---
description: learned preferences, project conventions, and Do-Not-Repeat rules
budget_tokens: 2000
---
# Cerebrum

> OpenWolf's learning memory. Updated automatically as the AI learns from interactions.
> Do not edit manually unless correcting an error.
> Last updated: 2026-10-30

## User Preferences

<!-- How the user likes things done. Code style, tools, patterns, communication. -->
- Writes in Portuguese (pt-BR); answer in Portuguese. Wants things finished end to end: merged, released, deployed and checked in production, without being asked again (said so on 2026-10-22).
- Likes a clean interface with every function reachable (Apple / Anthropic as references, Outlook over Gmail), dark theme by default with a light one.
- [2026-10-30] CI must be efficient: never redo work already done for the same content. Hash what goes into the artifact (the `inputs-<hash>` image tag, or a filtered `git ls-tree` hash), ask the registry, and skip CI and build when it exists; a version tag or a docs/workflow-only merge only re-points tags. Do not run `ci.yml` on `main` by push when `release.yml` already calls it. Use `paths-ignore` for docs and tool state (`.wolf`, `.claude`, `.superset`). The user repeated this several times and was angry when a tag was about to recompile the Next.js build.
- [2026-10-30] Keep repositories clean: after a branch is merged, delete it on Gitea and locally (`git push gitea --delete <b>`, `git branch -d <b>`). Never touch the user's own unmerged branches.
- [2026-10-30] Every tool gets semver tags and a Gitea Release (Releases tab, not just container images) with notes from the matching `CHANGELOG.md` section (`scripts/release-notes.sh`). Keep the changelog updated under Unreleased. A tag job that creates the release must use an explicit `if: ${{ !cancelled() && needs.<job>.result == 'success' && startsWith(gitea.ref, 'refs/tags/v') }}`.
- [2026-10-30] Source of truth is Gitea (`git.lucasrguerra.dev.br`, remote `gitea`, SSH on port 22 through the host). The GitHub account is suspended (404): never push to or depend on GitHub. Workflows live in `.gitea/workflows` and use the `gitea.*` context.

## Key Learnings

- **Project:** LambdaMail
- **Description:** A self-hosted mail server with an integrated webmail and admin console, built to
- [2026-10-30] Release flow: `plan` job hashes `services/ migrations/ config/` → `inputs-<hash>`; reuse takes ~1 min instead of 30. A job downstream of a skipped `build` needs explicit status checks in its `if`. Images: `git.lucasrguerra.dev.br/lucasrguerra/lambdamail/<service>`. v1.0.0 was the first tag (no history survived from GitHub). Production deploy is blocked until the Coolify app's source is switched from Public GitHub to Gitea in the Coolify UI (API cannot); deploy only when the user is assured everything is right. Single `.env.example` + `scripts/init-env.sh` (`make env`).

## Do-Not-Repeat

<!-- Mistakes made and corrected. Each entry prevents the same mistake recurring. -->
<!-- Format: [YYYY-MM-DD] Description of what went wrong and what to do instead. -->
- [2026-10-22] `git add -A` swept the untracked `.wolf/` and `CLAUDE.md` into a public repo. Add explicit paths (`git add services migrations`), never `-A`.
- [2026-10-22] Deploy is two steps: PATCH the Coolify env `IMAGE_TAG` to `sha-<commit>` and only then POST /deploy. A deploy without the PATCH redeploys the old image and still says "finished". Wait for the Release run to be `completed`, not just for `gh run watch` to return.
- [2026-10-22] `pkill -f <pattern>` kills the shell that is running it when the pattern appears in the command text. Use a bracket such as `[m]ock.mjs`, and never in a command that also contains the pattern as plain text.
- [2026-10-22] `~/.claude/tools/chrome-claude --print-path` launches Chrome. Pass the wrapper only as `executablePath`.
- [2026-10-22] `services/protocols` e2e tests apply only migration 0001. Delivery code must not call SQL functions or columns from later migrations.
- [2026-10-22] A `<Button>` inside a `<form>` submits it unless `type="button"` (Undo send used to resend the message).
- [2026-10-22] Never run side effects inside a React state updater (it can run twice).
- [2026-10-23] Inside a JS template literal `\\d` silently becomes `d`. For scripts embedded in template strings write `[0-9]` instead of `\\d`, and test the script's behaviour, not only that it is present.
- [2026-10-30] On the Gitea runners never mount the job workspace into a container with `-v "$PWD:..."`: the Docker daemon (DinD) cannot see it and mounts an empty directory. Use `docker create` + `docker cp` + `docker start -a`.
- [2026-10-30] Do not use `aquasecurity/trivy-action` (clones Trivy from the Gitea server), `actions/upload-artifact` v4+, the `gha` buildx cache or `rustsec/audit-check`. Run Trivy from `aquasec/trivy` with `-v trivy-cache:/root/.cache/`, use the registry for cache, `cargo audit` for Rust. The runner sets `GITHUB_OUTPUT`/`GITHUB_STEP_SUMMARY` but NOT `GITEA_OUTPUT` etc.
- [2026-10-30] Pushing old tags to Gitea triggers the `.github/workflows/release.yml` found in those old commits (Gitea falls back to `.github` where `.gitea` is absent). They queue forever on missing macOS/Windows runners: cancel them (`POST /repos/{o}/{r}/actions/runs/{id}/cancel`) right after pushing tags.
- [2026-10-30] The runner Docker daemons persist between jobs: steps that create networks/containers must be idempotent and clean up with `if: always()`.

## Decision Log

<!-- Significant technical decisions with rationale. Why X was chosen over Y. -->
- 2026-10-22 Sessions: webmail session is 30 days and renewed daily while in use; each account is also a `lm_acct_<id>` cookie, `lm_user_session` stays the active one so the Go service and the middleware needed no change. Console stays at 8 hours.
- 2026-10-22 Trusted senders live in table `trusted_senders`; delivery rescues a Junk verdict only when DMARC passed, or SPF passed for the From domain (a forged From must not be rescued).
- 2026-10-22 Conversations: `thread_id` is written at delivery (Message-ID, then In-Reply-To/References, then Re:-subject); NULL means "its own conversation" via COALESCE(thread_id, id). Subject key is computed in Go at delivery and in SQL (`lm_subject_key`) for the backfill; a test holds them equal.
- 2026-10-22 Themes: every colour is a CSS variable per theme (`globals.css`), Tailwind scales (slate, indigo, amber, rose, emerald) read them, `ink` is the on-ground colour. Dark is default; the theme is chosen by a script in `<head>` before first paint. Font Geist is self-hosted (@fontsource-variable/geist).
- 2026-10-23 Logo: a lambda of two straight strokes of one weight, ends cut square, joined without a seam, flat ultramarine tile with continuous corners. The first version (round caps, gradient, envelope flap) read as childish; do not go back to round-capped strokes. Generator: `scripts/brand/` (mark.py, icons.mjs); `Logo.tsx` carries the same path.
- 2026-10-23 Reader: a message written plainly is drawn in the app's colours (transparent frame, text lifted if too dark, white backdrops cleared); a designed one (backgrounds, bgcolor, 3+ tables) keeps a white sheet. Decided by `looksDesigned` in `lib/emailBody.ts`; a reply's quoted history folds behind a button.