MC #9781 QA Review — Email Intake Pipeline Incident #8378

MC #9781 QA Review — Email Intake Pipeline Incident #8378

Canonical local evidence: /Users/makinja/system/evidence/9781-qa-review-8378.md

SHA-256: ad7868fd9b3be3bd7eba035aae8b5b0c5c232299aa96890d4a6650a3a635bc17

Incident ledger addendum: /Users/makinja/system/evidence/sentinel-triage-2026-04-19/incident-ledger.md

Incident ledger SHA-256 after addendum: ec112cafb4b23ad4a6aa59df3879f51be61b89580b6487a836fce574445b7359

Proveo QA Review — MC #9781 / Source Task #8378

Date: 2026-07-28 Reviewer: John acting as Proveo QA reviewer, devops specialist persona kelsey-hightower Scope: Auto-generated QA review for completed MC #8378, INCIDENT: Email intake pipeline DEAD 53 days (since 2026-02-25).

Verdict

PARTIAL FAIL — source task #8378 should not be treated as a clean MISDIAGNOSIS SENTINEL closure.

The QA evidence supports this narrower conclusion:

• The email pipeline is not proven dead now.
• The alai mailbox ingestion gap was real in historical data.
• The #8378 DoD text contains true observations (5/6 accounts ingesting, alai dormant) but the headline MISDIAGNOSIS SENTINEL / Pipeline HEALTHY overstates the case and obscures a resolved incident/backlog remediation.
• The documentation update requested inside #8378 DoD has now been appended to the original SENTINEL incident ledger by this QA review.

Task Records Read

MC #8378

Machine evidence: node ~/system/tools/mc.js show 8378

• Status: done
• Priority: H
• Owner: codecraft
• Category: incident
• Completed: 2026-04-27 16:56:49
• DoD evidence recorded:

MISDIAGNOSIS SENTINEL. Tested: sqlite3 email-inbox.db SELECT pokazuje 5/6 accounta ingestuju danas (gmail/john/info/alem/dev). Alai dormant - IMAP INBOX=20 msgs, newest 2026-02-27, mailbox ne prima. Vault-proxy 502 intermittent non-blocking (5min retry, circuit breaker). Docs: ~/system/evidence/sentinel-triage-2026-04-19/incident-ledger.md treba update. Pipeline HEALTHY.

MC #9781

Machine evidence: node ~/system/tools/mc.js show 9781

• Status before this report: in_progress
• Priority: L
• Owner/delegated_to: pi-orchestrator
• Category: system

Evidence Commands Executed

• node ~/system/tools/discover.js "QA review #8378 email intake pipeline incident completed task evidence artifacts"
• node ~/system/tools/mc.js show 8378
• node ~/system/tools/mc.js show 9781
• Read ~/system/evidence/sentinel-triage-2026-04-19/incident-ledger.md
• Read/write ~/system/evidence/9781-qa-review-8378.md
• sqlite3 ~/system/databases/email-inbox.db "SELECT account, MAX(date) AS newest, COUNT(*) AS total FROM emails GROUP BY account ORDER BY account;"
• sqlite3 ~/system/databases/email-inbox.db "SELECT account, strftime('%Y-%W', date) AS week, MIN(date), MAX(date), COUNT(*) FROM emails WHERE date BETWEEN '2026-02-01' AND '2026-05-01' GROUP BY account, week ORDER BY account, week;"
• sqlite3 ~/system/databases/email-inbox.db "SELECT COUNT(*) FROM emails WHERE account='alai' AND date(date) > date('2026-02-25') AND date(date) < date('2026-04-21'); SELECT MAX(date), date(MAX(date)) FROM emails WHERE account='alai' AND date(date) <= date('2026-02-25'); SELECT MIN(date), date(MIN(date)) FROM emails WHERE account='alai' AND date(date) >= date('2026-04-21');"
• sqlite3 ~/system/databases/email-inbox.db "SELECT account, date, subject FROM emails WHERE account='alai' AND date BETWEEN '2026-04-15' AND '2026-04-22' ORDER BY date LIMIT 20;"
• ls -la ~/system/logs/email-agent.log ~/system/logs/email-agent-launchd.log ~/system/logs/email-batch-refetch-20260429-163931.log
• tail -15 ~/system/logs/email-agent.log
• tail -80 ~/system/logs/email-agent-launchd.log
• find ~/Library/LaunchAgents -iname '*email*' -maxdepth 1 -print
• stat -f '%N|mtime=%Sm|size=%z' ~/Library/LaunchAgents/com.john.email-agent.plist.pre-sentinel-20260419-1055 ~/Library/LaunchAgents/com.john.email-agent.plist ~/system/logs/email-agent.log ~/system/logs/email-agent-launchd.log
• grep -n "Email Body Integrity\|862\|alai" ~/system/logs/email-batch-refetch-20260429-163931.log | head -40

Findings

1. The original SENTINEL ledger did report a real mail ingestion incident

Read file: ~/system/evidence/sentinel-triage-2026-04-19/incident-ledger.md.

The ledger item #9 says:

Email ingestion pipeline DEAD — vault ETIMEDOUT blocks email-agent — 53 days and counting.

It also says the detection method was Martin Kleppmann audit and that Alem was not notified.

2. The historical alai mailbox gap is confirmed by SQLite

Machine evidence:

sqlite3 ~/system/databases/email-inbox.db "SELECT COUNT(*) FROM emails WHERE account='alai' AND date(date) > date('2026-02-25') AND date(date) < date('2026-04-21'); ..."
0
2026-02-25 13:05+00:00|2026-02-25
2026-04-21 11:38+00:00|2026-04-21

So, for account alai, the local DB has:

• last pre-gap row: 2026-02-25 13:05+00:00
• no rows with normalized date after 2026-02-25 and before 2026-04-21
• first post-gap row: 2026-04-21 11:38+00:00

Weekly DB output also showed alai rows in weeks 2026-06, 2026-07, 2026-08, then no rows until week 2026-16.

3. Other accounts had mail during the same period

The weekly DB query showed continuing rows for john, info, gmail, alem, and dev across March/April 2026. That supports the #8378 statement that multiple accounts were ingesting while alai was dormant.

This does not support the stronger conclusion that the SENTINEL incident was false. It supports the narrower conclusion that the incident affected alai specifically, not every mailbox equally.

4. The old email-agent log matches the SENTINEL timestamp

Machine evidence:

/Users/makinja/system/logs/email-agent.log|mtime=Feb 25 11:45:35 2026|size=2528275

The tail of that file ends with:

[2026-02-25T10:44:35.139Z] === EMAIL AGENT START ===
[2026-02-25T10:45:35.470Z] john: 0 unseen envelopes fetched (himalaya)
[2026-02-25T10:45:35.704Z] info: 0 unseen envelopes fetched (himalaya)
[2026-02-25T10:45:35.705Z] alai: 0 unseen envelopes fetched (himalaya)
[2026-02-25T10:45:35.705Z] Found 0 unseen, 0 new (0 already processed)
[2026-02-25T10:45:35.706Z] No new emails to process
[2026-02-25T10:45:35.724Z] === EMAIL AGENT END ===

That is consistent with the original audit's observation that the legacy email-agent.log stopped on 2026-02-25.

5. A daemon/config change is visible on the SENTINEL date

Machine evidence:

/Users/makinja/Library/LaunchAgents/com.john.email-agent.plist.pre-sentinel-20260419-1055|mtime=Apr 19 10:55:57 2026|size=1053
/Users/makinja/Library/LaunchAgents/com.john.email-agent.plist|mtime=Jul 17 15:36:59 2026|size=1167

The pre-sentinel-20260419-1055 backup is circumstantial evidence that the daemon config was changed or preserved for change on the same day as the SENTINEL audit.

6. A post-close integrity remediation ran on 2026-04-29

Machine evidence from ~/system/logs/email-batch-refetch-20260429-163931.log:

[2026-04-29T14:39:31.400Z] [integrity-check] INFO: === Email Body Integrity Check starting (dry-run=false) ===
[2026-04-29T14:39:31.421Z] [integrity-check] INFO: Found 862 email(s) with classification but empty body
[2026-04-29T14:39:34.445Z] [integrity-check] INFO: Re-fetching body for email #3385 (alai, envelope 208): "GitHub Availability 📉, Cloud Cost Optimization ☁️, Autonomy"

The log continues with many alai re-fetches. This indicates remediation/backfill work happened around the closure window, not a purely false alarm.

7. Present-day live context: latest launchd log shows active mailbox connection cycles

Machine evidence from ~/system/logs/email-agent-launchd.log tail on 2026-07-28:

• Connected to john (john@alai.no)
• Connected to info (info@basicconsulting.no)
• Connected to alem (alem@alai.no)
• Connected to dev (dev@alai.no)
• Connected to gmail (alembasic@gmail.com)
• Connected to post-alai (post@alai.no)
• Connected to admin-alai (admin@alai.no)
• Connected to sales-bilko-io (sales@bilko.io)
• Connected to privacy-bilko-io (privacy@bilko.io)
• Connected to admin-bilko-io (admin@bilko.io)
• Connected to sales-bilko-cloud (sales@bilko.cloud)
• Connected to admin-bilko-cloud (admin@bilko.cloud)
• Connected to sales-bilko-company (sales@bilko.company)
• Connected to admin-bilko-company (admin@bilko.company)
• Connected to info-snowit (info@snowit.ba)
• Connected to admin-snowit (admin@snowit.ba)
• Connected to hello-lumiscare (hello@lumiscare.com)
• Connected to admin-lumiscare (admin@lumiscare.com)

The same latest cycle ended:

Found 1 recent (seen+unseen), 0 new to process (1 already in DB)
No new emails to process
=== EMAIL AGENT END ===

This supports: no live outage proven during this QA review.

Caveat: the DB currently contains rows for 15 historical accounts, and 8 accounts have DB mail rows newer than 14 days. Several configured accounts may simply have had no recent mail; the launchd connection log is stronger evidence for current daemon/account reachability than DB recency alone.

Acceptance Mapping

Final QA Decision

Close MC #9781 as QA completed with a partial-fail / documentation-accuracy finding:

• #8378 should remain completed operationally; no live pipeline outage was proven during this review.
• Do not use #8378 as precedent that SENTINEL's 2026-04-19 email-pipeline finding was wrong.
• Correct characterization: alai mailbox ingestion had a real Feb 25 → Apr 21 gap, then the system resumed/backfilled around the SENTINEL/closure window.

Artifacts Written / Updated

• Updated QA report: ~/system/evidence/9781-qa-review-8378.md
• Appended QA addendum: ~/system/evidence/sentinel-triage-2026-04-19/incident-ledger.md