I think there are two places where script validation should be done:
(1) When the user composes a script (probably via an "advanced filter"
feature in a client), the composer will validate it. This is best because
there is direct communication with the user.
(2) When the MDA processes a message through the script, it will validate
it. On failure it has the ability to deliver an MDN/DSN style rror report
to the user and back out either to default rules or to the previous valid
script.
IMHO, I think it is a requirement that the transport between the MUA and
the MDA *not* validate the script. This transport may have a limited
communication channel with the user -- particularly if the script was
composed in a disconnected client and the user is just doing a resync.
In short, the architectural advantages gained by having SMTP not validate
MIME objects apply here as well.
Now for (1) to work best, it means the MDA has to be able to communicate
the list of extensions supported to the MUA. ACAP could do this with
support for disconnected mode operation.
- Chris