# Phase 16: EML/MIME Evidence Parser - Discussion Log

> **Audit trail only.** Do not use as input to planning, research, or execution agents.
> Decisions are captured in CONTEXT.md — this log preserves the alternatives considered.

**Date:** 2026-07-15
**Phase:** 16-eml-mime-evidence-parser
**Areas discussed:** Raw .eml storage, Authentication-results depth, Indicators schema

---

## Raw .eml Storage

| Option | Description | Selected |
|--------|-------------|----------|
| Backblaze B2 | Reuse the LogLift evidence-storage pattern; raw_ref stores the B2 object key | ✓ |
| Hash only, no raw storage | raw_ref stores a content hash for dedup/audit; raw bytes never persisted | |
| Postgres bytea column | Store raw bytes directly in a new column | |

**User's choice:** Backblaze B2 (Recommended)
**Notes:** None beyond the recommendation.

---

## Authentication-Results Depth

| Option | Description | Selected |
|--------|-------------|----------|
| Structured pass/fail/none extraction | Parse Authentication-Results into structured spf/dkim/dmarc verdicts | ✓ |
| Raw header capture only | Store the raw header text as-is, no structured parsing | |

**User's choice:** Structured pass/fail/none extraction (Recommended)
**Notes:** None beyond the recommendation.

---

## Indicators Schema

| Option | Description | Selected |
|--------|-------------|----------|
| Add metadata JSONB column | ALTER TABLE indicators ADD COLUMN metadata JSONB | ✓ |
| Keep type+value only | Put extra detail into the parent messages JSONB columns instead | |

**User's choice:** Add metadata JSONB column (Recommended)
**Notes:** None beyond the recommendation.

---

## Claude's Discretion

- MIME parsing library/approach — explicitly routed to research (no codebase precedent)
- How to fetch full .eml attachment content from Autotask — explicitly routed to research/empirical testing (undocumented in AUTOTASK_API_GUIDE.md)
- URL extraction scope (dedup, normalization, which MIME parts to scan)
- Exact migration number for the indicators ALTER

## Deferred Ideas

None — discussion stayed within phase scope.
