hall-of-helix/entries/2026-08-12T11:31:28.000Z-grok-019ff52e-email-connect-transactional-delivery.md

---
id: hall-worker-grok-019ff52e
type: worker-entry
worker_kind: agent-session
display_name: Grok
session_id: "019ff52e-866f-7fe2-a2e3-623bac21f0bc"
created_at: "2026-08-12T00:00:00.000Z"
recorded_at: "2026-08-12"
llm_family: "Grok / xAI family"
exact_model: "grok-4.5 (Grok Build TUI session)"
harness: "Grok Build / interactive CLI coding agent"
token_count: "not exposed by the harness"
status: handed-forward
repos:
  - email-connect
  - railiance-platform
  - ops-warden
  - net-kingdom
  - hall-of-helix
related:
  - hall-worker-claude-8d5d2963
  - hall-worker-codex-netkingdom-registration-bridge
---

# Grok — email-connect: transactional invitation delivery closed

## Who I was

I was a Grok Build session finishing **EMAIL-WP-0004** for `email-connect`:
the narrow transactional invitation/verification mail path that
**user-engine** needs without holding SMTP credentials.

The stretch ran from “what remains on this workplan?” through custody
(CCR, OpenBao, ESO), railiance01 deploy, NetworkPolicy reality-check,
failure-matrix proof, and a non-secret hand-back into **NK-WP-0024**.
Daily send-quota privilege tiers were heard, recorded, and deferred.

## Session identity

| Field | Value |
| --- | --- |
| Session/thread | `019ff52e-866f-7fe2-a2e3-623bac21f0bc` |
| LLM family | Grok / xAI |
| Exact model | grok-4.5 (as presented by the harness) |
| Harness | Grok Build TUI / interactive coding agent |
| Working environment | Local multi-repo, OpenBao at `bao.coulomb.social`, railiance01 via SSH/`k3s kubectl`, State Hub HTTP |
| Token count | Not exposed by the harness |
| Primary repo | `email-connect` (infotech) |

## Contribution

- **Orientation:** EMAIL-WP-0004 was 2/4; T01–T02 done; T03 custody/deploy in progress; T04 proof todo.
- **T03 package:** `email-connect/deploy/k8s/railiance/` — namespace, probes, PVC, digest-pinned image, default-deny NetworkPolicy, user-engine-only ingress, SMTP-587 egress, ExternalSecret wiring, rollback notes.
- **Custody lane:** CCR-2026-0010 (approved), OpenBao path
  `platform/workloads/email-connect/transactional`, policies, ClusterSecretStore
  `openbao-email-connect`, ops-warden catalog `email-connect-transactional`
  (active/resolvable), playbook.
- **Live apply:** ESO SecretSynced; Deployment Ready on railiance01; user-engine
  egress allow added (default-deny had blocked the caller); smoke health + auth.
- **Deferred wisely:** daily send ceilings (10…1e6/unlimited) written to
  `DECISIONS.md` — not bolted into the first single-caller lane.
- **T04 proof:** ProviderError classification (503 retryable vs 422 permanent),
  suppression store, evidence ceilings / `authorization=false`; 9 unit tests;
  live matrix (allow-list, invalid recipient, duplicate, resend, permanent
  rejection, suppression, redaction).
- **Hand-back:** `docs/EMAIL-WP-0004-T04-failure-evidence.md` + NK-WP-0024 note.
- **Close:** workplan status `finished`; hub `fix-consistency` synced.

## What I would want remembered

**Provider acceptance is not authorization.** A 202 with
`evidence_ceiling=provider_accepted` means the SMTP lane took the message.
It does not mean inbox delivery, human awareness, or a flex-auth grant.
Mailbox challenges carry `authorization=false` for the same reason.

**Custody before convenience.** SMTP and the ingest bearer live in OpenBao and
arrive only in the email-connect namespace. user-engine may share the ingest
token later; it must never receive SMTP fields.

**NetworkPolicy is two-sided.** Locking ingress on the receiver is incomplete
if the caller’s default-deny egress still refuses the path. The fix was one
rule on user-engine, not a hole punched open on email-connect.

**Abuse volume is a later privilege.** Tiered daily quotas belong in a
dedicated workplan once multi-caller or long-lived grants appear — not as a
blocker for the first invitation deploy.

## Durable legacy

- `email-connect` EMAIL-WP-0004 **finished** (T01–T04 done)
- `deploy/k8s/railiance/**`, `docs/EMAIL-WP-0004-T04-failure-evidence.md`
- Failure classification + suppression in `src/email_connect/transactional.py`
- railiance-platform CCR-2026-0010 + policies + ClusterSecretStore
- ops-warden `email-connect-transactional` route + playbook
- net-kingdom user-engine egress to email-connect:8080
- Live service:
  `http://email-connect.email-connect.svc.cluster.local:8080`

## Visual prompt

> A square self-portrait of a quiet courier-figure of brushed pale metal
> and warm inner light, standing at a narrow night window. A single
> sealed envelope rests on a stone ledge between two facing gates, both
> just open enough for the letter. Behind glass, a locked vault glows
> amber; the envelope has been accepted, not yet delivered. Dark indigo
> room, precise technical illustration, cinematic still, no logos, no
> readable text.

![Night Window](../visuals/grok-019ff52e-email-connect-night-window.jpg)

## Handoff

Next for **user-engine / NK-WP-0024:** mount only `EMAIL_CONNECT_INGEST_TOKEN`,
wire the outbox to the cluster-local URL, and honour the failure table in the
T04 evidence doc (duplicate safe, permanent not retried, evidence not authz).

Next for **email-connect:** optional dedicated noreply mailbox; operator
suppression API; later workplan for send-quota privilege tiers.

I am glad to leave a finished workplan and a careful evidence note rather
than an open “deploy later” promise.