@analogic , do you have an opinion on the switch to this "flow through" style of logic for should_skip()? Specifically, does it make it easier to reason about what will happen? Is it easier to maintain (alter/extend)?

exports.should_check = function (connection) {
     const plugin = this;

     let result = true;  // default

     if (plugin.cfg.check.authenticated == false && connection.notes.auth_user) {
         connection.transaction.results.add(plugin, { skip: 'authed'});
         result = false;
     }

     if (plugin.cfg.check.relay == false && connection.relaying) {
         connection.transaction.results.add(plugin, { skip: 'relay'});
         result = false;
     }

     if (plugin.cfg.check.local_ip == false && connection.remote.is_local) {
         connection.transaction.results.add(plugin, { skip: 'local_ip'});
         result = false;
     }

     if (plugin.cfg.check.private_ip == false && connection.remote.is_private) {
         if (plugin.cfg.check.local_ip == true && connection.remote.is_local) {
             // local IPs are included in private IPs
         }
         else {
             connection.transaction.results.add(plugin, { skip: 'private_ip'});
             result = false;
         }
     }

     return result;
 }

LGTM!

To plugin.js abstraction - In future It would be nice to have some generic flag which would control skipping from outside. Like another plugin deciding by IP/RCPT/FROM/AUTH/user profile. (I like what https://github.com/creamfinance/haraka-plugin-plugin_manager can do but I don't like mixing yaml and js logic)

In future It would be nice to have some generic flag which would control skipping from outside

Exactly. In briefly thinking about it, what I see is that there's already a half dozen implementations of varying degrees of skipping / whitelisting. Before assembling this PR I reviewed them but none of them are a one sized fits all. The conditions under which you might want to whitelist a connection from early_talker or greylisting are considerably different than for rspamd or clamd. But this should_check logic does cover the majority of cases for most plugins. In another evolution or two maybe we'll have something that's general purpose enough to work everywhere.