July 14, 2026

miloh-mail

A Hermes-native system to grok correspondence — not just fetch unread mail. Design locked after a full grill; implementation not started.

Decision: Build greenfield miloh-mail on the M4 Max. SQLite is system of record (metadata + extracted text, forever). v1 is read-only IMAP across four accounts, plus one allowlisted morning digest email. Retire legacy milo-mail after explicit gates; keep milo-email for general send until a later phase.

The gap

Existing tools can list and send mail. They don’t compound into a model of people, threads, commitments, and open loops. “Read my inbox” ≠ “what’s outstanding with X?”

Tonbi’s Masterclass doesn’t ship a dedicated email episode; the pattern is still clear: tools for hands, layered memory for brain, cron for continuity, skills for procedure, quarantine for untrusted text.

What we’re replacing

System	Today	Fate
`milo-mail`	Personal triage: IMAP → SQLite → classify → Telegram digests	One-time import, freeze, retire after gates
`milo-email`	Fastmail client for agent identity (send/fetch)	Stays until miloh-mail send phase
`miloh-mail`	—	Hermes-owned knowledge + index + digest

Locked architecture

IMAP ×4  (every 15 min)
   → extract text + injection flags + rules
   → SQLite  (~/.hermes/work/miloh-mail/)

Hermes cron  05:00 America/Chicago
   → delta + open loops + project suggestions
   → email digest  (agent From → primary human To)

Hermes chat
   → miloh-mail CLI  (search / loops / dossier)

Choice	Lock
Code / data	`~/code/miloh-mail` · `~/.hermes/work/miloh-mail/`
Host	M4 Max
Store	SQLite: metadata + extracted body text forever
Attachments	Metadata only (no bulk download v1)
Folders	INBOX + Archive/All-Mail (deduped) + Sent; no Trash/Spam
History	90 days live first, then rate-limited forever backfill
Sync	Hermes cron every 15 minutes
Write policy	Strict read-only IMAP; digest SMTP allowlist only
Agent API	CLI + small Python library (no MCP v1)
Secrets	Vaultwarden source of truth + local secret files
Injection	Flag on ingest; default safe/redacted read path

Accounts (roles)

Mailbox	Role
Apple (me.com)	Primary human; digest destination
Gmail	Human secondary
al-engr personal	Human / work-adjacent
milo@ agent identity	Agent actor on Sent; digest From

Open loops & dossiers

Open loops: needs-reply · waiting-on-them · commitments (suggest + confirm) · noise ignore (noreply blocklist + editable domains). Noise can still be archived forever; it just doesn’t become a loop.

Dossiers: rules + manual assignment; LLM may suggest on the morning digest only — no silent full auto-file.

Seed projects: nous-hermes, bob-roxy, milo-trials, al-engr, family, finance-personal, legal-admin, travel, shopping-orders, uncategorized.

Human surface: v1 = SQLite + CLI only. Later, gated one-way markdown export into a dedicated Obsidian Mail/dossiers/ tree (generated, do-not-edit, stable slugs). Never Obsidian as co-source of truth. (Opus 4.8 agreed: protect vault trust until dossier quality is proven.)

Morning digest

Field	Value
When	05:00 America/Chicago
Channel	Email only (not Telegram)
From → To	Agent mailbox → Apple primary only
LLM	Grok primary, OpenAI subscription fallback (local too flaky for cron)
SMTP	New code in miloh-mail day one (not a thin wrap of legacy mail.py)
Sync path	Rules-only — no per-message LLM

Success & retirement gates

Product success without opening Mail.app: answer “what’s open with X?”; actually read the digest most mornings for a week; ≥3 seed projects populated; open loops catch a real drop.

Retire milo-mail when: 7 days stable four-account sync · 5 consecutive useful digests · CLI useful without fallback · import done · explicit go. milo-email remains until send ships.

Build phases

0 Skeleton — package, schema, secrets layout, seed projects
1 Sync — four IMAP accounts, extract + flags, 15m cron, 90-day window
2 Rules / loops / dossiers — blocklist, open loops, assign CLI, import legacy DB
3 Digest — renderer, Grok/OpenAI, SMTP allowlist, 05:00 CT cron
4 Hermes skill — documented CLI, chat smokes
5 Backfill + retire — forever backfill, kill milo-mail crons, optional Obsidian export

Why not just “better IMAP in chat”?

Because forever + open loops + dossiers need a durable index outside any single session. Session search and Honcho can sit on top of digests and summaries later; they are not the archive. Quarantine stays mandatory: email is untrusted content until proven otherwise.

Inspired by Tonbi email→GBrain (pattern only)

After design lock, I watched Tonbi’s Feeding GBrain Your Emails Autonomously with Hermes Agent and the GBrain email-to-brain recipe. No locks changed. The useful doctrine is the same split we already grilled:

Script collects · agent judges · brain remembers. Never both collect and judge in one path. IDs, deep links, timestamps, noise class → code. Who matters, action items, project suggestions → LLM. Hermes cron pre-run scripts exist exactly for that.

Steal	miloh-mail mapping
Deterministic collector	15m IMAP → SQLite (rules + injection flags)
Code-generated deep links	Never let the model invent mail URLs
Noise vs review/allowlist	Archive forever ≠ promote to open loops / dossiers
Sent mail as negative filter	Required so open loops don’t lie
Verbatim quotes; summary ≠ record	Digest carries short quotes + structure
Silent when empty	No spam digest on zero delta
Typed write contract for “brains”	Future one-way exporters (Obsidian dossiers; optional GBrain-shaped MD)

Not adopting for v1: GBrain as system of record, GWS/Google Cloud OAuth as the only access plane, Telegram digests, or auto-writing a people graph on every mail. miloh-mail is multi-account (Apple primary), SQLite forever, morning email digest, rules+manual dossiers. GBrain can sit downstream later as an optional renderer — same one-way posture as Obsidian, not a second SoR.

Design grilled and locked July 14, 2026. Tonbi pattern note added same day. Private plan: Obsidian AI Inbox · miloh-mail Plan.md. Implementation waits for an explicit go.