Templates, signatures and composing

A compose (compose, reply, reply-list, :template, :unsubscribe) opens a fields stage, aerc style: To, Cc, Bcc and Subject are structured fields edited in place, and From cycles through every configured identity with left/right or space rather than taking free text; replies preselect the identity the resolution engine picked. tab/shift-tab move between fields, enter advances and, on From, opens $EDITOR on the body alone; headers never pass through the editor. ctrl-e (or ctrl-h) toggles between the fields and the running editor, both ways, so one chord covers the round trip. esc backs out of the fields stage (to the review screen once one exists, else out of the compose). The stage's keys are always spelt out in the status line.

Leaving the editor lands on a review screen, Mutt style, showing the recipients, subject, seal plan, attachments and the first body lines; nothing is sent until confirmed there. Its keys:

y    send (seal per the plan, queue for antiphond)
e    edit the body again (ctrl-e works too)
h    edit the header fields again (ctrl-h works too)
a    add an attachment (path prompt, ~ expands)
d    remove the selected attachment
j/k  move the attachment selection
s    toggle signing for this message
x    toggle encryption for this message
q    close, asking first whether to save a draft
^c   stays on review; nothing is discarded

Attachments are read in full when added, so a bad path fails at the prompt (named error, then re-asked) rather than at send time. The message ships as multipart/mixed with base64 parts; the content type is inferred from the file extension, falling back to application/octet-stream, and signing or encryption wraps the whole multipart per RFC 3156.

q writes the compose, fields, plan and attachment paths included, to a file under store/drafts/ and names it in the statusline; :resume <path> reopens it on the fields stage exactly as saved (a vanished attachment file is reported and dropped).

OpenPGP at compose time

pgp_sign sets the default for mail sent from that identity; signing is off unless enabled. Before composing, :sign, :nosign, :encrypt and :noencrypt override the default for the next message only, and the compose statusline shows the resulting plan ([sign], [sign+encrypt]). Signing goes through gpg-agent, so pinentry and smartcards work as they do for gpg; the signer is the pgp_key fingerprint or, absent that, the agent key whose user ID carries the identity address.

Encryption requires a cert for every To and Cc address in the trusted keyring (.asc/.pgp files under the config directory's pgp/; see OpenPGP). If a cert is missing, signing fails, or the agent refuses, nothing is sent: the compose stays on the review screen and the statusline names the problem. Received multipart/encrypted mail is decrypted through gpg-agent when opened, and any signature inside is verified against the same keyring.

Machine state and data

State (nothing precious) goes to $XDG_STATE_HOME/antiphon, caches to $XDG_CACHE_HOME/antiphon, and the message store, index, operation log, outbox and sync state live under $XDG_DATA_HOME/antiphon/store, the path the vault mounts over from M6. antiphon doctor reports every resolved path and --init-store creates or repairs the store.