@bobfrankston/rmfmail 1.2.287 → 1.2.288

package/.commitmsg

@@ -1,33 +1,29 @@
-Grammar squiggles: stop inventing words, stop underlining white space
+Trust: a message that never crossed a trust boundary proves itself
 
-Three complaints from one compose session (Bob 2026-08-27, forwarding a
-message), all of them the checker arguing with prose that was fine:
+Bob 2026-08-27, on his own reply to John Levine about spam handling: "why is
+my own mail spam". It carried no Authentication-Results at all — his own
+authenticated submission never left his systems, so nothing added one — and
+`proved` therefore came back false, dropping it to a caution banner that told
+him not to open the links in prose he had just written. What flagged it was
+`URIBL_DBL_SPAM` 8.0 on blueorchestra.org: the domain he was QUOTING, in a
+discussion about spam. Guilt by association at its purest.
 
-1. "keypoint". Harper's CompoundNouns rule fires on any noun+noun pair whose
-   joined form is in its dictionary, so "One key point in my recent efforts"
-   came back as an error suggesting a word he did not write. Disabled in the
-   daemon next to AvoidCurses — same objection as that one: the tool
-   proofreads, it does not get a vote on word choice. Its siblings (MergeWords,
-   MakeupCompoundNoun, OvertimeCompoundNoun, ThereAfterCompound,
-   EasyGoingCompoundAdjective) are named in a comment there, one line each to
-   turn off if they start nagging.
+SpamAssassin states two proofs in its own rule list that such mail carries
+instead of an AR header:
 
-2. A blue dotted line across two blank lines. blockText concatenated a block's
-   text nodes with no separator, so the last word of a paragraph was glued to
-   the first word of the next: "…of the network" + "To: x@y.com" reached Harper
-   as "networkTo", and it reported — correctly, for the string it was given —
-   that the word should be split. The span then covered a junction that on
-   screen is two empty lines, and getClientRects painted a full-width underline
-   over the whitespace. Verified both halves against the real engine: gluing
-   produces `networkTo` and `FrankstonSubject` lints that vanish once the
-   breaks are there. blockText now emits "\n" at every line-breaking element,
-   and spanToRange refuses any span whose ends sit in different line boxes, so
-   no squiggle can ever be drawn across a paragraph boundary again.
+  ALL_TRUSTED    Passed through trusted hosts only via SMTP
+  DKIM_VALID_AU  Message has a valid DKIM or DK signature from author's domain
 
-3. Lints on the sentence being typed. The unfinished sentence under the caret
-   is now exempt — a thought that is not out yet is not an error.
+DKIM_VALID_AU is the same evidence DMARC alignment rests on — the author
+domain signed it and the signature verified — so it proves the From line on
+its own. ALL_TRUSTED says nothing untrusted handled the message in transit.
+`proved` now comes from any of the three, and `provedBy` names which, so the
+banner says WHICH proof rather than asserting DMARC that isn't there. His
+message is now a grey note: "…but bob.ma proved it sent this. Valid signature
+from bob.ma, the sending domain itself (DKIM_VALID_AU)."
 
-The pure helpers (collectBlocks, blockText, lineBox, caretOffset,
-sentenceStart, spanToRange) moved to module scope and are exported, because
-they hold the decisions worth testing; tests/dom/harper-lint.test.ts covers all
-three rules in jsdom, using the forward markup client/app.ts actually builds.
+Forgery still outranks proof — across the store the danger count is unchanged
+at 294 of 1,131 flagged; caution 599, quiet 238.
+
+Also: the Insert menu gains Blockquote and Quoted text (paste) — rmf-tiny
+0.1.53, see its .commitmsg.

package/client/android-bootstrap.bundle.js

@@ -2309,6 +2309,9 @@ function analyzeServerSpam(input) {
   const scored = (r) => !(r.score <= 0);
   const present = (cls) => rules.some((r) => r.cls === cls && scored(r));
   const kind = dmarc.authFailures.length || present("forgery") ? "forgery" : present("association") ? "association" : present("other") ? "unclassified" : rules.length ? "bulk" : "unclassified";
+  const has = (name) => rules.some((r) => r.name === name);
+  const provedBy = dmarc.pass ? "dmarc" : has("DKIM_VALID_AU") ? "dkim" : has("ALL_TRUSTED") ? "trusted" : "";
+  const fromDomain = (bare(input.fromAddress).split("@")[1] || "").toLowerCase();
   const reasons = rules.filter((r) => r.cls !== "neutral" && scored(r)).sort((a, b) => (b.score || 0) - (a.score || 0)).slice(0, 3).map((r) => {
     const num = Number.isFinite(r.score) ? `${r.score.toFixed(1)} ` : "";
     return r.description ? `${num}${r.name} (${r.description})` : `${num}${r.name}`;
@@ -2319,14 +2322,27 @@ function analyzeServerSpam(input) {
     flagged,
     rules,
     kind,
-    proved: dmarc.pass,
-    provedDomain: dmarc.domain,
+    proved: !!provedBy,
+    provedBy,
+    provedDomain: dmarc.domain || fromDomain,
     provedPolicy: dmarc.policy,
     bayesHam: rules.some((r) => r.name === "BAYES_00" || r.name === "BAYES_01"),
     authFailures: dmarc.authFailures,
     reasons
   };
 }
+function provedNote(a) {
+  switch (a.provedBy) {
+    case "dmarc":
+      return `DMARC pass, aligned${a.provedPolicy ? `, policy ${a.provedPolicy}` : ""}.`;
+    case "dkim":
+      return `Valid signature from ${a.provedDomain}, the sending domain itself (DKIM_VALID_AU).`;
+    case "trusted":
+      return "It passed through trusted hosts only (ALL_TRUSTED) \u2014 nothing untrusted handled it.";
+    default:
+      return "";
+  }
+}
 function serverSpamVerdict(input) {
   const a = analyzeServerSpam(input);
   if (!a || !a.flagged)
@@ -2345,8 +2361,8 @@ function serverSpamVerdict(input) {
     return {
       id: "server-spam-verdict",
       severity: "info",
-      text: `Your mail server scored this as spam, but ${a.provedDomain} proved it sent this.`,
-      detail: `DMARC pass, aligned${a.provedPolicy ? `, policy ${a.provedPolicy}` : ""}. ${numbers}${why}${bayes}`
+      text: a.provedBy === "trusted" ? "Your mail server scored this as spam, but it reached you without leaving your own systems." : `Your mail server scored this as spam, but ${a.provedDomain} proved it sent this.`,
+      detail: `${provedNote(a)} ${numbers}${why}${bayes}`
     };
   if (a.kind === "bulk")
     return {
@@ -2355,7 +2371,7 @@ function serverSpamVerdict(input) {
       text: "Your mail server rates this bulk mail \u2014 nothing that scored tests who sent it.",
       detail: `${numbers}${why}${bayes}`
     };
-  const proof = a.proved ? `${a.provedDomain} passed DMARC, so the From line is genuine. ` : "";
+  const proof = a.proved ? `${provedNote(a)} ` : "";
   return {
     id: "server-spam-verdict",
     severity: "caution",