openoutsend 0.1.17__tar.gz

openoutsend-0.1.17/.flake8

@@ -0,0 +1,3 @@
+[flake8]
+
+exclude = *migrations/*.py, env*, __pycache__, docs

openoutsend-0.1.17/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,16 @@
+## Description
+<!--- Describe your changes in detail -->
+
+## Closes issue(s)
+<!--- e.g. closes #34 -->
+
+## Screenshots (if appropriate)
+
+## Changes include
+<!--- What types of changes does your code introduce? Put an `x` in all the boxes that apply: -->
+- [ ] Bugfix (non-breaking change that solves an issue, bump the third digit of the version)
+- [ ] New feature (non-breaking change that adds functionality, bump the second digit of the version)
+- [ ] Breaking change (change that is not backwards-compatible and/or changes current functionality, bump the first digit of the version)
+- [ ] Documentation update (Don't bump the version of the project)
+
+## Other comments

openoutsend-0.1.17/.github/workflows/deploy.yml

@@ -0,0 +1,70 @@
+name: Deploy
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - uses: astral-sh/setup-uv@v5
+
+      - name: Install
+        run: uv pip install --system -e ".[dev]"
+
+      - name: Run tests
+        run: pytest
+
+  # The supported install. **Every green push to `main` is a release** — the version is
+  # derived here, not committed, because PyPI numbers are single-use and permanent.
+  #
+  # This is the finder's rule, and it is here for the reason it went there: `0.1.0` was
+  # tagged by hand on that side, twelve commits landed behind it, and `uvx openoutreach`
+  # kept serving the version from before all of them. A release nobody has to remember
+  # cannot drift. The cost is accepted: every commit that passes CI is public and
+  # permanent, so `main` is the release branch and `needs: test` is the whole gate.
+  publish-pypi:
+    if: github.ref == 'refs/heads/main'
+    needs: test
+    runs-on: ubuntu-latest
+    # Required: the PyPI trusted publisher is registered against this workflow filename
+    # *and* this environment name. Do not add a required reviewer to it — that would put
+    # every push behind a manual approval, which is the thing this job exists to remove.
+    environment: pypi
+    permissions:
+      id-token: write # PyPI trusted publishing
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0 # the version is a commit count; a shallow clone cannot count
+
+      # `0.1.0` in pyproject.toml is the *base*: major and minor are declared there and
+      # bumped by hand when the change deserves it; the patch is how many commits this
+      # repo has. Monotonic across a base bump (0.1.20 → 0.2.21), unique per commit, and
+      # nothing has to be committed for it. The finder counts from its `v0.1.0` tag; this
+      # repo has no tags, so the count starts at the first commit.
+      - name: Derive the version from the commit count
+        id: version
+        run: |
+          set -euo pipefail
+          base=$(grep -m1 '^version = ' pyproject.toml | cut -d'"' -f2 | cut -d. -f1,2)
+          patch=$(git rev-list --count HEAD)
+          version="${base}.${patch}"
+          echo "Releasing ${version}"
+          sed -i "0,/^version = .*/s//version = \"${version}\"/" pyproject.toml
+          echo "value=${version}" >> "$GITHUB_OUTPUT"
+
+      - name: Build sdist + wheel
+        run: pipx run build
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          skip-existing: true # a re-run of an already-published commit is a no-op

openoutsend-0.1.17/.gitignore

@@ -0,0 +1,22 @@
+*.pyc
+MANIFEST
+
+dist/
+build/
+docs/_build/
+*.egg-info/
+.idea/
+
+sqlite.db
+
+env*
+.venv/
+
+__pycache__
+
+*DS_Store
+
+.vscode
+
+#pyenv
+.python-version

openoutsend-0.1.17/.pre-commit-config.yaml

@@ -0,0 +1,19 @@
+exclude: 'docs|node_modules|migrations|.git|.tox'
+default_stages: [pre-commit]
+fail_fast: true
+default_language_version:
+  python: python3.13
+
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v6.0.0
+    hooks:
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+      - id: check-yaml
+
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.15.7
+    hooks:
+      - id: ruff
+      - id: ruff-format

openoutsend-0.1.17/LICENSE

@@ -0,0 +1,9 @@
+Copyright (c) 2026 eracle
+Copyright (c) 2020 Rootstrap
+Copyright (c) 2012 Zapier Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

openoutsend-0.1.17/PKG-INFO

@@ -0,0 +1,163 @@
+Metadata-Version: 2.5
+Name: openoutsend
+Version: 0.1.17
+Summary: The sending half of OpenOutreach: reads qualified leads on stdin and mails them from your own box.
+Project-URL: Homepage, https://github.com/eracle/OpenOutSend
+Project-URL: Finder, https://github.com/eracle/OpenOutreach
+Author-email: OpenOutreach <hello@openoutreach.app>
+License-Expression: MIT
+License-File: LICENSE
+Keywords: b2b,cold-email,imap,open-source,outreach,sales-automation,self-hosted,smtp
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Framework :: Django
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Office/Business
+Requires-Python: >=3.11
+Requires-Dist: django<7.0,>=5.2
+Requires-Dist: griffe<2,>=1
+Requires-Dist: imapclient<4,>=3
+Requires-Dist: jinja2<4,>=3.1
+Requires-Dist: pydantic-ai-slim[anthropic,bedrock,cohere,google,groq,mistral,openai]<3,>=2
+Requires-Dist: pydantic<3,>=2.9
+Requires-Dist: pytz>=2024.1
+Requires-Dist: tenacity<10,>=8
+Requires-Dist: termcolor<4,>=2.4
+Provides-Extra: dev
+Requires-Dist: factory-boy>=3.3; extra == 'dev'
+Requires-Dist: pytest-cov>=5; extra == 'dev'
+Requires-Dist: pytest-django>=4.8; extra == 'dev'
+Requires-Dist: pytest-mock>=3.14; extra == 'dev'
+Requires-Dist: pytest>=8; extra == 'dev'
+Description-Content-Type: text/markdown
+
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+
+# OpenOutSend
+
+The **sending half** of [OpenOutreach](https://github.com/eracle/OpenOutreach). OpenOutreach finds and
+qualifies B2B leads and prints them; it does not send email. This is what sends them.
+
+The boundary between the two is a pipe, and nothing else crosses it:
+
+```bash
+openoutreach find 50 --json | outsend
+```
+
+`find` writes qualified leads as JSON Lines on stdout. `outsend` reads them, stores them in its own
+database, and exits — it transmits nothing at that moment. Delivery, pacing and whatever step
+structure it grows are its own business, on its own clock.
+
+The pipe is **one-way by design**. Every consumer sees the same bytes, so a file dropped into Instantly
+or Smartlead gets exactly what this receiver gets, and "our own sender has no privileged path" is held
+by construction rather than by discipline.
+
+## Status: it runs end to end — install, pipe, connect a box, send
+
+**`outsend` is a command and the store is its own.** Install it, pipe leads in, and they land as rows;
+a second, separate invocation is what mails them:
+
+```bash
+pip install -e .
+outsend init --campaign devtools                            # once: what you sell, who you are, a box
+openoutreach find 50 --json | outsend --campaign devtools   # store
+outsend send --campaign devtools                            # read, answer, open
+```
+
+The two invocations are separate on purpose: a pipe's right-hand side must not block on the network
+while a producer is still writing, and the cadences differ — leads arrive when `find` runs, mail moves
+on the mailbox's clock. So the cron line is two entries, not one command doing both.
+
+It reads JSON Lines on stdin, upserts on `(lead_id, campaign)`, checks every address against the
+suppression list at the door, skips and counts a malformed line, prints the campaign it resolved and
+the counts to **stderr**, and exits 0 when every line became a row. Its database is
+`~/.openoutsend/data/db.sqlite3` (`OUTSEND_HOME` / `OUTSEND_DB` override it) and it migrates itself on
+first run, so a fresh install is an ingest that works rather than a traceback.
+
+**`outsend send` is one bounded pass, not a daemon.** It reads the mail, answers every thread the lead
+has replied in, opens as many first emails as the guards allow, and exits — cadence is a timer's job.
+Reading first is what makes the other two honest: an opt-out that arrived overnight suppresses the
+person before anything is written to them. Openers are the only cold volume, so they are the only
+thing under a daily cap, a spacing clock and a sending window; a reply obeys none of the three.
+**`outsend init` collects what a first run needs** — what the campaign sells and to whom, the name
+that signs the mail, and a mailbox to send it from — and it runs implicitly on the first send, so a
+setup step is never something a timer discovers. The environment first, prompts second and **only on a
+terminal**; headless, whatever is still missing is one error naming every variable that would have
+answered it. The mailbox is stored only once its credentials pass an SMTP login, because the provider
+has no health API and that login is the only gate there is.
+
+**Releases are every green push to `main`** (`.github/workflows/deploy.yml`): tests, then a build and a
+PyPI upload over trusted publishing, with the version derived from the commit count rather than
+committed — the finder's rule, for the reason it went there, since a release nobody has to remember
+cannot drift. No token is stored anywhere; the publisher is registered against the workflow filename
+and the `pypi` environment, so neither may be renamed.
+
+Still open: arming that (a PyPI pending publisher and the `pypi` environment are two browser steps),
+and then `pip install openoutreach[send]`, which can only be declared once this distribution is on
+PyPI.
+
+## Tests
+
+```bash
+pytest
+```
+
+pytest-django against a throwaway state dir (`conftest.py` redirects `OUTSEND_HOME` before Django
+loads, so a test run never touches `~/.openoutsend`). Nothing is skipped or ignored: the files that
+came across with the transport now assert against this side's own models.
+
+## Layout
+
+| Path | What it is |
+| --- | --- |
+| `cold_outreach/leads/` | what comes through the pipe — the models, ingest, suppression, the facts extraction |
+| `cold_outreach/emails/` | the transport — SMTP, IMAP sync, the mail pass, threads, delivery policy, warmth |
+| `cold_outreach/core/` | the outreach agent, its templates, and the sending window |
+| `cold_outreach/docs/` | how the agent and its templating work |
+| `cold_outreach/settings.py` | this repo's own Django settings and the state dir |
+| `cold_outreach/send_pass.py` | one pass — read, answer, open — and the line saying what held it |
+| `cold_outreach/first_run.py` | what `init` collects — the campaign's fields, the operator, the mailbox |
+| `cold_outreach/__main__.py` | the `outsend` console script |
+| `roadmap/` | open work, mostly inherited from OpenOutreach along with the code it describes |
+
+## Configuration
+
+The environment is the operator seam — the only way in a timer has:
+
+| | |
+| --- | --- |
+| `OUTSEND_OPERATOR_COUNTRY` | ISO 3166 alpha-2; resolves the local clock the sending window is measured in |
+| `OUTSEND_AI_MODEL` | a pydantic-ai `provider:model` id, e.g. `anthropic:claude-sonnet-4-5-20250929` |
+| `OUTSEND_LLM_API_KEY` / `OUTSEND_LLM_API_BASE` | credentials for it |
+| `OUTSEND_PRODUCT_DOCS` / `OUTSEND_CAMPAIGN_TARGET` / `OUTSEND_BOOKING_LINK` | what a campaign writes from; `outsend init` also asks for these on a terminal |
+| `OUTSEND_OPERATOR_NAME` / `OUTSEND_OPERATOR_EMAIL` | who signs the mail, and the address every send is blind-copied to (blank for none) |
+| `OUTSEND_MAILBOX_ADDRESS` / `OUTSEND_MAILBOX_PASSWORD` | the box to send from, and its **app password** — a Google box rejects the login password |
+| `OUTSEND_SMTP_HOST` / `OUTSEND_SMTP_PORT` / `OUTSEND_IMAP_HOST` / `OUTSEND_IMAP_PORT` | only for a box that is not on Google Workspace; those four default to Gmail's and are never prompted for |
+| `OUTSEND_SIGNATURE` | the sign-off appended to every send from that box; empty declines one for good |
+| `OUTSEND_HOME` / `OUTSEND_DB` | where the store lives |
+
+## The contract it has to implement
+
+The full design — what crosses, the record's field set, exit-code meaning, and why ingest is
+idempotent — lives in
+[`roadmap/p1-e2-find-send-boundary-contract.md`](https://github.com/eracle/openoutreach-docs/blob/main/roadmap/p1-e2-find-send-boundary-contract.md)
+in the `openoutreach-docs` repo. The parts this side owes:
+
+- **Ingest is idempotent**, keyed on `(lead_id, campaign)`, so the pipe is allowed to be lossy and
+  recovery is running it again.
+- **Suppression is checked at the door and is terminal** — the legal duty came here with `emails/`, and
+  a re-ingest must never resurrect somebody who opted out. An address that *changed* is re-checked,
+  because ingest is lead-keyed while suppression is address-keyed.
+- **Conflicts resolve latest-wins**, field by field: a re-ingest is a correction, not a duplicate.
+- **A malformed line is skipped and counted**, named on stderr, with a non-zero exit — `find` spent
+  real money on the rows behind it, so aborting the batch throws away paid work.
+- **A blank `email` is stored, not rejected.** An exportable row is not a mailable one; the address is
+  an enrichment that a later run fills in for free.
+
+## License
+
+MIT — see [LICENSE](LICENSE).

openoutsend-0.1.17/README.md

@@ -0,0 +1,126 @@
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+
+# OpenOutSend
+
+The **sending half** of [OpenOutreach](https://github.com/eracle/OpenOutreach). OpenOutreach finds and
+qualifies B2B leads and prints them; it does not send email. This is what sends them.
+
+The boundary between the two is a pipe, and nothing else crosses it:
+
+```bash
+openoutreach find 50 --json | outsend
+```
+
+`find` writes qualified leads as JSON Lines on stdout. `outsend` reads them, stores them in its own
+database, and exits — it transmits nothing at that moment. Delivery, pacing and whatever step
+structure it grows are its own business, on its own clock.
+
+The pipe is **one-way by design**. Every consumer sees the same bytes, so a file dropped into Instantly
+or Smartlead gets exactly what this receiver gets, and "our own sender has no privileged path" is held
+by construction rather than by discipline.
+
+## Status: it runs end to end — install, pipe, connect a box, send
+
+**`outsend` is a command and the store is its own.** Install it, pipe leads in, and they land as rows;
+a second, separate invocation is what mails them:
+
+```bash
+pip install -e .
+outsend init --campaign devtools                            # once: what you sell, who you are, a box
+openoutreach find 50 --json | outsend --campaign devtools   # store
+outsend send --campaign devtools                            # read, answer, open
+```
+
+The two invocations are separate on purpose: a pipe's right-hand side must not block on the network
+while a producer is still writing, and the cadences differ — leads arrive when `find` runs, mail moves
+on the mailbox's clock. So the cron line is two entries, not one command doing both.
+
+It reads JSON Lines on stdin, upserts on `(lead_id, campaign)`, checks every address against the
+suppression list at the door, skips and counts a malformed line, prints the campaign it resolved and
+the counts to **stderr**, and exits 0 when every line became a row. Its database is
+`~/.openoutsend/data/db.sqlite3` (`OUTSEND_HOME` / `OUTSEND_DB` override it) and it migrates itself on
+first run, so a fresh install is an ingest that works rather than a traceback.
+
+**`outsend send` is one bounded pass, not a daemon.** It reads the mail, answers every thread the lead
+has replied in, opens as many first emails as the guards allow, and exits — cadence is a timer's job.
+Reading first is what makes the other two honest: an opt-out that arrived overnight suppresses the
+person before anything is written to them. Openers are the only cold volume, so they are the only
+thing under a daily cap, a spacing clock and a sending window; a reply obeys none of the three.
+**`outsend init` collects what a first run needs** — what the campaign sells and to whom, the name
+that signs the mail, and a mailbox to send it from — and it runs implicitly on the first send, so a
+setup step is never something a timer discovers. The environment first, prompts second and **only on a
+terminal**; headless, whatever is still missing is one error naming every variable that would have
+answered it. The mailbox is stored only once its credentials pass an SMTP login, because the provider
+has no health API and that login is the only gate there is.
+
+**Releases are every green push to `main`** (`.github/workflows/deploy.yml`): tests, then a build and a
+PyPI upload over trusted publishing, with the version derived from the commit count rather than
+committed — the finder's rule, for the reason it went there, since a release nobody has to remember
+cannot drift. No token is stored anywhere; the publisher is registered against the workflow filename
+and the `pypi` environment, so neither may be renamed.
+
+Still open: arming that (a PyPI pending publisher and the `pypi` environment are two browser steps),
+and then `pip install openoutreach[send]`, which can only be declared once this distribution is on
+PyPI.
+
+## Tests
+
+```bash
+pytest
+```
+
+pytest-django against a throwaway state dir (`conftest.py` redirects `OUTSEND_HOME` before Django
+loads, so a test run never touches `~/.openoutsend`). Nothing is skipped or ignored: the files that
+came across with the transport now assert against this side's own models.
+
+## Layout
+
+| Path | What it is |
+| --- | --- |
+| `cold_outreach/leads/` | what comes through the pipe — the models, ingest, suppression, the facts extraction |
+| `cold_outreach/emails/` | the transport — SMTP, IMAP sync, the mail pass, threads, delivery policy, warmth |
+| `cold_outreach/core/` | the outreach agent, its templates, and the sending window |
+| `cold_outreach/docs/` | how the agent and its templating work |
+| `cold_outreach/settings.py` | this repo's own Django settings and the state dir |
+| `cold_outreach/send_pass.py` | one pass — read, answer, open — and the line saying what held it |
+| `cold_outreach/first_run.py` | what `init` collects — the campaign's fields, the operator, the mailbox |
+| `cold_outreach/__main__.py` | the `outsend` console script |
+| `roadmap/` | open work, mostly inherited from OpenOutreach along with the code it describes |
+
+## Configuration
+
+The environment is the operator seam — the only way in a timer has:
+
+| | |
+| --- | --- |
+| `OUTSEND_OPERATOR_COUNTRY` | ISO 3166 alpha-2; resolves the local clock the sending window is measured in |
+| `OUTSEND_AI_MODEL` | a pydantic-ai `provider:model` id, e.g. `anthropic:claude-sonnet-4-5-20250929` |
+| `OUTSEND_LLM_API_KEY` / `OUTSEND_LLM_API_BASE` | credentials for it |
+| `OUTSEND_PRODUCT_DOCS` / `OUTSEND_CAMPAIGN_TARGET` / `OUTSEND_BOOKING_LINK` | what a campaign writes from; `outsend init` also asks for these on a terminal |
+| `OUTSEND_OPERATOR_NAME` / `OUTSEND_OPERATOR_EMAIL` | who signs the mail, and the address every send is blind-copied to (blank for none) |
+| `OUTSEND_MAILBOX_ADDRESS` / `OUTSEND_MAILBOX_PASSWORD` | the box to send from, and its **app password** — a Google box rejects the login password |
+| `OUTSEND_SMTP_HOST` / `OUTSEND_SMTP_PORT` / `OUTSEND_IMAP_HOST` / `OUTSEND_IMAP_PORT` | only for a box that is not on Google Workspace; those four default to Gmail's and are never prompted for |
+| `OUTSEND_SIGNATURE` | the sign-off appended to every send from that box; empty declines one for good |
+| `OUTSEND_HOME` / `OUTSEND_DB` | where the store lives |
+
+## The contract it has to implement
+
+The full design — what crosses, the record's field set, exit-code meaning, and why ingest is
+idempotent — lives in
+[`roadmap/p1-e2-find-send-boundary-contract.md`](https://github.com/eracle/openoutreach-docs/blob/main/roadmap/p1-e2-find-send-boundary-contract.md)
+in the `openoutreach-docs` repo. The parts this side owes:
+
+- **Ingest is idempotent**, keyed on `(lead_id, campaign)`, so the pipe is allowed to be lossy and
+  recovery is running it again.
+- **Suppression is checked at the door and is terminal** — the legal duty came here with `emails/`, and
+  a re-ingest must never resurrect somebody who opted out. An address that *changed* is re-checked,
+  because ingest is lead-keyed while suppression is address-keyed.
+- **Conflicts resolve latest-wins**, field by field: a re-ingest is a correction, not a duplicate.
+- **A malformed line is skipped and counted**, named on stderr, with a non-zero exit — `find` spent
+  real money on the rows behind it, so aborting the batch throws away paid work.
+- **A blank `email` is stored, not rejected.** An exportable row is not a mailable one; the address is
+  an enrichment that a later run fills in for free.
+
+## License
+
+MIT — see [LICENSE](LICENSE).

openoutsend-0.1.17/cold_outreach/README.md

@@ -0,0 +1,71 @@
+# cold_outreach — ported from OpenOutreach, not yet wired up
+
+This directory is **parked code**, and it is now the whole of this repo. Nothing imports it,
+nothing runs it, and it is not on `INSTALLED_APPS`. It is the cold-outreach half of
+[OpenOutreach](https://github.com/eracle/OpenOutreach), moved here whole so it can be integrated
+deliberately rather than rewritten from memory.
+
+## Why it moved
+
+OpenOutreach became a **lead finder**: product description in, qualified leads out, with the reason
+each one was chosen, handed over as CSV. Sending is a specialism it was not good at, and a good lead
+list ruined by a bad opener reads to the buyer as a bad lead list. So the sending half comes here,
+where the whole job is the message.
+
+The boundary between the two is **one-way and public**: OpenOutreach exports leads, and nothing flows
+back. Whatever this code becomes, it must read that same export — no shared model, no direct import,
+no DB join. OpenOutSend gets no privileged path that Instantly or Smartlead would not get.
+
+The design decisions behind that split live in `roadmap/p1-e3-leadfinder-sequencer-boundary.md` in the
+`openoutreach-docs` repo. Read it before integrating; several decisions were reversed after the fact
+and the reasoning is recorded there rather than in either repo's git history.
+
+## What is here
+
+Layout mirrors OpenOutreach's, so the original import paths still read correctly.
+
+| path | what it is |
+|---|---|
+| `emails/models/mailbox.py` | `Mailbox` — one SMTP sending inbox, plus the pool-level pacing manager (`free_for_first_email`, `remaining_today`) and the measured daily cap. |
+| `emails/models/maillog.py` | `Message` / `Thread` / `DeliveryEvent` / `FolderCoverage` — the mail log. The record and its interpretation are separate objects; `processed_at IS NULL` is the third state. |
+| `emails/sync.py`, `classify.py`, `project.py`, `mail_pass.py` | The mail pass, in its three ordered jobs: sync (IMAP → rows, the only network step), classify (pure, versioned, over stored bytes), project (bounces → `DeliveryEvent`, opt-outs → suppression). |
+| `emails/threads.py` | Union-find over Message-IDs, so a reply carrying only `In-Reply-To` still reaches its deal. |
+| `emails/parsing.py` | Message parsing helpers. |
+| `emails/sender.py`, `smtp.py` | The send path: body → signature → opt-out line → attribution, `List-Unsubscribe`, SMTP auth. |
+| `emails/warmth.py`, `delivery_policy.py`, `report.py` | The three send guards — hours, rate, volume — and the receiver feedback that moves them. The daily cap is **measured** from the box's own Sent folder, not configured. |
+| `emails/steps/send.py`, `steps/reply.py` | The two pipeline steps: send one opener, answer one reply. |
+| `emails/admin.py`, `apps.py`, `migrations/` | Django wiring and the full migration history of the `emails` app. |
+| `core/agents/outreach.py`, `prompt.py` | The single outreach agent that owns the whole thread — cold open and every reply. Its job is **Mom Test research, not selling**: learn how the lead works today, never pitch unprompted. |
+| `core/templates/prompts/outreach_agent.j2` | That agent's prompt. |
+| `core/sending_window.py` | Mon–Fri, 08:00–20:00 in the *operator's* timezone, derived from their onboarding country. Openers wait for it; replies never come through it. |
+| `tests/` | The suite for all of the above, moved unchanged. |
+
+## What it still expects, and does not find here
+
+Every one of these is an OpenOutreach import that did **not** come along. They are the integration
+work, and most of them are the boundary in disguise:
+
+| import | what it was | what it has to become |
+|---|---|---|
+| `openoutreach.crm.models` (`Deal`, `Lead`, `DealState`) | the lead, the campaign-scoped deal, the state machine | **the port's main question.** A sequencer's unit is a recipient in a sequence, not a `Deal` in a finder's FSM. Do not recreate the finder's states here — take the exported row (`email, first_name, last_name, company, title, website, linkedin_url, reason, lead_id`) as the input and model the rest yourself. `lead_id` is the finder's join key; carry it, don't resolve it. |
+| `openoutreach.core.db.leads` (`suppress_email`) | permanent, account-level opt-out on `Lead.disqualified` | **the opt-out duty moves with this code.** A finder that never contacts anyone is not the sender under CAN-SPAM / GDPR / CASL, so the `List-Unsubscribe` header, the `+unsub` alias, the mailbox scan and the agent's `suppress` action are all this side's obligation now. Suppression needs a home here. |
+| `openoutreach.core.db.deals`, `db.summaries` | deal creation and conversation summaries | conversation state, so it belongs on this side; re-model against whatever replaces `Deal`. |
+| `openoutreach.core.llm` | the pydantic-ai model factory (`SiteConfig.ai_model` + key) | needs an equivalent, or accept an injected agent. |
+| `openoutreach.core.models.SiteConfig` | the config singleton — `country_code` drives the sending window | `sending_window.py` reads it directly; give it a seam rather than a singleton. |
+| `openoutreach.core.conf` | `WARM_*`, `MIN_SEND_INTERVAL_SECONDS`, `SEND_WINDOW_*` | copy the constants across; `WARM_CEILING_SENDS` is **derived** from the window and the pacing, so keep the arithmetic rather than re-declaring a number. |
+| `openoutreach.core.business_time` | Mon–Fri, used by the sending window and by thread age | small and self-contained; copy it. |
+| `openoutreach.core.operator` | the operator `User` — the BCC target on their own campaigns | an account concept this app already has in some form. |
+| `openoutreach.core.cycle` | the daemon loop that called these steps | **do not port.** The loop is the finder's, and it deleted its own daemon in favour of one bounded verb behind a timer. Sending here wants a cadence, not a resident process. |
+| `openoutreach.core.logblock` | log formatting | cosmetic; drop or replace. |
+
+## Two things not to lose
+
+**The freemium promotional campaign does not come with this code.** OpenOutreach shipped a campaign
+advertising itself, sent from the operator's own mailbox. It has been reclassified from growth asset
+to install tax and dies with the sender — it should not reappear here. `LEGAL_NOTICE.md` §4 in
+OpenOutreach is the disclosure that describes it.
+
+**The measured send cap is the good part.** `warmth.py` reads the box's own Sent folder and derives a
+daily ceiling from what that mailbox already does, rather than taking a configured number. It replaced
+a declared 50/day that nobody had measured. Whatever this becomes, keep the principle: the receiver
+counts every message the box emits, so the ledger has to count the same things.