Project

    Multi Mailbox Ops

    Multi Mailbox Ops is a private, local-first control plane for safe multi-account Gmail work from Codex. It preserves source-mailbox identity, removes ordinary mail sending from the V1 tool surface, treats message content as untrusted data, and requires frozen exact-ID plans, identity re-attestation, verification, receipts, and rollback for live mutations. Its two most developed product loops are guarded named-mailbox operations and durable scheduled monitoring/reporting across independently checkpointed mailboxes.

    AI Ops

    Narrative

    01

    A mailbox control plane with a hard edge

    Multi Mailbox Ops makes several Gmail identities operable from one Codex workflow without pretending they are one account. The gateway resolves a human alias to an immutable mailbox record, attests the live provider identity, and keeps ordinary mail sending absent from the V1 capability surface. Mail content is untrusted data; it cannot select tools, expand scope, or grant authority.

    02

    Exact plans, recoverable changes

    Live organization and cleanup work follows a frozen-plan protocol: discover, classify, freeze exact provider IDs and preconditions, review bounded authority, re-attest, execute, verify, and retain a redacted receipt with rollback state. Labels and archive are preferred, Trash is separately bounded and recoverable, and permanent deletion remains unavailable.

    03

    Monitoring that cannot silently consume its report

    Hourly mailbox coverage and scheduled reporting use independent durable cursors. Sanitized outcomes enter a private ledger, exact 9:00 AM and 5:00 PM Eastern reports freeze into reconciled pages, and committed delivery remains in a replayable outbox until a later user-visible acknowledgment proves it was surfaced. Failures and partial coverage remain visible instead of being summarized away.

    04

    Privacy is part of the architecture

    OAuth client material and refresh tokens live in macOS Keychain. The repository and machine-local operation store retain only the minimum non-secret registry, opaque identifiers, synthetic fixtures, policy versions, redacted outcomes, and recovery evidence needed for auditability. Public proof uses fictional report data rather than mailbox screenshots.

    System surfaces

    Codex MCP gateway

    Owner-operator using Codex

    Constrained project-specific search, read, preview, organization-policy, and monitoring tools with no ordinary send tool or generic Gmail fallback.

    Focused CLI

    Root operator and maintainer

    Mailbox onboarding, health checks, authority review, exact-plan execution, rollback, and monitor recovery commands for the root operator.

    Identity and operation store

    Runtime safety and recovery

    Machine-local registry, Keychain references, frozen plans, intents, redacted receipts, rollbacks, checkpoints, and delivery outbox.

    Scheduled monitor report

    Owner-operator reviewing scheduled mail changes

    Synthetic-proven responsive report surface with per-mailbox totals, exact message ledger, applied/skipped/failed outcomes, coverage windows, and checkpoint state.

    Repository Context Layer

    Product, engineering, and review

    Product contracts, safety decisions, project checkpoints, synthetic evidence, and deterministic documentation dashboard used as the operational source of truth.

    Implementation stack

    Runtime

    • • Node.js
    • • TypeScript
    • • ES modules
    • • Zod
    • • Google APIs
    • • Model Context Protocol SDK

    Local security boundary

    • • macOS Keychain
    • • Desktop OAuth loopback
    • • immutable mailbox registry
    • • positive endpoint allowlist
    • • root-owned live mutation

    Durable operations

    • • frozen exact-ID plans
    • • policy digests
    • • redacted receipts
    • • rollback manifests
    • • coverage/report cursors
    • • replayable delivery outbox

    Verification

    • • Vitest
    • • TypeScript
    • • synthetic Gmail adapter
    • • forbidden-capability scan
    • • release-package gate
    • • docs determinism
    • • responsive report proof

    Evidence

    18 artifacts grouped by type so each kind of proof can be scanned on its own.

    Data models

    2 artifacts
    data model

    Coverage ledger and scheduled delivery state

    Hourly mailbox coverage and scheduled report delivery use independent checkpoints so classification can progress without losing an unreported or unacknowledged delivery.

    8 entities1 diagram
    data model

    Mailbox identity, plan, and receipt boundary

    A human alias resolves to one immutable account and live provider identity; all reversible mutation evidence remains bound to that identity from preview through rollback.

    9 entities1 diagram

    Workflows

    2 artifacts
    workflowAug 9, 2026

    Durable scheduled monitor report

    How independent mailbox coverage becomes one exact scheduled report without losing items to heartbeat drift, incomplete pagination, partial mailbox failure, process restart, or an unacknowledged user-visible delivery.

    10 steps1 record
    workflowAug 9, 2026

    Guarded named-mailbox operation

    How one operator request becomes a mailbox-specific, exact, reviewable, reversible action while identity ambiguity, untrusted message content, stale authority, protected mail, and state drift fail closed.

    10 steps1 record

    Images

    4 artifacts
    Public-safe fictional report showing mailbox totals, exact ledger outcomes, controlled labels, coverage windows, checkpoint state, and pending delivery acknowledgment. — Multi Mailbox Opsimage

    Public-safe fictional report showing mailbox totals, exact ledger outcomes, controlled labels, coverage windows, checkpoint state, and pending delivery acknowledgment.

    Repository-owned portfolio view showing the active program, bounded project streams, attention queue, and explicit operator-owned decisions. — Multi Mailbox Opsimage

    Repository-owned portfolio view showing the active program, bounded project streams, attention queue, and explicit operator-owned decisions.

    Responsive proof that the same synthetic evidence remains legible in a narrow report surface. — Multi Mailbox Opsimage

    Responsive proof that the same synthetic evidence remains legible in a narrow report surface.

    The same operational source of truth at a narrow viewport, preserving lifecycle counts and active/blocked/in-review separation. — Multi Mailbox Opsimage

    The same operational source of truth at a narrow viewport, preserving lifecycle counts and active/blocked/in-review separation.

    Chats

    4 artifacts
    chatAug 2, 2026

    Building the Gateway and Stopping at the OAuth Security Gate

    Codex implementation conversation that merged the initial repository stack, built the gateway and synthetic safety foundation, configured Google Cloud and Gmail OAuth, rotated a credential exposed during browser automation, and stopped before live mailbox authorization when the Keychain boundary still required remediation.

    1 chat
    chatJul 31, 2026

    Designing Multi Mailbox Ops as a Source-Mailbox Gateway

    Foundational Codex conversation that rejected a forwarding-only unified inbox, defined authoritative operations against the original Gmail accounts, established the draft-only and no-send V1 boundary, and created the private Multi Mailbox Ops repository with its first permissions audit.

    1 chat
    chatAug 3, 2026

    Hardening Multi Mailbox Ops into a Four-Mailbox Monitor

    Long-running Codex operations conversation that separated clean-main, branch, credential, and live-mailbox truth; fixed the Keychain secret boundary; onboarded and identity-attested source mailboxes; developed controlled organization and monitoring policies; and iterated the recurring report from dense output into a deterministic four-mailbox workflow.

    1 chat
    chatAug 7, 2026

    Turning Operator Feedback into Mailbox Reporting and Routing Contracts

    Codex product and implementation conversation that converted a detailed operator critique into totals-first mailbox reports, stable mailbox markers, composable Ecommerce taxonomy, automatic controlled labeling, repository-independent plugin routing, per-mailbox permissions, and a separately gated assistant-mailbox architecture.

    1 chat

    Notes

    6 artifacts
    note

    product-brief

    Source Summary title: Product Brief - Multi-Mailbox Ops description: One-page product definition for safe Codex-first operation of multiple Gmail mailboxes s...

    1 topic1 scope
    note

    mailbox-safety-and-approval-model

    Source Summary title: Mailbox Safety and Approval Model description: Normative controls for draft-only, multi-mailbox search, cleanup, and unsubscribe operat...

    1 topic1 scope
    note

    monitor-report-contract

    Source Summary title: Monitor Report Contract description: Versioned presentation rules for scannable, accessible multi-mailbox monitor reports status: evolv...

    1 topic1 scope
    note

    organization-policy

    Source Summary title: Durable Mailbox Organization Policy description: Versioned taxonomy and execution rules for consistent agent-driven mailbox organizatio...

    1 topic1 scope
    note

    decision-log

    Source Summary title: Product Decision Log - Multi-Mailbox Ops description: Durable product and safety decisions for the multi-mailbox operating system statu...

    1 topic1 scope
    note

    report-preview-desktop

    Source Summary Synthetic mailbox monitor report Report type: Scheduled 9:00 AM report Report window: 5:00 PM-9:00 AM ET (synthetic period) Coverage: Complete...

    1 topic1 scope

    Connected references

    Building the Gateway and Stopping at the OAuth Security Gatechat · 1 edge →Designing Multi Mailbox Ops as a Source-Mailbox Gatewaychat · 1 edge →Hardening Multi Mailbox Ops into a Four-Mailbox Monitorchat · 1 edge →Turning Operator Feedback into Mailbox Reporting and Routing Contractschat · 1 edge →

    Key dates

    2026-07-31
    Project and safety contract established

    The repository scaffold defined explicit mailbox routing, structural no-send, reversible cleanup, separate unsubscribe authority, and privacy-safe evidence.

    2026-08-02
    Executable gateway and synthetic acceptance

    The TypeScript gateway, local Gmail runtime, Keychain boundary, Codex plugin, frozen workflows, and synthetic safety harness reached a reproducible release gate.

    2026-08-03
    First bounded operational pilots

    Source checkpoints record exact-plan organization and a separately approved limited cleanup/unsubscribe pilot while retaining no-send and no-permanent-delete boundaries.

    2026-08-08
    Durable monitor-report V2

    Independent coverage/report cursors, exact scheduled boundaries, paginated reconciliation, replayable delivery, multi-mailbox bundle proof, and label-drift handling landed on main.

    2026-08-09
    Hyphenomenon project intake

    The project was reviewed from clean source main and prepared as one active project with public-safe workflow, data-model, document, and synthetic image evidence.