@bobfrankston/rmfmail 1.2.287 → 1.2.289

package/.commitmsg

@@ -1,33 +1,12 @@
-Grammar squiggles: stop inventing words, stop underlining white space
-
-Three complaints from one compose session (Bob 2026-08-27, forwarding a
-message), all of them the checker arguing with prose that was fine:
-
-1. "keypoint". Harper's CompoundNouns rule fires on any noun+noun pair whose
-   joined form is in its dictionary, so "One key point in my recent efforts"
-   came back as an error suggesting a word he did not write. Disabled in the
-   daemon next to AvoidCurses — same objection as that one: the tool
-   proofreads, it does not get a vote on word choice. Its siblings (MergeWords,
-   MakeupCompoundNoun, OvertimeCompoundNoun, ThereAfterCompound,
-   EasyGoingCompoundAdjective) are named in a comment there, one line each to
-   turn off if they start nagging.
-
-2. A blue dotted line across two blank lines. blockText concatenated a block's
-   text nodes with no separator, so the last word of a paragraph was glued to
-   the first word of the next: "…of the network" + "To: x@y.com" reached Harper
-   as "networkTo", and it reported — correctly, for the string it was given —
-   that the word should be split. The span then covered a junction that on
-   screen is two empty lines, and getClientRects painted a full-width underline
-   over the whitespace. Verified both halves against the real engine: gluing
-   produces `networkTo` and `FrankstonSubject` lints that vanish once the
-   breaks are there. blockText now emits "\n" at every line-breaking element,
-   and spanToRange refuses any span whose ends sit in different line boxes, so
-   no squiggle can ever be drawn across a paragraph boundary again.
-
-3. Lints on the sentence being typed. The unfinished sentence under the caret
-   is now exempt — a thought that is not out yet is not an error.
-
-The pure helpers (collectBlocks, blockText, lineBox, caretOffset,
-sentenceStart, spanToRange) moved to module scope and are exported, because
-they hold the decisions worth testing; tests/dom/harper-lint.test.ts covers all
-three rules in jsdom, using the forward markup client/app.ts actually builds.
+The spam chip has to name the proof it actually has
+
+Follow-up to v1.2.288, caught by looking at the rendered chip on Bob's own
+message: the banner correctly said "Valid signature from bob.ma (DKIM_VALID_AU)"
+while the chip's tooltip underneath asserted "the sending domain passed DMARC"
+— on a message that carries no Authentication-Results header at all. A claim
+the reader cannot check is exactly what this whole change set exists to remove.
+
+`SpamScore` now carries `provedBy` alongside `proved`, and the chip's tooltip
+says which of the three proofs applied: the server's DMARC verdict, a valid
+signature from the sending domain, or never having passed through an untrusted
+host.

package/client/android-bootstrap.bundle.js

@@ -2309,6 +2309,9 @@ function analyzeServerSpam(input) {
   const scored = (r) => !(r.score <= 0);
   const present = (cls) => rules.some((r) => r.cls === cls && scored(r));
   const kind = dmarc.authFailures.length || present("forgery") ? "forgery" : present("association") ? "association" : present("other") ? "unclassified" : rules.length ? "bulk" : "unclassified";
+  const has = (name) => rules.some((r) => r.name === name);
+  const provedBy = dmarc.pass ? "dmarc" : has("DKIM_VALID_AU") ? "dkim" : has("ALL_TRUSTED") ? "trusted" : "";
+  const fromDomain = (bare(input.fromAddress).split("@")[1] || "").toLowerCase();
   const reasons = rules.filter((r) => r.cls !== "neutral" && scored(r)).sort((a, b) => (b.score || 0) - (a.score || 0)).slice(0, 3).map((r) => {
     const num = Number.isFinite(r.score) ? `${r.score.toFixed(1)} ` : "";
     return r.description ? `${num}${r.name} (${r.description})` : `${num}${r.name}`;
@@ -2319,14 +2322,27 @@ function analyzeServerSpam(input) {
     flagged,
     rules,
     kind,
-    proved: dmarc.pass,
-    provedDomain: dmarc.domain,
+    proved: !!provedBy,
+    provedBy,
+    provedDomain: dmarc.domain || fromDomain,
     provedPolicy: dmarc.policy,
     bayesHam: rules.some((r) => r.name === "BAYES_00" || r.name === "BAYES_01"),
     authFailures: dmarc.authFailures,
     reasons
   };
 }
+function provedNote(a) {
+  switch (a.provedBy) {
+    case "dmarc":
+      return `DMARC pass, aligned${a.provedPolicy ? `, policy ${a.provedPolicy}` : ""}.`;
+    case "dkim":
+      return `Valid signature from ${a.provedDomain}, the sending domain itself (DKIM_VALID_AU).`;
+    case "trusted":
+      return "It passed through trusted hosts only (ALL_TRUSTED) \u2014 nothing untrusted handled it.";
+    default:
+      return "";
+  }
+}
 function serverSpamVerdict(input) {
   const a = analyzeServerSpam(input);
   if (!a || !a.flagged)
@@ -2345,8 +2361,8 @@ function serverSpamVerdict(input) {
     return {
       id: "server-spam-verdict",
       severity: "info",
-      text: `Your mail server scored this as spam, but ${a.provedDomain} proved it sent this.`,
-      detail: `DMARC pass, aligned${a.provedPolicy ? `, policy ${a.provedPolicy}` : ""}. ${numbers}${why}${bayes}`
+      text: a.provedBy === "trusted" ? "Your mail server scored this as spam, but it reached you without leaving your own systems." : `Your mail server scored this as spam, but ${a.provedDomain} proved it sent this.`,
+      detail: `${provedNote(a)} ${numbers}${why}${bayes}`
     };
   if (a.kind === "bulk")
     return {
@@ -2355,7 +2371,7 @@ function serverSpamVerdict(input) {
       text: "Your mail server rates this bulk mail \u2014 nothing that scored tests who sent it.",
       detail: `${numbers}${why}${bayes}`
     };
-  const proof = a.proved ? `${a.provedDomain} passed DMARC, so the From line is genuine. ` : "";
+  const proof = a.proved ? `${provedNote(a)} ` : "";
   return {
     id: "server-spam-verdict",
     severity: "caution",
@@ -2514,6 +2530,7 @@ function spamScoreOf(input) {
     flagged: a.flagged,
     kind: a.kind,
     proved: a.proved,
+    provedBy: a.provedBy,
     reasons: a.reasons
   };
 }