…kpit

Build-list follow-on to PR #176 (KR-INTENT-EMAIL-TO-SEA-TICKET).
Operator-facing lens onto the intent.email_to_sea_ticket audit
stream so the substrate-level "what did Kora decide to do with
each inbound email" is visible at a glance:

  * created   → became a Sea_Ticket (deep-linkable)
  * logged_only → future promotion-loop training-data
  * dry_run   → preview-mode evaluation, no write
  * cap_exceeded → hourly throttle hit
  * failed    → triage surface (Sea_Ticket write errored)

K-DG drift caught: spec deviation from FE-only
=============================================

Bucket title says "FE-only PR — no backend changes (uses
existing /api/audit-events?seam=intent.email_to_sea_ticket from
PR #163 era)." K-DG showed that endpoint DOES NOT EXIST — the
established discipline (PR #155 KR-AUDIT-PANEL-ENDPOINTS) is one
endpoint per audit seam (/api/webhooks/events/recent,
/api/agent-activity/recent, /api/reasoning/recent, etc.), NOT a
generic /api/audit-events surface.

Spec §4 STOP-ASK clause explicitly anticipated this case +
licensed a "small BE addition might be needed." Added the
minimal per-seam endpoint (/api/email-intent/recent) following
the established pattern rather than escalating + creating a
coord cycle.

Backend (kora_cli/web_server.py — ~150 lines)
=============================================

  * GET /api/email-intent/recent
    Reads kora_audit_log.jsonl filtered to
    seam=intent.email_to_sea_ticket, projects each row to the
    EmailIntentEvent FE shape (per-branch field whitelist —
    SECURITY tested against arbitrary-field leak), returns
    newest-first with:
      - events: projected entry list
      - total_recent_24h + by_action_24h: aggregated counts
        per action over the 24h window
      - daily_created_14d: ordered [{date, count}] points so
        the sparkline renders chronologically without
        re-sorting client-side
      - action_values: echoed canonical action list (the FE
        constant + this echo + the emit_audit call sites
        form the 3-way drift guard)

  * _project_email_intent_audit() projection whitelists per-
    action fields:
      - created → ticket_id, tags (truncated)
      - logged_only → reason
      - dry_run → proposed_title
      - cap_exceeded → hourly_cap
      - failed → error (truncated to 200 chars defensively
        against runaway repr leaking stack-traceish content)

  * _EMAIL_INTENT_ACTION_VALUES — the BE projection allow-list
    (drift-guard pinned)

  * Unknown action values coerced to "unknown" (defensive
    against future writers adding new actions without
    updating the projection — test_unknown_action_coerced_defensively)

Frontend
========

  * web/src/pages/EmailIntentLogPage.tsx (new):
    - usePanelView("EmailIntentLogPage")
    - Summary chips: 24h counts per action
    - Sparkline: plain SVG <rect> bars (no chart-library dep
      per CC#2 discipline; same approach as CostTelemetryPage
      from PR #164). Empty days render as 1px ghost bars so
      operator sees day-grid position.
    - Filter chips: All / 5 actions; iterate
      EMAIL_INTENT_ACTION_VALUES (the canonical drift-guarded
      list) so adding a new action auto-adds a chip.
    - Per-row card: relative ts + subject + pattern chip +
      confidence + action badge + deep-link icon when
      ticket_id present (forward-compat
      /sea-tickets?focus=<ticket_id>)
    - Empty state: calm "no events / no filter matches"
      message with one-click "All" link, NOT a bare empty
      card list (spec §2c regression-guarded by test)

  * api.ts: api.getEmailIntentEventsRecent + EmailIntentEvent /
    EmailIntentEventsResponse / EmailIntentAction /
    EmailIntentDailyCount TS types + EMAIL_INTENT_ACTION_VALUES
    canonical constant (3-way drift guard's FE leg)

  * App.tsx: /email-intent-log route + sidebar nav entry
    placed right after /email (operator-flow: "Email inbox
    lens → Email Intent Log decisions")

Drift-guard pin (marquee)
=========================

test_action_values_drift_guard pins the 5 canonical action
values across THREE sources:

  1. BE projection allow-list: _EMAIL_INTENT_ACTION_VALUES
     in kora_cli/web_server.py
  2. BE emitter: "action" string literals at the 5
     _safe_audit call sites in
     kora_cli/intent/email_to_sea_ticket.py (regex-greps the
     source for `"action": "<value>"`)
  3. FE constant: EMAIL_INTENT_ACTION_VALUES in
     web/src/lib/api.ts

Drift in any one breaks the panel. Test fails CI on any
mismatch.

Tests (tests/kora_cli/test_email_intent_panel.py — 24 tests)
============================================================

  Backend (13):
    * endpoint registered, empty zero-response, by_action_24h
      shape-stable across all known actions, per-action
      projection (created/logged_only/dry_run/cap_exceeded/
      failed), unknown coerced to "unknown" defensively, daily
      sparkline bucket math (14 buckets ending today, chronological
      order, totals correct), 24h window cutoff, SECURITY
      (response doesn't echo arbitrary fields), subject + error
      truncated to bounded length

  Drift guard (2):
    * 3-way action-values drift guard (marquee)
    * SeamName Literal includes intent.email_to_sea_ticket

  FE source-pins (9):
    * api wrapper exists with correct URL
    * TS types declared (Event / Response / Action / DailyCount)
    * EMAIL_INTENT_ACTION_VALUES exported as a const
    * Page exists + usePanelView wired
    * Route + nav entry registered
    * Filter chips iterate the canonical action list
    * Deep-link uses /sea-tickets?focus=<id>
    * Sparkline uses plain SVG (no recharts/chart.js/d3/etc)
    * Empty state copy committed (regression guard)

24/24 pass. tsc -b clean. vite build clean.

Screenshots
===========

  web/docs/email-intent-log-panel/populated.png — 4 events
    (2 created + STK-42/41 deep-links, 1 logged_only with
    reason, 1 failed with truncated error), summary chips
    showing 8/3/1 split, sparkline with 14 day-bars
  web/docs/email-intent-log-panel/empty_filtered.png — operator
    filtered to "Failed" but zero failures; calm green-toned
    empty state with one-click "All" link

Sea_Ticket deep-link (forward-compat note)
==========================================

Deep-link is /sea-tickets?focus=<ticket_id>. SeaTicketsPage
doesn't currently consume the `focus` param — clicking lands
operator on the Sea_Tickets panel where they can scan their
assigned tickets (still useful). Follow-on bucket can teach
SeaTicketsPage to scroll/highlight the focused ticket without
requiring a re-write of this panel.

Follow-on recommendation
========================

Once enough logged_only entries accumulate (the
"promotion-loop training-data lens" — spec note), a Kora-side
analyzer bucket would surface the un-acted-on emails for
operator review (KR-EMAIL-LOGGED-ONLY-ANALYZER or similar).
The audit shape this panel consumes is forward-compatible.

Refs
====

  * rafe-walker/kora-docs
    17_cc_bucket_prompts/KR-FE-EMAIL-INTENT-LOG-PANEL_audit_stream_for_intent_seam.md
  * PR #155 — KR-AUDIT-PANEL-ENDPOINTS (per-seam endpoint pattern)
  * PR #163 — audit-emission infrastructure
  * PR #164 — CostTelemetryPage (plain-SVG charts pattern)
  * PR #176 — KR-INTENT-EMAIL-TO-SEA-TICKET (audit source)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>