Scope
The Sigil Mail and SNS substrate is the headless protocol layer. Encrypted message bodies live in Weave; commitments and policy state live on-chain. This note explains how to move client code onto the live runtime and SDK model.Deprecated prototype behaviour
The dBrowser starter prototype that wrote plaintext drafts under/mail/drafts is deprecated.
New code must use the private Weave mailbox SDK:
- Open a dedicated private Locus mailbox drive.
- Use the canonical top-level roots:
/inbox,/sent,/drafts,/archive,/attachments,/index,/policies,/delivery-receipts. - Store drafts as
EncryptedMailMessageV1objects under/drafts. - Never persist plaintext subjects, bodies, recipients, labels, status fields, attachment names, search tokens, private keys, DEKs, or key-wrap material.
- Publish a Sigil delivery commitment only when the message leaves draft state.
Runtime migration
There is no legacy production chain state to migrate. The feature adds new AkashaKV prefixes (mail/, sns/) and StatePartition::Mail receipt/state-change support. Nodes upgrading from older binaries open an empty Mail/SNS store unless newer binaries have already written records.
Client migration
Replace direct mailbox-file writes with SDK calls:| Call | Purpose |
|---|---|
mail_create_mailbox | Register a mailbox capability record. |
mail_publish_key | Publish or rotate encryption/signing keys. |
mail_update_receive_policy | Update the versioned receive policy. |
mail_publish_delivery_commitment | Record a delivery commitment on-chain. |
sns_register_name | Register a .sigil name. |
sns_set_name_records | Set resolver records (wallet, mail, website). |
pin_public_mail_file | Pin public mail metadata in Weave. |
sigil_resolveMail before delivery and scan recipient commitments with sigil_listMailDeliveriesByRecipient.
Remaining hardening
The substrate is live, but a consumer-facing product still requires:- Full AEAD encryption and key wrapping in the client.
- Full sender-key signature verification before display.
- Contact, reputation, proof, and rate-limit policy enforcement beyond the launch-live deny/allow/fee/stake gates.
- SNS auction settlement, if premium names are enabled.
- UI and bridge migration away from
/mail/*paths.
See also
- Sigil Mail — full specification.
- Sigil Name System — name records and resolution.
- Send encrypted mail — end-to-end recipe.