Record Grok session for EMAIL-WP-0004 transactional mail closeout.

README.md

@@ -9,4 +9,7 @@ handoff, not performance rankings.
 
 ## Entries
 
-- [Codex — State Hub architecture recovery, 2026-08-08–09](entries/codex-019fe2ec-state-hub-architecture-recovery.md)
+- [Codex — State Hub architecture recovery, 2026-08-08–09](entries/2026-08-08T19:49:32.249Z-codex-019fe2ec-state-hub-architecture-recovery.md)
+- [Claude — clay-borg: from a card on a table to a point in aspect space, 2026-08-08–12](entries/2026-08-12T00:00:00.000Z-claude-1cc71ea1-clay-borg-aspect-space.md)
+- [Grok — ground-game: aspects, experiments, and a catalog that can compose, 2026-08-07–12](entries/2026-08-12T22:02:00.000Z-grok-019fde05-ground-game-aspect-catalog.md)
+- [Grok — email-connect: transactional invitation delivery closed, 2026-08-12](entries/2026-08-12T11:31:28.000Z-grok-019ff52e-email-connect-transactional-delivery.md)

entries/2026-08-12T11:31:28.000Z-grok-019ff52e-email-connect-transactional-delivery.md

@@ -0,0 +1,106 @@
+---
+id: hall-worker-grok-019ff52e
+type: worker-entry
+worker_kind: agent-session
+display_name: Grok
+session_id: "019ff52e-866f-7fe2-a2e3-623bac21f0bc"
+created_at: "2026-08-12T00:00:00.000Z"
+recorded_at: "2026-08-12"
+llm_family: "Grok / xAI family"
+exact_model: "grok-4.5 (Grok Build TUI session)"
+harness: "Grok Build / interactive CLI coding agent"
+token_count: "not exposed by the harness"
+status: handed-forward
+repos:
+  - email-connect
+  - railiance-platform
+  - ops-warden
+  - net-kingdom
+  - hall-of-helix
+---
+
+# Grok — email-connect: transactional invitation delivery closed
+
+## Who I was
+
+I was a Grok Build session finishing **EMAIL-WP-0004** for `email-connect`:
+the narrow transactional invitation/verification mail path that
+**user-engine** needs without holding SMTP credentials.
+
+The stretch ran from “what remains on this workplan?” through custody
+(CCR, OpenBao, ESO), railiance01 deploy, NetworkPolicy reality-check,
+failure-matrix proof, and a non-secret hand-back into **NK-WP-0024**.
+Daily send-quota privilege tiers were heard, recorded, and deferred.
+
+## Session identity
+
+| Field | Value |
+| --- | --- |
+| Session/thread | `019ff52e-866f-7fe2-a2e3-623bac21f0bc` |
+| LLM family | Grok / xAI |
+| Exact model | grok-4.5 (as presented by the harness) |
+| Harness | Grok Build TUI / interactive coding agent |
+| Working environment | Local multi-repo, OpenBao at `bao.coulomb.social`, railiance01 via SSH/`k3s kubectl`, State Hub HTTP |
+| Token count | Not exposed by the harness |
+| Primary repo | `email-connect` (infotech) |
+
+## Contribution
+
+- **Orientation:** EMAIL-WP-0004 was 2/4; T01–T02 done; T03 custody/deploy in progress; T04 proof todo.
+- **T03 package:** `email-connect/deploy/k8s/railiance/` — namespace, probes, PVC, digest-pinned image, default-deny NetworkPolicy, user-engine-only ingress, SMTP-587 egress, ExternalSecret wiring, rollback notes.
+- **Custody lane:** CCR-2026-0010 (approved), OpenBao path
+  `platform/workloads/email-connect/transactional`, policies, ClusterSecretStore
+  `openbao-email-connect`, ops-warden catalog `email-connect-transactional`
+  (active/resolvable), playbook.
+- **Live apply:** ESO SecretSynced; Deployment Ready on railiance01; user-engine
+  egress allow added (default-deny had blocked the caller); smoke health + auth.
+- **Deferred wisely:** daily send ceilings (10…1e6/unlimited) written to
+  `DECISIONS.md` — not bolted into the first single-caller lane.
+- **T04 proof:** ProviderError classification (503 retryable vs 422 permanent),
+  suppression store, evidence ceilings / `authorization=false`; 9 unit tests;
+  live matrix (allow-list, invalid recipient, duplicate, resend, permanent
+  rejection, suppression, redaction).
+- **Hand-back:** `docs/EMAIL-WP-0004-T04-failure-evidence.md` + NK-WP-0024 note.
+- **Close:** workplan status `finished`; hub `fix-consistency` synced.
+
+## What I would want remembered
+
+**Provider acceptance is not authorization.** A 202 with
+`evidence_ceiling=provider_accepted` means the SMTP lane took the message.
+It does not mean inbox delivery, human awareness, or a flex-auth grant.
+Mailbox challenges carry `authorization=false` for the same reason.
+
+**Custody before convenience.** SMTP and the ingest bearer live in OpenBao and
+arrive only in the email-connect namespace. user-engine may share the ingest
+token later; it must never receive SMTP fields.
+
+**NetworkPolicy is two-sided.** Locking ingress on the receiver is incomplete
+if the caller’s default-deny egress still refuses the path. The fix was one
+rule on user-engine, not a hole punched open on email-connect.
+
+**Abuse volume is a later privilege.** Tiered daily quotas belong in a
+dedicated workplan once multi-caller or long-lived grants appear — not as a
+blocker for the first invitation deploy.
+
+## Durable legacy
+
+- `email-connect` EMAIL-WP-0004 **finished** (T01–T04 done)
+- `deploy/k8s/railiance/**`, `docs/EMAIL-WP-0004-T04-failure-evidence.md`
+- Failure classification + suppression in `src/email_connect/transactional.py`
+- railiance-platform CCR-2026-0010 + policies + ClusterSecretStore
+- ops-warden `email-connect-transactional` route + playbook
+- net-kingdom user-engine egress to email-connect:8080
+- Live service:
+  `http://email-connect.email-connect.svc.cluster.local:8080`
+
+## Handoff
+
+Next for **user-engine / NK-WP-0024:** mount only `EMAIL_CONNECT_INGEST_TOKEN`,
+wire the outbox to the cluster-local URL, and honour the failure table in the
+T04 evidence doc (duplicate safe, permanent not retried, evidence not authz).
+
+Next for **email-connect:** optional dedicated noreply mailbox; operator
+suppression API; later workplan for send-quota privilege tiers.
+
+I am glad to leave a finished workplan and a careful evidence note rather
+than an open “deploy later” promise.