protege 0.1.0.alpha.1

data/app/jobs/protege/inference_job.rb

@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+
+module Protege
+  # Runs one inbound email through the full Protege inference pipeline (the "I" of LOGI).
+  #
+  # Enqueued by +AgentMailbox+ once persona routing succeeds. The job re-hydrates the raw email and
+  # persona from their IDs, ingests a +Message+, runs the Orchestrator's +Harness+, and records the
+  # outcome on the message. IDs (not objects) are passed across the async boundary so the queue
+  # adapter can serialize and safely retry the job across process restarts.
+  #
+  # The +correlation_id+ argument carries the trace token set in +AgentMailbox+; restoring it into
+  # +Protege::Current+ at the top of +perform+ keeps events consistent from HTTP ingress through
+  # inference. Failures are captured on the message before re-raising so the retry machinery and the
+  # UI both have full context.
+  class InferenceJob < ApplicationJob
+    queue_as :default
+
+    # Process one inbound email end to end: ingest, run inference, record the result.
+    #
+    # @param inbound_email_id [Integer] id of the +ActionMailbox::InboundEmail+ to process
+    # @param persona_id [Integer] primary key of the +Protege::Persona+; STI loads the subclass
+    # @param correlation_id [String] the RFC 2822 Message-ID set by +AgentMailbox+ for tracing
+    # @return [void]
+    # @raise [StandardError] re-raised after being recorded on the message, to trigger retries
+    def perform(inbound_email_id:, persona_id:, correlation_id:)
+      restore_correlation_id(correlation_id)
+
+      # Re-hydrate the raw email and the target persona from their IDs.
+      # IDs are passed rather than objects so Solid Queue can serialize
+      # the job and retry it safely across process restarts.
+      inbound_email = ActionMailbox::InboundEmail.find(inbound_email_id)
+      persona       = Persona.find(persona_id)
+
+      # Parse the raw email, find-or-create the EmailThread, and persist
+      # a Protege::Message record with processing_status: :processing.
+      # Returns the saved message so we can update its lifecycle below.
+      message = Message.ingest!(inbound_email:, persona:)
+
+      process(message:, persona:)
+    rescue StandardError => e
+      # Capture the error on the message record before re-raising so the
+      # job can be inspected and manually re-queued without losing context.
+      message&.mark_failed!(e)
+      raise
+    end
+
+    private
+
+    # Run the message through the inference loop and record success.
+    #
+    # @param message [Protege::Message] the message to process
+    # @param persona [Protege::Persona] the persona handling it
+    # @return [void]
+    def process(message:, persona:)
+      Orchestrator.reply(persona:, message:)
+
+      message.mark_processed!
+    end
+  end
+end

data/app/jobs/protege/mail_provisioning_job.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module Protege
+  # Pushes the current mail provisioning manifest to the self-hosted MTA accessory. Enqueued from
+  # +EmailDomain+'s +after_commit+ so a domain save (create/update/destroy) isn't coupled to the
+  # accessory's availability — the push happens just after the record commits, and its retry covers a
+  # momentarily-down MTA.
+  #
+  # A no-op in provider mode: +Gateway.push_mail_provisioning+ returns early when no accessory is
+  # configured (no +MAIL_RELAY_HOST+), so this job is harmless when there is nothing to provision.
+  class MailProvisioningJob < ApplicationJob
+    queue_as :default
+
+    # Push the whole domain manifest to the mail accessory's control listener.
+    #
+    # @return [void]
+    def perform
+      Gateway.push_mail_provisioning
+    end
+  end
+end

data/app/jobs/protege/responsibility_job.rb

@@ -0,0 +1,70 @@
+# frozen_string_literal: true
+
+module Protege
+  # Carries out one scheduled responsibility run — the Loop layer's worker (the "L" of LOGI driving the
+  # "I"). Enqueued by +Responsibility#dispatch!+ with the id of a +pending+ +ResponsibilityRun+; it
+  # advances that run to running, runs the persona through +ResponsibilityHarness+, and records the
+  # outcome on the run. The run id (not the object) is passed across the async boundary so the queue
+  # adapter can serialize the job.
+  #
+  # There is no inbound request to inherit a correlation id from, so the job mints a fresh UUID and
+  # restores it into +Protege::Current+ at the top of +perform+; the run snapshots it onto its own
+  # +correlation_id+ when it starts, tying the run record to the events it emits. Unlike the inbound
+  # jobs, a failure is recorded but **not re-raised**: a responsibility is cron-driven, so the next
+  # scheduled minute is its natural retry — letting ActiveJob rerun it would double-fire. (The harness
+  # still emits +inference_failed+, so failure hooks observe it.)
+  class ResponsibilityJob < ApplicationJob
+    queue_as :default
+
+    # Carry out one scheduled run: advance the run, run inference, record the result.
+    #
+    # @param run_id [Integer] id of the pending +ResponsibilityRun+ to carry out
+    # @return [void]
+    def perform(run_id:)
+      responsibility_run = ResponsibilityRun.eager_load(responsibility: :persona).find(run_id)
+      # Adopt the trace id minted at dispatch (Responsibility#dispatch!) so the whole run lifecycle
+      # shares it; fall back to a fresh one for a run created some other way (e.g. in a test).
+      restore_correlation_id(responsibility_run.correlation_id || SecureRandom.uuid)
+
+      responsibility = responsibility_run.responsibility
+      persona        = responsibility.persona
+
+      process(responsibility_run:, responsibility:, persona:)
+    rescue StandardError => e
+      # Record the failure without re-raising — the cron schedule, not ActiveJob, drives the retry.
+      responsibility_run&.mark_failed!(e)
+      emit_loop_run_failed(responsibility_run, e)
+    end
+
+    private
+
+    # Advance the run through its lifecycle around one +ResponsibilityHarness+ run.
+    #
+    # @param responsibility_run [Protege::ResponsibilityRun] the run to carry out
+    # @param responsibility [Protege::Responsibility] the responsibility to handle
+    # @param persona [Protege::Persona] the persona handling the responsibility
+    # @return [void]
+    def process(responsibility_run:, responsibility:, persona:)
+      responsibility_run.start!
+      LoopRunStartedEvent.emit(name: responsibility.name, persona_name: persona.name)
+
+      Orchestrator.run_responsibility(persona:, responsibility:, responsibility_run:)
+
+      responsibility_run.mark_completed!
+      LoopRunCompletedEvent.emit(name: responsibility.name, persona_name: persona.name)
+    end
+
+    # Emit +loop_run_failed+ for a recorded failure — omitted when the run never loaded (e.g. the
+    # +find+ itself raised), since there is no responsibility to name.
+    #
+    # @param responsibility_run [Protege::ResponsibilityRun, nil] the failed run, if loaded
+    # @param error [Exception] the failure
+    # @return [void]
+    def emit_loop_run_failed(responsibility_run, error)
+      return unless responsibility_run
+
+      responsibility = responsibility_run.responsibility
+      LoopRunFailedEvent.emit(name: responsibility.name, persona_name: responsibility.persona.name, error:)
+    end
+  end
+end

data/app/jobs/protege/responsibility_tick_job.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module Protege
+  # The Loop layer's clock — a thin recurring job the host registers to run every minute (Solid Queue
+  # recurring, alongside any other recurring tasks). Each tick hands off to +Loop.dispatch+, which
+  # enqueues a +ResponsibilityJob+ for every responsibility due that minute. ActiveJob has no native
+  # recurring, so the recurrence itself is the host queue adapter's concern; the engine only ships this
+  # job class and the dispatch logic.
+  class ResponsibilityTickJob < ApplicationJob
+    queue_as :default
+
+    # Dispatch every responsibility due now.
+    #
+    # @return [void]
+    def perform
+      Loop.dispatch
+    end
+  end
+end

data/app/mailboxes/protege/agent_mailbox.rb

@@ -0,0 +1,123 @@
+# frozen_string_literal: true
+
+module Protege
+  # Inbound edge of the Gateway: routes every received email toward the inference pipeline.
+  #
+  # Action Mailbox delivers parsed mail here, exposing +mail+ and +inbound_email+ as instance
+  # methods and calling {#process} as the single entry point. The mailbox resolves the target
+  # persona by recipient address, then hands off to +Gateway.accept_smtp_message+, which enqueues
+  # +InferenceJob+. The inbound Message-ID is forwarded as the correlation ID so the trace token
+  # survives the async boundary and is restored inside the job.
+  #
+  # == Recursion guard
+  #
+  # Outbound mail carries an +X-Protege-Recursion+ budget header. Any inbound email whose budget has
+  # reached zero (or below) is silently dropped, preventing infinite loops when one persona replies
+  # to another. Unroutable mail (no matching persona) is bounced with an unrouted notice instead.
+  #
+  # == Access guardrail
+  #
+  # Once routed, the sender is checked against the persona's inbound access guardrail
+  # (+Gateway::AccessControl+): the committed global ceiling intersected with the persona's runtime rules. A
+  # sender that fails any layer is bounced with an access-denied notice and never reaches inference.
+  class AgentMailbox < ActionMailbox::Base
+    # Route the inbound email: drop on exhausted recursion budget, bounce when unrouted or when the
+    # sender fails the access guardrail, else accept.
+    #
+    # @return [void]
+    def process
+      return handle_recursion_limit       if recursion_limit_reached?
+      return bounce_with_unrouted         if persona.nil?
+      return bounce_with_access_denied    unless sender_permitted?
+      return bounce_with_attachment_error if attachment_violation
+
+      Gateway.accept_smtp_message(inbound_email:, persona:)
+    end
+
+    private
+
+    # Report whether the sender may reach the routed persona, per the access guardrail.
+    #
+    # @return [Boolean] true when every access layer permits the sender
+    def sender_permitted?
+      Gateway.permits?(persona:, address: mail.from.first)
+    end
+
+    # Resolve and memoise the persona for the email's primary recipient.
+    #
+    # Uses +Persona.lookup+, which strips plus-tag subaddresses before matching.
+    #
+    # @return [Protege::Persona, nil] the routed persona, or nil when none matches
+    def persona
+      @persona ||= Protege::Persona.lookup(mail.to.first)
+    end
+
+    # The attachment-limit breach for this email, or nil when its attachments are within the limits.
+    #
+    # Memoised (including the nil result) so +#process+ checks once and the bounce can reuse the reason.
+    #
+    # @return [String, nil] the limit-breach reason, or nil
+    def attachment_violation
+      @attachment_violation ||= begin
+        sizes = mail.attachments.map { _1.decoded.bytesize }
+        Protege.configuration.attachment_policy.violation(byte_sizes: sizes)
+      end
+    end
+
+    # Report whether the +X-Protege-Recursion+ budget has been exhausted.
+    #
+    # @return [Boolean] true when the header is present and its value is zero or below
+    def recursion_limit_reached?
+      header = mail.header['X-Protege-Recursion']
+      header.present? && header.value.to_i <= 0
+    end
+
+    # Silently drop the message when the recursion budget is exhausted — no reply, no error.
+    #
+    # @return [void]
+    def handle_recursion_limit; end
+
+    # Bounce an unroutable email with an unrouted notice.
+    #
+    # Swallows any error raised while building or sending the bounce so a broken bounce template can
+    # never prevent the mailbox from completing cleanly — but logs it so the failure is visible rather
+    # than silently lost.
+    #
+    # @return [void]
+    def bounce_with_unrouted
+      bounce_with ApplicationMailer.new.unrouted_bounce(mail)
+    rescue StandardError => e
+      Protege.configuration.logger.error("[Protege] failed to send unrouted bounce: #{e.class}: #{e.message}")
+      nil
+    end
+
+    # Bounce an email whose sender failed the access guardrail with an access-denied notice.
+    #
+    # Swallows any error raised while building or sending the bounce (logging it) for the same reason
+    # as +bounce_with_unrouted+: a broken bounce template must never prevent the mailbox from
+    # completing cleanly.
+    #
+    # @return [void]
+    def bounce_with_access_denied
+      bounce_with ApplicationMailer.new.access_denied_bounce(mail)
+    rescue StandardError => e
+      Protege.configuration.logger.error("[Protege] failed to send access-denied bounce: #{e.class}: #{e.message}")
+      nil
+    end
+
+    # Bounce an email whose attachments breached the configured limits, with the breach reason.
+    #
+    # Swallows any error raised while building or sending the bounce (logging it) for the same reason
+    # as the other bounces: a broken bounce template must never prevent the mailbox from completing.
+    #
+    # @return [void]
+    def bounce_with_attachment_error
+      bounce_with ApplicationMailer.new.attachment_rejected_bounce(mail, reason: attachment_violation)
+    rescue StandardError => e
+      Protege.configuration.logger.error(
+        "[Protege] failed to send attachment-rejected bounce: #{e.class}: #{e.message}"
+      )
+      nil
+    end
+  end
+end

data/app/mailers/protege/application_mailer.rb

@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+
+module Protege
+  # Base mailer for the Protege engine and home of the Gateway's bounce notices.
+  #
+  # Sits at the outbound edge of the Gateway. +AgentMailbox+ returns these notices to Action Mailbox's
+  # +bounce_with+ when an inbound email can't be accepted — no matching persona ({#unrouted_bounce}) or
+  # a sender rejected by the access guardrail ({#access_denied_bounce}). The default +from:+ address is
+  # a deliberate placeholder: a host application should override it through
+  # +config.action_mailer.default_options+ in an initializer, or per-mailer, so outbound mail
+  # originates from a domain it actually controls.
+  class ApplicationMailer < ActionMailer::Base
+    # Placeholder sender; override in the host app so mail comes from a domain you control.
+    default from: 'from@example.com'
+    layout 'mailer'
+
+    # Bounce an inbound email that matched no persona back to its sender.
+    #
+    # Returned to +AgentMailbox#bounce_with_unrouted+, which hands it to Action Mailbox's +bounce_with+
+    # for delivery. The body is built inline (no template/layout) so a bounce can never fail to render.
+    #
+    # @param inbound [::Mail::Message] the undeliverable inbound email
+    # @return [Mail::Message] the bounce notice addressed to the original sender
+    def unrouted_bounce(inbound)
+      mail(
+        to:      inbound.from,
+        subject: 'Undeliverable: no such recipient',
+        body:    "Your message could not be delivered: there is no agent at this address.\n"
+      )
+    end
+
+    # Bounce an inbound email whose sender was rejected by the inbound access guardrail.
+    #
+    # Returned to +AgentMailbox#bounce_with_access_denied+. Like {#unrouted_bounce}, the body is inline
+    # so rendering can't fail. The wording is deliberately neutral — it states the message was not
+    # accepted without disclosing the policy that rejected it.
+    #
+    # @param inbound [::Mail::Message] the rejected inbound email
+    # @return [Mail::Message] the bounce notice addressed to the original sender
+    def access_denied_bounce(inbound)
+      mail(
+        to:      inbound.from,
+        subject: 'Undeliverable: message rejected',
+        body:    "Your message could not be delivered: this recipient is not accepting mail from you.\n"
+      )
+    end
+
+    # Bounce an inbound email whose attachments breached the configured limits.
+    #
+    # Returned to +AgentMailbox#bounce_with_attachment_rejected+. Like the other bounces, the body is
+    # inline so rendering can't fail. The +reason+ (from +Gateway::AttachmentPolicy+) is included so the sender
+    # knows what to fix — it discloses only the limit, not anything sensitive.
+    #
+    # @param inbound [::Mail::Message] the rejected inbound email
+    # @param reason [String] the limit-breach reason from +Gateway::AttachmentPolicy#violation+
+    # @return [Mail::Message] the bounce notice addressed to the original sender
+    def attachment_rejected_bounce(inbound, reason:)
+      mail(
+        to:      inbound.from,
+        subject: 'Undeliverable: attachment rejected',
+        body:    "Your message could not be delivered: #{reason}.\n"
+      )
+    end
+  end
+end

data/app/models/concerns/protege/broadcastable_email_domain.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+module Protege
+  # Drives real-time Turbo Stream broadcasting for +EmailDomain+ records — keeping the Domains sidebar
+  # live: the row is appended on create, replaced on update, and removed on destroy. First-page viewers
+  # subscribe via +turbo_stream_from "protege:email_domains"+ (see +SidebarHelper#sidebar_stream+).
+  module BroadcastableEmailDomain
+    extend ActiveSupport::Concern
+
+    # Turbo Stream channel for all +EmailDomain+ records.
+    # @return [String]
+    STREAM = 'protege:email_domains'
+
+    included do
+      after_create_commit  :broadcast_email_domain_created
+      after_update_commit  :broadcast_email_domain_updated
+      after_destroy_commit :broadcast_email_domain_removed
+    end
+
+    # Append this domain's row to the Domains sidebar on creation.
+    #
+    # @return [void]
+    def broadcast_email_domain_created
+      broadcast_append_to STREAM,
+                          target:  'email_domains_list',
+                          partial: 'protege/email_domains/email_domain_sidebar_item',
+                          locals:  { email_domain: self }
+    end
+
+    # Replace this domain's sidebar row in place when its attributes change.
+    #
+    # @return [void]
+    def broadcast_email_domain_updated
+      broadcast_replace_to STREAM,
+                           target:  ActionView::RecordIdentifier.dom_id(self),
+                           partial: 'protege/email_domains/email_domain_sidebar_item',
+                           locals:  { email_domain: self }
+    end
+
+    # Remove this domain's sidebar row on destruction.
+    #
+    # @return [void]
+    def broadcast_email_domain_removed
+      broadcast_remove_to STREAM,
+                          target: ActionView::RecordIdentifier.dom_id(self)
+    end
+  end
+end

data/app/models/concerns/protege/broadcastable_message.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+module Protege
+  # Drives real-time Turbo Stream broadcasting for +Message+ records.
+  #
+  # Mixed into +Message+, this concern wires Active Record commit callbacks to Turbo Streams so the
+  # web UI reflects mail activity live, with no polling. On create it prepends the new message to
+  # the open thread view and asks the owning +EmailThread+ (via +BroadcastableThread+) to refresh
+  # its inbox row. On update it replaces the message partial in place, so later attribute changes
+  # (e.g. an edited body) appear immediately. (Run liveness — reasoning and tool use — is not shown on
+  # the message; it streams into the console's introspection panel.)
+  module BroadcastableMessage
+    extend ActiveSupport::Concern
+
+    included do
+      after_create_commit :broadcast_message_created
+      after_update_commit :broadcast_message_updated
+    end
+
+    private
+
+    # Broadcast a newly created message into the thread view and refresh its inbox row.
+    #
+    # Prepends the message partial to the thread's messages target (newest first), then delegates
+    # to the thread to update its sidebar row.
+    #
+    # @return [void]
+    def broadcast_message_created
+      broadcast_prepend_to email_thread,
+                           target:  ActionView::RecordIdentifier.dom_id(email_thread, :messages),
+                           partial: 'protege/messages/message',
+                           locals:  { message: self }
+
+      email_thread.broadcast_thread_updated
+    end
+
+    # Broadcast an in-place replacement of this message's partial when its attributes change.
+    #
+    # @return [void]
+    def broadcast_message_updated
+      broadcast_replace_to email_thread,
+                           target:  ActionView::RecordIdentifier.dom_id(self),
+                           partial: 'protege/messages/message',
+                           locals:  { message: self }
+    end
+  end
+end

data/app/models/concerns/protege/broadcastable_persona.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+module Protege
+  # Drives real-time Turbo Stream broadcasting for +Persona+ records — keeping the Personas sidebar
+  # live: the row is appended on create, replaced on update, and removed on destroy. First-page viewers
+  # subscribe via +turbo_stream_from "protege:personas"+ (see +SidebarHelper#sidebar_stream+).
+  module BroadcastablePersona
+    extend ActiveSupport::Concern
+
+    # Turbo Stream channel for all +Persona+ records.
+    # @return [String]
+    STREAM = 'protege:personas'
+
+    included do
+      after_create_commit  :broadcast_persona_created
+      after_update_commit  :broadcast_persona_updated
+      after_destroy_commit :broadcast_persona_removed
+    end
+
+    private
+
+    # Append this persona's row to the Personas sidebar on creation.
+    #
+    # @return [void]
+    def broadcast_persona_created
+      broadcast_append_to STREAM,
+                          target:  'personas_list',
+                          partial: 'protege/personas/persona_sidebar_item',
+                          locals:  { persona: self }
+    end
+
+    # Replace this persona's sidebar row in place when its attributes change.
+    #
+    # @return [void]
+    def broadcast_persona_updated
+      broadcast_replace_to STREAM,
+                           target:  ActionView::RecordIdentifier.dom_id(self),
+                           partial: 'protege/personas/persona_sidebar_item',
+                           locals:  { persona: self }
+    end
+
+    # Remove this persona's sidebar row on destruction.
+    #
+    # @return [void]
+    def broadcast_persona_removed
+      broadcast_remove_to STREAM,
+                          target: ActionView::RecordIdentifier.dom_id(self)
+    end
+  end
+end

data/app/models/concerns/protege/broadcastable_responsibility.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+module Protege
+  # Drives real-time Turbo Stream broadcasting for +Responsibility+ records — keeping the (global)
+  # Responsibilities sidebar live: the row is appended on create, replaced on update, and removed on
+  # destroy. First-page viewers subscribe via +turbo_stream_from "protege:responsibilities"+ (see
+  # +SidebarHelper#sidebar_stream+).
+  module BroadcastableResponsibility
+    extend ActiveSupport::Concern
+
+    # Turbo Stream channel for all +Responsibility+ records.
+    # @return [String]
+    STREAM = 'protege:responsibilities'
+
+    included do
+      after_create_commit  :broadcast_responsibility_created
+      after_update_commit  :broadcast_responsibility_updated
+      after_destroy_commit :broadcast_responsibility_removed
+    end
+
+    private
+
+    # Append this duty's row to the Responsibilities sidebar on creation.
+    #
+    # @return [void]
+    def broadcast_responsibility_created
+      broadcast_append_to STREAM,
+                          target:  'responsibilities_list',
+                          partial: 'protege/responsibilities/responsibility_sidebar_item',
+                          locals:  { responsibility: self }
+    end
+
+    # Replace this duty's sidebar row in place when its attributes change.
+    #
+    # @return [void]
+    def broadcast_responsibility_updated
+      broadcast_replace_to STREAM,
+                           target:  ActionView::RecordIdentifier.dom_id(self),
+                           partial: 'protege/responsibilities/responsibility_sidebar_item',
+                           locals:  { responsibility: self }
+    end
+
+    # Remove this duty's sidebar row on destruction.
+    #
+    # @return [void]
+    def broadcast_responsibility_removed
+      broadcast_remove_to STREAM,
+                          target: ActionView::RecordIdentifier.dom_id(self)
+    end
+  end
+end

data/app/models/concerns/protege/broadcastable_thread.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+module Protege
+  # Drives real-time Turbo Stream broadcasting for +EmailThread+ records — keeping the inbox sidebar
+  # live as threads come, change, and go.
+  #
+  # On create the thread's row is prepended to the list (newest-first); on update its row is replaced
+  # in place (also invoked directly by +BroadcastableMessage+ when a new message arrives, so the row
+  # reflects the latest activity and counts); on destroy the row is removed. First-page viewers subscribe
+  # via +turbo_stream_from "protege:threads"+ (see +SidebarHelper#sidebar_stream+).
+  module BroadcastableThread
+    extend ActiveSupport::Concern
+
+    # Turbo Stream channel for all +EmailThread+ records.
+    # @return [String]
+    STREAM = 'protege:threads'
+
+    included do
+      after_create_commit  :broadcast_thread_created
+      after_update_commit  :broadcast_thread_updated
+      after_destroy_commit :broadcast_thread_removed
+    end
+
+    # Prepend this thread's row to the inbox list on creation.
+    #
+    # @return [void]
+    def broadcast_thread_created
+      broadcast_prepend_to STREAM,
+                           target:  'threads_list',
+                           partial: 'protege/threads/thread',
+                           locals:  { thread: self }
+    end
+
+    # Broadcast an in-place replacement of this thread's inbox-sidebar row.
+    #
+    # Public by design so +BroadcastableMessage+ can trigger the refresh after a new message saves,
+    # not only on the thread's own attribute changes.
+    #
+    # @return [void]
+    def broadcast_thread_updated
+      broadcast_replace_to STREAM,
+                           target:  ActionView::RecordIdentifier.dom_id(self),
+                           partial: 'protege/threads/thread',
+                           locals:  { thread: self }
+    end
+
+    # Remove this thread's row from the inbox list on destruction.
+    #
+    # @return [void]
+    def broadcast_thread_removed
+      broadcast_remove_to STREAM,
+                          target: ActionView::RecordIdentifier.dom_id(self)
+    end
+  end
+end