daswerklab@gmail.com is connected as native Gmail source 2. It is
independent of German iCloud source 1, daswerklab@icloud.com. Using the
Gmail address as an Apple sign-in identifier does not connect Google mail.
| Source | Provider | Mailbox | Schedule |
|---|---|---|---|
| 1 | iCloud IMAP | daswerklab@icloud.com |
*/15 * * * * |
| 2 | Gmail API | daswerklab@gmail.com |
*/15 * * * * |
The dedicated Google Cloud project is msgvault-beachlab, display name
msgvault, number 38818430731. Its Gmail API is enabled. The consent
application and Desktop OAuth client are named msgvault NUC, with
daswerklab@gmail.com as support/developer contact. Google showed
In production before the final native authorization flow was started.
The callback is http://localhost:8089/callback, reached through a temporary
loopback SSH tunnel; it is not exposed publicly.
The owner approved gmail.readonly and gmail.modify on 2026-10-11 to import,
search and clean mail. The stored token's exact scope set matches those two
permissions and has a refresh token. No full-mail, Calendar or Drive scope
was granted. Google includes composing and sending in gmail.modify; it
does not offer a scope limited to moving messages to Trash.
Msgvault 0.21.0's delete-staged defaults to Gmail Trash, recoverable for
30 days. --permanent needs a separate https://mail.google.com/ grant.
No Gmail deletion batch was selected or executed during connection. The
global [deletion].remote_enabled remains false; an owner-approved exact
batch can use the native one-command MSGVAULT_ENABLE_REMOTE_DELETE=1 gate.
Both MCP transports retain their read-only tool exposure. The Google provider
grant permits cleanup through the native owner workflow; it does not itself
enable MCP write tools.
Sources: Google Gmail scopes,
native scope definitions,
native deletion workflow,
installed add-account/delete-staged help, and live token metadata.
Google allows personal apps with fewer than 100 users without verification; this application remains unverified and Google shows that warning. Production removes the special seven-day refresh-token expiration of External/Testing apps, not every possible cause of token revocation. Sources: personal-use exception and token expiration.
Private NUC files are mode 0600, owned by msgvault:
/var/lib/msgvault/tokens/google-client-msgvault-nuc.json/var/lib/msgvault/tokens/daswerklab@gmail.com.json
[oauth].client_secrets points to that client file. The prior configuration
is preserved at
/var/lib/msgvault-backup/gmail-connection-20261011/config.before.toml.
The Mac recovery client is private at
/Users/Papi/.config/msgvault/gmail-connection-20261011/google-client.json.
Never put secrets, tokens or OAuth callback codes in Git or command output.
Google's disabled Publish app action became available after the actual homepage/privacy/use links were saved. The owner then confirmed publication and the read/modify grant. The public disclosure URLs are:
https://msgvault.beachlab.org/abouthttps://msgvault.beachlab.org/about#privacyhttps://msgvault.beachlab.org/about#terms
oauth-info.html describes the personal
archive, the Google grant, OpenAI embeddings, private storage, encrypted NAS
backups and the separate archive deletion lifecycle. The authorized Google
domain is beachlab.org.
The Nginx template exposes only the exact informational /about route and
its /about/ redirect. A public GET returned HTTP 200 with a byte-for-byte
match to the HTML; /, /api/v1/stats and /about/anything still redirected
to Authentik. The archive's existing passkey checks remain active. For
recovery, install the HTML from this repository as root-owned mode 0644 at
/var/www/msgvault-info/index.html, install the site template, validate Nginx
and reload it. The HTML can be reproduced from Git; the encrypted archive
backup separately preserves the native client/token/configuration. Source:
Google OAuth Branding requirements
and private public-route readback evidence.
The first full sync, native run 31, completed on 2026-10-11 at 15:12:14 UTC: 249 found, 249 added, zero errors/skips, 13.39 MB downloaded in 2 minutes 28 seconds. This matched the provider's profile count of 249 before import. Scheduled run 32 at 15:15 UTC imported one new message, bringing Gmail to 250 and demonstrating that automatic incremental sync works. The iCloud archive remained at 2,655 messages at this readback.
The initial job msgvault-gmail-initial-20261011.service ran exact-source
sync-full --source-id 2 followed by embeddings build --yes; it exited
successfully. The build added all 249 initial messages to active generation
3, with zero failures. Ten texts were reported as truncated under the
existing 2000-character input limit; their archived messages remain available
for reading and full-text search. The later scheduled message was also
indexed. The live API reported 2,905 messages, 2,905 embedded, zero missing,
and vector status ready.
The semantic model remains text-embedding-3-small, 1536 dimensions,
fingerprint text-embedding-3-small:1536:p1-111111:c2000:e1. The configured
15-minute embedding schedule and post-sync trigger remain enabled.
Sources: Msgvault vector sync triggers
and the native job, generation list and authenticated API readback.
Codex's registered MCP returned three semantic results for account
daswerklab@gmail.com, all with source_id=2. The same query through the
exact stdio command in Watson's current mcp.servers.msgvault configuration
also returned three source-2 results. That checks Watson's configured MCP
transport, not a new message sent to the Watson chat. English iCloud topic
views remain scoped to source 1.
Native live receipts are private under
/var/lib/msgvault-backup/gmail-connection-20261011/: connected.json,
complete-readback.json and watson-mcp-proof.json. Browser/protected-route
evidence is private under the Mac directory named above.
The initial 250-message import was subsequently cleaned and filed under English topics on 2026-10-11, with owner approval: 80 unwanted messages (including all 34 TestFlight notifications) reached Gmail Trash and were purged from Msgvault. The remaining 170 were filed; Inbox retained 2 new messages and 4 items for review. Source 1 stayed at 2,655 messages. See Gmail organization and recovery evidence for the exact workflow, account guards, current topic profile and verification.
Encrypted NAS snapshot ba054dbc, captured at 15:16:34 UTC on 2026-10-11,
completed successfully and passed the runner's Restic data check. An isolated
Restic plus native restore reproduced sources 1/2 with 2,655 / 250
messages and SQLite integrity ok. The restored Google client and Gmail
token matched the live credentials byte-for-byte, with mode 0600. The live
archive was not replaced. Proof: private restore-proof.json in the NUC
receipt directory. Vectors are rebuilt after restoration, following the
existing backup procedure.
To reauthorize, reuse this Cloud project/client and run the native CLI as
msgvault, from /var/lib/msgvault, with --home /var/lib/msgvault:
add-account daswerklab@gmail.com. Its normal scope set includes read/modify;
do not use --readonly against an existing write grant and expect it to narrow
Google permissions. After account verification, restore the exact source's
15-minute schedule, sync it and build any missing embeddings. Credential
entry, new grants and legal acceptance must follow the applicable browser
handoff/confirmation policy.
Sources: Msgvault 0.21.0 OAuth setup, native source setup, installed CLI help and the authenticated runtime evidence above.