Global Database 0.2 (DRAFT)

🎯 The objective

The aim of this project is to make Global Database data portable between Thunderbird installations by implementing the PDPArchive-compatible mail and portable profile-data format defined by RFC 0008. It builds on the completed Global Database 0.1 cutover so users can export, validate, import, and back up their mail, portable settings, account configuration, and account/profile data without depending on legacy database layouts.

Success means that the app emits and imports a documented, versioned archive based on the selected PDPArchive draft, preserves the portable profile-data records required by RFC 0008, and can evolve emitted archives through explicit format and PDPArchive-version adapters.

🎒 Resources

• RFC 0008: Portable Profile Data Format
• Technical Design 0004: Portable Profile Data Format
• draft-ietf-mailmaint-pdparchive-01: Personal Data Portability Archive
• Global Database 0.1 milestone

🦮 Rules of the Road

🟢 In Scope

• Implement the current PDPArchive draft's mail layout and metadata mapping for mail held by the global database.
• Implement RFC 0008's Thunderbird-owned versioned records for portable settings, account configuration, identities,
  folder settings, and account/profile data.
• Export and import complete and selected portable profile-data bundles with validation before any runtime data changes.
• Implement archive and record-version adapters for every profile-data and PDPArchive draft revision emitted by the app.
• Implement the encrypted full-backup envelope and cross-device passphrase import defined by RFC 0008.
• Provide the verified portable-mail archive preflight used by POP3 Global Database migration.
• Establish fixture-based round-trip, compatibility, privacy-exclusion, corrupted-archive, and cross-device import verification.

🔴 Out of Scope

• Changing Room 3, global-database schema ownership, repository contracts, or the Global Database 0.1 cutover design.
• Treating a PDPArchive layout as the runtime Room schema or exposing archive types through repository APIs.
• Remote synchronization transport, storage, authentication replication, or automatic conflict resolution.
• Exporting passwords, OAuth tokens, certificate private keys, queued operations, database internals, migration state, or other device-bound state.
• Individual-message and selected-folder EML export. Those remain separate mail-export flows.

🚧 Technical and/or Business Requirements

• The initial compatibility target is draft-ietf-mailmaint-pdparchive-01, identified in each archive alongside the Thunderbird portable-profile-data and generator versions.
• PDPArchive's mail representation and the Thunderbird-owned record namespace are the portable format. The global database remains the app's runtime representation and maps through domain contracts.
• Imports validate the complete archive before modifying runtime data. They present selection and conflict information before applying user-approved changes.
• The format must preserve the stable portable IDs, revisions, origins, and tombstones defined by RFC 0008.
• Unknown optional fields must not discard known data. Unknown required versions must fail the affected import with an actionable local error.
• Full backups use the RFC 0008 user-passphrase-derived AES-256-GCM envelope. Portable exports warn that their mail, addresses, and server configuration are sensitive user data.
• POP3 migration remains gated on successful creation and verification of its portable mail archive. An IMAP archive is user-requested and does not block an IMAP-only migration.
• All archive processing and diagnostics must protect message content, addresses, server configuration, credentials, and passphrases from logs and telemetry.

Start by reading docs/engineering/rfcs/0008-portable-profile-data-format.md and docs/engineering/technical-designs/0004-portable-profile-data-format.md, then review the Global Database 0.1 milestone at issue 10374. Break the draft into scoped implementation tasks covering archive mapping, validation, adapters, encryption, and verification. Done requires portable export/import and backup behavior that meets RFC 0008, protects excluded data, and passes the specified fixture-based compatibility and privacy checks.