From dc1197a716a6139b1451f7f2e002513eb899d8fd Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 10 Oct 2026 18:11:14 +0000 Subject: [PATCH] docs(dir-sim): Stalwart's account list is both chains Stalwart's member groups carry a group's addresses and its ACL grants, so the account list is the mail chain plus the SID chain, restricted to addressed groups (Stalwart #11). Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg --- docs/DIRECTORY-SIMULATION-POC.md | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/docs/DIRECTORY-SIMULATION-POC.md b/docs/DIRECTORY-SIMULATION-POC.md index aea29ed..d7bf463 100644 --- a/docs/DIRECTORY-SIMULATION-POC.md +++ b/docs/DIRECTORY-SIMULATION-POC.md @@ -632,8 +632,7 @@ no-population-intermediate rule. address and passes it on to its members. A nested group without an address cannot be addressed and ends the chain (`members_transitive_through` / `groups_transitive_through` with the - mail-enabled filter). Spear's `mailbox_members` and Stalwart's account - lists use this. + mail-enabled filter). Spear's `mailbox_members` uses this. - *Permissions*: only a security group has a SID, so a group without one can neither hold nor pass on a permission. Inheritance walks the same nesting through security groups only @@ -645,6 +644,12 @@ no-population-intermediate rule. membership use this. - *Both*: a mail-enabled security group carries a permission and receives mail. + - *A consumer whose group serves both*: Stalwart's member groups give + an account the group's addresses and the group's ACL grants, so its + account list is the union of the two chains, restricted to addressed + groups because Stalwart names a group by its address. A security + group without an address passes on the addressed security group it + is nested in; a group with neither an address nor a SID ends both. - **Unknown is not security-enabled.** A group whose security flag was not read is never in the security-enabled filter, so a permission granted to it is not inherited and fails closed. A group created in a