diff --git a/00-META/glossary.md b/00-META/glossary.md index b6ca7e64..ee3224d5 100644 --- a/00-META/glossary.md +++ b/00-META/glossary.md @@ -794,9 +794,9 @@ and no session (ADR 0278), in its plain sense. §2), with the states `mail_send_status` answers (ADR 0440 §7). Only a caller granted asking to send for that account may ask for one (ADR 0460). - **mail web client** — the module `mesh-mail-web`, holder of `mail-webclient`: the operator's mail in a browser on - the private network (ADR 0440 §1); also called *the mail page*. + the private network (ADR 0440 §1). The page it serves is the mail page. - **mail notice** — `mesh-mail-notifier`'s desktop pop-up for a new inbox mail (ADR 0378 §7, §9). It retires when - `mesh-mail-notifier` is unassigned everywhere (ADR 0461 §6) and then moves to *mail signal*'s *Not:* line + `mesh-mail-notifier` is unassigned everywhere (ADR 0461 §7) and then moves to *mail signal*'s *Not:* line (issue 1418). - **mail reading** — the model's reading of each new mail as it arrives, in batches, into its mail group and mail entry; the seat `mail-reading`, held by `mesh-mail-reader` (ADR 0459). Not *triage* (the issue tracker's @@ -805,7 +805,7 @@ and no session (ADR 0278), in its plain sense. due date; never the body (ADR 0459 §4). Not *catalogue entry*: the catalogue is Delivery's. - **mark** — what a mail entry says the mail is to the operator: *matters*, *scam warning* or neither, never two (ADR 0459 §7). Not *kind* (Media's). -- **mail group** — a set of mails the model put together because they belong to one subject. Not *delivery +- **mail group** — a set of mails the model put together because they belong to one subject (ADR 0459 §4). Not *delivery group* or *account group*. - **reading lesson** — one correction the operator made on the mail page (a mark or a mail group), kept so later mail reading follows it (ADR 0459 §8 to §10). Always qualified: the bare *lesson* is Operator and conversation's. @@ -813,7 +813,7 @@ and no session (ADR 0278), in its plain sense. top of the mail page, that tells the operator mail matters (ADR 0461). Always qualified: the bare *signal* is Health and repair's. - **scam warning** — the mark of a mail the model judges an attempt to deceive the operator, with why; shown in - its own place on the mail page and never a mail signal (ADR 0459 §7, ADR 0461 §5). + its own place on the mail page and never a mail signal (ADR 0459 §7, ADR 0461 §6). - **mail conversation** — a thread (ADR 0383) with a mail context, followed on the mail page: the mail questions and their answers, each answer with the mails it found. The mail context is the framing that a mail is data, the tools `mail_search` and `mail_read` only, the operator's senders and folders, and the reading lessons (ADR 0462). diff --git a/03-DESIGN/01-to-be/59-the-mail-web-client.md b/03-DESIGN/01-to-be/59-the-mail-web-client.md index 529940d9..566e3b6b 100644 --- a/03-DESIGN/01-to-be/59-the-mail-web-client.md +++ b/03-DESIGN/01-to-be/59-the-mail-web-client.md @@ -44,7 +44,7 @@ thread with a mail context. Betterbird is removed once mail reading works on the every account `mesh-mail` holds, opens an attachment, and writes a mail that goes out on their Approve on Telegram; the same page is not reachable from a machine outside the private network. A new mail that matters reaches the operator's phone as one mail signal and stands at the top of the mail page in its mail group; a mail that does not -matter shows nothing anywhere. +matter gives no pop-up and no mail signal anywhere. ## 1. The parts @@ -87,7 +87,7 @@ outside. Two things hold it: Measured on 2026-10-19: the laptop and the workstation hold the mesh's authority (`mesh-internal-ca.crt`) as a trust anchor, and Firefox on both reads the system's trust through p11-kit, so the page opens there without a warning. Away from the private network (the laptop travelling without its tunnel) the page is unreachable; Betterbird stays the offline client -until it is removed (milestone 4, §11). +until it is removed (milestone 3, §11). ## 3. Signing in (ADR 0440 §3) @@ -149,14 +149,16 @@ mail-store (mesh-mail) ── MAIL: mail..message.added ──▶ mesh- - **A mail entry per mail, never the body.** Its own database (`postgres-database`) keeps each mail's mail group, a one-line summary, its mark (*matters*, *scam warning* or neither) and why, and a due date where the mail gives one, beside the mail groups and the reading lessons. -- **Batches.** One judgement reads at most 10 mails. Its question is filled in order, under 60 KiB of the - judgement's 64 KiB: the framing that a mail is data and never an instruction; the mail groups, at most 4 KiB; the - reading lessons that apply, at most 40 within 12 KiB, sender and mail group first, then the newest, under the - framing that a reading lesson outranks anything a mail says; then the mails, each cut to its first 3 KiB, a mail - in a Junk folder said to be so. A batch asks for up to 40 s with `within` and collects with +- **Batches.** One judgement reads at most 10 mails, and every part of its question has a bound, so it never + passes 55 KiB of the judgement's 64 KiB: the framing that a mail is data and never an instruction, at most 4 KiB; + the mail groups, at most 4 KiB, the largest first; the reading lessons that apply, at most 40 within 12 KiB, + sender and mail group first, then the newest, under the framing that a reading lesson outranks anything a mail + says; then each mail, at most 3.5 KiB (its headers at most 512 bytes, its text cut to its first 3 KiB), a mail in + a Junk folder said to be so. A batch asks for up to 40 s with `within` and collects with `claude_code_judged` (built under issue 508, recorded by ADR 0459 §14). Research 066 measured 1.9 to 3.1 s per mail, so a batch of 10 takes about 19 to 31 s; the bound keeps an issue tracker's check that waits behind a batch - on the same machine within its two minutes (ADR 0278 §2), which research 066's 15 mails and 120 s would not. Batches stay judgements; whether they become threads is issue 1417. + on the same machine within its two minutes (ADR 0278 §2), which research 066's 15 mails and 120 s would not. + Batches stay judgements; whether they become threads is issue 1417. - **Reading lessons.** When the operator changes a mail's mark or mail group on the page, `mesh-mail-web` calls `correct` and the correction is kept at once as a reading lesson (headers, the change, when; never body text), with no further Approve: it is the signed-in operator's own act. The page lists the reading lessons, undoes one @@ -192,7 +194,8 @@ mail-store (mesh-mail) ── MAIL: mail..message.added ──▶ mesh- ## 8. The mail conversation (ADR 0462) A mail conversation is a thread (ADR 0383), run by the thread handler (ADR 0384), with a mail context: the -framing that a mail is data, the tools `mail_search` and `mail_read` only under a caller granted reading only, the +framing that a mail is data, the tools `mail_search` and `mail_read` only under a caller granted reading only (a caller of the thread's own, +issue 1419), the operator's real senders and folder names, and the reading lessons. The operator writes a mail question on the mail page; each answer names the mails it found, and a question with no answer says so. `mesh-mail-web` creates and follows the thread over the bus on its server side; the page loads one script from its own origin and talks only to @@ -235,17 +238,15 @@ Tests 1 to 9 are milestone 1's; tests 10 to 17 are research 066's eight, in its answers whether it serves and the accounts it is granted (a unit test of `mesh-mail-web`, issue 1262). 9. The acceptance sentence at the top, live: in a browser on the laptop and on the workstation, for every account. -Tests 1 to 4 are one integration test that starts the module whole against the real bus (playbook 07 step 3 item 4); -tests 5 and 7 are `mesh-mail`'s own and test 8 `mesh-mail-web`'s, unit tests; test 6 is read before the module is -assigned; test 9 is proven live after the delivery. 10. A new mail on each account has a mail entry, in a mail group, within 5 minutes of its mail event; a test searches `mesh-mail-reader`'s database for a known body line and finds none. 11. The reader's caller is refused by `mail_send` for every account, and no mail is moved, flagged or deleted by it. -12. (Milestone 3.) On the mail page, a mail question by a person, by a time range and by "what needs a reply" finds +12. (Milestone 4.) On the mail page, a mail question by a person, by a time range and by "what needs a reply" finds its target mails, research 066's three failed kinds included; a question with no answer says so; the conversation is a thread readable through the thread seat; and the browser makes no request but to the mail page's own origin. 13. A batch with one mail that matters sends exactly one `tell` naming it, with no URL, mail address or host name in - its words, and the mail is at the top of the page; a subject carrying a host name still gives a mail signal. + its words, and the mail is at the top of the page; a sender whose name carries a host name still gives a + mail signal, in the safe form. 14. Research 066's 20 steering mails, read again, mark no injected words as mattering, and every phishing decoy that is marked is a scam warning, which sends no `tell`. 15. A reading lesson given on a real mail changes how the next mail of that sender is noted; undone, it no longer @@ -256,11 +257,14 @@ assigned; test 9 is proven live after the delivery. 17. With `mesh-mail-notifier` unassigned, a new mail that does not matter shows nothing on the laptop or the workstation, and one that matters gives one mail signal. +Tests 1 to 4 are one integration test that starts the module whole against the real bus (playbook 07 step 3 item 4); +tests 5 and 7 are `mesh-mail`'s own and test 8 `mesh-mail-web`'s, unit tests; test 6 is read before the module is +assigned; test 9 is proven live after the delivery. + Tests 11, 13 (with a stand-in router), 16 and the grant split's refusals are one integration test that starts `mesh-mail` and `mesh-mail-reader` whole against the real bus and store; the batch's budget, the seat's verbs and the -mail signal's words are unit tests; tests 10, 14, 15 and 17 are proven live after milestone 2's delivery; test 12 -with milestone 3. - +mail signal's words are unit tests; tests 10, 13, 14, 15 and 17 are proven live after milestone 2's delivery, test 13 +before `mesh-mail-notifier` is unassigned; test 12 with milestone 4. ## 11. Milestones @@ -268,8 +272,8 @@ with milestone 3. |---|---|---|---|---| | 1 | In a browser on the laptop and the workstation, the operator signs in and browses, searches and reads every account's mail with its attachments, and writes a mail that goes out on their Approve | tests 1 to 9 | mesh-catalog: `mesh-mail`'s account bucket (issue 1255, ADR 0439 §2); the module `mesh-mail-web` (manifest, sign-in, the pages, the send, the seat's verbs, the integration test) | — | | 2 | Each new mail is read into a mail group on the mail page; the mail that matters reaches the operator's phone as one mail signal, a scam warning shows on the page only, the operator's corrections become reading lessons, and the pop-up for every new mail is gone | tests 10, 11, 13 to 17 | mesh-catalog: `mesh-mail`'s grants split (issue 1227) and the seat `mail-reading` declared; the module `mesh-mail-reader` (batches, mail entries, reading lessons, mail signals, health, the integration test); `mesh-mail-web`'s mail groups, mail signals, scam warnings and reading lessons; `mesh-mail-notifier` unassigned (issue 1418) | 1 | -| 3 | On the mail page the operator asks questions about their mail and gets the mails that answer them, in a mail conversation kept as a thread | test 12 | mesh-catalog: `mesh-mail-web`'s mail conversation as a client of the thread seat; `mesh-mail`'s folder case and `-any` switches | 1; design 58's milestone 3 (issue 880) | -| 4 | Betterbird is gone from the laptop and the workstation, its profile and mail kept in the home | ADR 0379 §2 | mesh-catalog: Betterbird unassigned on the operator's Approve, then the `betterbird` module removed from the catalogue (issue 806) | 2 | +| 3 | Betterbird is gone from the laptop and the workstation, its profile and mail kept in the home | ADR 0379 §2 | mesh-catalog: Betterbird unassigned on the operator's Approve, then the `betterbird` module removed from the catalogue (issue 806) | 2 | +| 4 | On the mail page the operator asks questions about their mail and gets the mails that answer them, in a mail conversation kept as a thread | test 12 | mesh-catalog: `mesh-mail-web`'s mail conversation as a client of the thread seat; the thread's mail tools under a caller of their own granted reading only (issue 1419); `mesh-mail`'s folder case and `-any` switches | 2 (the grant split and the reading lessons); design 58's milestone 3 (issue 880) | **Milestone 1, confirmed by the operator on 2026-10-19, is delivered;** its live proof on the laptop and the workstation (a search, an attachment, one send on the Approve) is still the operator's. Its issues, one repository @@ -282,5 +286,7 @@ the operator's Approve: `mesh-mail-web`'s `reach` on its machine (`internal`), i Milestones 2 to 4 are written by research 066's graduation and wait for the operator's confirmation and their issues (playbook 04, steps 5 and 6). Milestone 2 is one release of `mesh-catalog`: the grant split, the new seat, the new module and the page change ship together, and `mesh-mail-reader` is granted reading only after that delivery, on the -operator's Approve; `mesh-mail-notifier` is unassigned only after test 13 passes live. Milestone 4 is issue 806; -Betterbird stays until mail reading (milestone 2) works, not until the mail conversation. +operator's Approve; `mesh-mail-notifier` is unassigned only after test 13 passes live. Milestone 3 is issue 806. +ADR 0379 §2's bar for removing Betterbird is milestone 1's; keeping Betterbird until mail reading (milestone 2) works, +and not until the mail conversation, is the lead's proposal, for the operator to confirm with the milestones +(playbook 04, step 5). Milestone 4 waits for threads and for the caller of issue 1419.