What problem it solves
Email is where commitments hide. Appointments, deadlines, renewals, “can you get back to me by Friday” — they arrive buried in prose, and either you transcribe them into your systems by hand or they silently become surprises. The obvious fix — let an AI read your inbox and act — carries the obvious danger: an inbox is an open port. Anyone in the world can put words in it. A system that turns inbox text into actions has to be paranoid about whose words it’s executing.
The thesis
Pipes move information; agents decide; provenance is sacred. The transport layer (connectors, polling, normalization) is deliberately dumb and lossless. The judgment layer (what matters, what’s a commitment, what deserves a draft) is small models with narrow jobs. And between the outside world and anything that acts sits a hard rule: third-party words can inform, but only the Principal’s words instruct.
Key features
- Announced autonomous capture. When the system captures something from email on its own, it says so — receipts issue from the choke point, so there’s a visible record of every autonomous read. No silent ingestion.
- Provenance gates (the P1 family). A third party’s email can never ride the capture pipeline as if it were my instruction. Source-threading is stamped and checked; the impersonation class of failure is guarded at the seam, with the ingress flagged as the injection-watch surface.
- Sender-aware handling. Sender classes decide how much of a message is stored and how it’s treated; a per-contact sender profiler builds a communication picture that feeds the reply drafter.
- The email loop, on existing rails. An orchestrator drives screen → capture → draft using the same spine every other segment uses — nothing bespoke, so every step is traced like any other agent run, and a captured commitment lands on the same calendar and to-do rails as a spoken one.
- A drafts hub where composed replies wait for a human send — drafting is autonomous, sending is not.
- The email doctrine: a label is consent. The always-on scan of every unlabeled message was retired. Now a message only enters the reasoning pipeline once I label it — labeling is the explicit signal that Witan is allowed to think about this one. A labeled message fires the propose-only spine right at the door; everything unlabeled is left alone. And the zero-capture case is never silent: if a pass pulls nothing actionable, one sticky receipt names the reasons, so “it did nothing” and “it saw nothing” can never be confused.
Highlights
- The provenance regression was caught, diagnosed, and closed the same week the capture pipeline went announced-autonomous — the exact failure mode this design is paranoid about, found by the system’s own verification pass.
- The screening/summarizing/drafting brains are cleanly separated from the transport, which means every piece can be swapped, benched, or audited alone.
- Retiring the always-on scan in favor of a label-gate is a rare case of removing autonomy to earn trust — the system reads less of my inbox now, on purpose, and that restraint is the feature.
Development log
July 20, 2026
Inbox pressure got engineered down. An attention gate now scores any inbound message for interrupt-grade importance and decides push-now versus hold-until-you’re-free, so only what genuinely can’t wait interrupts. “Inbox-zero” was corrected to mark-read-and-keep (not archive — a Principal correction), with only the truly-important left unread, and an unsubscribe digest ranks the senders clogging the inbox so the noise can be cut at the source. A done-signal seam also lets the rest of the system know when a labeled email has been fully handled.
July 16, 2026
The email doctrine landed: the always-on evaluator scan of unlabeled inbound was killed and replaced with a label-gate — a labeled message fires the propose-only intake spine at the door, and nothing else is read. The zero-capture pass also stopped being silent (one sticky receipt names why a pass found nothing). Net effect: less inbox surface touched, and every touch is one I authorized with a label.
July 8, 2026
Page created. This past week: announced autonomous capture with receipts, the provenance gate family (source-threading fix, sender-class gate, amplifier stamps), sender-profiler feeding the reply drafter, and Gmail-category-aware body truncation — the last survivor of the sender-class rollout.