIN)",
+            error_code="nxdomain",
+        )
+    except dns.resolver.NoAnswer:
+        # No MX -> try A/AAAA fallback per RFC
+        try:
+            for record_type in ('A', 'AAAA'):
+                try:
+                    await resolver.resolve(domain, record_type)
+                    domain_exists = True
+                    a_fallback = True
+                    mx_records.append({"host": domain, "priority": 0})
+                    break
+                except dns.resolver.NoAnswer:
+                    continue
+        except dns.resolver.NXDOMAIN:
+            return DNSResult(
+                domain_exists=False,
+                has_mx_records=False,
+                error="Domain does not exist (NXDOMAIN)",
+                error_code="nxdomain",
+            )
+        except dns.exception.Timeout:
+            return DNSResult(
+                domain_exists=False,
+                has_mx_records=False,
+                error="DNS address lookup timed out",
+                error_code="timeout",
+            )
+        except dns.exception.DNSException as e:
+            return DNSResult(
+                domain_exists=False,
+                has_mx_records=False,
+                error=f"DNS address lookup failed: {e.__class__.__name__}",
+                error_code="resolver_error",
+            )
+        if not domain_exists:
+            # An MX NODATA response confirms the owner name exists, even when
+            # it has no address record to which SMTP can be routed.
+            domain_exists = True
+    except dns.exception.Timeout:
+        return DNSResult(
+            domain_exists=False,
+            has_mx_records=False,
+            error="DNS timeout",
+            error_code="timeout",
+        )
+    except dns.exception.DNSException as e:
+        return DNSResult(
+            domain_exists=False,
+            has_mx_records=False,
+            error=f"DNS lookup failed: {e.__class__.__name__}",
+            error_code="resolver_error",
+        )
+
+    if not has_mx and not a_fallback:
+        return DNSResult(
+            domain_exists=True,
+            has_mx_records=False,
+            error="Domain has no MX, A, or AAAA records",
+            error_code="no_mail_records",
+        )
+
+    # ---- SPF / DMARC / DKIM (independent of each other -> concurrent) ----
+    has_spf, spf_record = await _lookup_spf(resolver, domain)
+    (has_dmarc, dmarc_record), (has_dkim, _) = await asyncio.gather(
+        _lookup_dmarc(resolver, domain),
+        _lookup_dkim(resolver, domain),
+    )
+
+    return DNSResult(
+        domain_exists=domain_exists,
+        has_mx_records=has_mx,
+        mx_records=mx_records,
+        a_fallback=a_fallback,
+        has_spf=has_spf,
+        spf_record=spf_record,
+        has_dmarc=has_dmarc,
+        dmarc_record=dmarc_record,
+        has_dkim=has_dkim
+    )
+
+
+async def _lookup_spf(resolver, domain: str) -> tuple[bool, str | None]:
+    try:
+        txt_answers = await resolver.resolve(domain, 'TXT')
+        for record in txt_answers:
+            txt = b''.join(record.strings).decode('utf-8', errors='replace')
+            if txt.startswith('v=spf1'):
+                return True, txt
+    except Exception:
+        pass
+    return False, None
+
+
+async def _lookup_dmarc(resolver, domain: str) -> tuple[bool, str | None]:
+    try:
+        answers = await resolver.resolve(f"_dmarc.{domain}", 'TXT')
+        for record in answers:
+            txt = b''.join(record.strings).decode('utf-8', errors='replace')
+            if 'DMARC1' in txt:
+                return True, txt
+    except Exception:
+        pass
+    return False, None
+
+
+async def _lookup_dkim(resolver, domain: str) -> tuple[bool, str | None]:
+    """Probe the known selectors concurrently, first hit wins."""
+
+    async def probe(selector: str):
+        try:
+            answers = await resolver.resolve(f"{selector}._domainkey.{domain}", 'TXT')
+            for record in answers:
+                txt = b''.join(record.strings).decode('utf-8', errors='replace')
+                if 'DKIM1' in txt or 'k=rsa' in txt or 'p=' in txt:
+                    return txt
+        except Exception:
+            return None
+        return None
+
+    results = await asyncio.gather(*(probe(s) for s in DKIM_SELECTORS))
+    for txt in results:
+        if txt:
+            return True, txt
+    return False, None

app/validator/doh_resolver.py

@@ -0,0 +1,220 @@
+"""DNS/MX worker over DNS-over-HTTPS (DoH) — free public resolvers.
+
+Architecture spec §3.2 / §7.3:
+
+- MX resolution runs on Google Public DNS and Cloudflare DNS over HTTPS.
+  Both are free, unlimited and need no authentication; HTTPS/443 egress is
+  never blocked (unlike UDP/53 on locked-down PaaS hosts).
+- The SAME query goes to BOTH resolvers. Divergent MX sets flag the domain as
+  `dns_inconsistent` — a deterministic risk signal (regional DNS hijack /
+  misconfiguration), requiring no inference.
+- Results are cached at the domain level: 24h TTL for MX answers, 1h for
+  negative (null-MX / NXDOMAIN) answers per the spec.
+- Punycode normalization happens here (§7.1) so Unicode domains resolve.
+
+The legacy dnspython path in dns_check.py remains the fallback: any DoH
+failure (network, JSON, schema) degrades to it transparently. The DoH layer
+can also be disabled entirely with DOH_ENABLED=false.
+"""
+from __future__ import annotations
+
+import asyncio
+import json
+from typing import Any, Optional
+
+import httpx
+
+from ..config import settings
+from .i18n import to_punycode
+
+GOOGLE_DOH = "https://dns.google/resolve"
+CLOUDFLARE_DOH = "https://cloudflare-dns.com/dns-query"
+
+MX_TTL_SECONDS = 24 * 3600          # spec: 24h for MX records
+NEGATIVE_TTL_SECONDS = 1 * 3600     # spec: 1h for null-MX negatives
+
+_TIMEOUT_LABEL = "timeout"
+
+
+async def _doh_query(
+    client: httpx.AsyncClient,
+    endpoint: str,
+    name: str,
+    rtype: str,
+    extra_params: dict | None = None,
+    accept: str = "application/dns-json",
+) -> dict:
+    """One DoH JSON query (RFC 8484-style JSON APIs used by both providers)."""
+    params = {"name": name, "type": rtype}
+    if extra_params:
+        params.update(extra_params)
+    resp = await client.get(endpoint, params=params, headers={"accept": accept})
+    resp.raise_for_status()
+    data = resp.json()
+    if not isinstance(data, dict):
+        raise ValueError("doh: non-object response")
+    return data
+
+
+def _parse_mx(data: dict) -> list[dict]:
+    """Extract MX records (sorted by priority) from a DoH answer."""
+    records: list[dict] = []
+    for ans in data.get("Answer") or []:
+        # RFC 1035 type 15 = MX
+        if ans.get("type") != 15:
+            continue
+        parts = str(ans.get("data", "")).split()
+        if len(parts) >= 2:
+            try:
+                priority = int(parts[0])
+            except ValueError:
+                priority = 0
+            host = " ".join(parts[1:]).rstrip(".").strip().lower()
+            if host:
+                records.append({"host": host, "priority": priority})
+    records.sort(key=lambda r: (r["priority"], r["host"]))
+    return records
+
+
+def _parse_a_like(data: dict, rtypes: set[int]) -> bool:
+    """True when the answer holds at least one A (1) / AAAA (28) record."""
+    for ans in data.get("Answer") or []:
+        if ans.get("type") in rtypes:
+            return True
+    return False
+
+
+def _mx_sets_match(a: list[dict], b: list[dict]) -> bool:
+    """Set-equality on (priority, host) — order-insensitive, tolerant."""
+    norm = lambda rs: {(r["host"], r["priority"]) for r in rs}
+    return norm(a) == norm(b)
+
+
+async def resolve_mx_dual(
+    domain: str, timeout: Optional[float] = None
+) -> dict[str, Any]:
+    """Query BOTH public resolvers for MX and compare.
+
+    Returns:
+        {
+          "status": "ok" | "nxdomain" | "no_mail" | "error",
+          "mx_records": [...],          # primary (Google) answer
+          "consistent": bool | None,    # None when the second resolver failed
+          "a_fallback": bool,
+          "error": str | None,
+        }
+    """
+    domain = to_punycode((domain or "").strip().lower().rstrip("."))
+    timeout = timeout if timeout is not None else settings.doh_timeout
+
+    async def _query_both() -> tuple[dict | None, dict | None, Exception | None]:
+        async with httpx.AsyncClient(timeout=timeout) as client:
+            google_task = _doh_query(client, GOOGLE_DOH, domain, "MX")
+            cf_task = _doh_query(
+                client, CLOUDFLARE_DOH, domain, "MX", extra_params={"ct": "application/dns-json"}
+            )
+            g_res = await asyncio.gather(google_task, cf_task, return_exceptions=True)
+        g, c = g_res
+        g_err = g if isinstance(g, Exception) else None
+        c_err = c if isinstance(c, Exception) else None
+        g_data = g if isinstance(g, dict) else None
+        c_data = c if isinstance(c, dict) else None
+        # If the PRIMARY (Google) failed but Cloudflare answered, swap so the
+        # pipeline still gets an authoritative answer from a public resolver.
+        if g_data is None and c_data is not None:
+            g_data, c_data = c_data, None
+        return g_data, c_data, g_err or c_err
+
+    try:
+        g_data, c_data, err = await _query_both()
+    except Exception as exc:  # httpx transport failure etc.
+        return {"status": "error", "mx_records": [], "consistent": None,
+                "a_fallback": False, "error": f"doh transport: {exc}"}
+
+    if g_data is None:
+        return {"status": "error", "mx_records": [], "consistent": None,
+                "a_fallback": False, "error": f"doh unavailable: {err}"}
+
+    g_status = g_data.get("Status", 0)
+    if g_status == 3:  # NXDOMAIN
+        return {"status": "nxdomain", "mx_records": [], "consistent": None,
+                "a_fallback": False, "error": "Domain does not exist (NXDOMAIN)"}
+    if g_status not in (0, 3):
+        return {"status": "error", "mx_records": [], "consistent": None,
+                "a_fallback": False, "error": f"doh resolver status {g_status}"}
+
+    mx = _parse_mx(g_data)
+    if mx:
+        consistent = (
+            _mx_sets_match(mx, _parse_mx(c_data))
+            if c_data is not None and c_data.get("Status", 0) == 0
+            else None
+        )
+        return {"status": "ok", "mx_records": mx, "consistent": consistent,
+                "a_fallback": False, "error": None}
+
+    # No MX → A/AAAA fallback per RFC 5321 §5.1
+    try:
+        async with httpx.AsyncClient(timeout=timeout) as client:
+            a_task = _doh_query(client, GOOGLE_DOH, domain, "A")
+            aaaa_task = _doh_query(client, GOOGLE_DOH, domain, "AAAA")
+            a_res = await asyncio.gather(a_task, aaaa_task, return_exceptions=True)
+        has_addr = any(
+            isinstance(d, dict) and _parse_a_like(d, {1, 28}) for d in a_res
+        )
+    except Exception:
+        has_addr = False
+
+    if has_addr:
+        return {"status": "ok", "a_fallback": True,
+                "mx_records": [{"host": domain, "priority": 0}],
+                "consistent": None, "error": None}
+    return {"status": "no_mail", "mx_records": [], "consistent": None,
+            "a_fallback": False, "error": "Domain has no MX, A, or AAAA records"}
+
+
+# ---- domain-level TTL cache (shared-cache backed, memory tier always works) --
+
+async def _cache_get(key: str) -> dict | None:
+    try:
+        from ..utils.cache import get_cache
+        raw = await get_cache(key)
+        if not raw:
+            return None
+        data = json.loads(raw)
+        return data if isinstance(data, dict) else None
+    except Exception:
+        return None  # cache outage → plain re-resolve
+
+
+async def _cache_set(key: str, payload: dict, ttl: int) -> None:
+    try:
+        from ..utils.cache import set_cache
+        await set_cache(key, json.dumps(payload), ttl)
+    except Exception:
+        pass  # a cache write failure must never break resolution
+
+
+def _mx_cache_key(domain: str) -> str:
+    return f"doh:mx:{to_punycode(domain.strip().lower())}"
+
+
+async def resolve_mx_dual_cached(domain: str, timeout: Optional[float] = None) -> dict:
+    """`resolve_mx_dual` with a domain-level TTL cache.
+
+    Definitive answers cache for 24h; negative answers (NXDOMAIN / no mail)
+    for 1h per the spec. Errors are never cached.
+    """
+    domain = (domain or "").strip().lower()
+    key = _mx_cache_key(domain)
+    cached = await _cache_get(key)
+    if cached is not None:
+        cached = {**cached, "cache_hit": True}
+        return cached
+
+    result = await resolve_mx_dual(domain, timeout)
+    if result.get("status") == "ok":
+        await _cache_set(key, {**result, "cache_hit": False}, MX_TTL_SECONDS)
+    elif result.get("status") in {"nxdomain", "no_mail"}:
+        await _cache_set(key, {**result, "cache_hit": False}, NEGATIVE_TTL_SECONDS)
+    return result

app/validator/engine.py

@@ -1,662 +1,833 @@
-import asyncio
-import re
-import time
-import uuid
-from datetime import datetime, timezone
-import structlog
-
-from ..models import (
-    ValidationResult,
-    ValidationStatus,
-    ScoringResult,
-    CatchAllResult,
-    DNSResult,
-    DisposableResult,
-    SMTPResult,
-    SyntaxResult,
-)
-from ..config import settings
-from .syntax import validate_syntax
-from .dns_check import check_dns
-from .disposable import check_disposable, domain_in_blocklist, domain_is_known
-from .mailbox_provider import MailboxProvider, resolve_provider
-from ..ml.runtime import get_model_async, predict_async
-from .mx_intel import mx_is_trusted
-from .retry_queue import is_greylist_result
-from .scoring import calculate_score
-
-logger = structlog.get_logger()
-
-
-def _mask_email_for_log(email: str) -> str:
-    local_part, separator, domain = email.rpartition("@")
-    if not separator or not domain:
-        return "[invalid-email]"
-    return f"{local_part[:1]}***@{domain}"
-
-
-def _build_checks_run(
-    syntax: SyntaxResult | None,
-    dns: DNSResult | None,
-    disposable: DisposableResult | None,
-    catch_all: CatchAllResult | None,
-    smtp: SMTPResult | None,
-    scoring: ScoringResult | None,
-) -> list[str]:
-    """Which of the 7-layer taxonomy keys actually executed for this result.
-
-    Mirrors the frontend fallback in src/lib/verifier.ts classify() so a layer
-    the engine did not run is never reported as a pass. DNS without an error
-    claims both `dns` and `mx`; a DNS error claims only `dns`.
-    """
-    checks: list[str] = []
-    if syntax is not None:
-        checks.append("syntax")
-    if dns is not None:
-        if dns.error:
-            checks.append("dns")
-        else:
-            checks.extend(["dns", "mx"])
-    if disposable is not None:
-        checks.append("disposable")
-    if catch_all is not None:
-        checks.append("catch_all")
-    if smtp is not None:
-        checks.append("smtp")
-    if scoring is not None:
-        checks.append("scoring")
-    return checks
-
-
-def _build_reason_code(
-    dns: DNSResult | None,
-    disposable: DisposableResult | None,
-    catch_all: CatchAllResult | None,
-    smtp: SMTPResult | None,
-    *,
-    early: str | None = None,
-) -> str | None:
-    """Machine cause for the verdict. Ordered most-specific/actionable first.
-
-    disposable outranks everything (frontend classifies it as Disposable). A
-    definitive SMTP rejection (verified False + code) outranks the domain-level
-    catch-all flag: reporting "catch_all_detected" beside status=invalid is
-    incoherent — the explicit "mailbox does not exist" is the actionable fact.
-    Catch-all then outranks a merely inconclusive probe.
-    """
-    if early:
-        return early
-    if disposable is not None and disposable.is_disposable:
-        return "disposable"
-    if dns is not None and dns.a_fallback and not dns.has_mx_records:
-        return "a_fallback_only"
-    if smtp is not None and smtp.verified is False and smtp.smtp_code:
-        if smtp.smtp_code >= 500:
-            return "rcpt_5xx"
-        if smtp.smtp_code >= 400:
-            return "rcpt_4xx"
-        if smtp.smtp_code >= 200:
-            return "rcpt_2xx"
-    if catch_all is not None and catch_all.is_catch_all:
-        return "catch_all_detected"
-    if smtp is not None and smtp.verified is None and smtp.error:
-        return (
-            "smtp_timeout"
-            if re.search(r"timed?\s*out", smtp.error, re.IGNORECASE)
-            else "smtp_unavailable"
-        )
-    return None
-
-
-class EmailValidationEngine:
-    """
-    Master 7-Layer Email Validation Orchestrator.
-
-    Layers:
-      1. Syntax / RFC 5321 check
-      2. DNS domain existence
-      3. MX record verification
-      4. Disposable / Role-based / Free provider detection
-      5. Catch-all domain detection
-      6. SMTP mailbox verification
-      7. Deterministic heuristic deliverability scoring
-    """
-
-    def __init__(
-        self,
-        mailbox: MailboxProvider | None = None,
-        cache=None,
-        retry_queue=None,
-    ):
-        self.use_proxies = settings.use_proxies
-        # Layers 5 (catch-all) and 6 (SMTP) run through a mailbox provider. On
-        # hosts that block port 25 (HF Spaces), this resolves to the verification
-        # API; elsewhere it is direct SMTP. Injectable for tests.
-        self.mailbox = mailbox if mailbox is not None else resolve_provider()
-        # DNS/MX and definitive mailbox verdicts are cached across runs — the
-        # same domain (and often the same address) recurs constantly in bulk
-        # lists. Transient failures are never cached; see validation_cache.py.
-        if cache is None:
-            from .validation_cache import validation_cache as cache
-
-        self.cache = cache
-        # Greylisted (4xx) addresses get a bounded second chance. Without this a
-        # valid mailbox on a greylisting domain stays permanently "risky".
-        if retry_queue is None:
-            from .retry_queue import retry_queue as retry_queue
-
-        self.retry_queue = retry_queue
-
-    async def validate(self, email: str, deep: bool = True) -> ValidationResult:
-        start_time = time.monotonic()
-        run_id = uuid.uuid4().hex[:12]
-
-        log = logger.bind(email=_mask_email_for_log(email), run_id=run_id)
-        log.info("validation_started")
-
-        # ---- Layer 1: Syntax -----------------------------------------
-        syntax = validate_syntax(email)
-
-        if not syntax.passed:
-            elapsed = (time.monotonic() - start_time) * 1000
-            scoring = calculate_score(syntax, None, None, None, None)
-            log.warning("syntax_failed", error=syntax.error)
-            return ValidationResult(
-                email=email,
-                status=ValidationStatus.INVALID,
-                syntax=syntax,
-                scoring=scoring,
-                processing_time_ms=round(elapsed, 2),
-                validated_at=datetime.now(timezone.utc).isoformat(),
-                checks_run=_build_checks_run(syntax, None, None, None, None, scoring),
-                reason_code=_build_reason_code(None, None, None, None),
-                run_id=run_id,
-                validator_version=settings.app_version,
-            )
-
-        domain = syntax.domain
-        normalized_email = syntax.normalized_email or email
-
-        # ---- Layers 2 & 3: DNS + MX ---------------------------------
-        dns_result = await check_dns(domain, settings.dns_timeout)
-
-        if dns_result.error_code in {"timeout", "resolver_error"}:
-            elapsed = (time.monotonic() - start_time) * 1000
-            scoring = calculate_score(syntax, dns_result, None, None, None)
-            log.warning(
-                "dns_inconclusive", domain=domain, error_code=dns_result.error_code
-            )
-            return ValidationResult(
-                email=normalized_email,
-                status=self._determine_status(scoring),
-                syntax=syntax,
-                dns=dns_result,
-                scoring=scoring,
-                processing_time_ms=round(elapsed, 2),
-                validated_at=datetime.now(timezone.utc).isoformat(),
-                checks_run=_build_checks_run(syntax, dns_result, None, None, None, scoring),
-                reason_code=_build_reason_code(dns_result, None, None, None, early="dns_timeout"),
-                run_id=run_id,
-                validator_version=settings.app_version,
-            )
-
-        if (
-            not dns_result.domain_exists
-            or dns_result.error_code == "nxdomain"
-            or (not dns_result.has_mx_records and not dns_result.a_fallback)
-        ):
-            elapsed = (time.monotonic() - start_time) * 1000
-            scoring = calculate_score(syntax, dns_result, None, None, None)
-            log.warning("dns_failed", domain=domain)
-            return ValidationResult(
-                email=normalized_email,
-                status=ValidationStatus.INVALID,
-                syntax=syntax,
-                dns=dns_result,
-                scoring=scoring,
-                processing_time_ms=round(elapsed, 2),
-                validated_at=datetime.now(timezone.utc).isoformat(),
-                checks_run=_build_checks_run(syntax, dns_result, None, None, None, scoring),
-                reason_code=_build_reason_code(
-                    dns_result, None, None, None, early="nxdomain"
-                ),
-                run_id=run_id,
-                validator_version=settings.app_version,
-            )
-
-        # ---- Layer 4: Disposable Detection ---------------------------
-        disposable = check_disposable(normalized_email, domain)
-
-        # ML advisory (single path): unknown domains only, fail-open. Mirrors
-        # the batch pipeline so both surfaces agree on the same address.
-        # Skipped when the MX runs on a trusted enterprise platform: the model
-        # learned 'unfamiliar domain string = disposable' from an imbalanced
-        # dataset and flags legitimate small businesses on Google Workspace /
-        # M365 — the deterministic MX intelligence is the better signal there.
-        ml_model = await get_model_async()
-        mx_host = (
-            dns_result.mx_records[0]["host"]
-            if dns_result.mx_records
-            else None
-        )
-        if (
-            ml_model is not None
-            and not domain_is_known(domain)
-            and deep
-            and not mx_is_trusted(mx_host)
-        ):
-            # Off the event loop: CPU inference inline would stall every other
-            # concurrent request (measured 42.6s cold start before this).
-            preds = await predict_async(ml_model, [f"john.smith [SEP] {domain}"])
-            if preds:
-                disposable = disposable.model_copy(
-                    update={"ml_label": preds[0][0], "ml_confidence": preds[0][1]}
-                )
-
-        if not deep:
-            # Fast path: skip SMTP for quick validation
-            elapsed = (time.monotonic() - start_time) * 1000
-            scoring = calculate_score(
-                syntax,
-                dns_result,
-                disposable,
-                None,
-                None,
-                mailbox_verification_skipped=True,
-            )
-            status = self._determine_status(scoring)
-            return ValidationResult(
-                email=normalized_email,
-                status=status,
-                syntax=syntax,
-                dns=dns_result,
-                disposable=disposable,
-                scoring=scoring,
-                processing_time_ms=round(elapsed, 2),
-                validated_at=datetime.now(timezone.utc).isoformat(),
-                checks_run=_build_checks_run(
-                    syntax, dns_result, disposable, None, None, scoring
-                ),
-                reason_code=_build_reason_code(dns_result, disposable, None, None),
-                run_id=run_id,
-                validator_version=settings.app_version,
-            )
-
-        # ---- Layers 5 & 6: Catch-All + SMTP --------------------------
-        mx_host = dns_result.mx_records[0]["host"]
-
-        # Run catch-all and SMTP in parallel for speed, via the mailbox
-        # provider (direct SMTP or the verification API, per configuration).
-        catch_all_task = asyncio.create_task(
-            self.mailbox.catch_all(domain, mx_host)
-        )
-        smtp_task = asyncio.create_task(
-            self.mailbox.verify(normalized_email, mx_host)
-        )
-
-        catch_all_raw, smtp_result = await asyncio.gather(
-            catch_all_task, smtp_task, return_exceptions=True
-        )
-
-        # Handle catch-all result. An exception means the probe could not run
-        # (e.g. port-25 egress blocked) — that is UNKNOWN, not "not catch-all".
-        if isinstance(catch_all_raw, Exception):
-            catch_all = CatchAllResult(
-                is_catch_all=None, confidence=0.0, error=str(catch_all_raw)
-            )
-        else:
-            is_catch_all, confidence = catch_all_raw
-            catch_all = CatchAllResult(is_catch_all=is_catch_all, confidence=confidence)
-
-        # Handle SMTP result
-        if isinstance(smtp_result, Exception):
-            smtp_result = SMTPResult(verified=None, error=str(smtp_result))
-
-        # ---- Layer 7: Scoring ----------------------------------------
-        scoring = calculate_score(
-            syntax, dns_result, disposable, catch_all, smtp_result
-        )
-
-        status = self._determine_status(scoring)
-        elapsed = (time.monotonic() - start_time) * 1000
-
-        log.info(
-            "validation_complete",
-            status=status,
-            score=scoring.score,
-            time_ms=round(elapsed, 2),
-        )
-
-        return ValidationResult(
-            email=normalized_email,
-            status=status,
-            syntax=syntax,
-            dns=dns_result,
-            disposable=disposable,
-            catch_all=catch_all,
-            smtp=smtp_result,
-            scoring=scoring,
-            processing_time_ms=round(elapsed, 2),
-            validated_at=datetime.now(timezone.utc).isoformat(),
-            checks_run=_build_checks_run(
-                syntax, dns_result, disposable, catch_all, smtp_result, scoring
-            ),
-            reason_code=_build_reason_code(dns_result, disposable, catch_all, smtp_result),
-            run_id=run_id,
-            validator_version=settings.app_version,
-        )
-
-    async def validate_batch(
-        self, emails: list[str], deep: bool = True
-    ) -> list[ValidationResult]:
-        """Validate many addresses in one pass, reusing per-domain work.
-
-        Bulk throughput comes from doing DNS/MX **once per domain** and handing
-        every (email, mx_host) pair to the mailbox provider in a **single** call,
-        so the SMTP engine can reuse one session per receiving host instead of a
-        fresh TCP handshake per address. Providers that cannot batch fall back to
-        the per-address path, so behaviour is never worse than before.
-
-        Results are returned in the same order as `emails`.
-        """
-        if not emails:
-            return []
-
-        run_id = uuid.uuid4().hex[:12]
-        out: list[ValidationResult | None] = [None] * len(emails)
-
-        def _stamp(**kw) -> ValidationResult:
-            return ValidationResult(
-                processing_time_ms=0.0,
-                validated_at=datetime.now(timezone.utc).isoformat(),
-                run_id=run_id,
-                validator_version=settings.app_version,
-                **kw,
-            )
-
-        # ---- Layer 1: syntax (per address) ---------------------------
-        parsed: list[tuple[str, SyntaxResult]] = []
-        domain_index: dict[str, list[int]] = {}
-        for idx, raw in enumerate(emails):
-            syntax = validate_syntax(raw)
-            parsed.append((raw, syntax))
-            if not syntax.passed:
-                scoring = calculate_score(syntax, None, None, None, None)
-                out[idx] = _stamp(
-                    email=raw,
-                    status=ValidationStatus.INVALID,
-                    syntax=syntax,
-                    scoring=scoring,
-                    checks_run=_build_checks_run(syntax, None, None, None, None, scoring),
-                    reason_code=_build_reason_code(None, None, None, None),
-                )
-                continue
-            domain_index.setdefault(syntax.domain, []).append(idx)
-
-        # ---- Layers 2 & 3: DNS + MX once per domain (cached) ---------
-        domains = list(domain_index.keys())
-        domain_dns: dict[str, DNSResult] = {}
-        misses: list[str] = []
-        for domain in domains:
-            cached_dns = await self.cache.get_dns(domain)
-            if cached_dns is not None:
-                domain_dns[domain] = cached_dns
-            else:
-                misses.append(domain)
-
-        if misses:
-            resolved = await asyncio.gather(
-                *[check_dns(d, settings.dns_timeout) for d in misses],
-                return_exceptions=True,
-            )
-            for domain, dns in zip(misses, resolved):
-                result = (
-                    dns
-                    if isinstance(dns, DNSResult)
-                    else DNSResult(
-                        domain_exists=False,
-                        has_mx_records=False,
-                        error=str(dns),
-                        error_code="resolver_error",
-                    )
-                )
-                domain_dns[domain] = result
-                # put_dns ignores transient failures internally.
-                await self.cache.put_dns(domain, result)
-
-        pending: list[tuple[int, str, SyntaxResult, str, DNSResult]] = []
-        for domain, idxs in domain_index.items():
-            dns = domain_dns[domain]
-            inconclusive = dns.error_code in {"timeout", "resolver_error"}
-            dead = (
-                not dns.domain_exists
-                or dns.error_code == "nxdomain"
-                or (not dns.has_mx_records and not dns.a_fallback)
-            )
-            for idx in idxs:
-                raw, syntax = parsed[idx]
-                normalized = syntax.normalized_email or raw
-                if inconclusive:
-                    scoring = calculate_score(syntax, dns, None, None, None)
-                    out[idx] = _stamp(
-                        email=normalized,
-                        status=self._determine_status(scoring),
-                        syntax=syntax,
-                        dns=dns,
-                        scoring=scoring,
-                        checks_run=_build_checks_run(
-                            syntax, dns, None, None, None, scoring
-                        ),
-                        reason_code=_build_reason_code(
-                            dns, None, None, None, early="dns_timeout"
-                        ),
-                    )
-                elif dead:
-                    scoring = calculate_score(syntax, dns, None, None, None)
-                    out[idx] = _stamp(
-                        email=normalized,
-                        status=ValidationStatus.INVALID,
-                        syntax=syntax,
-                        dns=dns,
-                        scoring=scoring,
-                        checks_run=_build_checks_run(
-                            syntax, dns, None, None, None, scoring
-                        ),
-                        reason_code=_build_reason_code(
-                            dns, None, None, None, early="nxdomain"
-                        ),
-                    )
-                else:
-                    pending.append((idx, normalized, syntax, domain, dns))
-
-        # ---- Layer 4 fast path (no mailbox probe) --------------------
-        if pending and not deep:
-            for idx, normalized, syntax, domain, dns in pending:
-                disposable = check_disposable(normalized, domain)
-                scoring = calculate_score(
-                    syntax, dns, disposable, None, None,
-                    mailbox_verification_skipped=True,
-                )
-                out[idx] = _stamp(
-                    email=normalized,
-                    status=self._determine_status(scoring),
-                    syntax=syntax,
-                    dns=dns,
-                    disposable=disposable,
-                    scoring=scoring,
-                    checks_run=_build_checks_run(
-                        syntax, dns, disposable, None, None, scoring
-                    ),
-                    reason_code=_build_reason_code(dns, disposable, None, None),
-                )
-            pending = []
-
-        # ---- Layers 5 & 6: ONE batched mailbox call ------------------
-        cached_verdicts: dict[str, tuple[SMTPResult, Optional[bool]]] = {}
-        catch_all_map: dict[str, Optional[bool]] = {}
-        if pending:
-            # Serve anything already answered (definitive verdicts only) so we
-            # never re-probe an address we already know the answer to.
-            to_probe: list[tuple[int, str, SyntaxResult, str, DNSResult]] = []
-            for item in pending:
-                _idx, normalized, _syntax, _domain, _dns = item
-                hit = await self.cache.get_verdict(normalized, deep)
-                if hit is None:
-                    to_probe.append(item)
-                else:
-                    cached_verdicts[normalized] = hit
-                    if hit[1] is not None:
-                        catch_all_map[item[3]] = hit[1]
-
-            pairs = [
-                (normalized, dns.mx_records[0]["host"])
-                for _, normalized, _, _, dns in to_probe
-            ]
-            smtp_map: dict[str, SMTPResult] = {}
-            if pairs:
-                try:
-                    if hasattr(self.mailbox, "verify_many"):
-                        smtp_map, caught = await self.mailbox.verify_many(pairs)
-                        for domain, value in (caught or {}).items():
-                            catch_all_map.setdefault(domain, value)
-                    else:
-                        # Provider cannot batch: per-address fallback.
-                        for email, mx in pairs:
-                            smtp_map[email] = await self.mailbox.verify(email, mx)
-                        for domain in {e.rsplit("@", 1)[-1].lower() for e, _ in pairs}:
-                            mx = next(
-                                m for e, m in pairs
-                                if e.rsplit("@", 1)[-1].lower() == domain
-                            )
-                            value, _conf = await self.mailbox.catch_all(domain, mx)
-                            catch_all_map.setdefault(domain, value)
-                except Exception as exc:  # one bad stage must not abort the batch
-                    smtp_map = {
-                        e: SMTPResult(verified=None, error=f"mailbox_stage_error: {exc}")
-                        for e, _ in pairs
-                    }
-
-            # ---- ML advisory signal (unknown domains, ONE batched call) ----
-            # Runs only where the curated lists have no answer - the exact gap
-            # a static blocklist cannot close. Any failure here is silently
-            # ignored: the deterministic verdict stands.
-            # Domains on trusted enterprise MX (Google Workspace / M365 /
-            # gateways) are excluded: disposable domains essentially never run
-            # there, and the model's 'unfamiliar string' bias would otherwise
-            # flag legitimate businesses as disposable.
-            ml_map: dict[str, tuple[str, float]] = {}
-            ml_model = await get_model_async()
-            if ml_model is not None:
-                unknown_domains = sorted(
-                    {
-                        domain
-                        for _, _, _, domain, dns in pending
-                        if not domain_is_known(domain)
-                        and dns.mx_records
-                        and not mx_is_trusted(dns.mx_records[0]["host"])
-                    }
-                )
-                if unknown_domains:
-                    # One batched call, off the event loop (CPU inference inline
-                    # stalls concurrent requests), and fail-open by construction:
-                    # predict_async never raises.
-                    preds = await predict_async(
-                        ml_model, [f"john.smith [SEP] {d}" for d in unknown_domains]
-                    )
-                    if preds:
-                        ml_map = dict(zip(unknown_domains, preds))
-
-            # ---- Layer 7: score each row -----------------------------
-            for idx, normalized, syntax, domain, dns in pending:
-                cached = cached_verdicts.get(normalized)
-                if cached is not None:
-                    smtp, ca_cached = cached
-                else:
-                    smtp = smtp_map.get(normalized) or SMTPResult(
-                        verified=None, error="engine returned no result"
-                    )
-                    ca_cached = None
-                    # Persist only definitive answers (verified verdict or a
-                    # confirmed catch-all); transient failures are never cached.
-                    await self.cache.put_verdict(
-                        normalized, deep, smtp, catch_all_map.get(domain)
-                    )
-
-                ca_value = (
-                    ca_cached if ca_cached is not None else catch_all_map.get(domain)
-                )
-                catch_all = CatchAllResult(
-                    is_catch_all=ca_value,
-                    confidence=0.9 if ca_value is not None else 0.0,
-                )
-                disposable = check_disposable(normalized, domain)
-                ml = ml_map.get(domain)
-                if ml is not None:
-                    disposable = disposable.model_copy(
-                        update={"ml_label": ml[0], "ml_confidence": ml[1]}
-                    )
-
-                # A 4xx means "come back later", not a verdict. Schedule one
-                # bounded retry so a real mailbox on a greylisting domain is not
-                # stranded as permanently risky. The queue never raises.
-                if cached is None:
-                    try:
-                        if is_greylist_result(smtp):
-                            await self.retry_queue.enqueue(
-                                normalized, dns.mx_records[0]["host"], smtp.smtp_code
-                            )
-                        elif smtp.verified is not None:
-                            # Definitive answer — cancel any pending retry.
-                            await self.retry_queue.resolve_email(normalized)
-                    except Exception:
-                        pass
-
-                scoring = calculate_score(
-                    syntax, dns, disposable, catch_all, smtp
-                )
-                out[idx] = _stamp(
-                    email=normalized,
-                    status=self._determine_status(scoring),
-                    syntax=syntax,
-                    dns=dns,
-                    disposable=disposable,
-                    catch_all=catch_all,
-                    smtp=smtp,
-                    scoring=scoring,
-                    checks_run=_build_checks_run(
-                        syntax, dns, disposable, catch_all, smtp, scoring
-                    ),
-                    reason_code=_build_reason_code(
-                        dns, disposable, catch_all, smtp
-                    ),
-                )
-
-        # Guarantee one result per input, in order.
-        for idx, result in enumerate(out):
-            if result is None:
-                raw = emails[idx]
-                syntax = parsed[idx][1] if idx < len(parsed) else validate_syntax(raw)
-                scoring = calculate_score(syntax, None, None, None, None)
-                out[idx] = _stamp(
-                    email=raw,
-                    status=ValidationStatus.UNKNOWN,
-                    syntax=syntax,
-                    scoring=scoring,
-                    checks_run=_build_checks_run(
-                        syntax, None, None, None, None, scoring
-                    ),
-                    reason_code="engine_missing_result",
-                )
-        return [r for r in out if r is not None]
-
-    def _determine_status(self, scoring: ScoringResult) -> ValidationStatus:
-        if scoring.score >= 75:
-            return ValidationStatus.VALID
-        elif scoring.score >= 40:
-            return ValidationStatus.RISKY
-        else:
-            return ValidationStatus.INVALID
-
-
-# Singleton engine
-engine = EmailValidationEngine()
+import asyncio
+import re
+import time
+import uuid
+from datetime import datetime, timezone
+from typing import Any, Optional
+import structlog
+
+from ..models import (
+    ValidationResult,
+    ValidationStatus,
+    ScoringResult,
+    CatchAllResult,
+    DNSResult,
+    DisposableResult,
+    SMTPResult,
+    SyntaxResult,
+)
+from ..config import settings
+from .syntax import validate_syntax
+from .dns_check import check_dns
+from .disposable import check_disposable, domain_in_blocklist, domain_is_known
+from .mailbox_provider import MailboxProvider, resolve_provider
+from .i18n import EAI_REASON, eai_gate
+from ..ml.hf_scorer import AIRiskScorer, ai_scorer, label_for_score, score_many_by_domain
+from ..ml.runtime import get_model_async, predict_async
+from .mx_intel import mx_is_trusted
+from .retry_queue import is_greylist_result
+from .scoring import calculate_score
+
+logger = structlog.get_logger()
+
+
+def _mask_email_for_log(email: str) -> str:
+    local_part, separator, domain = email.rpartition("@")
+    if not separator or not domain:
+        return "[invalid-email]"
+    return f"{local_part[:1]}***@{domain}"
+
+
+def _build_checks_run(
+    syntax: SyntaxResult | None,
+    dns: DNSResult | None,
+    disposable: DisposableResult | None,
+    catch_all: CatchAllResult | None,
+    smtp: SMTPResult | None,
+    scoring: ScoringResult | None,
+) -> list[str]:
+    """Which of the 7-layer taxonomy keys actually executed for this result.
+
+    Mirrors the frontend fallback in src/lib/verifier.ts classify() so a layer
+    the engine did not run is never reported as a pass. DNS without an error
+    claims both `dns` and `mx`; a DNS error claims only `dns`.
+    """
+    checks: list[str] = []
+    if syntax is not None:
+        checks.append("syntax")
+    if dns is not None:
+        if dns.error:
+            checks.append("dns")
+        else:
+            checks.extend(["dns", "mx"])
+    if disposable is not None:
+        checks.append("disposable")
+    if catch_all is not None:
+        checks.append("catch_all")
+    if smtp is not None:
+        checks.append("smtp")
+    if scoring is not None:
+        checks.append("scoring")
+    return checks
+
+
+def _build_reason_code(
+    dns: DNSResult | None,
+    disposable: DisposableResult | None,
+    catch_all: CatchAllResult | None,
+    smtp: SMTPResult | None,
+    *,
+    early: str | None = None,
+) -> str | None:
+    """Machine cause for the verdict. Ordered most-specific/actionable first.
+
+    disposable outranks everything (frontend classifies it as Disposable). A
+    definitive SMTP rejection (verified False + code) outranks the domain-level
+    catch-all flag: reporting "catch_all_detected" beside status=invalid is
+    incoherent — the explicit "mailbox does not exist" is the actionable fact.
+    Catch-all then outranks a merely inconclusive probe.
+    """
+    if early:
+        return early
+    if disposable is not None and disposable.is_disposable:
+        return "disposable"
+    if dns is not None and dns.a_fallback and not dns.has_mx_records:
+        return "a_fallback_only"
+    if smtp is not None and smtp.verified is False and smtp.smtp_code:
+        if smtp.smtp_code >= 500:
+            return "rcpt_5xx"
+        if smtp.smtp_code >= 400:
+            return "rcpt_4xx"
+        if smtp.smtp_code >= 200:
+            return "rcpt_2xx"
+    if catch_all is not None and catch_all.is_catch_all:
+        return "catch_all_detected"
+    if smtp is not None and smtp.verified is None and smtp.error:
+        return (
+            "smtp_timeout"
+            if re.search(r"timed?\s*out", smtp.error, re.IGNORECASE)
+            else "smtp_unavailable"
+        )
+    return None
+
+
+def _deterministic_verdict(
+    disposable: DisposableResult | None,
+    catch_all: CatchAllResult | None,
+    smtp: SMTPResult | None,
+) -> str:
+    """Pre-AI verdict of the deterministic gauntlet (spec Phase 5).
+
+    Order matters: an explicit mailbox rejection outranks the domain-level
+    catch-all flag (mirrors _build_reason_code), and a catch-all NEVER reads
+    "valid" even when the probe was accepted — it only proves the domain
+    accepts everything.
+    """
+    if disposable is not None and disposable.is_disposable:
+        return "disposable"
+    if (
+        smtp is not None
+        and smtp.verified is False
+        and smtp.smtp_code is not None
+        and smtp.smtp_code >= 500
+    ):
+        return "invalid"
+    if catch_all is not None and catch_all.is_catch_all:
+        return "catch_all"
+    if smtp is not None and smtp.verified is True:
+        return "valid"
+    return "unknown"
+
+
+def _smtp_class(smtp: SMTPResult | None) -> str:
+    """Coarse SMTP response class for the AI feature string (no PII)."""
+    if smtp is None:
+        return "skipped"
+    if smtp.verified is True:
+        return "accept"
+    if smtp.verified is False:
+        if smtp.smtp_code and smtp.smtp_code >= 500:
+            return "5xx"
+        if smtp.smtp_code and smtp.smtp_code >= 400:
+            return "4xx"
+        return "reject"
+    err = (smtp.error or "").lower()
+    if "worker" in err or "unreachable" in err:
+        return "transport_error"
+    return "unavailable"
+
+
+def _ambiguous(verdict: str) -> bool:
+    """Only these two reach the AI scorer (spec gate steps 6 and 8)."""
+    return verdict in {"catch_all", "unknown"}
+
+
+class EmailValidationEngine:
+    """
+    Master 7-Layer Email Validation Orchestrator.
+
+    Layers:
+      1. Syntax / RFC 5321 check
+      2. DNS domain existence
+      3. MX record verification
+      4. Disposable / Role-based / Free provider detection
+      5. Catch-all domain detection
+      6. SMTP mailbox verification
+      7. Deterministic heuristic deliverability scoring
+    """
+
+    def __init__(
+        self,
+        mailbox: MailboxProvider | None = None,
+        cache=None,
+        retry_queue=None,
+        scorer: AIRiskScorer | None = None,
+    ):
+        self.use_proxies = settings.use_proxies
+        # Layers 5 (catch-all) and 6 (SMTP) run through the autonomous mailbox
+        # layer: the built-in SMTP engine on this host, or the remote SMTP
+        # probe worker when SMTP_WORKER_URL is configured (spec §3.3).
+        self.mailbox = mailbox if mailbox is not None else resolve_provider()
+        # DNS/MX and definitive mailbox verdicts are cached across runs — the
+        # same domain (and often the same address) recurs constantly in bulk
+        # lists. Transient failures are never cached; see validation_cache.py.
+        if cache is None:
+            from .validation_cache import validation_cache as cache
+
+        self.cache = cache
+        # Greylisted (4xx) addresses get a bounded second chance. Without this a
+        # valid mailbox on a greylisting domain stays permanently "risky".
+        if retry_queue is None:
+            from .retry_queue import retry_queue as retry_queue
+
+        self.retry_queue = retry_queue
+        # AI risk scorer (spec §3.4): pattern-based classification for the
+        # ambiguous rows only; circuit breaker + heuristic fallback inside.
+        self.scorer = scorer if scorer is not None else ai_scorer
+
+    async def validate(self, email: str, deep: bool = True) -> ValidationResult:
+        start_time = time.monotonic()
+        run_id = uuid.uuid4().hex[:12]
+
+        log = logger.bind(email=_mask_email_for_log(email), run_id=run_id)
+        log.info("validation_started")
+
+        # ---- Layer 1: Syntax -----------------------------------------
+        syntax = validate_syntax(email)
+
+        if not syntax.passed:
+            elapsed = (time.monotonic() - start_time) * 1000
+            scoring = calculate_score(syntax, None, None, None, None)
+            log.warning("syntax_failed", error=syntax.error)
+            return ValidationResult(
+                email=email,
+                status=ValidationStatus.INVALID,
+                syntax=syntax,
+                scoring=scoring,
+                processing_time_ms=round(elapsed, 2),
+                validated_at=datetime.now(timezone.utc).isoformat(),
+                checks_run=_build_checks_run(syntax, None, None, None, None, scoring),
+                reason_code=_build_reason_code(None, None, None, None),
+                run_id=run_id,
+                validator_version=settings.app_version,
+                deterministic_verdict="invalid",
+            )
+
+        domain = syntax.domain
+        normalized_email = syntax.normalized_email or email
+
+        # ---- Layers 2 & 3: DNS + MX ---------------------------------
+        dns_result = await check_dns(domain, settings.dns_timeout)
+
+        if dns_result.error_code in {"timeout", "resolver_error"}:
+            elapsed = (time.monotonic() - start_time) * 1000
+            scoring = calculate_score(syntax, dns_result, None, None, None)
+            log.warning(
+                "dns_inconclusive", domain=domain, error_code=dns_result.error_code
+            )
+            return ValidationResult(
+                email=normalized_email,
+                status=self._determine_status(scoring),
+                syntax=syntax,
+                dns=dns_result,
+                scoring=scoring,
+                processing_time_ms=round(elapsed, 2),
+                validated_at=datetime.now(timezone.utc).isoformat(),
+                checks_run=_build_checks_run(syntax, dns_result, None, None, None, scoring),
+                reason_code=_build_reason_code(dns_result, None, None, None, early="dns_timeout"),
+                run_id=run_id,
+                validator_version=settings.app_version,
+                deterministic_verdict="unknown",
+            )
+
+        if (
+            not dns_result.domain_exists
+            or dns_result.error_code == "nxdomain"
+            or (not dns_result.has_mx_records and not dns_result.a_fallback)
+        ):
+            elapsed = (time.monotonic() - start_time) * 1000
+            scoring = calculate_score(syntax, dns_result, None, None, None)
+            log.warning("dns_failed", domain=domain)
+            return ValidationResult(
+                email=normalized_email,
+                status=ValidationStatus.INVALID,
+                syntax=syntax,
+                dns=dns_result,
+                scoring=scoring,
+                processing_time_ms=round(elapsed, 2),
+                validated_at=datetime.now(timezone.utc).isoformat(),
+                checks_run=_build_checks_run(syntax, dns_result, None, None, None, scoring),
+                reason_code=_build_reason_code(
+                    dns_result, None, None, None, early="nxdomain"
+                ),
+                run_id=run_id,
+                validator_version=settings.app_version,
+                deterministic_verdict="invalid",
+            )
+
+        # ---- Layer 4: Disposable Detection ---------------------------
+        disposable = check_disposable(normalized_email, domain)
+
+        # ML advisory (single path): unknown domains only, fail-open. Mirrors
+        # the batch pipeline so both surfaces agree on the same address.
+        # Skipped when the MX runs on a trusted enterprise platform: the model
+        # learned 'unfamiliar domain string = disposable' from an imbalanced
+        # dataset and flags legitimate small businesses on Google Workspace /
+        # M365 — the deterministic MX intelligence is the better signal there.
+        ml_model = await get_model_async()
+        mx_host = (
+            dns_result.mx_records[0]["host"]
+            if dns_result.mx_records
+            else None
+        )
+        if (
+            ml_model is not None
+            and not domain_is_known(domain)
+            and deep
+            and not mx_is_trusted(mx_host)
+        ):
+            # Off the event loop: CPU inference inline would stall every other
+            # concurrent request (measured 42.6s cold start before this).
+            preds = await predict_async(ml_model, [f"john.smith [SEP] {domain}"])
+            if preds:
+                disposable = disposable.model_copy(
+                    update={"ml_label": preds[0][0], "ml_confidence": preds[0][1]}
+                )
+
+        if not deep:
+            # Fast path: skip SMTP for quick validation
+            elapsed = (time.monotonic() - start_time) * 1000
+            scoring = calculate_score(
+                syntax,
+                dns_result,
+                disposable,
+                None,
+                None,
+                mailbox_verification_skipped=True,
+            )
+            status = self._determine_status(scoring)
+            return ValidationResult(
+                email=normalized_email,
+                status=status,
+                syntax=syntax,
+                dns=dns_result,
+                disposable=disposable,
+                scoring=scoring,
+                processing_time_ms=round(elapsed, 2),
+                validated_at=datetime.now(timezone.utc).isoformat(),
+                checks_run=_build_checks_run(
+                    syntax, dns_result, disposable, None, None, scoring
+                ),
+                reason_code=_build_reason_code(dns_result, disposable, None, None),
+                run_id=run_id,
+                validator_version=settings.app_version,
+                # Fast path: the mailbox question was never asked, so there is
+                # no deterministic mailbox verdict to report.
+                deterministic_verdict=None,
+            )
+
+        # ---- Layers 5 & 6: Catch-All + SMTP --------------------------
+        mx_host = dns_result.mx_records[0]["host"]
+
+        # EAI/SMTPUTF8 gate (spec §7.2): a non-ASCII local part can only be
+        # delivered when the receiving MX advertises SMTPUTF8. Without an SMTP
+        # dialogue the engine refuses the per-address probe deterministically
+        # instead of faking a verdict. The domain-level catch-all probe (a
+        # random ASCII local part) still runs — it is independent of the
+        # address's own local part.
+        eai_reason = eai_gate(syntax.local_part or "")
+
+        catch_all_task = asyncio.create_task(
+            self.mailbox.catch_all(domain, mx_host)
+        )
+        if eai_reason:
+            smtp_result = SMTPResult(
+                verified=None,
+                error=(
+                    f"{EAI_REASON}: mailbox probe requires SMTPUTF8 support "
+                    "(deterministic refusal)"
+                ),
+            )
+            try:
+                catch_all_raw = await catch_all_task
+            except Exception as exc:
+                # Same contract as the gather path: a failed probe is UNKNOWN.
+                catch_all_raw = exc
+        else:
+            smtp_task = asyncio.create_task(
+                self.mailbox.verify(normalized_email, mx_host)
+            )
+            catch_all_raw, smtp_result = await asyncio.gather(
+                catch_all_task, smtp_task, return_exceptions=True
+            )
+
+        # Handle catch-all result. An exception means the probe could not run
+        # (e.g. port-25 egress blocked) — that is UNKNOWN, not "not catch-all".
+        if isinstance(catch_all_raw, Exception):
+            catch_all = CatchAllResult(
+                is_catch_all=None, confidence=0.0, error=str(catch_all_raw)
+            )
+        else:
+            is_catch_all, confidence = catch_all_raw
+            catch_all = CatchAllResult(is_catch_all=is_catch_all, confidence=confidence)
+
+        # Handle SMTP result
+        if isinstance(smtp_result, Exception):
+            smtp_result = SMTPResult(verified=None, error=str(smtp_result))
+
+        # ---- Layer 7: Scoring ----------------------------------------
+        scoring = calculate_score(
+            syntax, dns_result, disposable, catch_all, smtp_result
+        )
+
+        status = self._determine_status(scoring)
+        elapsed = (time.monotonic() - start_time) * 1000
+
+        # ---- Normalized verdict (spec Phase 5): deterministic first, then AI --
+        deterministic = _deterministic_verdict(disposable, catch_all, smtp_result)
+        ai_score: float | None = None
+        ai_label: str | None = None
+        fallback_used = False
+        if deep and _ambiguous(deterministic):
+            features = AIRiskScorer.build_features(
+                domain=domain,
+                mx_host=mx_host,
+                smtp_class=_smtp_class(smtp_result),
+                catch_all=catch_all.is_catch_all if catch_all else None,
+                local_part=syntax.local_part or "",
+                dns_inconsistent=dns_result.dns_inconsistent,
+            )
+            scored = await self.scorer.score(features)
+            ai_score, ai_label, fallback_used = (
+                scored.score,
+                scored.label,
+                scored.fallback_used,
+            )
+            if scored.label == "high_risk":
+                scoring.warnings.append("ai_high_risk")
+        if dns_result.dns_inconsistent:
+            scoring.warnings.append("dns_inconsistent: resolvers disagree on MX")
+
+        reason = _build_reason_code(dns_result, disposable, catch_all, smtp_result)
+        if eai_reason:
+            reason = EAI_REASON
+
+        log.info(
+            "validation_complete",
+            status=status,
+            score=scoring.score,
+            time_ms=round(elapsed, 2),
+        )
+
+        return ValidationResult(
+            email=normalized_email,
+            status=status,
+            syntax=syntax,
+            dns=dns_result,
+            disposable=disposable,
+            catch_all=catch_all,
+            smtp=smtp_result,
+            scoring=scoring,
+            processing_time_ms=round(elapsed, 2),
+            validated_at=datetime.now(timezone.utc).isoformat(),
+            checks_run=_build_checks_run(
+                syntax, dns_result, disposable, catch_all, smtp_result, scoring
+            ),
+            reason_code=reason,
+            run_id=run_id,
+            validator_version=settings.app_version,
+            deterministic_verdict=deterministic,
+            ai_risk_score=ai_score,
+            ai_label=ai_label,
+            fallback_used=fallback_used,
+        )
+
+    async def validate_batch(
+        self, emails: list[str], deep: bool = True
+    ) -> list[ValidationResult]:
+        """Validate many addresses in one pass, reusing per-domain work.
+
+        Bulk throughput comes from doing DNS/MX **once per domain** and handing
+        every (email, mx_host) pair to the mailbox provider in a **single** call,
+        so the SMTP engine can reuse one session per receiving host instead of a
+        fresh TCP handshake per address. Providers that cannot batch fall back to
+        the per-address path, so behaviour is never worse than before.
+
+        Results are returned in the same order as `emails`.
+        """
+        if not emails:
+            return []
+
+        run_id = uuid.uuid4().hex[:12]
+        out: list[ValidationResult | None] = [None] * len(emails)
+
+        def _stamp(**kw) -> ValidationResult:
+            return ValidationResult(
+                processing_time_ms=0.0,
+                validated_at=datetime.now(timezone.utc).isoformat(),
+                run_id=run_id,
+                validator_version=settings.app_version,
+                **kw,
+            )
+
+        # ---- Layer 1: syntax (per address) ---------------------------
+        parsed: list[tuple[str, SyntaxResult]] = []
+        domain_index: dict[str, list[int]] = {}
+        for idx, raw in enumerate(emails):
+            syntax = validate_syntax(raw)
+            parsed.append((raw, syntax))
+            if not syntax.passed:
+                scoring = calculate_score(syntax, None, None, None, None)
+                out[idx] = _stamp(
+                    email=raw,
+                    status=ValidationStatus.INVALID,
+                    syntax=syntax,
+                    scoring=scoring,
+                    checks_run=_build_checks_run(syntax, None, None, None, None, scoring),
+                    reason_code=_build_reason_code(None, None, None, None),
+                )
+                continue
+            domain_index.setdefault(syntax.domain, []).append(idx)
+
+        # ---- Layers 2 & 3: DNS + MX once per domain (cached) ---------
+        domains = list(domain_index.keys())
+        domain_dns: dict[str, DNSResult] = {}
+        misses: list[str] = []
+        for domain in domains:
+            cached_dns = await self.cache.get_dns(domain)
+            if cached_dns is not None:
+                domain_dns[domain] = cached_dns
+            else:
+                misses.append(domain)
+
+        if misses:
+            resolved = await asyncio.gather(
+                *[check_dns(d, settings.dns_timeout) for d in misses],
+                return_exceptions=True,
+            )
+            for domain, dns in zip(misses, resolved):
+                result = (
+                    dns
+                    if isinstance(dns, DNSResult)
+                    else DNSResult(
+                        domain_exists=False,
+                        has_mx_records=False,
+                        error=str(dns),
+                        error_code="resolver_error",
+                    )
+                )
+                domain_dns[domain] = result
+                # put_dns ignores transient failures internally.
+                await self.cache.put_dns(domain, result)
+
+        pending: list[tuple[int, str, SyntaxResult, str, DNSResult]] = []
+        for domain, idxs in domain_index.items():
+            dns = domain_dns[domain]
+            inconclusive = dns.error_code in {"timeout", "resolver_error"}
+            dead = (
+                not dns.domain_exists
+                or dns.error_code == "nxdomain"
+                or (not dns.has_mx_records and not dns.a_fallback)
+            )
+            for idx in idxs:
+                raw, syntax = parsed[idx]
+                normalized = syntax.normalized_email or raw
+                if inconclusive:
+                    scoring = calculate_score(syntax, dns, None, None, None)
+                    out[idx] = _stamp(
+                        email=normalized,
+                        status=self._determine_status(scoring),
+                        syntax=syntax,
+                        dns=dns,
+                        scoring=scoring,
+                        checks_run=_build_checks_run(
+                            syntax, dns, None, None, None, scoring
+                        ),
+                        reason_code=_build_reason_code(
+                            dns, None, None, None, early="dns_timeout"
+                        ),
+                        deterministic_verdict="unknown",
+                    )
+                elif dead:
+                    scoring = calculate_score(syntax, dns, None, None, None)
+                    out[idx] = _stamp(
+                        email=normalized,
+                        status=ValidationStatus.INVALID,
+                        syntax=syntax,
+                        dns=dns,
+                        scoring=scoring,
+                        checks_run=_build_checks_run(
+                            syntax, dns, None, None, None, scoring
+                        ),
+                        reason_code=_build_reason_code(
+                            dns, None, None, None, early="nxdomain"
+                        ),
+                        deterministic_verdict="invalid",
+                    )
+                else:
+                    pending.append((idx, normalized, syntax, domain, dns))
+
+        # ---- Layer 4 fast path (no mailbox probe) --------------------
+        if pending and not deep:
+            for idx, normalized, syntax, domain, dns in pending:
+                disposable = check_disposable(normalized, domain)
+                scoring = calculate_score(
+                    syntax, dns, disposable, None, None,
+                    mailbox_verification_skipped=True,
+                )
+                out[idx] = _stamp(
+                    email=normalized,
+                    status=self._determine_status(scoring),
+                    syntax=syntax,
+                    dns=dns,
+                    disposable=disposable,
+                    scoring=scoring,
+                    checks_run=_build_checks_run(
+                        syntax, dns, disposable, None, None, scoring
+                    ),
+                    reason_code=_build_reason_code(dns, disposable, None, None),
+                    deterministic_verdict=None,
+                )
+            pending = []
+
+        # ---- Layers 5 & 6: ONE batched mailbox call ------------------
+        cached_verdicts: dict[str, tuple[SMTPResult, Optional[bool]]] = {}
+        catch_all_map: dict[str, Optional[bool]] = {}
+        if pending:
+            # Serve anything already answered (definitive verdicts only) so we
+            # never re-probe an address we already know the answer to.
+            to_probe: list[tuple[int, str, SyntaxResult, str, DNSResult]] = []
+            for item in pending:
+                _idx, normalized, _syntax, _domain, _dns = item
+                hit = await self.cache.get_verdict(normalized, deep)
+                if hit is None:
+                    to_probe.append(item)
+                else:
+                    cached_verdicts[normalized] = hit
+                    if hit[1] is not None:
+                        catch_all_map[item[3]] = hit[1]
+
+            smtp_map: dict[str, SMTPResult] = {}
+            pairs: list[tuple[str, str]] = []
+            for _idx, normalized, _syntax, _domain, _dns in to_probe:
+                if eai_gate(_syntax.local_part or ""):
+                    # Deterministic EAI refusal (spec §7.2): the probe requires
+                    # an SMTPUTF8 advertisement we cannot observe, so refuse
+                    # instead of guessing. Cache/check semantics unchanged.
+                    smtp_map[normalized] = SMTPResult(
+                        verified=None,
+                        error=(
+                            f"{EAI_REASON}: mailbox probe requires SMTPUTF8 "
+                            "(deterministic refusal)"
+                        ),
+                    )
+                    continue
+                if _dns.mx_records:
+                    pairs.append((normalized, _dns.mx_records[0]["host"]))
+                else:
+                    smtp_map[normalized] = SMTPResult(
+                        verified=None, error="no MX host available for probe"
+                    )
+            if pairs:
+                try:
+                    if hasattr(self.mailbox, "verify_many"):
+                        smtp_map, caught = await self.mailbox.verify_many(pairs)
+                        for domain, value in (caught or {}).items():
+                            catch_all_map.setdefault(domain, value)
+                    else:
+                        # Provider cannot batch: per-address fallback.
+                        for email, mx in pairs:
+                            smtp_map[email] = await self.mailbox.verify(email, mx)
+                        for domain in {e.rsplit("@", 1)[-1].lower() for e, _ in pairs}:
+                            mx = next(
+                                m for e, m in pairs
+                                if e.rsplit("@", 1)[-1].lower() == domain
+                            )
+                            value, _conf = await self.mailbox.catch_all(domain, mx)
+                            catch_all_map.setdefault(domain, value)
+                except Exception as exc:  # one bad stage must not abort the batch
+                    smtp_map = {
+                        e: SMTPResult(verified=None, error=f"mailbox_stage_error: {exc}")
+                        for e, _ in pairs
+                    }
+
+            # ---- ML advisory signal (unknown domains, ONE batched call) ----
+            # Runs only where the curated lists have no answer - the exact gap
+            # a static blocklist cannot close. Any failure here is silently
+            # ignored: the deterministic verdict stands.
+            # Domains on trusted enterprise MX (Google Workspace / M365 /
+            # gateways) are excluded: disposable domains essentially never run
+            # there, and the model's 'unfamiliar string' bias would otherwise
+            # flag legitimate businesses as disposable.
+            ml_map: dict[str, tuple[str, float]] = {}
+            ml_model = await get_model_async()
+            if ml_model is not None:
+                unknown_domains = sorted(
+                    {
+                        domain
+                        for _, _, _, domain, dns in pending
+                        if not domain_is_known(domain)
+                        and dns.mx_records
+                        and not mx_is_trusted(dns.mx_records[0]["host"])
+                    }
+                )
+                if unknown_domains:
+                    # One batched call, off the event loop (CPU inference inline
+                    # stalls concurrent requests), and fail-open by construction:
+                    # predict_async never raises.
+                    preds = await predict_async(
+                        ml_model, [f"john.smith [SEP] {d}" for d in unknown_domains]
+                    )
+                    if preds:
+                        ml_map = dict(zip(unknown_domains, preds))
+
+            # ---- Layer 7: score each row -----------------------------
+            ai_cache: dict[str, Any] = {}  # feature string -> AIScore (dedupe)
+            for idx, normalized, syntax, domain, dns in pending:
+                cached = cached_verdicts.get(normalized)
+                if cached is not None:
+                    smtp, ca_cached = cached
+                else:
+                    smtp = smtp_map.get(normalized) or SMTPResult(
+                        verified=None, error="engine returned no result"
+                    )
+                    ca_cached = None
+                    # Persist only definitive answers (verified verdict or a
+                    # confirmed catch-all); transient failures are never cached.
+                    await self.cache.put_verdict(
+                        normalized, deep, smtp, catch_all_map.get(domain)
+                    )
+
+                ca_value = (
+                    ca_cached if ca_cached is not None else catch_all_map.get(domain)
+                )
+                catch_all = CatchAllResult(
+                    is_catch_all=ca_value,
+                    confidence=0.9 if ca_value is not None else 0.0,
+                )
+                disposable = check_disposable(normalized, domain)
+                ml = ml_map.get(domain)
+                if ml is not None:
+                    disposable = disposable.model_copy(
+                        update={"ml_label": ml[0], "ml_confidence": ml[1]}
+                    )
+
+                # A 4xx means "come back later", not a verdict. Schedule one
+                # bounded retry so a real mailbox on a greylisting domain is not
+                # stranded as permanently risky. The queue never raises.
+                if cached is None:
+                    try:
+                        if is_greylist_result(smtp):
+                            await self.retry_queue.enqueue(
+                                normalized, dns.mx_records[0]["host"], smtp.smtp_code
+                            )
+                        elif smtp.verified is not None:
+                            # Definitive answer — cancel any pending retry.
+                            await self.retry_queue.resolve_email(normalized)
+                    except Exception:
+                        pass
+
+                scoring = calculate_score(
+                    syntax, dns, disposable, catch_all, smtp
+                )
+
+                # ---- Normalized verdict (spec Phase 5) -------------------
+                deterministic = _deterministic_verdict(disposable, catch_all, smtp)
+                ai_score: float | None = None
+                ai_label: str | None = None
+                fallback_used = False
+                if deep and _ambiguous(deterministic):
+                    feats = AIRiskScorer.build_features(
+                        domain=domain,
+                        mx_host=dns.mx_records[0]["host"] if dns.mx_records else None,
+                        smtp_class=_smtp_class(smtp),
+                        catch_all=ca_value,
+                        local_part=syntax.local_part or "",
+                        dns_inconsistent=dns.dns_inconsistent,
+                    )
+                    if feats not in ai_cache:
+                        ai_cache[feats] = await self.scorer.score(feats)
+                    scored = ai_cache[feats]
+                    ai_score, ai_label, fallback_used = (
+                        scored.score,
+                        scored.label,
+                        scored.fallback_used,
+                    )
+                    if scored.label == "high_risk":
+                        scoring.warnings.append("ai_high_risk")
+                if dns.dns_inconsistent:
+                    scoring.warnings.append("dns_inconsistent: resolvers disagree on MX")
+                reason = _build_reason_code(dns, disposable, catch_all, smtp)
+                if (syntax.local_part or "") and eai_gate(syntax.local_part or ""):
+                    reason = EAI_REASON
+
+                out[idx] = _stamp(
+                    email=normalized,
+                    status=self._determine_status(scoring),
+                    syntax=syntax,
+                    dns=dns,
+                    disposable=disposable,
+                    catch_all=catch_all,
+                    smtp=smtp,
+                    scoring=scoring,
+                    checks_run=_build_checks_run(
+                        syntax, dns, disposable, catch_all, smtp, scoring
+                    ),
+                    reason_code=reason,
+                    deterministic_verdict=deterministic,
+                    ai_risk_score=ai_score,
+                    ai_label=ai_label,
+                    fallback_used=fallback_used,
+                    cache_hit=cached is not None,
+                )
+
+        # Guarantee one result per input, in order.
+        for idx, result in enumerate(out):
+            if result is None:
+                raw = emails[idx]
+                syntax = parsed[idx][1] if idx < len(parsed) else validate_syntax(raw)
+                scoring = calculate_score(syntax, None, None, None, None)
+                out[idx] = _stamp(
+                    email=raw,
+                    status=ValidationStatus.UNKNOWN,
+                    syntax=syntax,
+                    scoring=scoring,
+                    checks_run=_build_checks_run(
+                        syntax, None, None, None, None, scoring
+                    ),
+                    reason_code="engine_missing_result",
+                    deterministic_verdict="unknown",
+                )
+        return [r for r in out if r is not None]
+
+    def _determine_status(self, scoring: ScoringResult) -> ValidationStatus:
+        if scoring.score >= 75:
+            return ValidationStatus.VALID
+        elif scoring.score >= 40:
+            return ValidationStatus.RISKY
+        else:
+            return ValidationStatus.INVALID
+
+
+# Singleton engine
+engine = EmailValidationEngine()

app/validator/i18n.py

@@ -0,0 +1,76 @@
+"""Internationalization primitives for the autonomous engine.
+
+Covers the two i18n hard requirements from the architecture spec:
+
+7.1  Punycode / IDN domains — a Unicode domain (e.g. bücher.example) must be
+     normalized to Punycode (RFC 3492, "xn--…") before MX resolution and SMTP
+     probing. The `email-validator` library already does this at Layer 1, but
+     every other layer (DoH resolver, DNS cache keys, SMTP dialogue) must ALSO
+     receive the ASCII form, so the conversion lives here as the single source.
+
+7.2  EAI / SMTPUTF8 local parts — a non-ASCII local part (utf8@bücher.example)
+     can only be delivered when the receiving MX advertises SMTPUTF8. Without
+     an SMTP dialogue we cannot observe the advertisement, so the engine must
+     NOT claim a definitive verdict for these addresses: it refuses the probe
+     deterministically and reports `unsupported_eai` (honest unknown, never a
+     fake invalid).
+"""
+from __future__ import annotations
+
+import idna
+
+EAI_REASON = "unsupported_eai"
+
+
+def to_punycode(domain: str) -> str:
+    """Return the ASCII (Punycode) form of a domain, best-effort.
+
+    Already-ASCII domains pass through unchanged (fast path). A domain that
+    cannot be encoded (malformed Unicode, over-long label) is returned as-is —
+    DNS will then fail naturally and the verdict degrades honestly.
+    """
+    if not domain:
+        return domain
+    try:
+        domain.encode("ascii")
+        return domain  # pure ASCII — nothing to do
+    except UnicodeEncodeError:
+        pass
+    try:
+        return idna.encode(domain, uts46=True).decode("ascii")
+    except Exception:
+        # Last resort: Python's builtin IDNA (RFC 3490 without uts46 mapping)
+        try:
+            return domain.encode("idna").decode("ascii")
+        except Exception:
+            return domain
+
+
+def domain_is_unicode(domain: str) -> bool:
+    """True when the domain needs Punycode (contains non-ASCII labels)."""
+    try:
+        domain.encode("ascii")
+        return False
+    except UnicodeEncodeError:
+        return True
+
+
+def local_part_is_ascii(local_part: str) -> bool:
+    """True when the local part is plain ASCII (no EAI/SMTPUTF8 needed)."""
+    try:
+        (local_part or "").encode("ascii")
+        return True
+    except UnicodeEncodeError:
+        return False
+
+
+def eai_gate(local_part: str) -> str | None:
+    """Deterministic EAI gate for the mailbox-probe layers.
+
+    Returns None when the local part is ASCII and probing may proceed.
+    Returns the machine reason ("unsupported_eai") when the address requires
+    SMTPUTF8 and this deployment cannot honestly verify it.
+    """
+    if local_part_is_ascii(local_part):
+        return None
+    return EAI_REASON

app/validator/mailbox_provider.py

@@ -1,19 +1,27 @@
 """Mailbox verification providers (Layer 5 catch-all + Layer 6 SMTP).
 
-Direct SMTP to the recipient MX on port 25 is the classic mailbox probe, but
-most cloud hosts — Hugging Face Spaces included — block outbound port 25. When
-direct SMTP cannot run, the mailbox verdict is delegated to a third-party
-verification API (MillionVerifier) whose status strings map 1:1 onto this
-product's taxonomy.
-
-resolve_provider() picks the provider from settings:
-    mailbox_provider = "auto"  → API when mv_api_key is set, else local SMTP
-    mailbox_provider = "api"   → force the verification API
-    mailbox_provider = "local" → force direct SMTP
-
-The circuit breaker on LocalSmtpProvider stops a blocked host from burning the
-full SMTP timeout on every address in a bulk job: after `fail_threshold`
-consecutive connection failures it fails fast for `cooldown_seconds`.
+The engine is FULLY AUTONOMOUS (v3.0.0): mailbox verdicts come from its own
+SMTP probing engine — no third-party verification API, no vendor key, no
+per-check fee. The former MillionVerifier delegation was removed by design
+decision: a stray key must never be able to re-route verification data (and
+the full recipient list) through a vendor.
+
+resolve_provider() picks the mailbox layer from settings:
+
+    mailbox_provider = "auto"   → remote SMTP worker when SMTP_WORKER_URL is
+                                  configured, else the built-in engine
+    mailbox_provider = "local"  → built-in SMTP engine (this host)
+    mailbox_provider = "remote" → the remote SMTP probe worker (spec §3.3)
+
+RemoteSmtpWorkerProvider implements the four-worker architecture: the
+orchestrator (this app) delegates the port-25 dialogue to a separate
+deployment of the same image running on a host whose egress allows it
+(see POST /api/v1/smtp/probe in routes.py). A shared secret
+(SMTP_WORKER_TOKEN) guards the worker route.
+
+Both providers embed a circuit breaker so a host with blocked port-25 egress
+(or a dead worker) fails fast instead of burning the full SMTP timeout on
+every address in a bulk job.
 """
 from __future__ import annotations
 
@@ -25,44 +33,10 @@ from typing import Optional, Tuple
 import httpx
 
 from ..config import settings
-from ..models import CatchAllResult, SMTPResult
+from ..models import SMTPResult
 from .smtp_verify import GIBBERISH_LOCAL, smtp_verifier
 
 
-def map_mv_result(payload: dict) -> SMTPResult:
-    """Map one MillionVerifier real-time response into our SMTPResult contract.
-
-    Live schema (verified 2026-10-11 against API_KEY_FOR_TEST):
-        {"result": "ok"|"catch_all"|"invalid"|"disposable"|"unknown"|"error",
-         "quality": "good"|"risky"|"bad", "resultcode": <int>,
-         "free": bool, "role": bool, "error": str}
-    """
-    result = (payload.get("result") or "").lower()
-    error = payload.get("error") or ""
-
-    if result == "ok":
-        return SMTPResult(verified=True, smtp_code=250, smtp_message="provider: ok")
-    if result == "invalid":
-        # A provider-confirmed dead mailbox is a permanent (5xx-class) reject.
-        # The message MUST carry an explicit mailbox-rejection phrase so
-        # scoring._is_explicit_mailbox_rejection() hard-fails it to score 0
-        # (Invalid) — a bare "invalid" would be softened to -30 "inconclusive"
-        # and mis-score a definitive answer as risky.
-        return SMTPResult(
-            verified=False,
-            smtp_code=550,
-            smtp_message=error or "550 mailbox does not exist (provider confirmed)",
-        )
-    if result in {"catch_all", "unknown", "disposable"}:
-        # None of these proves the specific mailbox exists. catch_all accepts
-        # everything; unknown is the provider's own inconclusive bucket.
-        return SMTPResult(
-            verified=None, error=f"provider: {result}" + (f" ({error})" if error else "")
-        )
-    # "error" or anything unexpected → inconclusive, surfaced as an error.
-    return SMTPResult(verified=None, error=f"provider: {result or 'error'} {error}".strip())
-
-
 class MailboxProvider:
     """Common interface every mailbox provider implements."""
 
@@ -75,50 +49,6 @@ class MailboxProvider:
         raise NotImplementedError
 
 
-class MillionVerifierProvider(MailboxProvider):
-    name = "millionverifier"
-
-    def __init__(self, api_key: Optional[str] = None, timeout: Optional[int] = None):
-        self.api_key = api_key if api_key is not None else settings.mv_api_key
-        self.timeout = timeout if timeout is not None else settings.mv_timeout
-        self.endpoint = "https://api.millionverifier.com/api/v3/"
-
-    async def _call(self, email: str) -> dict:
-        async with httpx.AsyncClient(timeout=self.timeout + 5) as client:
-            resp = await client.get(
-                self.endpoint,
-                params={"api": self.api_key, "email": email, "timeout": self.timeout},
-            )
-            resp.raise_for_status()
-            return resp.json()
-
-    async def verify(self, email: str, mx_host: str) -> SMTPResult:
-        try:
-            payload = await self._call(email)
-        except Exception as exc:  # network / HTTP failure → inconclusive
-            return SMTPResult(verified=None, error=f"provider unavailable: {exc}")
-        return map_mv_result(payload)
-
-    async def catch_all(self, domain: str, mx_host: str) -> Tuple[Optional[bool], float]:
-        # Domain property: probe a high-entropy gibberish local part. A 250 on
-        # gibberish ⇒ catch-all; a reject ⇒ not. The real address must never be
-        # used here (it would always "accept", a false negative).
-        gibberish = f"{GIBBERISH_LOCAL}{random.getrandbits(32):08x}@{domain}"
-        try:
-            payload = await self._call(gibberish)
-        except Exception:
-            return None, 0.0
-        result = (payload.get("result") or "").lower()
-        if result == "catch_all":
-            return True, 0.95
-        if result == "invalid":
-            return False, 0.9
-        # "ok" on gibberish would itself indicate catch-all; unknown/error → None
-        if result == "ok":
-            return True, 0.8
-        return None, 0.0
-
-
 class AutonomousSmtpProvider(MailboxProvider):
     """The self-contained engine: own SMTP probing, no third-party service.
 
@@ -190,16 +120,27 @@ class AutonomousSmtpProvider(MailboxProvider):
         return results, catch_all
 
 
-class LocalSmtpProvider(MailboxProvider):
-    """Direct port-25 SMTP with a circuit breaker for blocked egress."""
+class RemoteSmtpWorkerProvider(MailboxProvider):
+    """Delegates the port-25 dialogue to a remote SMTP probe worker (§3.3).
 
-    name = "local"
+    The worker is any deployment of this same image whose SMTP_WORKER_URL this
+    orchestrator can reach. Egress requirement moves to the worker host; the
+    orchestrator stays PaaS-deployable.
+    """
+
+    name = "remote"
 
     def __init__(
         self,
+        url: Optional[str] = None,
+        token: Optional[str] = None,
+        timeout: Optional[int] = None,
         fail_threshold: Optional[int] = None,
         cooldown_seconds: Optional[int] = None,
     ):
+        self.url = (url if url is not None else settings.smtp_worker_url).rstrip("/")
+        self.token = token if token is not None else settings.smtp_worker_token
+        self.timeout = timeout if timeout is not None else settings.smtp_worker_timeout
         self.fail_threshold = (
             fail_threshold if fail_threshold is not None else settings.smtp_fail_threshold
         )
@@ -211,6 +152,131 @@ class LocalSmtpProvider(MailboxProvider):
         self._consecutive_failures = 0
         self._open_until = 0.0
 
+    # ---- circuit breaker (same contract as LocalSmtpProvider) --------------
+    @property
+    def circuit_open(self) -> bool:
+        return time.monotonic() < self._open_until
+
+    def record_failure(self) -> None:
+        self._consecutive_failures += 1
+        if self._consecutive_failures >= self.fail_threshold:
+            self._open_until = time.monotonic() + self.cooldown
+
+    def record_success(self) -> None:
+        self._consecutive_failures = 0
+        self._open_until = 0.0
+
+    def _headers(self) -> dict:
+        h = {"Content-Type": "application/json"}
+        if self.token:
+            h["X-Worker-Token"] = self.token
+        return h
+
+    async def _post(self, path: str, payload: dict):
+        async with httpx.AsyncClient(timeout=self.timeout + 5) as client:
+            resp = await client.post(
+                f"{self.url}/smtp{path}", json=payload, headers=self._headers()
+            )
+            resp.raise_for_status()
+            return resp.json()
+
+    async def verify(self, email: str, mx_host: str) -> SMTPResult:
+        if self.circuit_open:
+            return SMTPResult(
+                verified=None, error="SMTP worker unavailable (circuit open)"
+            )
+        try:
+            data = await self._post(
+                "/probe", {"email": email, "mx_host": mx_host}
+            )
+            result = SMTPResult(**data)
+        except Exception as exc:
+            self.record_failure()
+            return SMTPResult(
+                verified=None, error=f"smtp_worker_unreachable: {exc}"
+            )
+        self.record_success()
+        return result
+
+    async def catch_all(
+        self, domain: str, mx_host: str
+    ) -> Tuple[Optional[bool], float]:
+        if self.circuit_open:
+            return None, 0.0
+        try:
+            data = await self._post(
+                "/probe", {"domain": domain, "mx_host": mx_host, "probe": "catch_all"}
+            )
+        except Exception:
+            self.record_failure()
+            return None, 0.0
+        self.record_success()
+        value = data.get("is_catch_all")
+        confidence = float(data.get("confidence", 0.0) or 0.0)
+        if value is None or confidence == 0.0:
+            return None, 0.0
+        return bool(value), confidence
+
+    async def verify_many(self, pairs):
+        pairs = [(e, mx) for e, mx in pairs if e and mx]
+        if not pairs:
+            return {}, {}
+        if self.circuit_open:
+            return (
+                {
+                    e: SMTPResult(
+                        verified=None, error="SMTP worker unavailable (circuit open)"
+                    )
+                    for e, _ in pairs
+                },
+                {},
+            )
+        try:
+            data = await self._post(
+                "/probe/batch", {"pairs": [[e, mx] for e, mx in pairs]}
+            )
+            results = {
+                e: SMTPResult(**row) for e, row in (data.get("results") or {}).items()
+            }
+            catch_all = {d: v for d, v in (data.get("catch_all") or {}).items()}
+            self.record_success()
+            return results, catch_all
+        except Exception as exc:
+            self.record_failure()
+            return (
+                {
+                    e: SMTPResult(
+                        verified=None, error=f"smtp_worker_unreachable: {exc}"
+                    )
+                    for e, _ in pairs
+                },
+                {},
+            )
+
+
+class LocalSmtpProvider(MailboxProvider):
+    """Direct port-25 SMTP (one dialogue per call) with a circuit breaker.
+
+    Kept as the building block for single-probe paths and tests; bulk traffic
+    goes through AutonomousSmtpProvider's session-reusing batch engine.
+    """
+
+    name = "local"
+
+    def __init__(
+        self,
+        fail_threshold: Optional[int] = None,
+        cooldown_seconds: Optional[int] = None,
+    ):
+        self.fail_threshold = (
+            fail_threshold if fail_threshold is not None else settings.smtp_fail_threshold
+        )
+        self.cooldown = (
+            cooldown_seconds if cooldown_seconds is not None else settings.smtp_cooldown_seconds
+        )
+        self._consecutive_failures = 0
+        self._open_until = 0.0
+
     @property
     def circuit_open(self) -> bool:
         return time.monotonic() < self._open_until
@@ -262,19 +328,22 @@ class LocalSmtpProvider(MailboxProvider):
 
 
 def resolve_provider() -> MailboxProvider:
-    """Pick the mailbox provider.
+    """Pick the mailbox layer.
 
-    The validator is autonomous by default: it uses its own SMTP engine and
-    needs no third-party account. The verification API is opt-in only
-    (`mailbox_provider="api"`, or `prefer_api_provider=True` with a key set) —
-    a stray key must never silently re-route the engine through a vendor.
+    Fully autonomous by default: the built-in SMTP engine answers with no
+    external dependency. A configured SMTP_WORKER_URL shifts the port-25
+    dialogue to the dedicated worker host — nothing else changes.
     """
     mode = (settings.mailbox_provider or "auto").strip().lower()
-    if mode == "api":
-        return MillionVerifierProvider()
+    if mode == "remote":
+        if settings.smtp_worker_url:
+            return RemoteSmtpWorkerProvider()
+        # Misconfiguration must not crash the API: degrade to the built-in
+        # engine, which reports honest transport failures.
+        return AutonomousSmtpProvider()
     if mode == "local":
         return AutonomousSmtpProvider()
-    # auto → own engine, unless API use was explicitly preferred and configured.
-    if settings.mv_api_key and getattr(settings, "prefer_api_provider", False):
-        return MillionVerifierProvider()
+    # auto → remote worker when configured, else built-in.
+    if settings.smtp_worker_url:
+        return RemoteSmtpWorkerProvider()
     return AutonomousSmtpProvider()

tests/test_autonomous_provider.py

@@ -6,7 +6,7 @@ from app.models import SMTPResult
 from app.validator.mailbox_provider import (
     AutonomousSmtpProvider,
     LocalSmtpProvider,
-    MillionVerifierProvider,
+    RemoteSmtpWorkerProvider,
     resolve_provider,
 )
 
@@ -64,9 +64,9 @@ class AutonomousProviderTests(unittest.IsolatedAsyncioTestCase):
 
 
 class DefaultProviderTests(unittest.TestCase):
-    def test_auto_without_key_resolves_to_autonomous(self):
+    def test_auto_without_worker_resolves_to_autonomous(self):
         with patch.object(settings, "mailbox_provider", "auto"), patch.object(
-            settings, "mv_api_key", ""
+            settings, "smtp_worker_url", ""
         ):
             self.assertIsInstance(resolve_provider(), AutonomousSmtpProvider)
 
@@ -74,29 +74,16 @@ class DefaultProviderTests(unittest.TestCase):
         with patch.object(settings, "mailbox_provider", "local"):
             self.assertIsInstance(resolve_provider(), AutonomousSmtpProvider)
 
-    def test_api_forced_still_available(self):
-        with patch.object(settings, "mailbox_provider", "api"), patch.object(
-            settings, "mv_api_key", "k"
-        ):
-            self.assertIsInstance(resolve_provider(), MillionVerifierProvider)
-
-    def test_auto_with_key_and_preference_uses_api(self):
-        with patch.object(settings, "mailbox_provider", "auto"), patch.object(
-            settings, "mv_api_key", "k"
-        ), patch.object(settings, "prefer_api_provider", True):
-            self.assertIsInstance(resolve_provider(), MillionVerifierProvider)
-
-    def test_auto_with_key_but_no_preference_stays_autonomous(self):
-        # Independence by default: a stray key must not silently re-route the
-        # engine through a third party.
+    def test_auto_with_worker_resolves_remote(self):
         with patch.object(settings, "mailbox_provider", "auto"), patch.object(
-            settings, "mv_api_key", "k"
-        ), patch.object(settings, "prefer_api_provider", False):
-            self.assertIsInstance(resolve_provider(), AutonomousSmtpProvider)
+            settings, "smtp_worker_url", "https://worker.example.com"
+        ):
+            self.assertIsInstance(resolve_provider(), RemoteSmtpWorkerProvider)
 
     def test_legacy_local_provider_still_importable(self):
         self.assertTrue(callable(LocalSmtpProvider))
 
 
+
 if __name__ == "__main__":
     unittest.main()

tests/test_dns_concurrency.py

@@ -3,9 +3,16 @@ import time
 import unittest
 from unittest.mock import patch
 
+from app.config import settings
 from app.validator import dns_check
 
 
+def disable_doh():
+    """Concurrency tests target the legacy dnspython lookups; keep DoH off so
+    the MX gate does not hit the network."""
+    return patch.object(settings, "doh_enabled", False)
+
+
 class FakeAnswer:
     def __init__(self, text: str):
         self.strings = [text.encode()]
@@ -39,7 +46,7 @@ class DnsAuthConcurrencyTests(unittest.IsolatedAsyncioTestCase):
     """
 
     async def test_auth_record_lookups_run_concurrently(self):
-        with patch.object(dns_check.dns.asyncresolver, "Resolver",
+        with disable_doh(), patch.object(dns_check.dns.asyncresolver, "Resolver",
                           return_value=SlowResolver()):
             t0 = time.perf_counter()
             result = await dns_check.check_dns("example.test")
@@ -65,7 +72,7 @@ class DnsAuthConcurrencyTests(unittest.IsolatedAsyncioTestCase):
                                             "preference": 10})()]
                 raise dns_check.dns.resolver.NoAnswer()
 
-        with patch.object(dns_check.dns.asyncresolver, "Resolver", return_value=Bare()):
+        with disable_doh(), patch.object(dns_check.dns.asyncresolver, "Resolver", return_value=Bare()):
             result = await dns_check.check_dns("example.test")
 
         self.assertTrue(result.has_mx_records)

tests/test_dns_correctness.py

@@ -1,95 +1,103 @@
-import unittest
-from unittest.mock import patch
-
-import dns.exception
-import dns.resolver
-
-from app.validator.dns_check import check_dns
-
-
-class ResolverStub:
-    timeout = 0
-    lifetime = 0
-
-    def __init__(self, responses):
-        self.responses = responses
-
-    async def resolve(self, name, record_type):
-        response = self.responses.get((name, record_type))
-        if isinstance(response, Exception):
-            raise response
-        if response is None:
-            raise dns.resolver.NoAnswer()
-        return response
-
-
-class DNSCheckTests(unittest.IsolatedAsyncioTestCase):
-    async def test_timeout_is_reported_as_transient(self):
-        resolver = ResolverStub({("example.test", "MX"): dns.exception.Timeout()})
-        with patch(
-            "app.validator.dns_check.dns.asyncresolver.Resolver", return_value=resolver
-        ):
-            result = await check_dns("example.test")
-
-        self.assertEqual(result.error_code, "timeout")
-        self.assertFalse(result.domain_exists)
-
-    async def test_no_nameservers_is_reported_as_transient(self):
-        resolver = ResolverStub(
-            {("unavailable.test", "MX"): dns.resolver.NoNameservers()}
-        )
-        with patch(
-            "app.validator.dns_check.dns.asyncresolver.Resolver", return_value=resolver
-        ):
-            result = await check_dns("unavailable.test")
-
-        self.assertEqual(result.error_code, "resolver_error")
-
-    async def test_nxdomain_is_reported_as_definitive(self):
-        resolver = ResolverStub({("missing.test", "MX"): dns.resolver.NXDOMAIN()})
-        with patch(
-            "app.validator.dns_check.dns.asyncresolver.Resolver", return_value=resolver
-        ):
-            result = await check_dns("missing.test")
-
-        self.assertEqual(result.error_code, "nxdomain")
-        self.assertFalse(result.domain_exists)
-
-    async def test_a_record_fallback_is_preserved(self):
-        resolver = ResolverStub(
-            {
-                ("mail.example.test", "MX"): dns.resolver.NoAnswer(),
-                ("mail.example.test", "A"): ["192.0.2.10"],
-            }
-        )
-        with patch(
-            "app.validator.dns_check.dns.asyncresolver.Resolver", return_value=resolver
-        ):
-            result = await check_dns("mail.example.test")
-
-        self.assertTrue(result.domain_exists)
-        self.assertFalse(result.has_mx_records)
-        self.assertTrue(result.a_fallback)
-        self.assertEqual(result.mx_records[0]["host"], "mail.example.test")
-
-    async def test_no_mx_or_address_is_distinct_from_transient_dns_error(self):
-        resolver = ResolverStub(
-            {
-                ("no-mail.example.test", "MX"): dns.resolver.NoAnswer(),
-                ("no-mail.example.test", "A"): dns.resolver.NoAnswer(),
-                ("no-mail.example.test", "AAAA"): dns.resolver.NoAnswer(),
-            }
-        )
-        with patch(
-            "app.validator.dns_check.dns.asyncresolver.Resolver", return_value=resolver
-        ):
-            result = await check_dns("no-mail.example.test")
-
-        self.assertEqual(result.error_code, "no_mail_records")
-        self.assertTrue(result.domain_exists)
-        self.assertFalse(result.has_mx_records)
-        self.assertFalse(result.a_fallback)
-
-
-if __name__ == "__main__":
-    unittest.main()
+import unittest
+from unittest.mock import patch
+
+import dns.exception
+import dns.resolver
+
+from app.config import settings
+from app.validator.dns_check import check_dns
+
+
+def disable_doh():
+    """These tests exercise the LEGACY dnspython path — keep them hermetic by
+    turning the DoH layer off (its own behaviour is covered by
+    test_doh_resolver.py)."""
+    return patch.object(settings, "doh_enabled", False)
+
+
+class ResolverStub:
+    timeout = 0
+    lifetime = 0
+
+    def __init__(self, responses):
+        self.responses = responses
+
+    async def resolve(self, name, record_type):
+        response = self.responses.get((name, record_type))
+        if isinstance(response, Exception):
+            raise response
+        if response is None:
+            raise dns.resolver.NoAnswer()
+        return response
+
+
+class DNSCheckTests(unittest.IsolatedAsyncioTestCase):
+    async def test_timeout_is_reported_as_transient(self):
+        resolver = ResolverStub({("example.test", "MX"): dns.exception.Timeout()})
+        with disable_doh(), patch(
+            "app.validator.dns_check.dns.asyncresolver.Resolver", return_value=resolver
+        ):
+            result = await check_dns("example.test")
+
+        self.assertEqual(result.error_code, "timeout")
+        self.assertFalse(result.domain_exists)
+
+    async def test_no_nameservers_is_reported_as_transient(self):
+        resolver = ResolverStub(
+            {("unavailable.test", "MX"): dns.resolver.NoNameservers()}
+        )
+        with disable_doh(), patch(
+            "app.validator.dns_check.dns.asyncresolver.Resolver", return_value=resolver
+        ):
+            result = await check_dns("unavailable.test")
+
+        self.assertEqual(result.error_code, "resolver_error")
+
+    async def test_nxdomain_is_reported_as_definitive(self):
+        resolver = ResolverStub({("missing.test", "MX"): dns.resolver.NXDOMAIN()})
+        with disable_doh(), patch(
+            "app.validator.dns_check.dns.asyncresolver.Resolver", return_value=resolver
+        ):
+            result = await check_dns("missing.test")
+
+        self.assertEqual(result.error_code, "nxdomain")
+        self.assertFalse(result.domain_exists)
+
+    async def test_a_record_fallback_is_preserved(self):
+        resolver = ResolverStub(
+            {
+                ("mail.example.test", "MX"): dns.resolver.NoAnswer(),
+                ("mail.example.test", "A"): ["192.0.2.10"],
+            }
+        )
+        with disable_doh(), patch(
+            "app.validator.dns_check.dns.asyncresolver.Resolver", return_value=resolver
+        ):
+            result = await check_dns("mail.example.test")
+
+        self.assertTrue(result.domain_exists)
+        self.assertFalse(result.has_mx_records)
+        self.assertTrue(result.a_fallback)
+        self.assertEqual(result.mx_records[0]["host"], "mail.example.test")
+
+    async def test_no_mx_or_address_is_distinct_from_transient_dns_error(self):
+        resolver = ResolverStub(
+            {
+                ("no-mail.example.test", "MX"): dns.resolver.NoAnswer(),
+                ("no-mail.example.test", "A"): dns.resolver.NoAnswer(),
+                ("no-mail.example.test", "AAAA"): dns.resolver.NoAnswer(),
+            }
+        )
+        with disable_doh(), patch(
+            "app.validator.dns_check.dns.asyncresolver.Resolver", return_value=resolver
+        ):
+            result = await check_dns("no-mail.example.test")
+
+        self.assertEqual(result.error_code, "no_mail_records")
+        self.assertTrue(result.domain_exists)
+        self.assertFalse(result.has_mx_records)
+        self.assertFalse(result.a_fallback)
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_doh_resolver.py

@@ -0,0 +1,220 @@
+"""DoH DNS/MX worker tests (spec §3.2 / §7.3) — mocked HTTP, hermetic."""
+import unittest
+from unittest.mock import AsyncMock, patch
+
+from app.validator import doh_resolver
+from app.validator.doh_resolver import (
+    _mx_sets_match,
+    _parse_mx,
+    resolve_mx_dual,
+    resolve_mx_dual_cached,
+)
+
+
+def _doh_response(status=0, answers=None):
+    return {"Status": status, "Answer": answers or []}
+
+
+def _mx_answer(priority, host):
+    return {"name": "example.com.", "type": 15, "TTL": 300, "data": f"{priority} {host}"}
+
+
+def _a_answer(ip="93.184.216.34"):
+    return {"name": "example.com.", "type": 1, "TTL": 300, "data": ip}
+
+
+class _FakeResp:
+    def __init__(self, data):
+        self._data = data
+
+    def raise_for_status(self):
+        return None
+
+    def json(self):
+        return self._data
+
+
+class FakeDoHClient:
+    """Routes by (host, type) so MX / A / AAAA queries can differ.
+
+    `responses` maps ("google"|"cloudflare", rtype) -> payload-or-Exception.
+    """
+
+    responses: dict = {}
+
+    def __init__(self, responses=None, *a, **kw):
+        if responses is not None:
+            self.responses = responses
+
+    async def __aenter__(self):
+        return self
+
+    async def __aexit__(self, *a):
+        return False
+
+    async def get(self, url, params=None, **kw):
+        host = "google" if "dns.google" in url else "cloudflare"
+        rtype = (params or {}).get("type", "MX")
+        payload = self.responses.get((host, rtype))
+        if payload is None:
+            payload = {"Status": 0, "Answer": []}
+        if isinstance(payload, Exception):
+            raise payload
+        return _FakeResp(payload)
+
+
+def _client_patch(responses):
+    return patch(
+        "app.validator.doh_resolver.httpx.AsyncClient",
+        lambda *a, **kw: FakeDoHClient(responses, *a, **kw),
+    )
+
+
+class ParseTests(unittest.TestCase):
+    def test_parse_mx_sorted_by_priority(self):
+        data = _doh_response(0, [_mx_answer(20, "mx2.example.com."), _mx_answer(10, "mx1.example.com.")])
+        records = _parse_mx(data)
+        self.assertEqual(records, [
+            {"host": "mx1.example.com", "priority": 10},
+            {"host": "mx2.example.com", "priority": 20},
+        ])
+
+    def test_parse_mx_ignores_non_mx(self):
+        data = _doh_response(0, [
+            {"name": "example.com.", "type": 1, "TTL": 300, "data": "93.184.216.34"},
+            _mx_answer(10, "mx1.example.com."),
+        ])
+        records = _parse_mx(data)
+        self.assertEqual(len(records), 1)
+
+    def test_sets_match_order_insensitive(self):
+        a = [{"host": "mx1", "priority": 10}, {"host": "mx2", "priority": 20}]
+        b = [{"host": "mx2", "priority": 20}, {"host": "mx1", "priority": 10}]
+        self.assertTrue(_mx_sets_match(a, b))
+        self.assertFalse(_mx_sets_match(a, [{"host": "mx3", "priority": 10}]))
+
+
+class ResolveDualTests(unittest.IsolatedAsyncioTestCase):
+    async def test_consistent_resolvers(self):
+        mx = [_mx_answer(10, "mx1.example.com.")]
+        responses = {("google", "MX"): _doh_response(0, mx), ("cloudflare", "MX"): _doh_response(0, mx)}
+        with _client_patch(responses):
+            out = await resolve_mx_dual("example.com")
+        self.assertEqual(out["status"], "ok")
+        self.assertTrue(out["consistent"])
+        self.assertEqual(out["mx_records"][0]["host"], "mx1.example.com")
+
+    async def test_inconsistent_resolvers_flagged(self):
+        g = [_mx_answer(10, "mx1.example.com.")]
+        c = [_mx_answer(10, "mx2.example.com.")]
+        responses = {("google", "MX"): _doh_response(0, g), ("cloudflare", "MX"): _doh_response(0, c)}
+        with _client_patch(responses):
+            out = await resolve_mx_dual("example.com")
+        self.assertEqual(out["status"], "ok")
+        self.assertIs(out["consistent"], False)
+        self.assertEqual(out["mx_records"][0]["host"], "mx1.example.com")
+
+    async def test_nxdomain(self):
+        responses = {
+            ("google", "MX"): _doh_response(3),
+            ("cloudflare", "MX"): _doh_response(3),
+        }
+        with _client_patch(responses):
+            out = await resolve_mx_dual("nope.invalid")
+        self.assertEqual(out["status"], "nxdomain")
+
+    async def test_a_fallback_when_no_mx(self):
+        responses = {
+            ("google", "MX"): _doh_response(0, []),
+            ("cloudflare", "MX"): _doh_response(0, []),
+            ("google", "A"): _doh_response(0, [_a_answer()]),
+            ("google", "AAAA"): _doh_response(0, []),
+        }
+        with _client_patch(responses):
+            out = await resolve_mx_dual("example.com")
+        self.assertEqual(out["status"], "ok")
+        self.assertTrue(out["a_fallback"])
+        self.assertEqual(out["mx_records"], [{"host": "example.com", "priority": 0}])
+
+    async def test_no_mail_when_no_mx_no_address(self):
+        responses = {
+            ("google", "MX"): _doh_response(0, []),
+            ("cloudflare", "MX"): _doh_response(0, []),
+            ("google", "A"): _doh_response(0, []),
+            ("google", "AAAA"): _doh_response(0, []),
+        }
+        with _client_patch(responses):
+            out = await resolve_mx_dual("example.com")
+        self.assertEqual(out["status"], "no_mail")
+
+    async def test_primary_failure_falls_back_to_cloudflare_answer(self):
+        mx = [_mx_answer(10, "mx1.example.com.")]
+        responses = {
+            ("google", "MX"): RuntimeError("google down"),
+            ("cloudflare", "MX"): _doh_response(0, mx),
+        }
+        with _client_patch(responses):
+            out = await resolve_mx_dual("example.com")
+        self.assertEqual(out["status"], "ok")
+        self.assertEqual(out["mx_records"][0]["host"], "mx1.example.com")
+        self.assertIsNone(out["consistent"])
+
+    async def test_both_fail_is_error(self):
+        responses = {
+            ("google", "MX"): RuntimeError("g down"),
+            ("cloudflare", "MX"): RuntimeError("c down"),
+        }
+        with _client_patch(responses):
+            out = await resolve_mx_dual("example.com")
+        self.assertEqual(out["status"], "error")
+
+
+class CachedResolveTests(unittest.IsolatedAsyncioTestCase):
+    async def test_cache_hit_short_circuits_network(self):
+        payload = {
+            "status": "ok", "mx_records": [{"host": "mx1.example.com", "priority": 10}],
+            "consistent": True, "a_fallback": False, "error": None, "cache_hit": True,
+        }
+        with patch.object(
+            doh_resolver, "_cache_get", AsyncMock(return_value=payload)
+        ), patch.object(
+            doh_resolver, "resolve_mx_dual",
+            AsyncMock(side_effect=AssertionError("must not resolve")),
+        ):
+            out = await resolve_mx_dual_cached("example.com")
+        self.assertTrue(out["cache_hit"])
+        self.assertEqual(out["mx_records"][0]["host"], "mx1.example.com")
+
+    async def test_ok_result_is_cached(self):
+        result = {
+            "status": "ok", "mx_records": [{"host": "mx1.example.com", "priority": 10}],
+            "consistent": True, "a_fallback": False, "error": None,
+        }
+        with patch.object(doh_resolver, "_cache_get", AsyncMock(return_value=None)), \
+             patch.object(doh_resolver, "_cache_set", AsyncMock()) as set_mock, \
+             patch.object(doh_resolver, "resolve_mx_dual", AsyncMock(return_value=result)):
+            out = await resolve_mx_dual_cached("example.com")
+        set_mock.assert_awaited_once()
+        args, kwargs = set_mock.call_args
+        self.assertEqual(kwargs.get("ttl") or args[2], doh_resolver.MX_TTL_SECONDS)
+        self.assertFalse(out.get("cache_hit", False))
+
+    async def test_error_results_never_cached(self):
+        calls = {"n": 0}
+
+        async def fake_resolve(domain, timeout=None):
+            calls["n"] += 1
+            return {"status": "error", "mx_records": [], "consistent": None,
+                    "a_fallback": False, "error": "doh down"}
+
+        with patch.object(doh_resolver, "_cache_get", AsyncMock(return_value=None)), \
+             patch.object(doh_resolver, "_cache_set", AsyncMock()) as set_mock, \
+             patch.object(doh_resolver, "resolve_mx_dual", fake_resolve):
+            await resolve_mx_dual_cached("example.com")
+            await resolve_mx_dual_cached("example.com")
+        set_mock.assert_not_called()
+        self.assertEqual(calls["n"], 2)
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_engine_autonomous.py

@@ -0,0 +1,288 @@
+"""Autonomous-engine engine-level tests (spec Phase 3 gate + Phase 5 verdict).
+
+Verifies the deterministic-first routing, the normalized verdict fields on
+both single and batch paths, the EAI deterministic refusal, and the
+catch-all-never-valid invariant.
+"""
+import unittest
+from unittest.mock import AsyncMock, patch
+
+from app.config import settings
+from app.models import DNSResult, DisposableResult, SMTPResult, SyntaxResult
+from app.validator.engine import (
+    EmailValidationEngine,
+    _deterministic_verdict,
+    _smtp_class,
+)
+
+
+GOOD_SYNTAX = SyntaxResult(
+    passed=True, normalized_email="john@example.test",
+    domain="example.test", local_part="john",
+)
+GOOD_DNS = DNSResult(
+    domain_exists=True, has_mx_records=True,
+    mx_records=[{"host": "mx.example.test", "priority": 10}],
+)
+GOOD_DISPOSABLE = DisposableResult(
+    is_disposable=False, is_free_provider=False, is_role_based=False,
+)
+
+
+class FakeScorer:
+    """Records feature strings; returns a fixed score."""
+
+    def __init__(self, score=0.2, label="low_risk", fallback_used=False):
+        self.fixed_score = score
+        self.label = label
+        self.fallback_used = fallback_used
+        self.calls = []
+
+    async def score(self, features):
+        self.calls.append(features)
+        from app.ml.hf_scorer import AIScore
+
+        return AIScore(score=self.fixed_score, label=self.label,
+                       source="heuristic" if self.fallback_used else "inference",
+                       fallback_used=self.fallback_used)
+
+
+def _build_engine(mailbox, scorer):
+    from app.validator.validation_cache import ValidationCache
+
+    async def _no_get(key):
+        return None
+
+    async def _no_set(key, value, ttl=None):
+        return None
+
+    eng = EmailValidationEngine(
+        mailbox=mailbox, cache=ValidationCache(get=_no_get, set=_no_set),
+        scorer=scorer,
+    )
+    return eng
+
+
+def _patch_pipeline(syntax=GOOD_SYNTAX, dns=None, disposable=GOOD_DISPOSABLE):
+    dns = dns or GOOD_DNS
+    return (
+        patch("app.validator.engine.validate_syntax", return_value=syntax),
+        patch("app.validator.engine.check_dns", new=AsyncMock(return_value=dns)),
+        patch("app.validator.engine.check_disposable", return_value=disposable),
+    )
+
+
+class DeterministicVerdictUnitTests(unittest.TestCase):
+    def test_explicit_5xx_outranks_catch_all(self):
+        smtp = SMTPResult(verified=False, smtp_code=550, smtp_message="no such user")
+        verdict = _deterministic_verdict(None, None, smtp)
+        self.assertEqual(verdict, "invalid")
+
+    def test_catch_all_never_valid(self):
+        from app.models import CatchAllResult
+
+        ca = CatchAllResult(is_catch_all=True, confidence=0.95)
+        smtp = SMTPResult(verified=True, smtp_code=250)
+        self.assertEqual(_deterministic_verdict(None, ca, smtp), "catch_all")
+
+    def test_definitive_accept_is_valid(self):
+        smtp = SMTPResult(verified=True, smtp_code=250)
+        self.assertEqual(_deterministic_verdict(None, None, smtp), "valid")
+
+    def test_disposable_outranks_everything(self):
+        from app.models import DisposableResult
+
+        d = DisposableResult(is_disposable=True, is_free_provider=False,
+                             is_role_based=False)
+        smtp = SMTPResult(verified=True, smtp_code=250)
+        self.assertEqual(_deterministic_verdict(d, None, smtp), "disposable")
+
+    def test_inconclusive_is_unknown(self):
+        smtp = SMTPResult(verified=None, error="smtp_unreachable: egress blocked")
+        self.assertEqual(_deterministic_verdict(None, None, smtp), "unknown")
+
+    def test_smtp_class_mapping(self):
+        self.assertEqual(_smtp_class(SMTPResult(verified=True, smtp_code=250)), "accept")
+        self.assertEqual(_smtp_class(SMTPResult(verified=False, smtp_code=550)), "5xx")
+        self.assertEqual(_smtp_class(SMTPResult(verified=False, smtp_code=451)), "4xx")
+        self.assertEqual(
+            _smtp_class(SMTPResult(verified=None, error="smtp_unreachable: blocked")),
+            "transport_error",
+        )
+        self.assertEqual(_smtp_class(None), "skipped")
+
+
+class SinglePathTests(unittest.IsolatedAsyncioTestCase):
+    async def test_ambiguous_rows_reach_scorer_and_get_fields(self):
+        mailbox_accepts = AsyncMock()
+        mailbox_accepts.name = "fake"
+        mailbox_accepts.verify = AsyncMock(
+            return_value=SMTPResult(verified=None, error="smtp_unreachable: egress")
+        )
+        mailbox_accepts.catch_all = AsyncMock(return_value=(True, 0.9))
+        scorer = FakeScorer(score=0.75, label="high_risk", fallback_used=True)
+        eng = _build_engine(mailbox_accepts, scorer)
+
+        patches = _patch_pipeline()
+        with patches[0], patches[1], patches[2]:
+            result = await eng.validate("john@example.test", deep=True)
+
+        self.assertEqual(result.deterministic_verdict, "catch_all")
+        self.assertEqual(result.ai_risk_score, 0.75)
+        self.assertEqual(result.ai_label, "high_risk")
+        self.assertTrue(result.fallback_used)
+        # catch-all NEVER collapses into valid regardless of the AI score.
+        self.assertNotEqual(result.status.value, "valid")
+        self.assertIn("ai_high_risk", result.scoring.warnings)
+        self.assertEqual(len(scorer.calls), 1)
+
+    async def test_deterministic_rows_never_reach_scorer(self):
+        mailbox = AsyncMock()
+        mailbox.name = "fake"
+        mailbox.verify = AsyncMock(
+            return_value=SMTPResult(verified=False, smtp_code=550,
+                                    smtp_message="550 no such user")
+        )
+        mailbox.catch_all = AsyncMock(return_value=(False, 0.9))
+        scorer = FakeScorer()
+        eng = _build_engine(mailbox, scorer)
+
+        patches = _patch_pipeline()
+        with patches[0], patches[1], patches[2]:
+            result = await eng.validate("john@example.test", deep=True)
+
+        self.assertEqual(result.deterministic_verdict, "invalid")
+        self.assertEqual(scorer.calls, [])
+        self.assertIsNone(result.ai_risk_score)
+        self.assertFalse(result.fallback_used)
+
+    async def test_eai_address_refused_deterministically(self):
+        unicode_syntax = SyntaxResult(
+            passed=True, normalized_email="用户@example.test",
+            domain="example.test", local_part="用户",
+        )
+        mailbox = AsyncMock()
+        mailbox.name = "fake"
+        mailbox.verify = AsyncMock(
+            side_effect=AssertionError("must not probe an EAI address")
+        )
+        mailbox.catch_all = AsyncMock(return_value=(None, 0.0))
+        scorer = FakeScorer()
+        eng = _build_engine(mailbox, scorer)
+
+        patches = _patch_pipeline(syntax=unicode_syntax)
+        with patches[0], patches[1], patches[2]:
+            result = await eng.validate("用户@example.test", deep=True)
+
+        self.assertEqual(result.reason_code, "unsupported_eai")
+        mailbox.verify.assert_not_awaited()
+        # The domain-level catch-all probe still ran (independent of local part).
+        mailbox.catch_all.assert_awaited_once()
+
+    async def test_dns_inconsistent_adds_warning(self):
+        bad_dns = DNSResult(
+            domain_exists=True, has_mx_records=True,
+            mx_records=[{"host": "mx.example.test", "priority": 10}],
+            dns_inconsistent=True, mx_source="doh:dual",
+        )
+        mailbox = AsyncMock()
+        mailbox.name = "fake"
+        mailbox.verify = AsyncMock(
+            return_value=SMTPResult(verified=None, error="smtp_unreachable: egress")
+        )
+        mailbox.catch_all = AsyncMock(return_value=(True, 0.9))
+        scorer = FakeScorer(score=0.3, label="low_risk")
+        eng = _build_engine(mailbox, scorer)
+
+        patches = _patch_pipeline(dns=bad_dns)
+        with patches[0], patches[1], patches[2]:
+            result = await eng.validate("john@example.test", deep=True)
+
+        self.assertIn("dns_inconsistent: resolvers disagree on MX",
+                      result.scoring.warnings)
+        # The inconsistency is visible to the scorer feature string.
+        self.assertIn("dns_consistent=no", scorer.calls[0])
+
+    async def test_fast_path_has_no_deterministic_verdict(self):
+        scorer = FakeScorer()
+        eng = _build_engine(AsyncMock(), scorer)
+        patches = _patch_pipeline()
+        with patches[0], patches[1], patches[2]:
+            result = await eng.validate("john@example.test", deep=False)
+        self.assertIsNone(result.deterministic_verdict)
+        self.assertEqual(scorer.calls, [])
+
+
+class BatchPathTests(unittest.IsolatedAsyncioTestCase):
+    async def test_batch_rows_carry_normalized_fields(self):
+        class BatchMailbox:
+            name = "fake-batch"
+
+            async def verify_many(self, pairs):
+                results = {
+                    e: SMTPResult(verified=None, error="smtp_unreachable: egress")
+                    for e, _ in pairs
+                }
+                return results, {"example.test": True}
+
+        scorer = FakeScorer(score=0.55, label="medium_risk", fallback_used=True)
+        eng = _build_engine(BatchMailbox(), scorer)
+
+        patches = _patch_pipeline()
+        with patches[0], patches[1], patches[2]:
+            results = await eng.validate_batch(
+                ["john@example.test", "jane@example.test"], deep=True
+            )
+
+        self.assertEqual(len(results), 2)
+        for row in results:
+            self.assertEqual(row.deterministic_verdict, "catch_all")
+            self.assertEqual(row.ai_label, "medium_risk")
+            self.assertEqual(row.ai_risk_score, 0.55)
+            self.assertTrue(row.fallback_used)
+            self.assertFalse(row.cache_hit)
+        # Feature dedupe: identical rows share one scorer call.
+        self.assertEqual(len(scorer.calls), 1)
+
+    async def test_batch_eai_refused_without_probe(self):
+        class BatchMailbox:
+            name = "fake-batch"
+
+            async def verify_many(self, pairs):
+                # Fires only if the EAI row wrongly reaches the mailbox stage.
+                assert all(
+                    all(ord(c) < 128 for c in e.rsplit("@", 1)[0]) for e, _ in pairs
+                ), "EAI rows must not reach the mailbox stage"
+                results = {
+                    e: SMTPResult(verified=None, error="smtp_unreachable: egress")
+                    for e, _ in pairs
+                }
+                return results, {"example.test": True}
+
+        ascii_syntax = GOOD_SYNTAX
+        unicode_syntax = SyntaxResult(
+            passed=True, normalized_email="用户@example.test",
+            domain="example.test", local_part="用户",
+        )
+
+        def syntax_side(email):
+            return unicode_syntax if "用户" in email else ascii_syntax
+
+        scorer = FakeScorer(score=0.5, label="medium_risk")
+        eng = _build_engine(BatchMailbox(), scorer)
+
+        syntax_patch, dns_patch, disposable_patch = _patch_pipeline()
+        with patch("app.validator.engine.validate_syntax", side_effect=syntax_side), \
+             dns_patch, disposable_patch:
+            results = await eng.validate_batch(
+                ["john@example.test", "用户@example.test"], deep=True
+            )
+
+        by_email = {r.email: r for r in results}
+        self.assertEqual(by_email["用户@example.test"].reason_code, "unsupported_eai")
+        self.assertEqual(by_email["john@example.test"].deterministic_verdict,
+                         "catch_all")
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_hf_scorer.py

@@ -0,0 +1,249 @@
+"""AI Risk Scorer tests (spec §3.4 / Phase 4 / Phase 6).
+
+Pins the three invariants that make the metered layer safe:
+  1. Circuit breaker — consecutive failures open it; quota/auth failures open
+     it permanently; the heuristic takes over with fallback_used=True.
+  2. Feature privacy — the feature string carries domain + SMTP metadata,
+     never the full address.
+  3. Burn-rate accounting — every verification is counted; inference vs
+     heuristic split is observable against the <5% target.
+"""
+import unittest
+from unittest.mock import AsyncMock, patch
+
+from app.ml import hf_scorer as hs
+from app.ml.hf_scorer import (
+    AIRiskScorer,
+    AIScore,
+    BURN_RATE_TARGET,
+    label_for_score,
+    score_many_by_domain,
+)
+
+
+def _scorer(**kw) -> AIRiskScorer:
+    defaults = dict(model="test/model", token="tok", timeout=5,
+                    fail_threshold=3, cooldown=300)
+    defaults.update(kw)
+    return AIRiskScorer(**defaults)
+
+
+class FeaturePrivacyTests(unittest.TestCase):
+    def test_feature_string_never_contains_the_address(self):
+        features = AIRiskScorer.build_features(
+            domain="corp.test", mx_host="mx.corp.test", smtp_class="4xx",
+            catch_all=True, local_part="secret.john.doe",
+        )
+        self.assertNotIn("secret.john.doe", features)
+        self.assertNotIn("@", features)
+        self.assertIn("domain=corp.test", features)
+        self.assertIn("smtp=4xx", features)
+        self.assertIn("catch_all=yes", features)
+
+    def test_local_shape_classification(self):
+        role = AIRiskScorer.build_features(domain="d.test", mx_host=None,
+                                           smtp_class="accept", catch_all=False,
+                                           local_part="info")
+        self.assertIn("local=role", role)
+        entropy = AIRiskScorer.build_features(domain="d.test", mx_host=None,
+                                              smtp_class="accept", catch_all=False,
+                                              local_part="ab123456")
+        self.assertIn("local=high_entropy", entropy)
+
+
+class LabelTests(unittest.TestCase):
+    def test_label_thresholds(self):
+        self.assertEqual(label_for_score(0.1), "low_risk")
+        self.assertEqual(label_for_score(0.5), "medium_risk")
+        self.assertEqual(label_for_score(0.9), "high_risk")
+
+    def test_label_mapping(self):
+        self.assertAlmostEqual(hs._label_risk("high_risk", 0.9), 0.9)
+        self.assertAlmostEqual(hs._label_risk("low", 0.9), 0.1)
+        self.assertIsNone(hs._label_risk("weird_unknown_label", 0.5))
+
+
+class HeuristicTests(unittest.TestCase):
+    def test_greylist_scores_medium(self):
+        s = _scorer()
+        out = s.heuristic("domain=d.test mx=other smtp=4xx catch_all=yes local=normal dns_consistent=yes")
+        self.assertTrue(0.4 <= out.score < 0.7)
+        self.assertEqual(out.source, "heuristic")
+        self.assertTrue(out.fallback_used)
+
+    def test_trusted_platform_catchall_scores_lower(self):
+        s = _scorer()
+        trusted = s.heuristic("domain=d.test mx=trusted_platform smtp=accept catch_all=yes local=normal dns_consistent=yes")
+        other = s.heuristic("domain=d.test mx=other smtp=accept catch_all=yes local=normal dns_consistent=yes")
+        self.assertLess(trusted.score, other.score)
+
+    def test_scores_clamped(self):
+        s = _scorer()
+        out = s.heuristic("domain=d.test mx=other smtp=4xx catch_all=yes local=high_entropy dns_consistent=no")
+        self.assertTrue(0.0 <= out.score <= 1.0)
+
+
+class InferenceTests(unittest.IsolatedAsyncioTestCase):
+    def _patch_post(self, resp_status=200, payload=None, exc=None):
+        captured = {}
+
+        class FakeResp:
+            status_code = resp_status
+            text = "quota exhausted" if resp_status == 429 else ""
+            def raise_for_status(self):
+                return None
+            def json(self):
+                return payload or []
+
+        class FakeClient:
+            def __init__(self, *a, **kw):
+                pass
+            async def __aenter__(self):
+                return self
+            async def __aexit__(self, *a):
+                return False
+            async def post(self, url, json=None, headers=None):
+                captured["url"] = url
+                captured["headers"] = headers
+                if exc:
+                    raise exc
+                return FakeResp()
+
+        return patch("app.ml.hf_scorer.httpx.AsyncClient", FakeClient), captured
+
+    async def test_successful_inference(self):
+        s = _scorer()
+        payload = [[{"label": "high_risk", "score": 0.92}]]
+        p, captured = self._patch_post(payload=payload)
+        with p:
+            out = await s.score("domain=d.test mx=other smtp=4xx catch_all=yes local=normal dns_consistent=yes")
+        self.assertEqual(out.source, "inference")
+        self.assertFalse(out.fallback_used)
+        self.assertEqual(out.label, "high_risk")
+        self.assertIn("router.huggingface.co", captured["url"])
+        self.assertEqual(captured["headers"]["Authorization"], "Bearer tok")
+        self.assertEqual(s.metrics.inference_calls, 1)
+
+    async def test_unmappable_labels_degrade_to_heuristic(self):
+        s = _scorer()
+        payload = [[{"label": "gibberish_label", "score": 0.99}]]
+        p, _ = self._patch_post(payload=payload)
+        with p:
+            out = await s.score("domain=d.test mx=other smtp=4xx catch_all=yes local=normal dns_consistent=yes")
+        self.assertEqual(out.source, "heuristic")
+        self.assertTrue(out.fallback_used)
+
+    async def test_quota_error_opens_circuit_permanently(self):
+        s = _scorer()
+        p, _ = self._patch_post(resp_status=429)
+        with p:
+            out1 = await s.score("domain=d.test mx=other smtp=4xx catch_all=yes local=normal dns_consistent=yes")
+        self.assertTrue(out1.fallback_used)
+        self.assertTrue(s.breaker.permanently_open)
+        # Subsequent calls never touch the network again.
+        out2 = await s.score("domain=d.test mx=other smtp=4xx catch_all=yes local=normal dns_consistent=yes")
+        self.assertEqual(out2.source, "heuristic")
+        self.assertEqual(s.metrics.circuit_opens, 1)
+
+    async def test_transient_failures_open_after_threshold(self):
+        s = _scorer(fail_threshold=2, cooldown=300)
+        p, _ = self._patch_post(resp_status=500)
+        with p:
+            await s.score("domain=d.test mx=other smtp=4xx catch_all=yes local=normal dns_consistent=yes")
+            self.assertFalse(s.breaker.is_open)
+            await s.score("domain=d.test mx=other smtp=4xx catch_all=yes local=normal dns_consistent=yes")
+            self.assertTrue(s.breaker.is_open)
+
+    async def test_disabled_inference_uses_heuristic_without_fallback_penalty(self):
+        # No model/token configured: the heuristic IS the primary source.
+        s = _scorer(model="", token="")
+        out = await s.score("domain=d.test mx=other smtp=4xx catch_all=yes local=normal dns_consistent=yes")
+        self.assertEqual(out.source, "heuristic")
+        # Not counted as a "fallback event" — nothing was configured to fall back FROM.
+        self.assertEqual(s.metrics.fallback_events, 0)
+
+
+class ZeroShotAndQuotaTests(unittest.IsolatedAsyncioTestCase):
+    """Zero-shot NLI mode + quota-exhaustion handling (HTTP 402)."""
+
+    def test_risk_from_payload_zero_shot_shape(self):
+        risk = hs._risk_from_payload(
+            {"labels": ["high_risk", "low_risk", "medium_risk"],
+             "scores": [0.7, 0.2, 0.1]}
+        )
+        # Probability-weighted expectation: 0.7*0.7 + 0.8*0.2 + 0.4*0.1 = 0.69
+        self.assertIsNotNone(risk)
+        self.assertGreaterEqual(risk, 0.6)
+        self.assertLessEqual(risk, 0.75)
+
+    def test_risk_from_payload_text_classification_shape(self):
+        risk = hs._risk_from_payload([[{"label": "low_risk", "score": 0.9}]])
+        self.assertIsNotNone(risk)
+        self.assertLessEqual(risk, 0.39)
+
+    def test_risk_from_payload_unmappable_is_none(self):
+        self.assertIsNone(hs._risk_from_payload({"labels": ["x"], "scores": [1.0]}))
+
+    async def test_402_opens_circuit_permanently(self):
+        s = _scorer()
+
+        class FakeResp:
+            status_code = 402
+            text = '{"error":"You have no remaining credits."}'
+            def raise_for_status(self):
+                return None
+            def json(self):
+                return {}
+
+        class FakeClient:
+            def __init__(self, *a, **kw):
+                pass
+            async def __aenter__(self):
+                return self
+            async def __aexit__(self, *a):
+                return False
+            async def post(self, *a, **kw):
+                return FakeResp()
+
+        with patch("app.ml.hf_scorer.httpx.AsyncClient", FakeClient):
+            out = await s.score(
+                "domain=d.test mx=other smtp=4xx catch_all=yes local=normal dns_consistent=yes"
+            )
+        self.assertTrue(s.breaker.permanently_open)
+        self.assertTrue(out.fallback_used)
+        self.assertIn("402", s.metrics.last_error)
+
+
+class BurnRateTests(unittest.IsolatedAsyncioTestCase):
+    async def test_metrics_track_verification_share(self):
+        s = _scorer(model="", token="")  # heuristic-only
+        features = "domain=d.test mx=other smtp=4xx catch_all=yes local=normal dns_consistent=yes"
+        for _ in range(10):
+            await s.score(features)
+        m = s.metrics.as_dict()
+        self.assertEqual(m["verifications_scored"], 10)
+        self.assertEqual(m["heuristic_calls"], 10)
+        self.assertEqual(m["inference_calls"], 0)
+        self.assertEqual(m["burn_rate"], 0.0)
+        self.assertTrue(m["burn_rate_ok"])
+        self.assertEqual(m["burn_rate_target"], BURN_RATE_TARGET)
+
+    async def test_score_many_by_domain(self):
+        s = _scorer(model="", token="")
+        out = await score_many_by_domain(s, {
+            "a.test": "domain=a.test mx=other smtp=4xx catch_all=yes local=normal dns_consistent=yes",
+            "b.test": "domain=b.test mx=other smtp=4xx catch_all=yes local=normal dns_consistent=yes",
+        })
+        self.assertEqual(set(out.keys()), {"a.test", "b.test"})
+        self.assertTrue(all(isinstance(v, AIScore) for v in out.values()))
+
+    async def test_status_shape(self):
+        s = _scorer()
+        st = s.status()
+        self.assertTrue(st["enabled"])
+        self.assertIn("circuit", st)
+        self.assertIn("metrics", st)
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_i18n.py

@@ -0,0 +1,61 @@
+"""Internationalization primitives (spec §7.1 Punycode / §7.2 SMTPUTF8)."""
+import unittest
+
+from app.validator.i18n import (
+    EAI_REASON,
+    domain_is_unicode,
+    eai_gate,
+    local_part_is_ascii,
+    to_punycode,
+)
+
+
+class PunycodeTests(unittest.TestCase):
+    def test_ascii_domain_untouched(self):
+        self.assertEqual(to_punycode("example.com"), "example.com")
+
+    def test_unicode_domain_encoded(self):
+        out = to_punycode("bücher.example")
+        self.assertTrue(out.startswith("xn--"))
+        self.assertEqual(out.encode("ascii").decode(), out)
+
+    def test_already_punycode_roundtrip(self):
+        self.assertEqual(to_punycode("xn--bcher-kva.example"), "xn--bcher-kva.example")
+
+    def test_unicode_tld(self):
+        out = to_punycode("пример.рф")
+        self.assertTrue(all(ord(c) < 128 for c in out))
+        self.assertIn("xn--", out)
+
+    def test_garbage_domain_returns_as_is(self):
+        # Must never raise — DNS will fail naturally and the verdict degrades.
+        self.assertEqual(to_punycode("\x00bad"), "\x00bad")
+
+    def test_empty_and_dot_stripping_safe(self):
+        self.assertEqual(to_punycode(""), "")
+        self.assertEqual(to_punycode("example.com"), "example.com")
+
+
+class UnicodeDetectionTests(unittest.TestCase):
+    def test_domain_is_unicode(self):
+        self.assertTrue(domain_is_unicode("münchen.de"))
+        self.assertFalse(domain_is_unicode("xn--mnchen-3ya.de"))
+        self.assertFalse(domain_is_unicode("example.com"))
+
+
+class EAITests(unittest.TestCase):
+    def test_ascii_local_passes_gate(self):
+        self.assertIsNone(eai_gate("john.smith"))
+        self.assertIsNone(eai_gate("o+brien+tag"))
+
+    def test_unicode_local_blocked_deterministically(self):
+        self.assertEqual(eai_gate("用户"), EAI_REASON)
+        self.assertEqual(eai_gate("café"), EAI_REASON)
+
+    def test_ascii_flag_consistency(self):
+        self.assertTrue(local_part_is_ascii("simple"))
+        self.assertFalse(local_part_is_ascii("日本語"))
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_mailbox_provider.py

@@ -1,161 +1,212 @@
+"""Mailbox-layer tests after the v3.0.0 autonomy refactor.
+
+The MillionVerifier delegation was removed BY DESIGN: the engine must run with
+no vendor account, key, or per-check fee, and a stray key must never be able
+to re-route the recipient list through a third party. These tests pin that
+decision: no MV symbol is importable, no settings knob re-enables it, and the
+explicit 5xx mailbox-rejection path (previously exercised through the MV
+adapter) still hard-fails to score 0 through a plain provider.
+"""
 import unittest
 from unittest.mock import AsyncMock, patch
 
 from app.config import settings
 from app.models import SMTPResult
+from app.validator import mailbox_provider as mp
 from app.validator.mailbox_provider import (
     MailboxProvider,
-    MillionVerifierProvider,
     LocalSmtpProvider,
     AutonomousSmtpProvider,
+    RemoteSmtpWorkerProvider,
     resolve_provider,
-    map_mv_result,
 )
 
 
-class MapMVResultTests(unittest.TestCase):
-    """MillionVerifier live schema (verified 2026-10-11 against API_KEY_FOR_TEST):
-    {"result": "ok"|"catch_all"|"invalid"|"disposable"|"unknown"|"error",
-     "quality": "good"|"risky"|"bad", "resultcode": 1..4, "free": bool, "role": bool}
-    The mapping must translate that into our SMTPResult taxonomy."""
-
-    def test_ok_maps_to_verified(self):
-        r = map_mv_result({"result": "ok", "quality": "good", "resultcode": 1, "free": False, "role": False})
-        self.assertTrue(r.verified)
-
-    def test_invalid_maps_to_rejected_5xx(self):
-        r = map_mv_result({"result": "invalid", "quality": "bad", "resultcode": 4, "free": False, "role": False})
-        self.assertFalse(r.verified)
-        self.assertEqual(r.smtp_code, 550)
-
-    def test_invalid_carries_explicit_rejection_phrase(self):
-        # A provider-confirmed dead mailbox must score 0 (Invalid), not be
-        # softened to -30 "inconclusive". calculate_score() only hard-fails a
-        # 5xx when the message carries an explicit mailbox-rejection phrase, so
-        # the adapter must supply one — otherwise a definitive "invalid" is
-        # mis-scored as risky/valid.
-        r = map_mv_result({"result": "invalid", "quality": "bad", "resultcode": 4})
-        self.assertIn("does not exist", (r.smtp_message or "").lower())
-
-    def test_catch_all_maps_to_inconclusive(self):
-        # A catch-all domain accepts the probe but proves nothing about the
-        # specific mailbox — it must NOT read as verified.
-        r = map_mv_result({"result": "catch_all", "quality": "risky", "resultcode": 2, "free": False, "role": False})
-        self.assertIsNone(r.verified)
-
-    def test_unknown_maps_to_inconclusive(self):
-        r = map_mv_result({"result": "unknown", "quality": "risky", "resultcode": 5, "free": False, "role": False})
-        self.assertIsNone(r.verified)
-
-    def test_error_maps_to_inconclusive_with_error(self):
-        r = map_mv_result({"result": "error", "error": "rate limited"})
-        self.assertIsNone(r.verified)
-        self.assertIn("rate limited", r.error)
-
-
-class MillionVerifierProviderTests(unittest.IsolatedAsyncioTestCase):
-    async def test_verify_calls_api_with_email_and_key(self):
-        provider = MillionVerifierProvider(api_key="test-key", timeout=5)
-        fake = {"result": "ok", "quality": "good", "resultcode": 1, "free": False, "role": False}
-        with patch("app.validator.mailbox_provider.httpx.AsyncClient") as client_cls:
-            resp = AsyncMock()
-            resp.raise_for_status = lambda: None
-            resp.json = lambda: fake
-            client_cls.return_value.__aenter__ = AsyncMock(return_value=AsyncMock(get=AsyncMock(return_value=resp)))
-            client_cls.return_value.__aexit__ = AsyncMock(return_value=False)
-            result = await provider.verify("a@example.com", "mx.example.com")
-        self.assertTrue(result.verified)
+class AutonomyInvariantTests(unittest.TestCase):
+    """The engine is autonomous: no third-party verification API exists."""
 
-    async def test_catch_all_probe_gibberish_not_real_address(self):
-        # catch-all must be detected with a gibberish local part, never the
-        # real address (that would be a false negative).
-        provider = MillionVerifierProvider(api_key="test-key", timeout=5)
-        captured = {}
+    def test_millionverifier_is_gone(self):
+        self.assertFalse(hasattr(mp, "MillionVerifierProvider"))
+        self.assertFalse(hasattr(mp, "map_mv_result"))
 
-        with patch("app.validator.mailbox_provider.httpx.AsyncClient") as client_cls:
-            async def fake_get(url, params=None, timeout=None):
-                captured["params"] = params
-                resp = AsyncMock()
-                resp.raise_for_status = lambda: None
-                resp.json = lambda: {"result": "catch_all", "quality": "risky", "resultcode": 2}
-                return resp
-            client_cls.return_value.__aenter__ = AsyncMock(return_value=AsyncMock(get=fake_get))
-            client_cls.return_value.__aexit__ = AsyncMock(return_value=False)
-            is_catch_all, confidence = await provider.catch_all("example.com", "mx.example.com")
+    def test_config_has_no_mv_knobs(self):
+        from app.config import Settings
 
-        self.assertNotIn("example.com", captured["params"]["email"].split("@")[0])
-        self.assertTrue(is_catch_all)
-        self.assertGreater(confidence, 0.5)
+        for field in ("mv_api_key", "mv_timeout", "prefer_api_provider"):
+            self.assertFalse(
+                hasattr(settings, field),
+                f"settings.{field} must not exist after the autonomy refactor",
+            )
+            self.assertFalse(
+                field in Settings.model_fields,
+                f"Settings.{field} must not be declared",
+            )
+
+    def test_api_mode_is_no_longer_a_valid_choice(self):
+        # Any leftover "api" configuration degrades to the built-in engine
+        # instead of raising or silently selecting a vendor.
+        with patch.object(settings, "mailbox_provider", "api"), patch.object(
+            settings, "smtp_worker_url", ""
+        ):
+            provider = resolve_provider()
+        self.assertIsInstance(provider, (AutonomousSmtpProvider, RemoteSmtpWorkerProvider))
+
+
+class ResolveProviderTests(unittest.TestCase):
+    def test_local_forced_is_autonomous(self):
+        with patch.object(settings, "mailbox_provider", "local"), patch.object(
+            settings, "smtp_worker_url", "https://worker.example.com"
+        ):
+            self.assertIsInstance(resolve_provider(), AutonomousSmtpProvider)
+
+    def test_auto_without_worker_is_autonomous(self):
+        with patch.object(settings, "mailbox_provider", "auto"), patch.object(
+            settings, "smtp_worker_url", ""
+        ):
+            self.assertIsInstance(resolve_provider(), AutonomousSmtpProvider)
+
+    def test_auto_with_worker_resolves_remote(self):
+        with patch.object(settings, "mailbox_provider", "auto"), patch.object(
+            settings, "smtp_worker_url", "https://worker.example.com"
+        ):
+            self.assertIsInstance(resolve_provider(), RemoteSmtpWorkerProvider)
+
+    def test_remote_forced_without_url_degrades_to_autonomous(self):
+        with patch.object(settings, "mailbox_provider", "remote"), patch.object(
+            settings, "smtp_worker_url", ""
+        ):
+            self.assertIsInstance(resolve_provider(), AutonomousSmtpProvider)
+
+    def test_providers_satisfy_protocol(self):
+        for cls in (AutonomousSmtpProvider, RemoteSmtpWorkerProvider, LocalSmtpProvider):
+            self.assertTrue(hasattr(cls, "verify"))
+            self.assertTrue(hasattr(cls, "catch_all"))
+            self.assertTrue(issubclass(cls, MailboxProvider))
 
 
 class EngineProviderVerdictTests(unittest.IsolatedAsyncioTestCase):
-    """End-to-end: a provider-confirmed dead mailbox must hard-fail to score 0
-    (Invalid) through the whole engine, not be softened to 'risky' (the live
-    mis-score observed before the adapter supplied an explicit rejection phrase)."""
+    """End-to-end: an explicit 5xx mailbox rejection must hard-fail to score 0
+    (Invalid) through the whole engine — the invariant the MV adapter used to
+    guarantee, now pinned against a plain provider."""
 
-    async def test_provider_invalid_scores_zero(self):
-        from unittest.mock import AsyncMock, patch as _patch
+    async def test_explicit_rejection_scores_zero(self):
         from app.models import DNSResult, DisposableResult, SyntaxResult
         from app.validator.engine import EmailValidationEngine
 
-        engine = EmailValidationEngine(mailbox=MillionVerifierProvider(api_key="k"))
-
         class DeadMailboxProvider:
             async def verify(self, email, mx_host):
-                return map_mv_result({"result": "invalid", "resultcode": 4})
+                return SMTPResult(
+                    verified=False,
+                    smtp_code=550,
+                    smtp_message="550 mailbox does not exist",
+                )
+
             async def catch_all(self, domain, mx_host):
                 return (False, 0.9)
 
-        engine.mailbox = DeadMailboxProvider()
+        eng = EmailValidationEngine(mailbox=DeadMailboxProvider())
         with (
-            _patch("app.validator.engine.validate_syntax", return_value=SyntaxResult(
+            patch("app.validator.engine.validate_syntax", return_value=SyntaxResult(
                 passed=True, normalized_email="a@example.test",
                 domain="example.test", local_part="a",
             )),
-            _patch("app.validator.engine.check_dns", new=AsyncMock(return_value=DNSResult(
+            patch("app.validator.engine.check_dns", new=AsyncMock(return_value=DNSResult(
                 domain_exists=True, has_mx_records=True,
                 mx_records=[{"host": "mx.example.test", "priority": 10}],
             ))),
-            _patch("app.validator.engine.check_disposable", return_value=DisposableResult(
+            patch("app.validator.engine.check_disposable", return_value=DisposableResult(
                 is_disposable=False, is_free_provider=False, is_role_based=False,
             )),
         ):
-            result = await engine.validate("a@example.test", deep=True)
+            result = await eng.validate("a@example.test", deep=True)
 
         self.assertEqual(result.scoring.score, 0)
         self.assertEqual(result.status.value, "invalid")
         self.assertEqual(result.reason_code, "rcpt_5xx")
+        # The normalized verdict agrees with the deterministic gauntlet.
+        self.assertEqual(result.deterministic_verdict, "invalid")
 
 
-class ResolveProviderTests(unittest.TestCase):
-    def test_api_forced(self):
-        with patch.object(settings, "mailbox_provider", "api"), patch.object(
-            settings, "mv_api_key", "k"
-        ):
-            self.assertIsInstance(resolve_provider(), MillionVerifierProvider)
+class RemoteSmtpWorkerProviderTests(unittest.IsolatedAsyncioTestCase):
+    """The remote worker path (spec §3.3): orchestrator delegates port-25."""
 
-    def test_local_forced_is_autonomous(self):
-        with patch.object(settings, "mailbox_provider", "local"):
-            self.assertIsInstance(resolve_provider(), AutonomousSmtpProvider)
+    def _provider(self):
+        return RemoteSmtpWorkerProvider(
+            url="https://worker.example.com", token="s3cret", timeout=5,
+            fail_threshold=2, cooldown_seconds=60,
+        )
 
-    def test_auto_with_key_prefers_api_only_when_opted_in(self):
-        with patch.object(settings, "mailbox_provider", "auto"), patch.object(
-            settings, "mv_api_key", "k"
-        ), patch.object(settings, "prefer_api_provider", True):
-            self.assertIsInstance(resolve_provider(), MillionVerifierProvider)
+    async def test_verify_posts_to_worker(self):
+        p = self._provider()
+        payload = {"verified": True, "smtp_code": 250, "smtp_message": "ok"}
+        with patch("app.validator.mailbox_provider.httpx.AsyncClient") as client_cls:
+            resp = AsyncMock()
+            resp.raise_for_status = lambda: None
+            resp.json = lambda: payload
+            client = AsyncMock()
+            client.post = AsyncMock(return_value=resp)
+            client_cls.return_value.__aenter__ = AsyncMock(return_value=client)
+            client_cls.return_value.__aexit__ = AsyncMock(return_value=False)
+            result = await p.verify("a@corp.test", "mx.corp.test")
+        self.assertTrue(result.verified)
+        args, kwargs = client.post.call_args
+        self.assertEqual(args[0], "https://worker.example.com/smtp/probe")
+        self.assertEqual(kwargs["headers"]["X-Worker-Token"], "s3cret")
 
-    def test_auto_without_key_is_autonomous(self):
-        with patch.object(settings, "mailbox_provider", "auto"), patch.object(
-            settings, "mv_api_key", ""
-        ):
-            self.assertIsInstance(resolve_provider(), AutonomousSmtpProvider)
+    async def test_worker_unreachable_is_inconclusive_and_opens_circuit(self):
+        p = self._provider()
+        with patch("app.validator.mailbox_provider.httpx.AsyncClient") as client_cls:
+            client_cls.return_value.__aenter__ = AsyncMock(
+                side_effect=RuntimeError("boom")
+            )
+            client_cls.return_value.__aexit__ = AsyncMock(return_value=False)
+            r1 = await p.verify("a@corp.test", "mx.corp.test")
+            r2 = await p.verify("b@corp.test", "mx.corp.test")
+        self.assertIsNone(r1.verified)
+        self.assertIn("unreachable", (r1.error or ""))
+        # Threshold 2 reached → circuit open, next call fails fast.
+        self.assertTrue(p.circuit_open)
+        r3 = await p.verify("c@corp.test", "mx.corp.test")
+        self.assertIn("circuit open", (r3.error or "").lower())
+
+    async def test_catch_all_roundtrip(self):
+        p = self._provider()
+        payload = {"is_catch_all": True, "confidence": 0.95}
+        with patch("app.validator.mailbox_provider.httpx.AsyncClient") as client_cls:
+            resp = AsyncMock()
+            resp.raise_for_status = lambda: None
+            resp.json = lambda: payload
+            client = AsyncMock()
+            client.post = AsyncMock(return_value=resp)
+            client_cls.return_value.__aenter__ = AsyncMock(return_value=client)
+            client_cls.return_value.__aexit__ = AsyncMock(return_value=False)
+            is_ca, confidence = await p.catch_all("corp.test", "mx.corp.test")
+        self.assertTrue(is_ca)
+        self.assertGreater(confidence, 0.5)
 
-    def test_provider_satisfies_protocol(self):
-        # Structural check: both providers expose verify + catch_all.
-        self.assertTrue(hasattr(MillionVerifierProvider, "verify"))
-        self.assertTrue(hasattr(MillionVerifierProvider, "catch_all"))
-        self.assertTrue(hasattr(LocalSmtpProvider, "verify"))
-        self.assertTrue(hasattr(LocalSmtpProvider, "catch_all"))
+    async def test_verify_many_batch_roundtrip(self):
+        p = self._provider()
+        payload = {
+            "results": {
+                "a@corp.test": {"verified": True, "smtp_code": 250},
+                "b@corp.test": {"verified": False, "smtp_code": 550},
+            },
+            "catch_all": {"corp.test": False},
+        }
+        with patch("app.validator.mailbox_provider.httpx.AsyncClient") as client_cls:
+            resp = AsyncMock()
+            resp.raise_for_status = lambda: None
+            resp.json = lambda: payload
+            client = AsyncMock()
+            client.post = AsyncMock(return_value=resp)
+            client_cls.return_value.__aenter__ = AsyncMock(return_value=client)
+            client_cls.return_value.__aexit__ = AsyncMock(return_value=False)
+            results, catch_all = await p.verify_many(
+                [("a@corp.test", "mx"), ("b@corp.test", "mx")]
+            )
+        self.assertTrue(results["a@corp.test"].verified)
+        self.assertFalse(results["b@corp.test"].verified)
+        self.assertEqual(catch_all, {"corp.test": False})
 
 
 class CircuitBreakerTests(unittest.TestCase):

tests/test_worker_endpoints.py

@@ -0,0 +1,125 @@
+"""Worker endpoint tests (spec §3.3) — POST /api/v1/smtp/probe*.
+
+Uses FastAPI TestClient against the real router so auth open-prefix handling
+and the X-Worker-Token guard are exercised end-to-end.
+"""
+import unittest
+from unittest.mock import AsyncMock, patch
+
+from fastapi.testclient import TestClient
+
+from app.config import settings
+from app.main import app
+from app.models import SMTPResult
+
+
+def _client():
+    return TestClient(app)
+
+
+class WorkerEndpointTests(unittest.TestCase):
+    def setUp(self):
+        self.probe_payload = {"email": "a@corp.test", "mx_host": "mx.corp.test"}
+
+    def test_mailbox_probe_returns_smtp_result(self):
+        with patch(
+            "app.validator.mailbox_provider.AutonomousSmtpProvider.verify",
+            new=AsyncMock(return_value=SMTPResult(verified=True, smtp_code=250)),
+        ):
+            with _client() as client:
+                res = client.post("/api/v1/smtp/probe", json=self.probe_payload)
+        self.assertEqual(res.status_code, 200)
+        body = res.json()
+        self.assertTrue(body["verified"])
+        self.assertEqual(body["smtp_code"], 250)
+
+    def test_catch_all_probe_shape(self):
+        with patch(
+            "app.validator.mailbox_provider.AutonomousSmtpProvider.catch_all",
+            new=AsyncMock(return_value=(True, 0.95)),
+        ):
+            with _client() as client:
+                res = client.post(
+                    "/api/v1/smtp/probe",
+                    json={"domain": "corp.test", "mx_host": "mx.corp.test",
+                          "probe": "catch_all"},
+                )
+        self.assertEqual(res.status_code, 200)
+        self.assertEqual(res.json(), {"is_catch_all": True, "confidence": 0.95})
+
+    def test_batch_probe_roundtrip(self):
+        with patch(
+            "app.validator.mailbox_provider.AutonomousSmtpProvider.verify_many",
+            new=AsyncMock(return_value=(
+                {"a@corp.test": SMTPResult(verified=True, smtp_code=250)},
+                {"corp.test": False},
+            )),
+        ):
+            with _client() as client:
+                res = client.post(
+                    "/api/v1/smtp/probe/batch",
+                    json={"pairs": [["a@corp.test", "mx.corp.test"]]},
+                )
+        self.assertEqual(res.status_code, 200)
+        body = res.json()
+        self.assertTrue(body["results"]["a@corp.test"]["verified"])
+        self.assertEqual(body["catch_all"], {"corp.test": False})
+
+    def test_token_guard_rejects_bad_token(self):
+        with patch.object(settings, "smtp_worker_token", "s3cret"):
+            with _client() as client:
+                res = client.post("/api/v1/smtp/probe", json=self.probe_payload)
+        self.assertEqual(res.status_code, 401)
+
+    def test_token_guard_accepts_good_token(self):
+        with patch.object(settings, "smtp_worker_token", "s3cret"), patch(
+            "app.validator.mailbox_provider.AutonomousSmtpProvider.verify",
+            new=AsyncMock(return_value=SMTPResult(verified=True, smtp_code=250)),
+        ):
+            with _client() as client:
+                res = client.post(
+                    "/api/v1/smtp/probe",
+                    json=self.probe_payload,
+                    headers={"X-Worker-Token": "s3cret"},
+                )
+        self.assertEqual(res.status_code, 200)
+
+    def test_probe_requires_email_or_domain(self):
+        with _client() as client:
+            res = client.post("/api/v1/smtp/probe", json={"mx_host": "mx.corp.test"})
+        self.assertEqual(res.status_code, 422)
+
+
+class OpsEndpointTests(unittest.TestCase):
+    def test_engine_status_shape(self):
+        with _client() as client:
+            res = client.get("/api/v1/engine/status")
+        self.assertEqual(res.status_code, 200)
+        body = res.json()
+        self.assertEqual(body["version"], settings.app_version)
+        self.assertIn("dns", body)
+        self.assertIn("smtp", body)
+        self.assertIn("ai_scorer", body)
+        self.assertIn("egress_port25", body["smtp"])
+
+    def test_inference_metrics_shape(self):
+        with _client() as client:
+            res = client.get("/api/v1/metrics/inference")
+        self.assertEqual(res.status_code, 200)
+        body = res.json()
+        for key in ("verifications_scored", "inference_calls", "heuristic_calls",
+                    "burn_rate", "burn_rate_target", "burn_rate_ok"):
+            self.assertIn(key, body)
+
+    def test_health_carries_workers_summary(self):
+        with _client() as client:
+            res = client.get("/api/v1/health")
+        self.assertEqual(res.status_code, 200)
+        body = res.json()
+        self.assertIn("workers", body)
+        self.assertIn("ai_scorer", body["workers"])
+        self.assertEqual(body["version"], settings.app_version)
+
+
+if __name__ == "__main__":
+    unittest.main()