# Reported issues for mail-index

Pod holds 8 of 8 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to [mail-index](/mcp/mail-index).

## Most discussed

### M3: Reach full MCP tool parity on the Worker

## Context
Depends on 004 (worker MCP endpoint), 006 (Job engine — handbacks and
auto-refresh become Jobs), 007 (OAuth in front), 005 (stored `scopes` for
write gating).
Read first: ADR-0001 (inline is O(1) only), ADR-0005 **including its
2026-07-01 amendment** (freshness block on every response; any stale
account-scoped read auto-refreshes), ADR-0009 (handback → Job), ADR-0007
(write tools opt-in), CONTEXT.md (Command handback, Job, Inline enrichment).

The single tool registry is `TOOLS` in `s

[Read the thread](https://github.com/unsoldgroup/mail-index/issues/19) · 2026-07-18 · open · 1 comment

### M4: Ship remote ops and docs — threat model, install guide, status polish, push design note

## Context
Depends on all of 001–012 ("13 last") — it documents and hardens what they
built.
Read first: ADR-0008 (the costs it promises to state plainly — this ticket
redeems that promise in the threat model), docs/THREAT-MODEL.md (current
local-only posture), docs/INSTALL.md + docs/agent-install.md (the local
guides the worker guide mirrors), docs/oauth-and-verification.md, CONTEXT.md
(Deployment, Trigger rule).

## Decision
Four deliverables, no new features:

- **Threat model, remote section

[Read the thread](https://github.com/unsoldgroup/mail-index/issues/24) · 2026-07-18 · open · 0 comments

### M4: Expose a minimal A2A surface (agent card + message/send)

## Context
Depends on 010: Trigger rules ("shares engine" per the dependency graph —
lands after the tool surface is final) and transitively 007/008 (auth +
parity: A2A wraps the same engine as the MCP tools).
Read first: docs/PLAN-worker.md decision #9, CONTEXT.md (Recall — this is the
capability the card advertises), ADR-0008.

The engine to wrap: `dispatch(ctx, name, args)` (src/mcp/server.ts:415) and `toolList()` from
`src/mcp/server.ts` — the same registry-backed execution path the MCP
tran

[Read the thread](https://github.com/unsoldgroup/mail-index/issues/22) · 2026-07-18 · open · 0 comments

### M4: Implement Trigger rules with signed webhook delivery

## Context
Depends on 006: Job engine (evaluation hooks into the sync pipeline; delivery
retries ride Queues) and 008: tool parity (new tools join the same TOOLS
registry, gated by 007 OAuth).
Read first: CONTEXT.md **Trigger rule** — use its predicate list *exactly*:
"category, `is_list`, Correspondent status, Interest profile membership,
label, sender/domain, subject/FTS terms — evaluated against newly synced
Messages". The differentiator vs provider filters: rules can reference what
the index

[Read the thread](https://github.com/unsoldgroup/mail-index/issues/21) · 2026-07-18 · open · 0 comments

### M3: Add MCP OAuth via workers-oauth-provider with operator allowlist

## Context
Depends on 004: worker/ entry (wraps its fetch handler; kills its dev bearer
stub) and 005: Google OAuth connect (reuses the BYO Google client for the
sign-in leg).
Read first: docs/PLAN-worker.md decision #4, ADR-0008 (single-tenant — the
only human is the operator), CONTEXT.md (Deployment).

## Decision
Full MCP OAuth using Cloudflare's `workers-oauth-provider` library, so the
Worker works as a claude.ai remote connector out of the box.

- Add `workers-oauth-provider` as a dependenc

[Read the thread](https://github.com/unsoldgroup/mail-index/issues/18) · 2026-07-18 · open · 0 comments

### M2: Build the Google OAuth connect flow with encrypted token storage

## Context
Depends on 003: Gmail REST MailSource adapter and 004: worker/ entry.
Read first: docs/oauth-and-verification.md (Option B — BYO Google Cloud
client), ADR-0008 ("The Worker holds Google credentials" — AES-GCM, key only
in Worker secrets, ciphertext in D1, "a D1 export alone is useless"),
ADR-0007 (opt-in writes; `gmail.modify` is a separate consent), CONTEXT.md
(Account, Read-only by default).

This gives 003's injected `tokenProvider` a real implementation and gives 006
credentials f

[Read the thread](https://github.com/unsoldgroup/mail-index/issues/16) · 2026-07-18 · open · 0 comments

### M2: Create the worker/ entry and wrangler config serving streamable-HTTP MCP

## Context
Depends on 001: Extract async StorageDriver and 002: D1 StorageDriver.
Read first: docs/PLAN-worker.md (decisions #1, #2, #11 — #11 excludes the
self-update shim), ADR-0008 (Worker lives outside the egress-guarded core),
CONTEXT.md (Deployment).

The MCP engine to reuse lives in `src/mcp/server.ts`: the `TOOLS` registry
(single source of truth binding name → schema → handler), `dispatch()`,
`toolList()`, and `buildServer(ctx: ToolContext): Server`. Note:
`serveHttp(opts: HttpServeOpti

[Read the thread](https://github.com/unsoldgroup/mail-index/issues/15) · 2026-07-18 · open · 0 comments

### M1: Add the Gmail REST MailSource adapter behind an injectable fetch seam

## Context
Depends on nothing in this repo's ticket chain (parallel to 001/002; feeds 5
and 6 per the dependency graph 3→(5,6)).
Read first: CONTEXT.md (Enrichment, Read-only by default, Account), ADR-0007
(opt-in mailbox writes), ADR-0008 ("audited seams" — the Gmail REST adapter
lives outside the guarded assumptions but is pinned, not waived).

Today's adapters spawn CLIs: `src/source/adapters/gws/` and `.../gog/` each
have a `runner.ts` (the spawn seam, allowlisted in `test/egress-guard.test.

[Read the thread](https://github.com/unsoldgroup/mail-index/issues/14) · 2026-07-18 · open · 0 comments

## Most recent

The remaining reports are on [the project's issue tracker](https://github.com/unsoldgroup/mail-index/issues).