docs: inspect n12-pre message source formats
This commit is contained in:
@@ -3,6 +3,7 @@
|
||||
Date: 2026-07-09
|
||||
Stage: B source discovery
|
||||
Evidence index: `docs/source-discovery/2026-07-09-n12-pre-zyl-index.md`
|
||||
Schema notes: `docs/source-discovery/2026-07-09-n12-pre-zyl-schema-notes.md`
|
||||
|
||||
## Source priority
|
||||
|
||||
@@ -16,63 +17,24 @@ Evidence index: `docs/source-discovery/2026-07-09-n12-pre-zyl-index.md`
|
||||
|
||||
| MCP tool | Primary source | Fallback source | Evidence file | Decision status | Next implementation slice |
|
||||
| --- | --- | --- | --- | --- | --- |
|
||||
| `isphere_receive_messages` | `zyl\iSphere\8c5e81a7f6dd1169.10083\27000000\Account\90005981\MsgLib.db` | `zyl\Impp\Account\90005981\MsgLib.db` plus `Smark.SendReceive`, `SaveToDB`, and `PacketReader.ProcessPacket` logs | `docs/source-discovery/2026-07-09-n12-pre-zyl-index.md#first-extraction-target-list` | selected for schema inspection; implementation starts after message table mapping is confirmed | first |
|
||||
| `isphere_search_contacts` | contact/conversation/person tables inside `MsgLib.db`, if schema exposes display names or account ids | infer from message rows; then UIA helper source through current WinHelper if DB lacks contact display names | `docs/source-discovery/2026-07-09-n12-pre-zyl-index.md#msglibdb-candidates` | candidate pending DB schema inspection | second |
|
||||
| `isphere_search_groups` | group/conversation tables inside `MsgLib.db`, if schema exposes group ids or group display names | infer from group-message rows; then UIA helper source through current WinHelper if DB lacks group display names | `docs/source-discovery/2026-07-09-n12-pre-zyl-index.md#msglibdb-candidates` | candidate pending DB schema inspection | third |
|
||||
| `isphere_receive_files` | importal hashed document cache mapped through `MsgLib.db` attachment/file-reference rows | `Smark.SendReceive` and `SaveToDB` logs for file-reference traces | `docs/source-discovery/2026-07-09-n12-pre-zyl-index.md#receiveddocument-cache-candidates` | candidate pending DB schema and cache-reference inspection | fourth |
|
||||
| `isphere_receive_messages` | decrypted `PacketReader.ProcessPacket` XMPP `<message>` stanzas | decrypted `Smark.SendReceive` transport stanzas; decrypted `SaveToDB` `Chat_OnMessageArrived` traces; wrapped `MsgLib.db` after DB wrapper is solved | `docs/source-discovery/2026-07-09-n12-pre-zyl-schema-notes.md#field-mapping-evidence` | selected for Stage C log-backed parser | first |
|
||||
| `isphere_search_contacts` | decrypted packet/send-receive JIDs and later roster stanzas from `Smark.SendReceive` | `MsgLib.db` contact/conversation tables after DB wrapper is solved; UIA helper source if display names are missing | `docs/source-discovery/2026-07-09-n12-pre-zyl-schema-notes.md#log-decryption-result` | candidate pending parser coverage | second |
|
||||
| `isphere_search_groups` | decrypted XMPP group/message stanzas if groupchat/group JIDs appear | `MsgLib.db` group/conversation tables after DB wrapper is solved; UIA helper source if group display names are missing | `docs/source-discovery/2026-07-09-n12-pre-zyl-schema-notes.md#field-mapping-evidence` | candidate pending group stanza evidence | third |
|
||||
| `isphere_receive_files` | decrypted `PacketReader.ProcessPacket` file-transfer message stanzas plus `zyl\importal\<hash>` cache mapping | decrypted `Smark.SendReceive` and `SaveToDB` traces for file-reference reconciliation | `docs/source-discovery/2026-07-09-n12-pre-zyl-schema-notes.md#field-mapping-evidence` | candidate pending cache-reference mapping | fourth |
|
||||
|
||||
## Stage C entry rule
|
||||
|
||||
Open implementation only after the selected row links to a concrete file or directory in the evidence index and the schema/log inspection notes state which fields map to the MCP output contract.
|
||||
|
||||
## Stage B2 extraction and inspection order
|
||||
|
||||
| Order | Target | Why | Expected output |
|
||||
| --- | --- | --- | --- |
|
||||
| 1 | `zyl\iSphere\8c5e81a7f6dd1169.10083\27000000\Account\90005981\MsgLib.db` | latest visible iSphere message DB; best candidate for `isphere_receive_messages` | schema summary, table list, sample redacted row shapes |
|
||||
| 2 | `zyl\Impp\Account\90005981\MsgLib.db` | same account id in older/parallel IMPP tree | schema comparison with iSphere DB |
|
||||
| 3 | `zyl\Impp\Account\27091282\MsgLib.db` | largest DB, likely richer schema/data variety | schema comparison and attachment/contact table clues |
|
||||
| 4 | `zyl\importal\localcache\8c5e81a7f6dd1169.10083\27000000\Log\90005981\SaveToDB\2026-07-07_1.log` | may reveal which DB table receives message data | log field summary and DB/table clues |
|
||||
| 5 | `zyl\importal\localcache\8c5e81a7f6dd1169.10083\27000000\Log\90005981\Smark.SendReceive\2026-07-07_1.log` | send/receive trace near latest DB timestamp | message-id or payload-shape clues |
|
||||
| 6 | `zyl\importal\localcache\8c5e81a7f6dd1169.10083\27000000\Log\90005981\PacketReader.ProcessPacket\2026-07-07_1.log` | packet processing trace near latest DB timestamp | packet-to-message mapping clues |
|
||||
| 7 | `zyl\importal\localcache\8c5e81a7f6dd1169.10083\27000000\Log\90005981\LoginInfo\2026-07-07_1.log` | account/session context for source mapping | account id and environment context |
|
||||
|
||||
## Tool-by-tool decision notes
|
||||
|
||||
### `isphere_receive_messages`
|
||||
|
||||
Selected first because the latest `90005981` iSphere `MsgLib.db` and same-day logs align around `2026-07-07 15:30-15:43`. Stage B2 must inspect the DB schema and produce a field mapping for:
|
||||
|
||||
- message id
|
||||
- conversation id or peer id
|
||||
- sender id/name
|
||||
- timestamp
|
||||
- message body or content reference
|
||||
- attachment/file reference if present
|
||||
|
||||
After schema mapping, Stage C can start with a local DB-backed source abstraction before registering the business MCP tool.
|
||||
|
||||
### `isphere_search_contacts`
|
||||
|
||||
Candidate path is DB-first. If the DB contains contact/person tables, use those. If not, derive a minimal contact search result from message conversation rows and sender/peer identifiers, then use UIA as fallback for display-name enrichment.
|
||||
|
||||
### `isphere_search_groups`
|
||||
|
||||
Candidate path is DB-first. If the DB contains group/conversation tables, use those. If not, infer group-like conversations from message rows and use UIA as fallback for display-name enrichment.
|
||||
|
||||
### `isphere_receive_files`
|
||||
|
||||
Candidate path is DB/cache mapping. The hashed `zyl\importal\<hash>` directories appear to hold received document cache files. This tool needs DB/log references to map those hashed directories back to conversations/messages before implementation.
|
||||
Open implementation only for the selected row whose evidence maps concrete fields to the MCP output contract. After Stage B2, `isphere_receive_messages` satisfies the entry rule through decrypted `PacketReader.ProcessPacket` XML shape.
|
||||
|
||||
## Stage C first slice recommendation
|
||||
|
||||
Start Stage C with a narrow `isphere_receive_messages` source abstraction:
|
||||
Start Stage C with a narrow log-backed `isphere_receive_messages` source abstraction:
|
||||
|
||||
1. Extract the selected DB/log files into `runs/offline-evidence-intake/zyl-qqfile-20260709/extracted/`.
|
||||
2. Inspect schema and record a schema note under `docs/source-discovery/`.
|
||||
3. Implement a local DB source interface only after the table/field mapping is confirmed.
|
||||
4. Keep MCP registration as the next commit after the source abstraction test passes.
|
||||
1. Implement DES/CBC/PKCS7 line decryption for `IMPP.Util.Log.LogSecurityPolicy` format.
|
||||
2. Implement a parser for decrypted `PacketReader.ProcessPacket` XMPP `<message>` stanzas.
|
||||
3. Normalize only redacted test fixtures into message structs first.
|
||||
4. Add the MCP tool registration after the parser/source abstraction passes tests.
|
||||
|
||||
## Stop condition for this matrix
|
||||
## Deferred source work
|
||||
|
||||
If DB schema inspection shows no message table or no usable message fields, do not start Stage C implementation. Return to Stage B and promote the log source or UIA helper source to the first candidate.
|
||||
`MsgLib.db` is deferred because the selected DB files are not direct SQLite and did not decrypt to a SQLite header with the known log policy key. A separate DB-wrapper analysis node is required before using DB tables as a production read source.
|
||||
|
||||
Reference in New Issue
Block a user