Engineering notes from building an email firewall in the open. House rule: a number only appears here if you can re-run it from the repo — and when one stops reproducing, it comes down and we say so.
Email is attacker-writable input. Four layers of defense, and the honest line between a safety policy and a safety property.
No message text leaves your machine: the two env vars, the qwen3:8b starting point, and how to measure your model instead of trusting it.
Over-billing doesn't lose money — it loses availability. The incident, and the four rules the cap now follows.
Rules are auditable and stale; models generalize and can't explain themselves. The honest comparison, and the split that keeps both halves.
Skip-the-inbox filters done safely: the label trick, the keyword trap that eats receipts, and the weekly-review safety net.
The importance markers, the filter option that silently overrides them, and the retraining loop most people never use.
The order matters: kill subscriptions first, then batch, then filter — and why muting the app just relocates the anxiety.
Why Gmail buries real mail under Promotions, the four fixes that actually work, and why the model forgets your corrections.
Four working ways to stop every email from buzzing your phone — Gmail's high-priority-only setting, per-label notifications, importance-only desktop alerts — and the structural gap all four share.
Six current models, one narrow job, one run each. Price does not order the table, the interesting failure has a mechanism, and the safety floor held for every model — including the two that failed the gate.
Longer essays from before this page existed: