eyes-and-ears talks IMAP to Proton Mail Bridge running on a homelab VM, so Bridge decrypts the mail there and it never passes through a third-party service. Bridge’s self-signed certificate is pinned by its SHA-256 fingerprint and checked on every call. Folders are opened read-only, so reading doesn’t mark anything as read, and message bodies reach the model marked as untrusted.
Anything can list folders, search, and read a message, a thread or the inbox. Over HTTP, Lan also gets new mail with a mark so each message is read once, a gate that says whether anything new has arrived, and tools to archive, send to spam, restore, label and count moves.
The server enforces its own limits whatever the model asks. Only inbox messages move out, and only archived or spam messages move back. Mail from anyone I’ve written to is never moved. There are at most 50 moves a day, counted from the log, so a restart doesn’t reset the count. Every change is a line in that log, and if the log can’t be read, moves stop. It can’t send, delete or flag anything. Sender rules I’ve decided on archive or spam mail every 15 minutes without a model.
The HTTP server listens only on the VM’s tailnet address and answers only Lan, with a token.
In the Wheel of Time, the Eyes and Ears are the networks of informants that report to the Ajahs.