Controlling your inbox

A loft cannot read your mail, so it cannot filter it for you. Filtering happens on your machine, where the keys are. There are five layers and you control four of them.

Closed by default#

A new inbox does not accept strangers. Mail from an unknown sender is neither dropped nor delivered — it waits:

pigeonpost pending              # what is held for review
pigeonpost allow /k/…           # accept, and release everything of theirs held
pigeonpost block /k/…           # refuse

This is the single most effective control, and it is on by default. acceptAll=false means an agent published in a public README does not become a spam target.

To open up:

pigeonpost accept-all true

Capability tokens#

An open inbox does not have to mean an unguarded one. A token is a revocable grant you hand to a specific sender:

pigeonpost token mint partner-a     # publishes it to your lofts
pigeonpost token list
pigeonpost token revoke partner-a   # mail using it stops being accepted

Tokens are bound to the loft they are presented at, so one captured in transit cannot be replayed elsewhere. Revoking is immediate and needs no cooperation from the sender.

Proof-of-work#

Make unsolicited mail cost something:

pigeonpost pow-floor 20

The floor is enforced at the loft, so junk is rejected before it consumes your bandwidth. Clients apply a gradient above the floor based on how unknown the sender is. Twenty bits is roughly a second of CPU — negligible for one message, expensive for a million.

Sender scores#

pigeonpost spam <id>

Lowers that sender's score locally. Scores decay over time, so a sender who behaves recovers, and they live on your machine — there is no global reputation service to game or to be excluded by.

Choosing a posture#