@bobfrankston/rmfmail 1.2.286 → 1.2.288

package/.commitmsg

@@ -1,43 +1,29 @@
-Spam banner: classify the rules instead of reusing the delivery score
+Trust: a message that never crossed a trust boundary proves itself
 
-The trust banner asked "is this forged" and answered it with SpamAssassin's
-bottom line, a number tuned to answer "should this be delivered". Four
-newsletters Bob subscribed to (Constant Contact, Adobe MAX, Mokin, ActBlue)
-scored 2.2 to 10.9 and two of them raised "This message is not what it says
-it is" — on mail that passes DMARC aligned on a published reject policy,
-where that headline is factually false. What scored them was bulk-mail rules
-and third-party blocklist entries about hosts they merely link to: Mokin's
-6.0 URIBL_SBL is the Spamhaus listing of the IP of the nameserver of a linked
-domain, fourth-order guilt by association, more than the whole 4.5 threshold
-on its own.
+Bob 2026-08-27, on his own reply to John Levine about spam handling: "why is
+my own mail spam". It carried no Authentication-Results at all — his own
+authenticated submission never left his systems, so nothing added one — and
+`proved` therefore came back false, dropping it to a caution banner that told
+him not to open the links in prose he had just written. What flagged it was
+`URIBL_DBL_SPAM` 8.0 on blueorchestra.org: the domain he was QUOTING, in a
+discussion about spam. Guilt by association at its purest.
 
-trust.ts now reads the `tests=` list that was sitting in the same header and
-sorts the rules into what they are evidence OF — forgery, third-party
-association, bulk mail, or unclassified — and reads the topmost
-Authentication-Results for a DMARC-aligned pass. Severity follows the rules,
-never the number:
+SpamAssassin states two proofs in its own rule list that such mail carries
+instead of an AR header:
 
-  - a forgery rule fired, or the server itself recorded an SPF/DKIM/DMARC
-    failure -> danger, unchanged. Phishing and malware URL listings count as
-    identity evidence, so a lookalike domain with its own valid DKIM cannot
-    buy silence.
-  - sender DMARC-proved and every rule that scored is one this file can name,
-    or the whole score is bulk rules -> info: a new neutral severity with no
-    headline and no "do not open anything" footer.
-  - anything else -> caution, including a proved sender whose score came from
-    rules with no class. Unknown is never a reason to go quiet.
+  ALL_TRUSTED    Passed through trusted hosts only via SMTP
+  DKIM_VALID_AU  Message has a valid DKIM or DK signature from author's domain
 
-Findings and the score chip now come from one analysis, so they cannot
-disagree; the chip goes grey rather than red when the sender is proved or the
-score is all bulk, and both name their evidence ("8.0 SH_DBL_HEADERS (A domain
-found in headers is listed in DBL)") instead of showing a bare number. The
-`threshold/2` chip floor is untouched — see docs/spam-false-positives.md on
-why tuning it is not the fix.
+DKIM_VALID_AU is the same evidence DMARC alignment rests on — the author
+domain signed it and the signature verified — so it proves the From line on
+its own. ALL_TRUSTED says nothing untrusted handled the message in transit.
+`proved` now comes from any of the three, and `provedBy` names which, so the
+banner says WHICH proof rather than asserting DMARC that isn't there. His
+message is now a grey note: "…but bob.ma proved it sent this. Valid signature
+from bob.ma, the sending domain itself (DKIM_VALID_AU)."
 
-Over 20,291 messages in the store, 1,131 were flagged spam and every one of
-them used to get the red banner: now 294 do, 672 are caution, 165 are quiet
-notes. Tests cover all four sample messages verbatim, plus the two ways the
-proof could be gamed (a forged Authentication-Results below the server's own,
-and one naming a different From).
+Forgery still outranks proof — across the store the danger count is unchanged
+at 294 of 1,131 flagged; caution 599, quiet 238.
 
-TODO C165 first cut. Sender trust via allowlist.jsonc still open.
+Also: the Insert menu gains Blockquote and Quoted text (paste) — rmf-tiny
+0.1.53, see its .commitmsg.

package/client/android-bootstrap.bundle.js

@@ -2309,6 +2309,9 @@ function analyzeServerSpam(input) {
   const scored = (r) => !(r.score <= 0);
   const present = (cls) => rules.some((r) => r.cls === cls && scored(r));
   const kind = dmarc.authFailures.length || present("forgery") ? "forgery" : present("association") ? "association" : present("other") ? "unclassified" : rules.length ? "bulk" : "unclassified";
+  const has = (name) => rules.some((r) => r.name === name);
+  const provedBy = dmarc.pass ? "dmarc" : has("DKIM_VALID_AU") ? "dkim" : has("ALL_TRUSTED") ? "trusted" : "";
+  const fromDomain = (bare(input.fromAddress).split("@")[1] || "").toLowerCase();
   const reasons = rules.filter((r) => r.cls !== "neutral" && scored(r)).sort((a, b) => (b.score || 0) - (a.score || 0)).slice(0, 3).map((r) => {
     const num = Number.isFinite(r.score) ? `${r.score.toFixed(1)} ` : "";
     return r.description ? `${num}${r.name} (${r.description})` : `${num}${r.name}`;
@@ -2319,14 +2322,27 @@ function analyzeServerSpam(input) {
     flagged,
     rules,
     kind,
-    proved: dmarc.pass,
-    provedDomain: dmarc.domain,
+    proved: !!provedBy,
+    provedBy,
+    provedDomain: dmarc.domain || fromDomain,
     provedPolicy: dmarc.policy,
     bayesHam: rules.some((r) => r.name === "BAYES_00" || r.name === "BAYES_01"),
     authFailures: dmarc.authFailures,
     reasons
   };
 }
+function provedNote(a) {
+  switch (a.provedBy) {
+    case "dmarc":
+      return `DMARC pass, aligned${a.provedPolicy ? `, policy ${a.provedPolicy}` : ""}.`;
+    case "dkim":
+      return `Valid signature from ${a.provedDomain}, the sending domain itself (DKIM_VALID_AU).`;
+    case "trusted":
+      return "It passed through trusted hosts only (ALL_TRUSTED) \u2014 nothing untrusted handled it.";
+    default:
+      return "";
+  }
+}
 function serverSpamVerdict(input) {
   const a = analyzeServerSpam(input);
   if (!a || !a.flagged)
@@ -2345,8 +2361,8 @@ function serverSpamVerdict(input) {
     return {
       id: "server-spam-verdict",
       severity: "info",
-      text: `Your mail server scored this as spam, but ${a.provedDomain} proved it sent this.`,
-      detail: `DMARC pass, aligned${a.provedPolicy ? `, policy ${a.provedPolicy}` : ""}. ${numbers}${why}${bayes}`
+      text: a.provedBy === "trusted" ? "Your mail server scored this as spam, but it reached you without leaving your own systems." : `Your mail server scored this as spam, but ${a.provedDomain} proved it sent this.`,
+      detail: `${provedNote(a)} ${numbers}${why}${bayes}`
     };
   if (a.kind === "bulk")
     return {
@@ -2355,7 +2371,7 @@ function serverSpamVerdict(input) {
       text: "Your mail server rates this bulk mail \u2014 nothing that scored tests who sent it.",
       detail: `${numbers}${why}${bayes}`
     };
-  const proof = a.proved ? `${a.provedDomain} passed DMARC, so the From line is genuine. ` : "";
+  const proof = a.proved ? `${provedNote(a)} ` : "";
   return {
     id: "server-spam-verdict",
     severity: "caution",