Today's note
New entry
Mail accounts
Connect a mailbox with its IMAP password (app passwords where required). Credentials are sealed at rest; the agent never sees them and no tool can read them back.
Manual server config skips autodetect. Both servers still require a live IMAP login before anything is stored.
Calendar accounts
Connect a CalDAV server (Fastmail, iCloud, Nextcloud, Google app-password). Credentials are sealed at rest; the agent never sees them and no tool can read them back.
Manual server URL is authoritative — discovery is skipped entirely and connect fails loudly if this URL doesn't work. A live PROPFIND must still succeed before anything is stored.
Provision user
Creates the user and, if requested, issues their first API token. The token is shown exactly once and never stored — copy it somewhere safe now.
New tenant
Platform operators only; the section is hidden for tenant admins.