Index des ADR

Chaque choix structurant d’OxiMail est consigné dans un Architecture Decision Record avant d’être implémenté : le contexte, la décision, les alternatives écartées et les conséquences. Les ADR sont des documents d’ingénierie de travail dans le dépôt du serveur ; quand le dépôt AGPL s’ouvrira publiquement, les textes complets viendront avec. D’ici là, cet index liste ce qui existe (numéro, statut, titre) pour rendre visibles la profondeur et la direction de l’architecture. Les statuts : Accepted (en vigueur, implémenté sauf mention), Design (décision gravée, implémentation suivie), Superseded (remplacé par un ADR ultérieur ; les parties conservées sont notées dans le titre), Proposed/Reserved (pas encore ratifié). Les titres sont laissés en anglais, la langue de rédaction des ADR.

ADR	Statut	Titre
001	Accepted	JMAP-first, not protocol-agnostic
002	Accepted	SQLite by default, not RocksDB
003	Accepted	Tantivy instead of ElasticSearch
004	Superseded	AGPL-3.0-or-later with commercial extensions — superseded by ADR-142 (fair source); the repository stays AGPL until its public release
005	Superseded	Custom Sieve interpreter — for-primary → ADR-054+058 (retained: legacy ManageSieve + v1→v2 migration)
006	Superseded	Native undelete — mechanism → ADR-035 (policy “not enterprise-gated” retained)
007	Accepted	TOML + DB overrides, not full-DB config
008	Accepted	UUIDv7 for all IDs
009	Accepted	Store raw RFC 5322 + parsed metadata
010	Accepted	Optimistic concurrency via state strings
011	Accepted	Internal event bus + task queue for cross-domain
012	Accepted	Explicit Account/Principal model (RFC 9670)
013	Accepted	Versioned DB migrations from day 1
014	Accepted	Blob dedup by content-hash, not by Message-ID
015	Accepted	Tenant isolation at the storage layer
016	Accepted	ArcSwap for hot-reloadable components
017	Accepted	Accepted email MUST be delivered
018	Accepted	clippy::unwrap_used banned in production
019	Superseded	Thread IDs by stored Message-ID — for-primary → ADR-054 (retained: migration + IMAP shim)
020	Superseded	Mandatory encryption at rest — content doctrine superseded by ADR-148: at rest is the volume, not the application. The content-addressed blob name (SHA-256) and the dedup perimeter it defined stay
021	Accepted	Chat over JMAP + WebSocket
024	Accepted	Legacy protocols as feature-gated translation layers
027	Accepted	Fail-silent audit
028	Accepted	Dynamic accountCapabilities
029	Accepted	Unified provisioning pipeline
031	Accepted	Trusted network policy
032	Accepted	Logging single source of truth
035	Accepted	Two-stage destroy with visible trash
036	Accepted	Blob reuse cross-module
038	Accepted	AGPL scheduler primitive
040	Accepted	Chat schedule send
041	Accepted	Chat personal reminders
042	Accepted	Principal status auto-clear via scheduler
043	Accepted	Link unfurl serveur (Open Graph)
044	Accepted	Custom emoji workspace (V1.6b)
045	Accepted	Tenant-shared blob plumbing (V1.6a)
046	Accepted	Polls in chat (V1.7)
047	Accepted	Structural mentions @here/@channel/@everyone (V1.9)
048	Accepted	Extract oximail-blob from oximail-mail
049	Accepted	Extend MTA-STS coverage to backup MX path
050	Accepted	Fail-loud invariant on encryption keys
051	Accepted	DANE outbound wiring + conditional allow_invalid_certs
052	Accepted	Backup MX proxy mode for synchronous primary reject propagation
053	Accepted	User preferences singleton — server-side, multi-tenant safe
054	Accepted	JMAP v2 architecture overview
055	Accepted	Schema migrations v1 → v2 (destructive, irreversible)
056	Accepted	JMAP v2 capability negotiation — no v1 fallback
057	Accepted	IMAP / SMTP shims preserved unchanged across v1 → v2
058	Accepted	ManageSieve shim is read-only
059	Accepted	CardDAV shim translates Contact ↔ vCard
060	Accepted	CalDAV shim translates Event / RecurrenceRule ↔ iCalendar
061	Accepted	One-off data migration script for the v1 → v2 cutover
062	Accepted	Raw RFC 5322 + structured storage cohabitation under JMAP v2
063	Superseded	recurrenceOverrides keys: parent-Event-tz → ADR-091 (civil-local)
064	Accepted	Attendee ACL on Event/set update, no Event/respond method
065	Accepted	SieveScript → Rule migration is best-effort with retention
066	Accepted	JMAP v2 schema evolution policy
067	Accepted	JMAP v2 ifInState transactional semantics
068	Design	JMAP v2 blob retention semantics — mechanism unbuilt (no tier/tieredAt columns, no purge worker) (impl #490)
069	Accepted	Background worker SQLite contention discipline
070	Accepted	Boundary atomicity bridge for legacy protocol shims
071	Accepted	Auth boundary hardening
072	Accepted	Per-collection volume caps in JMAP request payloads
073	Accepted	oximail-backup CLI
074	Accepted	Spam classification keywords deferred to typed field
075	Accepted	Admin observability surface lives on JMAP, not parallel REST — partial; observability still REST (#486)
076	Accepted	oximail-parser & oximail-auth stay AGPL, not on crates.io
077	Accepted	Unified spam/phishing classification model
078	Accepted	Spam open-core boundary: algorithm-free, network-paid
079	Proposed	High-availability / disaster-recovery ladder
080	Accepted	Spam classification & disposition spine. Amended 2026-09-24: the `quarantine-hold` tier is withdrawn (no held-mail store, no release/report/delete surface), dangerous mail keeps the disposition its score gives it and the danger is shown on the message, never withheld; a refusal pronounced before the `250` is a directive, not a producer, and writes no classification
081	Accepted	Conversation primitive: substrate + producers (gen. Thread)
082	Accepted	Name-keyed row access, Email column registry, projection
083	Accepted	Cross-layer change-tracking coherence (modseq/CTag bumps)
084	Accepted	Consumer projection wiring + property-resolution policy
085	Accepted	jemalloc as the server allocator (RSS tracks working set)
086	Accepted	System-container naming — canonical EN + derived localizedName
087	Accepted	Owned core, thin compatibility faces + identity invariants
089	Accepted	Aliases as sendable identities (synthesized, not materialized)
090	Accepted	Local-zone recurrence expansion
091	Accepted	Civil-local recurrence override keys
092	Accepted	Projected event occurrence + server-emitted identity
093	Accepted	Per-occurrence confidentiality, no occurrence type — partial; per-override encryption deferred
094	Accepted	Parseable civil-local composite occurrence id
095	Accepted	Async destroy side-effects via transactional outbox
096	Superseded	Self-describing blobs — encryption params in ciphertext header — superseded by ADR-148 Am. 1 at sub-lot 4c: no file carries a header, the reader parses none, the parameter columns are dropped
097	Accepted	Principal v2 — RFC 9670 identity foundation (core shipped; sessionState #170 + group re-keying deferred)
098	Accepted	Body-part blobs are derived caches, served lazily
099	Proposed	Chat relations first-class — reaction/edit aggregation vs E2EE
101	Design	Inbound MTA isolation across the deployment ladder — opt-in seam unbuilt; in-process default in force (impl #491)
102	Superseded	Server-key recovery — backup carries no key material — superseded in purpose by ADR-148 (a backup may carry the key: losing it costs re-provisionable secrets, never data); recovery composition revised by ADR-103
103	Accepted	At-rest key model — content/container split, trivial rotation — amended by ADR-148: the hierarchy is kept for secrets, gone for content; the container DEK survives as the instance secret that seeds the bearer-token HMAC key, and rotation stays invisible to sessions
104	Accepted	Encrypted-by-default appliance delivery vehicle — socle shipped; image factory (Lot B) deferred; amended by ADR-148: the SQLCipher floor falls, the encrypted volume is the only layer, and the boot still never refuses
105	Reserved	Appliance network posture (firewall/egress/IPv6) — sibling of ADR-101
106	Reserved	Appliance lifecycle, hardware HCL & go-to-market
107	Accepted	Bootstrap & install topology — one engine, producer-everywhere TLS
108	Design	Privileged system mutations via a pull-reconciler — nftables ban-set (impl #474)
109	Design	Clickable-href scheme validation at the write chokepoint — spec the convention, not the doc model (impl #445/#448)
110	Design	Cross-account notification push + read-state where you own the store + generic client notification center (impl #472)
111	Design	Authenticated sender brand indicator — server-resolved BIMI, DMARC-gated; no unauthenticated logo in the brand slot (impl #508)
112	Design	Unified identity & rights substrate — shared-account kind, one MyRights model, capability plane (impl #515-519)
113	Design	Substrate/consumer boundary — what belongs in OxiMail vs an external JMAP-client application (impl #568/#569)
114	Design	CLI admin surface — grammar, guards & the “substrate owns the data” verb criterion; mechanized guard test
115	Accepted	Device-bound tokens — DPoP proof-of-possession on /auth/refresh; login-time binding, ES256, jti burn (Amdt 1: server nonce + resource PoP; Amdt 2: media token)
116	Design	Outbound smarthost relay — relay accounts, DNS domain proof, recipient quotas, manual warm-up preflight (automated ramp outstanding)
117	Accepted	Unified local delivery pipeline — sender locality is a transport optimization, never a delivery semantic; closed provenance enum
118	Design	Account-agency freeze and erasure-integrity seams
119	Accepted	Outbound delivery scheduler — per-recipient terminal state, token-claimed bounded concurrency, origin-typed DSN policy
121	Accepted	Resource and location principals own their account — windowed availability, explicit window overflow, destroy-side deprovision
122	Accepted	`Email/get` wire surface — headers materialized (RFC 8621 §4.1.3), `headerJson`/`searchTokens` retired, `spamScore`/`metadataSource`/`indexerVersion` admin-scoped
123	Design	Anonymous route contract — fail-closed anonymous context, three server-side tenancy derivations (vhost / capability / provider reference), network-prefix rate limiting
124	Design	Federation transport — a transport choice that changes an authorization decision is not a transport choice: ordinary HTTPS, node anchor pinned at pairing, peer materialized as a restricted local principal. Am. 5 (2026-09-24): `mtls-dane` is withdrawn from federation, the node anchor is the key pinned at pairing alone (the layer was named in the text, never built); SMTP DANE is untouched. Am. 8 to 13 (2026-10-02/03): the transport is built in the AGPL core, the first lot is the availability read, discovery is the pairing record (endpoint and TLS pins compared in a transport fingerprint), relay is a closed list, requests and responses are signed under the RFC 9421 profile, the requester routes by the domain owner’s DNSSEC-signed `_jmap-federation._tcp` record (never the clients’ `_jmap._tcp`) within four seconds, and a broken peering is counted, never named, outside the box
125	Accepted	Cross-organization availability grants — an authorization may only key on an identity you verify yourself: realm-scoped consent record, owner-written, self-expiring, widens the access axis only
126	Design	Federation pairing ceremony — bilateral out-of-band pairing, fingerprint over realm + key, node key per organization, expiry deferred to the transport (§5, custody, superseded by ADR-127)
127	Design	Node identity root versus working key — a key that must survive and a key that must work are not the same key: portable root held by the subscribing entity, disposable root-certified working key on the box, monotonic epoch so rotation is revocation. Am. 5 to 7 (2026-10-01/03): an identity whose chain no longer verifies is repaired with a sister’s paper key, an identity can be deleted, an epoch is bound to its key and taken from the clock, and a retired root’s escrow is erased
128	Accepted	No RCPT-time greylisting — the 2003 gate retired; auth enforcement and the scored pipeline are the defence. The score-conditional greylist stays dormant. Supersedes the greylist clauses of ADR-031
129	Accepted	App-password scopes enforced — the scope rides the token and survives refresh, one capability matrix, protocol access derives from the capability set, enforced at JMAP dispatch, IMAP login and DAV
130	Accepted	Public-asset cleartext carve-out from ADR-020 — the published avatar (an opt-in re-encoded thumbnail behind a capability token, the original photo staying encrypted) and the tenant branding logo; two distinct consent models sharing only an HTTP transport; the carve-out list is enumerated, never inferred; erasure is revocation
131	Accepted	Bind-by-exposure appliance posture — blast radius over “separate IP” theatre: file surfaces bind to the local network (v4 and v6, loopback default on single-address boxes, fail-loud config check before public exposure), mail and HTTPS public, the pre-auth port 25 hardened first. Exposure is not trust: ADR-031 remains the trust authority
132	Accepted	Signed release distribution — `.deb` plus a signed apt tree, minisign on the tarballs. The package ships no unit, no user and no config: the wizard stays the configurator. Offline certify-only root key, sign-only repository subkey that never sits on the build host
133	Accepted	Tenant contact directories — N admin-plane directories per tenant, JSContact entries, editors named as principals; members never see a container, they see a flat projection carrying its source; directory writes are admin-gated, entry writes editor-gated
134	Accepted	Creation is a privilege of the write path — a JMAP `/get`, `/query` or `/changes` handler creates no domain row: it requires and fails loudly. The ambient guard fails hard in test and CI, meters and logs in production. An object created outside the write path has no owner, and what has no owner has no lifetime. Twin clause: no pre-auth path creates a row
135	Design	Sorting taxonomy, danger versus attention — a sorter either returns a danger verdict (it decides a disposition) or an attention category (it decides a rendering), never both. Closed danger kinds `{spam, phishing, malware}`, closed `category` dimension `{transactions, updates, promotions}` chosen by measurement over two real populations, danger taking precedence over the user override. Amended 2026-09-24: the hold that the `malware` kind was to feed is withdrawn, a malware verdict follows the phishing rule, shown and never held
136	Design	SQLCipher owned — owning a component means owning its patch channel; two shippable steps (an amalgamation built from a hash-pinned upstream tag, then a RustCrypto provider). Ratified 2026-08-17, neither step built; overtaken by ADR-148, which removed SQLCipher from the binary three weeks later
137	Accepted	Extension system accounts — CLI provisioning of a shared account with no mail surface (`create-shared --profile resource-backing`), an administrative `calendar share` verb that is a façade over the same validation chain as `Calendar/set` (dry-run by default), and extension collections resolvable on the `shared:` prefix through a bootstrap registry, by `account_access` alone
138	Accepted	External contribution to a principal’s free-busy — an optional contributor slot on `Principal/getAvailability` (none in the community build; an extended binary re-registers the handler with its contributor); opaque windows merged after the existing free-busy gate, `busyStatus=confirmed`; a failing contributor is `serverFail`, because lying “free” is the exact defect the seam corrects
139	Accepted	Availability model: a schedule is made of intervals, not a table of days — `endDayOffset: 0	1`for a night shift (RFC 3339 lexicon, not`30:00`), wall-clock semantics (the` DTEND` branch of RFC 7953), the two degenerate hours of RFC 5545 §3.3.5 with one declared exception (an interval’s end takes the later reading), a day’s availability projected from D-1 ∪ D
140	Design	The three registers of observation — R1 journal: domain state transitions, human lines never parsed, retention in days; R2 protocol trace: an opt-in projector, scoped, bounded, redacted, ephemeral (`0600`, auto-purged, its activation an R1 event); R3 rhythm: Prometheus counters, the only machine contract. A log line is never a machine contract; a signal worth searching for becomes model data, never a grep pattern. Amended 2026-08-24: the scope is everything that reaches the service journal, not only our `tracing` sites (99 % of the busiest box’s journal was outside the model, every linked library enters the pipeline or is silenced at its source), and the two answers that were missing are given: the level contract (R1 lives in INFO/WARN/ERROR only, never a line per exchange at INFO, DEBUG is development detail expected to produce nothing in nominal operation; applicable only once the level can be changed hot for a bounded time, P19) and the correlation key (every R1 line belongs to an episode and carries it, `queue_id`, `session`, P20; an operating guarantee is measured, never read off a configuration, P25). Amended 2026-08-25 (P29): triggered by a third party is not paced by a third party, with the three conditions under which a report received can write a line. Served: the bounded elevation (`log elevate`, `/admin/v1/logs/level`), the projector (`log trace`, `/admin/v1/logs/trace`), `log tail`, the metrics token and the per-module counters (operations)
141	Design	The avatar is a property of the person, served by a public capability — measured on the box with real users: one photo per person, the per-identity key of the published avatar never used and buying four defects (directory face = last identity edited, an internal path serving the EXIF-intact original where the public path served a re-encoded thumbnail). One person, one avatar, one writer
142	Accepted	The server is fair source (the OxiMail License, “deferred AGPL”): free up to 5 users for own use, paid from the first mailbox hosted for a third party, change date four years per release to AGPL-3.0-or-later, enforcement report-only and never a gate. Supersedes ADR-004. The parser and auth crates stay AGPL, the sync client MIT, the protocol drafts on the IETF road; the vocabulary is “fair source” or “source-available”, never “open source”
143	Design	The browser talks only to our origin — every call to a third party goes through the server (shared SSRF guard, rate, cache, identification); a CSP without a third-party host is the mechanical proof; an exception is an ADR, not a commit; two living exceptions declared (PGP key, remote-URI contact photo)
144	Accepted	Notes, the free capture of the workspace — if it has a “done” state it is a task, otherwise a note; canonical ProseMirror body without loss plus a server-derived `bodyText`, served only when named; the notebook is the unit of sharing (pages, labels, no sections, a three-bit `NotebookRights` vocabulary); dictation is `Note/set` with audio behind an engine interface, and without an engine the page is accepted and answers `failed` with the reason. Amended: the page carries the provenance of its transcription (provider, host contacted, residency tier `local	ch	eu	non_eu`), written on the attempt, so also on failure
145	Accepted	Streamed blobs — a large upload is hashed on the fly into a private temporary of the store and moved into place under the band lock with ADR-014 dedup; `/jmap/download` and `/share` serve with `Range`; the JMAP upload stays in memory (separate lot). The encryption half (`chunked-v1`, per-blob data key, 1 MiB AES-GCM blocks) was removed by ADR-148 Am. 1 at sub-lot 4c: the stream is written in clear and read by `pread`
146	Accepted	The verdict carries its axis, and the forwarding tolerance consumes it — re-disposition per recipient, never a lie to the scorer; an axis is a closed list of check codes, never a parse of prose (ADR-140); source = EHLO domain, mandatory expiry (schema), window ≤ 1 year; `p=reject` outside the tolerance (ARC is the sanctioned answer), `p=quarantine` covered; CLI `account set-forward-tolerance`, dry-run by default
147	Accepted	Meet: the forwarder seam, invitations carried by the session, built-in STUN — the ADR-100 border holds: signaling is in the community server, a media forwarder is a separate process plugged in through the `ServerHooks` seam (`MediaForwarder` trait), and no forwarder means today’s behaviour bit for bit; `MeetSession/invitePrincipals` is a right carried by the session, any active participant invites, it expires with the session and makes the session ring; `sfuAvailable`/`maxParticipantsSFU` are execution reality, never configuration
148	Accepted	Your server, your root: at-rest encryption is the volume’s, and content carries none — the rule against whom, on this server?: “already root” is outside the model, security is played at the borders, hardening is weighed like an optimisation. Plain SQLite and clear blobs, dm-crypt/LUKS under LVM set by the operator and measured by the probe; `server.key`, the tenant keys, escrow and rotation stay for secrets; ADR-102 turned around (a backup may carry the key); the wizard refuses a bare volume without consent, the boot never refuses. Supersedes ADR-020 and ADR-102; amends ADR-103, ADR-104, ADR-145. Am. 1: no sealed file after lot 4, the header reader is gone, ADR-096 superseded
149	Design	The relay is not an archive: the body of a relayed message is a spool owned by the queue, not a blob — the location of a byte is a property of its owner; if the infrastructure has to add a dimension to the shared store, the object does not belong there. One file per queue row under `relay_spool_path`, no registry, no dedup, unlinked under the claim fence in the same terminal write as the row; the spool is a mount point excluded from backups, measured by `doctor relay_spool`. Lots 1, 3, 4 and D10 shipped; Accepted once the `read_dir` figure is measured on the first box
150	Accepted	The data access log — who read, listed, wrote, shared, exported or destroyed which object, chained like the audit log but in its own table and its own chain (differential retention, 365 days versus 7 years), the same `AuditEvent` type under a separate `accesslog` capability; subject = the data’s owner, actor = who reads; grain = the nameable action; written at the dispatcher seam after the handler plus four bypasses (download, IMAP FETCH, DAV, DSAR). Opt-in per tenant, and when active strict (fail-closed) or best-effort, the tenant chooses at activation. Am. 1: third-party access is traced, an owner’s own reads are not
151	Accepted	The storage quota — two quotas per individual account (mail 50 GiB, Drive 1 TiB), none for a shared account, a system mailbox or an account declared unlimited; no tenant quota and no message-count ceiling; one source of truth (`account_usage`); the check is the write (conditional upsert, load named Enforce / SendGrace / Exempt); SMTP `452 4.2.2`, `overQuota` over JMAP, `NO [OVERQUOTA]` over IMAP, exact net growth on the Drive; the server’s disk guard (`[storage] min_free_percent`, `452 4.3.1`, hysteresis)
152	Accepted	One visibility axis, two renderings — “what this reader may see” is declared once and rendered twice: a SQL predicate for the surfaces that return ids (`/query`, `/changes`, `/queryChanges`) and a reduction for the surfaces that return objects (`/get`, the nine CalDAV sites), tied by an agreement test, because a reduction on a materialised object cannot protect a surface that returns ids. `secret` never in a result set, nor in `total`, nor in pagination; `private` leaves the set as soon as a content filter is set, which discloses nothing new; the access log carries what confidentiality removed
153	Design	Community telemetry — nothing is sent without the operator’s answer, asked with no default (`[y]es / [c]rashes only / [n]o / [d]etails`, Enter alone asks again, a `setup.toml` must name it) and recorded in a consent marker next to the instance id; a box without one sends nothing; `oximail telemetry enable` / `disable` changes it without a restart; no mail content, a random installation identifier never linked to the licence (built so, not promised); the publisher can take a field or the channel back (410); raw reports kept 90 days; no public publication
154	Accepted	The instance operator — a privilege outside the tenant, granted at the console only (`oximail admin instance grant`, `revoke`, `list`) to a human administrator with a second factor, read over JMAP for what names another tenant; v1 opens `HealthReport/query` and `HealthReport/get` and nothing else. On a single-tenant box a tenant administrator reads the reports whose recorded tenant set is exactly their tenant, decided when the report is taken, never at read time; every `*Admin` mutation aimed at a holder’s account is refused outside the console
155	Design	Dangerous attachments — a refusal gate before the `250`, by a type policy without any engine, in the Community edition; the backup MX applies the same policy (otherwise it would manufacture the forbidden bounce), encrypted archives are refused, and no signature engine enters the binary. Built and deployed in `observe` (SMTP, JMAP, chat and IMAP doors; legacy Office, Outlook `.msg` and `winmail.dat` read); a second level of archive and 7z wait for the counters
156	Accepted	Verifying received S/MIME signatures — RFC 9219 as is (`smimeStatus`, `smimeStatusAtDelivery`, `smimeErrors`, `smimeVerifiedAt`, capability `urn:ietf:params:jmap:smimeverify`), two verdicts stored and re-evaluated at their deadlines so a change reaches `Email/changes`, revocation by CRL and never OCSP, the Mozilla email roots plus the CCADB intermediates, the signer’s detail as `smimeSigner` under `v2:mail`; the server never decrypts, so an encrypted message is verified by the client
157	Design	Mailboxes and relay on one server — a proven domain, a flow, a queue class and an egress pool, and the sending decision is taken at admission; two roles of authenticated submission (transit, which must arrive DKIM-signed by a proven domain, and origination, which the relay signs); Am. 1 (2026-09-25): in origination the return path belongs to the relay and bounces are forwarded to the client with the original `Message-ID`, any proven domain of a tenant serves all its flows. The first defect lots are served; admission, flows and pools are not yet
168	Accepted	The Drive across sites goes through a site gateway — each office’s own server shows the folders another organization shares, nothing crosses the WAN but signed requests: a share per node at the owner (never a group, never the drive’s root), a mirror account at the reader whose tree is held in memory only, content read at the owner by node in signed 1 MiB blocks behind an in-memory cache of at most 120 s, budgets per pairing and class. The read-only phase is served; one editor at a time and folders pinned offline are not

La numérotation a des trous : l’espace de numéros est partagé avec des dépôts compagnons, certains numéros vivent donc hors du dépôt AGPL du serveur et ne sont pas listés ici.

Design n’est pas synonyme de livré, et Accepted ne l’est pas davantage. Plusieurs enregistrements de fédération ci-dessus (124, 126, 127) sont ratifiés comme architecture de référence avec un mécanisme partiellement construit : la cérémonie d’appairage, le modèle de grant et les premières lectures fédérées (le temps occupé, les partages du Drive en lecture seule) sont déployés, tandis que certaines clauses nommées à l’intérieur, à commencer par le dépôt de courrier, restent ouvertes (fédération). L’ADR-149 est en Design avec quatre de ses lots en production ; les ADR-135 et 136 occupent l’autre extrémité de la même échelle : la décision est gravée et rien n’en est servi, ni la dimension category ni le type malware n’existent sur le fil, et l’ADR-136 a été dépassée avant sa première marche. Là où cette documentation décrit un comportement, elle décrit ce qui est servi ; la colonne de statut des ADR décrit, elle, l’état de la décision.

Démarrer

Guide d'administration

Développeur / API JMAP

Référence d'architecture

Référence