Skip to content

feat: add inactive Outlook warning-draft workflow scaffold #18

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Jdelg718 merged 1 commit into from
May 18, 2026
Merged

feat: add inactive Outlook warning-draft workflow scaffold #18

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
75 changes: 48 additions & 27 deletions HANDOFF.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,11 +4,11 @@

- GitHub: `https://github.com/Jdelg718/BotFucker`
- Default branch: `main`
- Latest merged milestone: Phase 15 Emergency-Stop Bridge Rehearsal (`feat: add emergency-stop bridge rehearsal`, main at 3b1075e)
- Current working branch: `phase-16-outlook-warning-draft-sandbox-contract`
- Current PR target: Phase 16 Microsoft Outlook Warning-Draft Sandbox Contract — docs/tests only, no OAuth/live provider mutation/no send
- Selected next provider/action target: Microsoft Outlook warning draft in sandbox/manual reviewed bridge contract; no send-reply mutation yet
- Current local demo target: demonstrate deterministic local review, optional mocked LLM classifier fallback/validation, approved-action export, dry-run n8n bridge contract, fail-closed YOLO policy checks, real n8n import validation results, the Phase 13 Reviewed Action Bridge Promotion Plan, durable bridge ledger dedupe scaffold, and emergency-stop bridge rehearsal
- Latest merged milestone: Phase 16 Microsoft Outlook Warning-Draft Sandbox Contract (`0377242`)
- Current working branch: `phase-17-inactive-outlook-warning-draft-workflow-scaffold`
- Current PR target: Phase 17 Inactive Outlook Warning-Draft Workflow Scaffold — docs/tests/workflow scaffold only, no credentials/no activation/no mail delivery
- Selected next provider/action target: sandbox import/rehearsal or operator validation of the inactive Microsoft Outlook warning-draft scaffold; no live send/OAuth
- Current local demo target: demonstrate deterministic local review, optional mocked LLM classifier fallback/validation, approved-action export, dry-run n8n bridge contract, fail-closed YOLO policy checks, real n8n import validation results, durable bridge ledger dedupe scaffold, emergency-stop bridge rehearsal, and inactive/manual Outlook warning-draft scaffold
- Current promo artifact: `promo/botfucker-animated-explainer/renders/botfucker-animated-explainer_narrated-final.mp4`

## What BotFucker Is
Expand All @@ -27,7 +27,7 @@ Important files:

```text
DESIGN.md # v2 architecture and principles
ROADMAP.md # phased product roadmap, current through Phase 15 emergency-stop bridge rehearsal
ROADMAP.md # phased product roadmap, current through Phase 17 inactive Outlook warning-draft scaffold
docs/n8n-import-validation.md # Phase 12 real n8n import/dry-run procedure and results
docs/webhook-contract.md # normalized n8n/webhook JSON contract
docs/n8n-workflow.json # importable n8n import starter workflow
Expand All @@ -39,6 +39,8 @@ docs/reviewed-action-bridge-promotion-plan.md # Phase 13 reviewed live-bridge ga
docs/bridge-ledger-scaffold.md # Phase 14 durable processed-audit ledger scaffold; no OAuth/live mutation
docs/bridge-rehearsal.md # Phase 15 emergency-stop/dry-run bridge rehearsal; no provider execution
docs/microsoft-outlook-warning-draft-sandbox.md # Phase 16 Outlook warning-draft sandbox contract; no send
docs/n8n-outlook-warning-draft-scaffold.json # Phase 17 inactive/manual Outlook warning-draft n8n scaffold
docs/n8n-outlook-warning-draft-scaffold.md # Phase 17 operator guide: emergency stop, dedupe, rollback/manual deletion
README.md # user-facing setup and project overview
outreach_filter.py # compatibility CLI wrapper
botfucker/models.py # normalized email/classification/review models
Expand Down Expand Up @@ -72,6 +74,7 @@ These are non-negotiable:
- Provider-side actions are future bridge work, not local UI behavior.
- The Phase 14 durable bridge ledger records `audit_id` state only (`bridge_ledger_state_only`) before provider mutation; it is not a provider action engine.
- The Phase 15 bridge rehearsal is dry-run-only; emergency stop exits before ledger claim, and provider execution remains `not_performed`.
- The Phase 17 Outlook warning-draft workflow is inactive/manual; its Graph `createReply` placeholder is disabled and unconnected, with no auth material in the export.

## Current Test Commands

Expand Down Expand Up @@ -273,45 +276,63 @@ python3 -m py_compile outreach_filter.py botfucker/*.py scripts/validate_n8n_wor
python3 -m unittest discover -s tests -v
```

### Phase 13 — Reviewed Action Bridge Promotion Plan

Delivered operator/security/ops promotion gates for one provider action at a time, with credential ownership in n8n only, rollback/emergency-stop requirements, sandbox/manual test expectations, and no live mutation.

### Phase 14 — Durable Bridge Ledger Scaffold

Delivered `botfucker.bridge_ledger.DurableBridgeLedger`, durable `audit_id` dedupe state, status transitions, docs, and tests proving IDs/status only with no provider calls or secret columns.

### Phase 15 — Emergency-Stop Bridge Rehearsal

Delivered `botfucker.bridge_rehearsal.rehearse_approved_actions()`, default-on emergency stop, duplicate skip behavior, dry-run logging only, docs, and tests proving provider execution remains `not_performed`.

### Phase 16 — Microsoft Outlook Warning-Draft Sandbox Contract

Delivered `docs/microsoft-outlook-warning-draft-sandbox.md`, selecting Microsoft Outlook/Graph `createReply` as the warning-draft-only target, documenting `Mail.ReadWrite` as a permission note, and forbidding live delivery or other mailbox mutations.

### Phase 17 — Inactive Outlook Warning-Draft Workflow Scaffold

Delivered inactive/manual `docs/n8n-outlook-warning-draft-scaffold.json`, operator guide `docs/n8n-outlook-warning-draft-scaffold.md`, emergency-stop/dedupe scaffold, disabled/unconnected Graph `createReply` placeholder, validator coverage, and tests proving no credentials, no activation, no connected provider action, and no forbidden mailbox mutation strings in the workflow export.

## Next PR Recommendation

After Phase 14, keep OAuth on hold. The next safe step is emergency-stop proof or a sandbox-only bridge rehearsal that uses the durable bridge ledger and still performs no production provider mutation.
After Phase 17, keep OAuth on hold. The next safe step is sandbox import/rehearsal or operator validation of the inactive Outlook warning-draft scaffold, still without production provider mutation.

Do **not** add real OAuth, provider credentials, or live n8n provider mutation nodes until the Phase 13 gate has Rex/Gus review and provider-specific sandbox evidence.
Do **not** add real OAuth, provider credentials, or live n8n provider delivery nodes. Keep Rex/Gus review and sandbox evidence ahead of any connected provider action.

Suggested follow-up scope:

1. Review Phase 14 ledger scaffold with Rex/Gus.
2. Keep the first provider/action pair to `approve_warning` only.
3. Use processed-`audit_id` state before any provider mutation attempt.
4. Keep credentials in n8n only.
5. Require rollback and emergency-stop proof before any live provider action node is connected.
1. Import `docs/n8n-outlook-warning-draft-scaffold.json` into sandbox n8n as inactive.
2. Run the manual path with emergency stop on and fake input only.
3. Confirm the disabled Graph `createReply` placeholder remains unconnected unless Rex/Gus approve a sandbox-only rehearsal.
4. Document import behavior, cleanup, rollback, and manual draft deletion notes.
5. Keep credentials in n8n/operator infrastructure only.

## Suggested Prompt for Kodex/Codex

```text
You are working on BotFucker, an AI-era inbox defense app.

Read DESIGN.md, ROADMAP.md, HANDOFF.md, README.md, docs/webhook-contract.md, docs/n8n-workflow.md, docs/n8n-approved-action-bridge.md, docs/n8n-import-validation.md, docs/provider-auth-plan.md, docs/reviewed-action-bridge-promotion-plan.md, and docs/bridge-ledger-scaffold.md.
Read DESIGN.md, ROADMAP.md, HANDOFF.md, README.md, docs/webhook-contract.md, docs/n8n-workflow.md, docs/n8n-approved-action-bridge.md, docs/n8n-import-validation.md, docs/provider-auth-plan.md, docs/reviewed-action-bridge-promotion-plan.md, docs/bridge-ledger-scaffold.md, docs/bridge-rehearsal.md, docs/microsoft-outlook-warning-draft-sandbox.md, and docs/n8n-outlook-warning-draft-scaffold.md.

First, verify the current Phase 14 branch without changing behavior:
First, verify the current Phase 17 branch without changing behavior:
- run python3 scripts/validate_n8n_workflow_exports.py
- run python3 -m py_compile outreach_filter.py botfucker/*.py scripts/validate_n8n_workflow_exports.py
- run python3 -m unittest discover -s tests -v
- inspect docs/bridge-ledger-scaffold.md and botfucker/bridge_ledger.py
- confirm the ledger stores durable audit_id/status data only and has no provider calls or credential fields

Then review Phase 14 only: Durable Bridge Ledger Scaffold.
- inspect docs/n8n-outlook-warning-draft-scaffold.json and docs/n8n-outlook-warning-draft-scaffold.md
- confirm the workflow is inactive/manual, has no credentials, and keeps the Graph createReply placeholder disabled and unconnected

Check that claim_action records pending state before provider mutation, duplicate audit_id claims fail closed, unsafe approved-action exports are rejected, and no OAuth/provider credentials/live provider mutation nodes were added.
Then review Phase 17 only: Inactive Outlook Warning-Draft Workflow Scaffold.

Do not add real OAuth. Do not add provider credentials. Do not attach Gmail/Microsoft/IMAP/SMTP mutation credentials. Do not enable live n8n provider actions. Preserve the provider boundary: live provider execution remains separately reviewed and guarded.
Do not add real OAuth. Do not add provider credentials. Do not activate n8n. Do not connect live Microsoft provider delivery. Preserve the provider boundary: the next step is sandbox import/rehearsal or operator validation, not live send/OAuth.
```

## Team Plan

- **Amy**: orchestration and scope control. She keeps the product from wandering into OAuth swamp country before bridge promotion is reviewed.
- **Chip**: owns durable bridge ledger scaffold and bridge promotion safety docs/tests.
- **Chip**: owns bridge promotion docs/tests, inactive/manual Outlook draft scaffolding, and dry-run-to-sandbox safety reviews.
- **Rex**: security veto on processed-audit dedupe, credential absence, live-action safety gates, provider-boundary isolation, and XSS regressions.
- **Gus**: n8n operator verification, dry-run bridge observability, cleanup steps, CI, ledger operability, and operator docs.
- **Fred**: provider sandbox/action-limit research only; no direct OAuth implementation yet.
Expand All @@ -323,15 +344,15 @@ Do not add real OAuth. Do not add provider credentials. Do not attach Gmail/Micr
- No production OAuth yet.
- Real n8n import validation passed on n8n-vps with sample-only dry-run and cleanup; do not activate those workflows without a separate reviewed bridge-promotion plan.
- n8n approved action bridge is dry-run only; live provider actions still need a separate explicit reviewed workflow.
- Phase 14 durable bridge ledger scaffold exists for processed-`audit_id` dedupe, but it is not connected to live provider mutation.
- Phase 17 Outlook warning-draft scaffold is inactive/manual only; Graph `createReply` is disabled and unconnected until sandbox import/rehearsal or operator validation.
- YOLO guardrails exist but live provider actions still require explicit operator configuration and must not be casually enabled.

## Tomorrow Restart

- Phase 14 branch is local: `phase-14-durable-bridge-ledger`.
- First move next: re-check tests, review diff, and open/squash Phase 14 if green.
- Phase 15 target should be emergency-stop proof or sandbox-only bridge rehearsal using the durable ledger.
- Do **not** add OAuth, provider credentials, or live n8n provider mutation nodes.
- Phase 17 branch is local: `phase-17-inactive-outlook-warning-draft-workflow-scaffold`.
- First move next: re-check tests, review diff, and open/squash Phase 17 if green.
- Phase 18 target should be sandbox import/rehearsal or operator validation of the inactive Outlook warning-draft scaffold.
- Do **not** add OAuth, provider credentials, activate n8n, or connect live provider delivery.
- Keep live provider execution separate, reviewed, audited, deduped by processed `audit_id`, rollback-ready, and security/ops-reviewed.

## Product Voice
Expand Down
12 changes: 12 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,7 @@ See [DESIGN.md](DESIGN.md) for the proposed architecture and roadmap.
- Provides a Phase 14 durable bridge ledger scaffold for recording processed `audit_id` state before provider mutation.
- Provides a Phase 15 dry-run bridge rehearsal that proves emergency stop and duplicate-skip behavior before provider mutation.
- Documents the selected Phase 16 sandbox target: Microsoft Outlook warning-draft creation only, with no send-reply mutation.
- Provides a Phase 17 inactive/manual n8n Outlook warning-draft scaffold with a disabled, unconnected Graph `createReply` placeholder.
- Keeps provider credentials and live mailbox side effects outside the local UI and review queue.

## Safety First
Expand Down Expand Up @@ -509,6 +510,17 @@ Safety constraints:
- no OAuth, no provider credentials, and no live provider mutation nodes are added
- checked-in n8n workflows remain inactive/dry-run starters

## Phase 17 Inactive Outlook Warning-Draft Workflow Scaffold

Phase 17 adds an inactive/manual n8n scaffold for the selected Microsoft Outlook `approve_warning` draft path. It is still a scaffold: no OAuth setup, no checked-in auth material, no activation, and no mail delivery.

Artifacts:

- [`docs/n8n-outlook-warning-draft-scaffold.json`](docs/n8n-outlook-warning-draft-scaffold.json) — inactive n8n workflow with manual trigger, fake approved-action input, emergency-stop/dedupe validation, a draft-only summary node, and a disabled/unconnected Graph `createReply` placeholder.
- [`docs/n8n-outlook-warning-draft-scaffold.md`](docs/n8n-outlook-warning-draft-scaffold.md) — operator checklist covering emergency stop, dedupe, rollback, and manual draft deletion.

Next step: sandbox import/rehearsal or operator validation of this scaffold. Do not jump from this artifact to live delivery or broad OAuth work.

## Test Before Going Live

Compile-check the script and package:
Expand Down
62 changes: 44 additions & 18 deletions ROADMAP.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,7 @@ Merged through PR #8:
- reviewed live-bridge promotion gate
- durable bridge ledger scaffold for processed `audit_id` state before provider mutation
- tests for classifier/history/safety/review/webhook/docs/branding/bridge-ledger behavior
- inactive/manual Microsoft Outlook warning-draft workflow scaffold with disabled Graph `createReply` placeholder

The repo is ready to pull locally into Kodex/Codex and demonstrate the local cockpit without connecting to any live mail provider.

Expand Down Expand Up @@ -414,6 +415,12 @@ Status: implemented on `phase-16-outlook-warning-draft-sandbox-contract`.

Goal: document Kent's selected first provider/action target without adding OAuth, credentials, or live mutation behavior.

Selected target:

- Provider: Microsoft Outlook
- First action: create/save a warning draft only
- Scope: sandbox/manual reviewed bridge contract first; no send-reply mutation yet

Delivered:

- `docs/microsoft-outlook-warning-draft-sandbox.md`
Expand All @@ -432,33 +439,52 @@ Acceptance criteria:
- Credentials stay outside BotFucker and inside n8n/operator infrastructure.
- Current workflow exports remain provider-call-free and credential-free.

## Near-Term Recommendation
### Phase 17 — Inactive Outlook Warning-Draft Workflow Scaffold ✅

After Phase 16 is reviewed and merged, the next PR should be **Phase 17: inactive Microsoft Outlook warning-draft workflow scaffold**, not broad OAuth implementation.
Status: implemented on `phase-17-inactive-outlook-warning-draft-workflow-scaffold`.

Kent selected the first provider/action target:
Goal: provide an inactive/manual n8n scaffold for the selected Microsoft Outlook warning-draft path without adding credentials, activation, live provider execution, or mail delivery.

- Provider: Microsoft Outlook
- First action: create/save a warning draft only
- Scope: sandbox/manual reviewed bridge contract first; no send-reply mutation yet
Delivered:

- `docs/n8n-outlook-warning-draft-scaffold.json`
- `docs/n8n-outlook-warning-draft-scaffold.md`
- manual-trigger-only inactive workflow export
- fake approved-action input and draft-only safety summary
- emergency-stop default-on check and `audit_id` duplicate guard
- disabled, unconnected Microsoft Graph `createReply` HTTP placeholder
- validator/test coverage proving no credential material, no forbidden mailbox mutation strings, and no connected provider action step
- operator docs for emergency stop, dedupe, rollback, and manual deletion of sandbox drafts

Acceptance criteria:

- Workflow remains `active: false` and manual-triggered only.
- Placeholder Graph draft node is disabled and unconnected.
- No credentials, tokens, or live auth material are committed.
- No forbidden send/delete/move/archive/read-state/rules/contact/settings action is present in the workflow export.
- Next step is sandbox import/rehearsal or operator validation, not live delivery or broad OAuth.

## Near-Term Recommendation

After Phase 17 is reviewed and merged, the next PR should be **Phase 18: sandbox import/rehearsal and operator validation for the inactive Outlook draft scaffold**, not live send/OAuth.

Recommended scope:

- keep one provider/action pair only (`approve_warning`)
- document the exact sandbox mailbox/provider target Kent wants to use
- keep credentials in n8n only
- keep dry-run as the default path
- map the Phase 15 rehearsal outcomes onto an inactive n8n/operator checklist
- require Rex/Gus security/ops review before any live mutation node is connected
- import the Phase 17 scaffold into a sandbox n8n instance as inactive
- verify the manual path with emergency stop on and fake input only
- verify the disabled Graph placeholder remains disconnected unless Rex/Gus approve a sandbox-only rehearsal
- document observed n8n import behavior, cleanup, and rollback notes
- keep credentials in n8n/operator infrastructure only
- keep the provider action to Microsoft Graph `createReply` draft creation only

OAuth can still wait. Phase 16 picks the sandbox road. Next is building the inactive/manual Outlook draft scaffold — not handing the robot live mailbox keys because apparently we enjoy learning by fire.
OAuth can still wait. The next useful work is proving the inactive scaffold imports and rehearses cleanly, not handing the robot live mailbox keys because apparently we enjoy learning by fire.

### Restart checklist after Phase 16
### Restart checklist after Phase 17

1. Re-check Phase 16 PR CI and mergeability.
2. Squash-merge Phase 16 into `main` if still green.
3. Build only an inactive/manual Microsoft Outlook warning-draft workflow scaffold.
4. Keep the provider action to create/save draft only; do not send replies.
1. Re-check Phase 17 PR CI and mergeability.
2. Squash-merge Phase 17 into `main` if still green.
3. Import only the inactive/manual scaffold into sandbox n8n for rehearsal.
4. Keep the provider action to create/save draft only; do not perform live delivery.
5. Keep provider credentials inside n8n/operator infrastructure only; do not put secrets in BotFucker.

## Team Utilization
Expand Down
Loading
Loading