Zach Zayac

Projects / WITAN

Email Monitor & Scheduling

Live · guarded

Autonomous email capture with provenance gates — commitments surface without impersonation risk.

Updated

What problem it solves

Email is where commitments hide. Appointments, deadlines, renewals, “can you get back to me by Friday” — they arrive buried in prose, and either you transcribe them into your systems by hand or they silently become surprises. The obvious fix — let an AI read your inbox and act — carries the obvious danger: an inbox is an open port. Anyone in the world can put words in it. A system that turns inbox text into actions has to be paranoid about whose words it’s executing.

The thesis

Pipes move information; agents decide; provenance is sacred. The transport layer (connectors, polling, normalization) is deliberately dumb and lossless. The judgment layer (what matters, what’s a commitment, what deserves a draft) is small models with narrow jobs. And between the outside world and anything that acts sits a hard rule: third-party words can inform, but only the Principal’s words instruct.

The email trust boundary Anyone can write to an inbox; dumb lossless pipes carry it in; a provenance gate splits third-party words (inform only) from the Principal's words (may instruct); drafting is autonomous, sending is human. WORDS ARE NOT COMMANDS UNLESS THEY ARE YOURS OUTSIDE — ANYONE CAN WRITE HERE The inbox an open port — the injection-watch surface Transport dumb, lossless pipes — receipts at the choke point Provenance gate whose words are these? third-party words INFORM: screen · summarize · surface the Principal's words INSTRUCT: capture · schedule · act screeners, a per-sender profiler, and a reply drafter sit past the gate — drafting is autonomous, sending is a human's hand
The trust boundary: an inbox is an open port, so provenance is checked at the seam — outside words may inform, only mine may instruct.

Key features

  • Announced autonomous capture. When the system captures something from email on its own, it says so — receipts issue from the choke point, so there’s a visible record of every autonomous read. No silent ingestion.
  • Provenance gates (the P1 family). A third party’s email can never ride the capture pipeline as if it were my instruction. Source-threading is stamped and checked; the impersonation class of failure is guarded at the seam, with the ingress flagged as the injection-watch surface.
  • Sender-aware handling. Sender classes decide how much of a message is stored and how it’s treated; a per-contact sender profiler builds a communication picture that feeds the reply drafter.
  • The email loop, on existing rails. An orchestrator drives screen → capture → draft using the same spine every other segment uses — nothing bespoke, so every step is traced like any other agent run, and a captured commitment lands on the same calendar and to-do rails as a spoken one.
  • A drafts hub where composed replies wait for a human send — drafting is autonomous, sending is not.

Highlights

  • The provenance regression was caught, diagnosed, and closed the same week the capture pipeline went announced-autonomous — the exact failure mode this design is paranoid about, found by the system’s own verification pass.
  • The screening/summarizing/drafting brains are cleanly separated from the transport, which means every piece can be swapped, benched, or audited alone.

Development log

July 8, 2026

Page created. This past week: announced autonomous capture with receipts, the provenance gate family (source-threading fix, sender-class gate, amplifier stamps), sender-profiler feeding the reply drafter, and Gmail-category-aware body truncation — the last survivor of the sender-class rollout.