This runbook is for teams migrating prototype clients off the dBrowser starter mailbox model and onto the live Sigil Mail and Sigil Name System (SNS) runtime.

Scope

The Sigil Mail and SNS substrate is the headless protocol layer. Encrypted message bodies live in Weave; commitments and policy state live on-chain. This note explains how to move client code onto the live runtime and SDK model.

Deprecated prototype behaviour

The dBrowser starter prototype that wrote plaintext drafts under /mail/drafts is deprecated. New code must use the private Weave mailbox SDK:
  • Open a dedicated private Locus mailbox drive.
  • Use the canonical top-level roots: /inbox, /sent, /drafts, /archive, /attachments, /index, /policies, /delivery-receipts.
  • Store drafts as EncryptedMailMessageV1 objects under /drafts.
  • Never persist plaintext subjects, bodies, recipients, labels, status fields, attachment names, search tokens, private keys, DEKs, or key-wrap material.
  • Publish a Sigil delivery commitment only when the message leaves draft state.

Runtime migration

There is no legacy production chain state to migrate. The feature adds new AkashaKV prefixes (mail/, sns/) and StatePartition::Mail receipt/state-change support. Nodes upgrading from older binaries open an empty Mail/SNS store unless newer binaries have already written records.

Client migration

Replace direct mailbox-file writes with SDK calls:
CallPurpose
mail_create_mailboxRegister a mailbox capability record.
mail_publish_keyPublish or rotate encryption/signing keys.
mail_update_receive_policyUpdate the versioned receive policy.
mail_publish_delivery_commitmentRecord a delivery commitment on-chain.
sns_register_nameRegister a .sigil name.
sns_set_name_recordsSet resolver records (wallet, mail, website).
pin_public_mail_filePin public mail metadata in Weave.
Clients should resolve sigil_resolveMail before delivery and scan recipient commitments with sigil_listMailDeliveriesByRecipient.

Remaining hardening

The substrate is live, but a consumer-facing product still requires:
  • Full AEAD encryption and key wrapping in the client.
  • Full sender-key signature verification before display.
  • Contact, reputation, proof, and rate-limit policy enforcement beyond the launch-live deny/allow/fee/stake gates.
  • SNS auction settlement, if premium names are enabled.
  • UI and bridge migration away from /mail/* paths.

See also