completing day 3

apps/api/src/actions/actions.controller.ts

@@ -0,0 +1,127 @@
+import {
+  Body,
+  Controller,
+  Get,
+  Headers,
+  HttpCode,
+  HttpStatus,
+  Inject,
+  NotFoundException,
+  Param,
+  Post,
+} from "@nestjs/common";
+import { eq, desc } from "drizzle-orm";
+import { schema, type Database } from "@courtmitra/db";
+import {
+  CreateActionPreviewInput,
+  GrantConsentInput,
+  PublicCasePageDto,
+} from "@courtmitra/contracts";
+import { parseOrThrow } from "../common/zod-validation.pipe.js";
+import { DB } from "../db/db.module.js";
+import { ActionsService } from "./actions.service.js";
+
+@Controller()
+export class ActionsController {
+  constructor(
+    @Inject(ActionsService) private readonly actions: ActionsService,
+    @Inject(DB) private readonly db: Database,
+  ) {}
+
+  @Post("api/missions/:missionId/actions/preview")
+  @HttpCode(HttpStatus.CREATED)
+  async preview(
+    @Param("missionId") missionId: string,
+    @Body() body: unknown,
+    @Headers("idempotency-key") idempotencyKey?: string,
+  ) {
+    const input = parseOrThrow(CreateActionPreviewInput, body);
+    return this.actions.previewAction(missionId, input, idempotencyKey);
+  }
+
+  @Post("api/actions/:actionId/consent")
+  async grantConsent(@Param("actionId") actionId: string) {
+    return this.actions.grantConsent(actionId);
+  }
+
+  @Post("api/actions/:actionId/execute")
+  @HttpCode(HttpStatus.ACCEPTED)
+  async execute(@Param("actionId") actionId: string) {
+    return this.actions.executeAction(actionId);
+  }
+
+  @Get("api/actions/:actionId")
+  async get(@Param("actionId") actionId: string) {
+    return this.actions.getAction(actionId);
+  }
+
+  @Get("api/public-pages/:slug")
+  async getPublicPage(@Param("slug") slug: string) {
+    const [pageRow] = await this.db
+      .select({
+        id: schema.publicCasePages.id,
+        missionId: schema.publicCasePages.missionId,
+        slug: schema.publicCasePages.slug,
+        visibility: schema.publicCasePages.visibility,
+        redactedSummary: schema.publicCasePages.redactedSummary,
+        createdAt: schema.publicCasePages.createdAt,
+      })
+      .from(schema.publicCasePages)
+      .where(eq(schema.publicCasePages.slug, slug))
+      .limit(1);
+
+    if (!pageRow) throw new NotFoundException(`Public page not found: ${slug}`);
+
+    const [missionRow] = await this.db
+      .select({
+        title: schema.missions.title,
+        issueDomain: schema.missions.issueDomain,
+        state: schema.missions.state,
+      })
+      .from(schema.missions)
+      .where(eq(schema.missions.id, pageRow.missionId))
+      .limit(1);
+
+    const latestActionRows = await this.db
+      .select({
+        id: schema.actions.id,
+        actionType: schema.actions.actionType,
+        title: schema.actions.title,
+        status: schema.actions.status,
+        proofState: schema.actions.proofState,
+        createdAt: schema.actions.createdAt,
+      })
+      .from(schema.actions)
+      .where(eq(schema.actions.missionId, pageRow.missionId))
+      .orderBy(desc(schema.actions.createdAt))
+      .limit(10);
+
+    const dto: PublicCasePageDto = {
+      id: pageRow.id,
+      missionId: pageRow.missionId,
+      slug: pageRow.slug,
+      visibility: pageRow.visibility,
+      redactedSummary: pageRow.redactedSummary,
+      createdAt: pageRow.createdAt.toISOString(),
+    };
+
+    return {
+      page: dto,
+      mission: missionRow
+        ? {
+            title: `User reports / unresolved / alleged issue`,
+            issueDomain: missionRow.issueDomain,
+            state: missionRow.state,
+          }
+        : null,
+      actions: latestActionRows.map((a) => ({
+        id: a.id,
+        actionType: a.actionType,
+        title: a.title,
+        status: a.status,
+        proofState: a.proofState,
+        createdAt: a.createdAt.toISOString(),
+      })),
+    };
+  }
+}

apps/api/src/actions/actions.module.ts

@@ -0,0 +1,9 @@
+import { Module } from "@nestjs/common";
+import { ActionsController } from "./actions.controller.js";
+import { ActionsService } from "./actions.service.js";
+
+@Module({
+  controllers: [ActionsController],
+  providers: [ActionsService],
+})
+export class ActionsModule {}

apps/api/src/actions/actions.service.ts

@@ -0,0 +1,377 @@
+import { Inject, Injectable, NotFoundException } from "@nestjs/common";
+import { eq, and, desc, isNull } from "drizzle-orm";
+import { schema, type Database } from "@courtmitra/db";
+import {
+  computeConsentHash,
+  canonicalizeConsentPreview,
+  canExecute,
+} from "@courtmitra/domain";
+import { getCapabilities } from "@courtmitra/adapters";
+import type {
+  ConsentPreview,
+  Action,
+  RoutePlanStepDto,
+  ActionPreviewDto,
+  ActionPreviewResponse,
+  ConsentGrantResponse,
+  ExecuteActionResponse,
+  ActionDetailDto,
+  ActionAttemptDto,
+  SubmissionDto,
+  ActionExecutionRefused,
+  CreateActionPreviewInput,
+} from "@courtmitra/contracts";
+import { DB } from "../db/db.module.js";
+import { WorkflowService } from "../workflow/inngest.module.js";
+
+@Injectable()
+export class ActionsService {
+  constructor(
+    @Inject(DB) private readonly db: Database,
+    @Inject(WorkflowService) private readonly workflow: WorkflowService,
+  ) {}
+
+  async previewAction(
+    missionId: string,
+    input: CreateActionPreviewInput,
+    idempotencyKey?: string,
+  ): Promise<ActionPreviewDto> {
+    const [missionRow] = await this.db
+      .select({ id: schema.missions.id, userId: schema.missions.userId })
+      .from(schema.missions)
+      .where(eq(schema.missions.id, missionId))
+      .limit(1);
+    if (!missionRow) throw new NotFoundException(`Mission not found: ${missionId}`);
+
+    const [planRow] = await this.db
+      .select()
+      .from(schema.routePlans)
+      .where(
+        and(
+          eq(schema.routePlans.id, input.routePlanId),
+          eq(schema.routePlans.missionId, missionId),
+          isNull(schema.routePlans.supersededAt),
+        ),
+      )
+      .limit(1);
+    if (!planRow) throw new NotFoundException(`Route plan not found for mission: ${missionId}`);
+
+    const steps = planRow.steps as unknown as RoutePlanStepDto[];
+    const step = steps.find((s) => s.stepNo === input.stepNo);
+    if (!step) throw new NotFoundException(`Step ${input.stepNo} not found in route plan`);
+
+    const preview: ConsentPreview = {
+      actionType: step.actionType,
+      destination: input.destination,
+      public: false,
+      body: input.body,
+      attachments: input.attachments,
+      piiDisclosed: input.piiDisclosed,
+      risks: input.risks,
+    };
+
+    const hash = computeConsentHash(preview);
+
+    const canonicalized = canonicalizeConsentPreview(preview);
+
+    const [actionRow] = await this.db
+      .insert(schema.actions)
+      .values({
+        missionId,
+        routePlanId: input.routePlanId,
+        actionType: step.actionType,
+        title: step.title,
+        description: step.description,
+        inputPayload: canonicalized as Record<string, unknown>,
+        canonicalPayloadHash: hash,
+        consentRequired: true,
+        status: "preview_ready",
+        riskLevel: step.riskLevel,
+        createdBy: "user",
+        idempotencyKey: idempotencyKey ?? null,
+      })
+      .returning();
+
+    await this.db.insert(schema.missionStatusSnapshots).values({
+      missionId,
+      state: "actions_preview_ready",
+      substate: null,
+      headline: `Action preview ready: ${step.title}`,
+      blockedReason: null,
+      nextUserAction: "Review and approve the action to proceed.",
+      nextSystemAction: "Wait for user consent before execution.",
+      primaryButton: "Approve & send",
+      danger: false,
+      confidence: null,
+    });
+
+    const previewResponse: ActionPreviewResponse = {
+      actionId: actionRow!.id,
+      actionType: step.actionType,
+      destination: input.destination,
+      public: false,
+      bodyPreview: input.body.slice(0, 500),
+      attachments: input.attachments,
+      piiDisclosed: input.piiDisclosed,
+      risks: input.risks,
+      actionPreviewHash: hash,
+      proofStateAfter: "draft_only",
+    };
+
+    const action: Action = {
+      id: actionRow!.id,
+      missionId: actionRow!.missionId,
+      routePlanId: actionRow!.routePlanId,
+      actionType: actionRow!.actionType as Action["actionType"],
+      title: actionRow!.title,
+      description: actionRow!.description,
+      target: actionRow!.target as Record<string, unknown> | null,
+      inputPayload: actionRow!.inputPayload as Record<string, unknown> | null,
+      canonicalPayloadHash: actionRow!.canonicalPayloadHash,
+      consentRequired: actionRow!.consentRequired,
+      consentGrantId: actionRow!.consentGrantId,
+      status: actionRow!.status as Action["status"],
+      proofState: actionRow!.proofState as Action["proofState"],
+      proofRef: actionRow!.proofRef as Record<string, unknown> | null,
+      idempotencyKey: actionRow!.idempotencyKey,
+      riskLevel: actionRow!.riskLevel as Action["riskLevel"],
+      createdBy: actionRow!.createdBy as Action["createdBy"],
+      createdAt: actionRow!.createdAt.toISOString(),
+      updatedAt: actionRow!.updatedAt.toISOString(),
+    };
+
+    return {
+      action,
+      canonicalPayloadHash: hash,
+      preview: previewResponse,
+    };
+  }
+
+  async grantConsent(actionId: string): Promise<ConsentGrantResponse> {
+    const [actionRow] = await this.db
+      .select()
+      .from(schema.actions)
+      .where(eq(schema.actions.id, actionId))
+      .limit(1);
+    if (!actionRow) throw new NotFoundException(`Action not found: ${actionId}`);
+
+    const [missionRow] = await this.db
+      .select({ id: schema.missions.id, userId: schema.missions.userId })
+      .from(schema.missions)
+      .where(eq(schema.missions.id, actionRow.missionId))
+      .limit(1);
+    if (!missionRow) throw new NotFoundException(`Mission not found: ${actionRow.missionId}`);
+
+    const [existingGrant] = await this.db
+      .select()
+      .from(schema.consentGrants)
+      .where(
+        and(
+          eq(schema.consentGrants.missionId, actionRow.missionId),
+          eq(schema.consentGrants.actionPreviewHash, actionRow.canonicalPayloadHash ?? ""),
+          isNull(schema.consentGrants.revokedAt),
+        ),
+      )
+      .orderBy(desc(schema.consentGrants.grantedAt))
+      .limit(1);
+
+    if (existingGrant) {
+      // Link the existing consent to this action (it was created for a sibling action with the same hash).
+      await this.db
+        .update(schema.actions)
+        .set({ consentGrantId: existingGrant.id, status: "approved", updatedAt: new Date() })
+        .where(eq(schema.actions.id, actionId));
+
+      return {
+        id: existingGrant.id,
+        actionId: actionRow.id,
+        actionPreviewHash: existingGrant.actionPreviewHash,
+        grantedAt: existingGrant.grantedAt?.toISOString() ?? new Date().toISOString(),
+      };
+    }
+
+    const now = new Date();
+    const [grant] = await this.db
+      .insert(schema.consentGrants)
+      .values({
+        missionId: actionRow.missionId,
+        userId: missionRow.userId,
+        actionType: actionRow.actionType,
+        actionPreviewHash: actionRow.canonicalPayloadHash ?? "",
+        consentText: "I approve this action",
+        channel: "web",
+        grantedAt: now,
+      })
+      .returning();
+
+    await this.db
+      .update(schema.actions)
+      .set({
+        consentGrantId: grant!.id,
+        status: "approved",
+        updatedAt: new Date(),
+      })
+      .where(eq(schema.actions.id, actionId));
+
+    return {
+      id: grant!.id,
+      actionId: actionRow.id,
+      actionPreviewHash: grant!.actionPreviewHash,
+      grantedAt: grant!.grantedAt?.toISOString() ?? now.toISOString(),
+    };
+  }
+
+  async executeAction(
+    actionId: string,
+  ): Promise<ExecuteActionResponse | ActionExecutionRefused> {
+    const [actionRow] = await this.db
+      .select()
+      .from(schema.actions)
+      .where(eq(schema.actions.id, actionId))
+      .limit(1);
+    if (!actionRow) throw new NotFoundException(`Action not found: ${actionId}`);
+
+    if (actionRow.status === "succeeded" || actionRow.proofState === "sent_by_email") {
+      return {
+        refused: true,
+        reason: "This action has already been executed.",
+        code: "idempotency_key_used",
+      };
+    }
+
+    let consentGrant: { actionPreviewHash: string } | null = null;
+    if (actionRow.consentGrantId) {
+      const [grantRow] = await this.db
+        .select({ actionPreviewHash: schema.consentGrants.actionPreviewHash })
+        .from(schema.consentGrants)
+        .where(eq(schema.consentGrants.id, actionRow.consentGrantId))
+        .limit(1);
+      if (grantRow) {
+        consentGrant = grantRow;
+      }
+    }
+
+    const capabilities = getCapabilities();
+    const action: Action = {
+      id: actionRow.id,
+      missionId: actionRow.missionId,
+      routePlanId: actionRow.routePlanId,
+      actionType: actionRow.actionType as Action["actionType"],
+      title: actionRow.title,
+      description: actionRow.description,
+      target: null,
+      inputPayload: actionRow.inputPayload as Record<string, unknown> | null,
+      canonicalPayloadHash: actionRow.canonicalPayloadHash,
+      consentRequired: actionRow.consentRequired,
+      consentGrantId: actionRow.consentGrantId,
+      status: actionRow.status as Action["status"],
+      proofState: actionRow.proofState as Action["proofState"],
+      proofRef: null,
+      idempotencyKey: actionRow.idempotencyKey,
+      riskLevel: actionRow.riskLevel as Action["riskLevel"],
+      createdBy: actionRow.createdBy as Action["createdBy"],
+      createdAt: actionRow.createdAt.toISOString(),
+      updatedAt: actionRow.updatedAt.toISOString(),
+    };
+
+    const outgoingPreview: ConsentPreview = {
+      actionType: actionRow.actionType,
+      destination: (actionRow.inputPayload as Record<string, unknown>)?.["destination"] as string ?? "",
+      public: false,
+      body: (actionRow.inputPayload as Record<string, unknown>)?.["body"] as string ?? "",
+      attachments: (actionRow.inputPayload as Record<string, unknown>)?.["attachments"] as ConsentPreview["attachments"] ?? [],
+      piiDisclosed: (actionRow.inputPayload as Record<string, unknown>)?.["piiDisclosed"] as string[] ?? [],
+      risks: (actionRow.inputPayload as Record<string, unknown>)?.["risks"] as string[] ?? [],
+    };
+
+    const gateResult = canExecute(action, consentGrant, outgoingPreview, capabilities);
+    if (gateResult.refused) {
+      return gateResult;
+    }
+
+    // Delegate execution to the Inngest worker. We DO NOT change status here —
+    // the worker's executor sets it to "executing" inside its own transaction,
+    // and canExecute allows "executing" so retries work.
+    await this.workflow.send("action.execute_requested" as any, {
+      actionId: actionRow.id,
+      missionId: actionRow.missionId,
+    } as any);
+
+    return {
+      actionId: actionRow.id,
+      proofState: "draft_only",
+      status: "approved",
+      attempt: null,
+    };
+  }
+
+  async getAction(actionId: string): Promise<ActionDetailDto> {
+    const [actionRow] = await this.db
+      .select()
+      .from(schema.actions)
+      .where(eq(schema.actions.id, actionId))
+      .limit(1);
+    if (!actionRow) throw new NotFoundException(`Action not found: ${actionId}`);
+
+    const [latestAttempt] = await this.db
+      .select()
+      .from(schema.actionAttempts)
+      .where(eq(schema.actionAttempts.actionId, actionId))
+      .orderBy(desc(schema.actionAttempts.attemptNo))
+      .limit(1);
+
+    const submissionRows = await this.db
+      .select()
+      .from(schema.submissions)
+      .where(eq(schema.submissions.actionId, actionId))
+      .orderBy(desc(schema.submissions.createdAt));
+
+    const action: Action = {
+      id: actionRow.id,
+      missionId: actionRow.missionId,
+      routePlanId: actionRow.routePlanId,
+      actionType: actionRow.actionType as Action["actionType"],
+      title: actionRow.title,
+      description: actionRow.description,
+      target: actionRow.target as Record<string, unknown> | null,
+      inputPayload: actionRow.inputPayload as Record<string, unknown> | null,
+      canonicalPayloadHash: actionRow.canonicalPayloadHash,
+      consentRequired: actionRow.consentRequired,
+      consentGrantId: actionRow.consentGrantId,
+      status: actionRow.status as Action["status"],
+      proofState: actionRow.proofState as Action["proofState"],
+      proofRef: actionRow.proofRef as Record<string, unknown> | null,
+      idempotencyKey: actionRow.idempotencyKey,
+      riskLevel: actionRow.riskLevel as Action["riskLevel"],
+      createdBy: actionRow.createdBy as Action["createdBy"],
+      createdAt: actionRow.createdAt.toISOString(),
+      updatedAt: actionRow.updatedAt.toISOString(),
+    };
+
+    const latestAttemptDto: ActionAttemptDto | null = latestAttempt
+      ? {
+          id: latestAttempt.id,
+          adapterName: latestAttempt.adapterName,
+          attemptNo: latestAttempt.attemptNo,
+          status: latestAttempt.status,
+          errorCode: latestAttempt.errorCode,
+          errorMessage: latestAttempt.errorMessage,
+          startedAt: latestAttempt.startedAt?.toISOString() ?? null,
+          finishedAt: latestAttempt.finishedAt?.toISOString() ?? null,
+        }
+      : null;
+
+    const submissions: SubmissionDto[] = submissionRows.map((s) => ({
+      id: s.id,
+      proofState: s.proofState as SubmissionDto["proofState"],
+      externalReference: s.externalReference,
+      sentAt: s.sentAt?.toISOString() ?? null,
+    }));
+
+    return {
+      action,
+      latestAttempt: latestAttemptDto,
+      submissions,
+    };
+  }
+}

apps/api/src/app.module.ts

@@ -6,6 +6,7 @@ import { ConversationsModule } from "./conversations/conversations.module.js";
 import { WebhooksModule } from "./webhooks/webhooks.module.js";
 import { EvidenceModule } from "./evidence/evidence.module.js";
 import { RoutePlansModule } from "./route-plans/route-plans.module.js";
+import { ActionsModule } from "./actions/actions.module.js";
 import { CapabilitiesController } from "./capabilities/capabilities.controller.js";
 import { HealthController } from "./health.controller.js";
 
@@ -18,6 +19,7 @@ import { HealthController } from "./health.controller.js";
     WebhooksModule,
     EvidenceModule,
     RoutePlansModule,
+    ActionsModule,
   ],
   controllers: [CapabilitiesController, HealthController],
 })

apps/api/src/workflow/inngest.module.ts

@@ -23,7 +23,11 @@ export class WorkflowService {
       | "message.received"
       | "evidence.uploaded"
       | "mission.route_plan_requested"
-      | "mission.facts_confirmed",
+      | "mission.facts_confirmed"
+      | "action.execute_requested"
+      | "action.executed"
+      | "action.failed"
+      | "mission.followup_due",
     data: Record<string, string | boolean>,
   ): Promise<void> {
     await this.inngest.send({ name, data });

apps/web/src/app/missions/[id]/page.tsx

@@ -2,13 +2,40 @@
 
 import { use, useCallback, useEffect, useState } from "react";
 import Link from "next/link";
-import type { Mission, MissionEvent, MissionStatusSnapshot } from "@courtmitra/contracts";
+import type {
+  Mission,
+  MissionEvent,
+  MissionStatusSnapshot,
+  ActionPreviewDto,
+  ConsentGrantResponse,
+  ExecuteActionResponse,
+  CreateActionPreviewInput,
+} from "@courtmitra/contracts";
 import { api, type EvidenceItem, type FactsResponse, type RoutePlanDto } from "../../../lib/api";
 
 // ---------------------------------------------------------------------------
 // Support-level badge
 // ---------------------------------------------------------------------------
 
+type PerStepActionState = {
+  preview: ActionPreviewDto | null;
+  consent: ConsentGrantResponse | null;
+  execution: ExecuteActionResponse | null;
+  error: string | null;
+  loading: boolean;
+};
+
+function ProofStateBadge({ state }: { state: string | null }) {
+  if (!state) return null;
+  const cls =
+    state === "sent_by_email"
+      ? "badge badge-explicit"
+      : state === "failed"
+        ? "badge badge-contradicted"
+        : "badge badge-weak";
+  return <span className={cls}>{state}</span>;
+}
+
 function SupportBadge({ level }: { level: string }) {
   const cls =
     level === "explicit"
@@ -476,6 +503,10 @@ interface RoutePlanPanelProps {
   triggering: boolean;
   triggerError: string | null;
   onTrigger: () => void;
+  actionStates: Record<number, PerStepActionState>;
+  onPreviewAction: (stepNo: number, destination: string, body: string) => void;
+  onGrantConsent: (actionId: string) => void;
+  onExecuteAction: (actionId: string) => void;
 }
 
 function RoutePlanPanel({
@@ -484,8 +515,14 @@ function RoutePlanPanel({
   triggering,
   triggerError,
   onTrigger,
+  actionStates,
+  onPreviewAction,
+  onGrantConsent,
+  onExecuteAction,
 }: RoutePlanPanelProps) {
   const [expandedStep, setExpandedStep] = useState<number | null>(null);
+  const [destinationInputs, setDestinationInputs] = useState<Record<number, string>>({});
+  const [bodyInputs, setBodyInputs] = useState<Record<number, string>>({});
 
   if (loading) {
     return (
@@ -705,6 +742,127 @@ function RoutePlanPanel({
                     Neutral guidance — not legal advice
                   </div>
                 )}
+
+                {/* Action preview / consent / send */}
+                <div style={{ marginTop: 16, borderTop: "1px solid var(--border)", paddingTop: 14 }}>
+                  <div className="muted" style={{ fontSize: 12, marginBottom: 8 }}>
+                    Action
+                  </div>
+                  <input
+                    placeholder={`Email destination (default: ${step.authority ?? "authority"})`}
+                    value={destinationInputs[step.stepNo] ?? ""}
+                    onChange={(e) =>
+                      setDestinationInputs((prev) => ({ ...prev, [step.stepNo]: e.target.value }))
+                    }
+                    style={{ marginBottom: 8 }}
+                  />
+                  <textarea
+                    placeholder="Action body (will be filled from template)"
+                    value={bodyInputs[step.stepNo] ?? ""}
+                    onChange={(e) =>
+                      setBodyInputs((prev) => ({ ...prev, [step.stepNo]: e.target.value }))
+                    }
+                    style={{ minHeight: 80, marginBottom: 8, fontSize: 13 }}
+                  />
+                  <button
+                    className="btn-secondary btn-small"
+                    disabled={actionStates[step.stepNo]?.loading}
+                    onClick={(e) => {
+                      e.stopPropagation();
+                      onPreviewAction(
+                        step.stepNo,
+                        destinationInputs[step.stepNo] ?? step.authority ?? "",
+                        bodyInputs[step.stepNo] ?? "",
+                      );
+                    }}
+                  >
+                    {actionStates[step.stepNo]?.loading ? "Generating…" : "Preview Action"}
+                  </button>
+
+                  {actionStates[step.stepNo]?.error && (
+                    <div className="error" style={{ marginTop: 6 }}>
+                      {actionStates[step.stepNo]!.error}
+                    </div>
+                  )}
+
+                  {actionStates[step.stepNo]?.preview && !actionStates[step.stepNo]?.consent && (
+                    <div
+                      style={{
+                        marginTop: 12,
+                        padding: "10px 14px",
+                        background: "var(--panel-2)",
+                        border: "1px solid var(--border)",
+                        borderRadius: 8,
+                      }}
+                      onClick={(e) => e.stopPropagation()}
+                    >
+                      <div className="muted" style={{ fontSize: 11, marginBottom: 6 }}>
+                        Preview — hash:{" "}
+                        {actionStates[step.stepNo]!.preview!.canonicalPayloadHash.slice(0, 16)}…
+                      </div>
+                      <pre
+                        style={{
+                          fontSize: 12,
+                          whiteSpace: "pre-wrap",
+                          wordBreak: "break-word",
+                          maxHeight: 120,
+                          overflow: "auto",
+                          margin: 0,
+                          color: "var(--muted)",
+                        }}
+                      >
+                        {actionStates[step.stepNo]!.preview!.preview.bodyPreview}
+                      </pre>
+                      <label style={{ display: "flex", alignItems: "center", gap: 8, marginTop: 10, cursor: "pointer" }}>
+                        <input type="checkbox" id={`consent-${step.stepNo}`} style={{ width: "auto" }} />
+                        <span style={{ fontSize: 13, color: "var(--text)" }}>
+                          I approve this action
+                        </span>
+                      </label>
+                      <button
+                        style={{ marginTop: 8 }}
+                        disabled={actionStates[step.stepNo]?.loading}
+                        onClick={() => {
+                          const cb = document.getElementById(`consent-${step.stepNo}`) as HTMLInputElement | null;
+                          if (!cb?.checked) return;
+                          onGrantConsent(actionStates[step.stepNo]!.preview!.action.id);
+                        }}
+                      >
+                        Approve &amp; Send
+                      </button>
+                    </div>
+                  )}
+
+                  {actionStates[step.stepNo]?.consent && !actionStates[step.stepNo]?.execution && (
+                    <div style={{ marginTop: 10 }} onClick={(e) => e.stopPropagation()}>
+                      <button
+                        disabled={actionStates[step.stepNo]?.loading}
+                        onClick={() =>
+                          onExecuteAction(actionStates[step.stepNo]!.preview!.action.id)
+                        }
+                      >
+                        {actionStates[step.stepNo]?.loading ? "Sending…" : "Send Now"}
+                      </button>
+                    </div>
+                  )}
+
+                  {actionStates[step.stepNo]?.execution && (
+                    <div style={{ marginTop: 8 }} onClick={(e) => e.stopPropagation()}>
+                      <ProofStateBadge
+                        state={
+                          (actionStates[step.stepNo]!.execution as ExecuteActionResponse & { refused?: boolean }).refused
+                            ? null
+                            : (actionStates[step.stepNo]!.execution as ExecuteActionResponse).proofState
+                        }
+                      />
+                      {actionStates[step.stepNo]!.execution && "refused" in actionStates[step.stepNo]!.execution! && (
+                        <div className="error" style={{ marginTop: 4 }}>
+                          {(actionStates[step.stepNo]!.execution as { reason?: string }).reason ?? "Execution refused"}
+                        </div>
+                      )}
+                    </div>
+                  )}
+                </div>
               </div>
             )}
           </div>
@@ -732,6 +890,7 @@ export default function MissionRoom({ params }: { params: Promise<{ id: string }
   const [error, setError] = useState<string | null>(null);
   const [confirming, setConfirming] = useState(false);
   const [confirmMsg, setConfirmMsg] = useState<string | null>(null);
+  const [actionStates, setActionStates] = useState<Record<number, PerStepActionState>>({});
 
   const load = useCallback(async () => {
     setError(null);
@@ -798,6 +957,71 @@ export default function MissionRoom({ params }: { params: Promise<{ id: string }
     }
   }
 
+  function updateActionState(
+    stepNoOrActionId: number | string,
+    patch: Partial<PerStepActionState>,
+  ) {
+    setActionStates((prev) => {
+      const stepNo =
+        typeof stepNoOrActionId === "number"
+          ? stepNoOrActionId
+          : Number(
+              Object.keys(prev).find(
+                (k) => prev[Number(k)]?.preview?.action.id === stepNoOrActionId,
+              ),
+            );
+      return { ...prev, [stepNo]: { ...(prev[stepNo] ?? emptyActionState()), ...patch } };
+    });
+  }
+
+  function emptyActionState(): PerStepActionState {
+    return { preview: null, consent: null, execution: null, error: null, loading: false };
+  }
+
+  async function handlePreviewAction(stepNo: number, destination: string, body: string) {
+    if (!routePlan || !mission) return;
+    const step = routePlan.steps.find((s) => s.stepNo === stepNo);
+    if (!step) return;
+    const routePlanId = mission.currentRoutePlanId ?? routePlan.missionId;
+    updateActionState(stepNo, { preview: null, consent: null, execution: null, error: null, loading: true });
+    try {
+      const input: CreateActionPreviewInput = {
+        routePlanId,
+        stepNo,
+        destination,
+        subject: `Complaint regarding ${step.title}`,
+        body,
+        attachments: [],
+        piiDisclosed: [],
+        risks: [],
+      };
+      const result = await api.previewAction(id, input);
+      updateActionState(stepNo, { preview: result, loading: false });
+    } catch (e) {
+      updateActionState(stepNo, { error: String(e), loading: false });
+    }
+  }
+
+  async function handleGrantConsent(actionId: string) {
+    updateActionState(actionId, { loading: true, error: null });
+    try {
+      const consent = await api.grantConsent(actionId);
+      updateActionState(actionId, { consent, loading: false });
+    } catch (e) {
+      updateActionState(actionId, { error: String(e), loading: false });
+    }
+  }
+
+  async function handleExecuteAction(actionId: string) {
+    updateActionState(actionId, { loading: true, error: null });
+    try {
+      const execution = await api.executeAction(actionId);
+      updateActionState(actionId, { execution, loading: false });
+    } catch (e) {
+      updateActionState(actionId, { error: String(e), loading: false });
+    }
+  }
+
   if (error) return <div className="container"><div className="error">{error}</div></div>;
   if (!mission) return <div className="container"><div className="muted">Loading…</div></div>;
 
@@ -912,6 +1136,10 @@ export default function MissionRoom({ params }: { params: Promise<{ id: string }
         triggering={triggering}
         triggerError={triggerError}
         onTrigger={() => void handleTriggerRoutePlan()}
+        actionStates={actionStates}
+        onPreviewAction={(stepNo, dest, body) => void handlePreviewAction(stepNo, dest, body)}
+        onGrantConsent={(actionId) => void handleGrantConsent(actionId)}
+        onExecuteAction={(actionId) => void handleExecuteAction(actionId)}
       />
 
       {/* ---------------------------------------------------------------- */}

apps/web/src/app/p/[slug]/page.tsx

@@ -0,0 +1,154 @@
+import { notFound } from "next/navigation";
+import type { Metadata } from "next";
+
+const API_BASE = process.env.NEXT_PUBLIC_API_BASE_URL ?? "http://localhost:3001/api";
+
+export const metadata: Metadata = {
+  robots: "noindex, nofollow",
+  title: "Case page — CourtMitra",
+};
+
+interface PublicPageResponse {
+  page: {
+    id: string;
+    missionId: string;
+    slug: string;
+    visibility: string;
+    redactedSummary: string | null;
+    createdAt: string;
+  };
+  mission: {
+    title: string;
+    issueDomain: string;
+    state: string;
+  } | null;
+  actions: Array<{
+    id: string;
+    actionType: string;
+    title: string;
+    status: string;
+    proofState: string | null;
+    createdAt: string;
+  }>;
+}
+
+function ProofStateBadge({ state }: { state: string | null }) {
+  if (!state) return null;
+  const cls =
+    state === "sent_by_email"
+      ? "badge badge-explicit"
+      : state === "failed"
+        ? "badge badge-contradicted"
+        : "badge badge-weak";
+  return <span className={cls}>{state}</span>;
+}
+
+export default async function PublicCasePage({
+  params,
+}: {
+  params: Promise<{ slug: string }>;
+}) {
+  const { slug } = await params;
+
+  let data: PublicPageResponse;
+  try {
+    const res = await fetch(`${API_BASE}/public-pages/${slug}`, {
+      cache: "no-store",
+    });
+    if (!res.ok) {
+      if (res.status === 404) notFound();
+      throw new Error(`Failed to load: ${res.status}`);
+    }
+    data = (await res.json()) as PublicPageResponse;
+  } catch {
+    notFound();
+  }
+
+  return (
+    <div className="container">
+      <meta name="robots" content="noindex,nofollow" />
+      <div className="header">
+        <div>
+          <div className="brand">Case page</div>
+          <div className="muted" style={{ marginTop: 4 }}>
+            CourtMitra — legal information &amp; workflow assistance only
+          </div>
+        </div>
+      </div>
+
+      <div className="card">
+        <div className="muted" style={{ fontSize: 12, marginBottom: 6 }}>
+          Status
+        </div>
+        <div style={{ display: "flex", gap: 8, flexWrap: "wrap" }}>
+          <span className="pill domain">
+            {data.mission?.issueDomain ?? "unresolved"}
+          </span>
+          <span className="pill">{data.mission?.state ?? "unknown"}</span>
+        </div>
+      </div>
+
+      <div className="card">
+        <div className="muted" style={{ fontSize: 12, marginBottom: 6 }}>
+          Subject
+        </div>
+        <div style={{ lineHeight: 1.6, fontSize: 14 }}>
+          User reports / unresolved / alleged issue
+        </div>
+      </div>
+
+      <div className="card">
+        <div className="muted" style={{ fontSize: 12, marginBottom: 6 }}>
+          Summary
+        </div>
+        <div style={{ lineHeight: 1.6, fontSize: 14, whiteSpace: "pre-wrap" }}>
+          {data.page.redactedSummary ?? "No summary available."}
+        </div>
+      </div>
+
+      <h3 className="muted" style={{ marginTop: 24, marginBottom: 12 }}>
+        Actions
+      </h3>
+      {data.actions.length === 0 ? (
+        <div className="card">
+          <div className="empty-state">No actions recorded yet.</div>
+        </div>
+      ) : (
+        data.actions.map((action) => (
+          <div
+            key={action.id}
+            className="card"
+            style={{ marginBottom: 10 }}
+          >
+            <div style={{ fontWeight: 600, fontSize: 14 }}>{action.title}</div>
+            <div style={{ display: "flex", gap: 8, marginTop: 6, flexWrap: "wrap" }}>
+              <span className="pill">{action.actionType}</span>
+              <span className="pill">{action.status}</span>
+              <ProofStateBadge state={action.proofState} />
+            </div>
+            <div className="muted" style={{ marginTop: 6, fontSize: 12 }}>
+              {new Date(action.createdAt).toLocaleString()}
+            </div>
+          </div>
+        ))
+      )}
+
+      <div
+        style={{
+          marginTop: 32,
+          padding: "14px 18px",
+          background: "var(--panel-2)",
+          border: "1px solid var(--border)",
+          borderRadius: 10,
+          fontSize: 12,
+          color: "var(--muted)",
+          lineHeight: 1.7,
+        }}
+      >
+        Legal information &amp; workflow assistance only — not a lawyer-client
+        relationship. CourtMitra does not guarantee outcomes. Entity labels use
+        &ldquo;user reports / unresolved / alleged&rdquo; wording only.
+      </div>
+    </div>
+  );
+}

apps/web/src/lib/api.ts

@@ -7,6 +7,11 @@ import type {
   ParsedEvidenceDto,
   EvidenceClaimDto,
   RoutePlanDto,
+  CreateActionPreviewInput,
+  ActionPreviewDto,
+  ConsentGrantResponse,
+  ExecuteActionResponse,
+  ActionDetailDto,
 } from "@courtmitra/contracts";
 
 const API_BASE = process.env.NEXT_PUBLIC_API_BASE_URL ?? "http://localhost:3001/api";
@@ -116,4 +121,28 @@ export const api = {
       headers: { "idempotency-key": crypto.randomUUID() },
       body: JSON.stringify({}),
     }),
+
+  // --- Action endpoints ---
+  previewAction: (missionId: string, input: CreateActionPreviewInput) =>
+    http<ActionPreviewDto>(`/missions/${missionId}/actions/preview`, {
+      method: "POST",
+      headers: { "idempotency-key": crypto.randomUUID() },
+      body: JSON.stringify(input),
+    }),
+
+  grantConsent: (actionId: string) =>
+    http<ConsentGrantResponse>(`/actions/${actionId}/consent`, {
+      method: "POST",
+      body: JSON.stringify({}),
+    }),
+
+  executeAction: (actionId: string) =>
+    http<ExecuteActionResponse>(`/actions/${actionId}/execute`, {
+      method: "POST",
+      headers: { "idempotency-key": crypto.randomUUID() },
+      body: JSON.stringify({}),
+    }),
+
+  getActionDetail: (actionId: string) =>
+    http<ActionDetailDto>(`/actions/${actionId}`),
 };

apps/worker/src/functions/action-execute.ts

@@ -0,0 +1,45 @@
+import { Inngest, type InngestFunction } from "inngest";
+import { db } from "../deps.js";
+import { executeAction } from "../lib/action-executor.js";
+import { createResendEmailAdapter, getCapabilities } from "@courtmitra/adapters";
+import type { ExecuteActionResponse, ActionExecutionRefused } from "@courtmitra/contracts";
+
+export function createActionExecute(inngest: Inngest): InngestFunction.Any {
+  return inngest.createFunction(
+    {
+      id: "action-execute",
+      name: "Execute Action",
+      triggers: [{ event: "action.execute_requested" }],
+    },
+    async ({ event, step }) => {
+      const { actionId, missionId } = event.data as {
+        actionId: string;
+        missionId: string;
+      };
+
+      const result = await step.run("execute-action", async () => {
+        const emailAdapter = createResendEmailAdapter();
+        const capabilities = getCapabilities();
+        return executeAction(actionId, { db, emailAdapter, capabilities });
+      });
+
+      await step.run("emit-execution-event", async () => {
+        if ("refused" in result && (result as ActionExecutionRefused).refused) {
+          await inngest.send({
+            name: "action.failed" as const,
+            data: { actionId, missionId, error: (result as ActionExecutionRefused).reason },
+          });
+          return;
+        }
+
+        const execResult = result as ExecuteActionResponse;
+        await inngest.send({
+          name: "action.executed" as const,
+          data: { actionId, missionId, proofState: execResult.proofState },
+        });
+      });
+
+      return result;
+    },
+  ) as InngestFunction.Any;
+}

apps/worker/src/functions/followup-schedule.ts

@@ -0,0 +1,66 @@
+import { eq, desc, and } from "drizzle-orm";
+import { Inngest, type InngestFunction } from "inngest";
+import { db } from "../deps.js";
+import { schema } from "@courtmitra/db";
+
+export function createFollowupSchedule(inngest: Inngest): InngestFunction.Any {
+  return inngest.createFunction(
+    {
+      id: "followup-schedule",
+      name: "Schedule Follow-up",
+      triggers: [{ event: "action.executed" }],
+    },
+    async ({ event, step }) => {
+      const { missionId, actionId, proofState } = event.data as {
+        missionId: string;
+        actionId: string;
+        proofState: string;
+      };
+
+      if (proofState !== "sent_by_email") {
+        return { skipped: true, reason: "proofState is not sent_by_email" };
+      }
+
+      const sleepUntil = new Date(Date.now() + 7 * 24 * 60 * 60 * 1000);
+      await step.sleepUntil("wait-for-followup", sleepUntil);
+
+      await step.run("mark-followup-due", async () => {
+        const [followup] = await db
+          .select()
+          .from(schema.followups)
+          .where(
+            and(
+              eq(schema.followups.missionId, missionId),
+              eq(schema.followups.type, "email_followup"),
+              eq(schema.followups.status, "scheduled"),
+            ),
+          )
+          .orderBy(desc(schema.followups.createdAt))
+          .limit(1);
+
+        if (followup) {
+          await db
+            .update(schema.followups)
+            .set({ status: "due" })
+            .where(eq(schema.followups.id, followup.id));
+        }
+
+        await db.insert(schema.missionEvents).values({
+          missionId,
+          eventType: "followup_due",
+          actorType: "system",
+          payload: { actionId },
+        });
+      });
+
+      await step.run("emit-followup-event", async () => {
+        await inngest.send({
+          name: "mission.followup_due" as const,
+          data: { missionId, actionId },
+        });
+      });
+
+      return { missionId, actionId, followupScheduled: true };
+    },
+  ) as InngestFunction.Any;
+}

apps/worker/src/inngest.ts

@@ -2,6 +2,8 @@ import { Inngest, type InngestFunction } from "inngest";
 import { createRunIntake } from "./functions/intake.js";
 import { createParseEvidence } from "./functions/evidence.js";
 import { createRunRoutePlan } from "./functions/route-plan.js";
+import { createActionExecute } from "./functions/action-execute.js";
+import { createFollowupSchedule } from "./functions/followup-schedule.js";
 
 /**
  * Inngest client. Phase-1 functions (intake, evidence parse, legal grounding,
@@ -15,4 +17,6 @@ export const functions: InngestFunction.Any[] = [
   createRunIntake(inngest),
   createParseEvidence(inngest),
   createRunRoutePlan(inngest),
+  createActionExecute(inngest),
+  createFollowupSchedule(inngest),
 ];

apps/worker/src/lib/action-executor.ts

@@ -0,0 +1,218 @@
+import { eq, desc } from "drizzle-orm";
+import { createHash } from "node:crypto";
+import { schema } from "@courtmitra/db";
+import { canExecute } from "@courtmitra/domain";
+import type { Database } from "@courtmitra/db";
+import type { SubmissionPort } from "@courtmitra/ports";
+import type {
+  AdapterCapability,
+  ConsentPreview,
+  ExecuteActionResponse,
+  ActionExecutionRefused,
+  Action,
+} from "@courtmitra/contracts";
+
+function computeHash(obj: unknown): string {
+  return "sha256:" + createHash("sha256").update(JSON.stringify(obj)).digest("hex");
+}
+
+const STATE_RANK: Record<string, number> = {
+  created: 0,
+  intake_in_progress: 1,
+  needs_user_input: 2,
+  evidence_processing: 3,
+  evidence_ready: 4,
+  facts_pending_confirmation: 5,
+  facts_confirmed: 6,
+  legal_grounding_in_progress: 7,
+  route_plan_ready: 8,
+  actions_preview_ready: 9,
+  actions_awaiting_consent: 10,
+  action_executing: 11,
+  waiting_for_response: 12,
+  followup_due: 13,
+  escalation_ready: 14,
+  human_review_required: 15,
+  resolver_reply_received: 16,
+  resolution_claimed: 17,
+  resolved: 18,
+  closed_unresolved: 19,
+  paused: 20,
+  blocked: 21,
+  failed: 22,
+};
+
+export async function executeAction(
+  actionId: string,
+  opts: { db: Database; emailAdapter: SubmissionPort; capabilities: AdapterCapability[] },
+): Promise<ExecuteActionResponse | ActionExecutionRefused> {
+  const { db: txDb, emailAdapter, capabilities } = opts;
+
+  const [actionRow] = await txDb
+    .select()
+    .from(schema.actions)
+    .where(eq(schema.actions.id, actionId))
+    .limit(1);
+
+  if (!actionRow) {
+    return { refused: true, reason: "Action not found", code: "consent_not_found" } satisfies ActionExecutionRefused;
+  }
+
+  const action = actionRow as unknown as Action;
+
+  let consentGrant: { actionPreviewHash: string } | null = null;
+  if (action.consentGrantId) {
+    const [grantRow] = await txDb
+      .select({ actionPreviewHash: schema.consentGrants.actionPreviewHash })
+      .from(schema.consentGrants)
+      .where(eq(schema.consentGrants.id, action.consentGrantId))
+      .limit(1);
+
+    if (grantRow) {
+      consentGrant = grantRow;
+    }
+  }
+
+  const inputPayload = action.inputPayload ?? {};
+  const preview: ConsentPreview = {
+    actionType: action.actionType,
+    destination: (inputPayload as any)?.destination ?? "",
+    public: false,
+    body: (inputPayload as any)?.body ?? "",
+    attachments: (inputPayload as any)?.attachments ?? [],
+    piiDisclosed: (inputPayload as any)?.piiDisclosed ?? [],
+    risks: (inputPayload as any)?.risks ?? [],
+  };
+
+  const check = canExecute(action, consentGrant, preview, capabilities);
+  if (check.refused) {
+    return check satisfies ActionExecutionRefused;
+  }
+
+  const result = await txDb.transaction(async (tx) => {
+    const [attempt] = await tx
+      .insert(schema.actionAttempts)
+      .values({
+        actionId,
+        adapterName: "resend_email",
+        attemptNo: 1,
+        requestPayloadHash: computeHash(action.inputPayload),
+        status: "started",
+        startedAt: new Date(),
+      })
+      .returning({ id: schema.actionAttempts.id });
+
+    if (!attempt) {
+      throw new Error("Failed to create action attempt record");
+    }
+
+    const submissionResult = await emailAdapter.submit({
+      missionId: action.missionId,
+      actionId,
+      destination: (inputPayload as any)?.destination ?? "",
+      subject: (inputPayload as any)?.subject,
+      body: (inputPayload as any)?.body ?? "",
+      attachments: ((inputPayload as any)?.attachments ?? []).map((a: any) => ({
+        id: a.id ?? "",
+        storageKey: a.sha256 ?? "",
+        filename: a.id ?? "attachment",
+      })),
+      idempotencyKey: action.idempotencyKey ?? `action-${actionId}`,
+    });
+
+    const succeeded = submissionResult.proofState !== "failed";
+
+    await tx
+      .update(schema.actionAttempts)
+      .set({
+        status: succeeded ? "succeeded" : "failed",
+        responsePayload: submissionResult.proofRef,
+        providerReference: submissionResult.externalReference,
+        finishedAt: new Date(),
+      })
+      .where(eq(schema.actionAttempts.id, attempt.id));
+
+    await tx
+      .update(schema.actions)
+      .set({
+        proofState: submissionResult.proofState,
+        status: succeeded ? "succeeded" : "failed",
+        updatedAt: new Date(),
+      })
+      .where(eq(schema.actions.id, actionId));
+
+    await tx.insert(schema.submissions).values({
+      missionId: action.missionId,
+      actionId,
+      adapterName: "resend_email",
+      status: succeeded ? "sent" : "failed",
+      proofState: submissionResult.proofState,
+      externalReference: submissionResult.externalReference,
+      payloadHash: action.canonicalPayloadHash,
+      sentAt: new Date(),
+    });
+
+    await tx.insert(schema.missionEvents).values({
+      missionId: action.missionId,
+      eventType: succeeded ? "action_executed" : "action_execution_failed",
+      actorType: "system",
+      payload: {
+        actionId,
+        proofState: submissionResult.proofState,
+        externalReference: submissionResult.externalReference,
+      },
+    });
+
+    const newState = succeeded ? "waiting_for_response" : "failed";
+    const [latestSnapshot] = await tx
+      .select({ state: schema.missionStatusSnapshots.state })
+      .from(schema.missionStatusSnapshots)
+      .where(eq(schema.missionStatusSnapshots.missionId, action.missionId))
+      .orderBy(desc(schema.missionStatusSnapshots.createdAt))
+      .limit(1);
+
+    const currentRank = STATE_RANK[latestSnapshot?.state ?? ""] ?? -1;
+    const newRank = STATE_RANK[newState] ?? 0;
+
+    if (newRank >= currentRank) {
+      await tx.insert(schema.missionStatusSnapshots).values({
+        missionId: action.missionId,
+        state: newState,
+        headline: succeeded
+          ? `Action "${action.title}" sent — waiting for response.`
+          : `Action "${action.title}" failed to send.`,
+        nextUserAction: succeeded
+          ? "Check for reply on the sent complaint."
+          : "Review the error and retry.",
+        nextSystemAction: succeeded
+          ? "Schedule follow-up reminder."
+          : "None — action failed.",
+        primaryButton: succeeded ? "View sent action" : "Retry",
+        danger: !succeeded,
+      });
+    }
+
+    if (succeeded) {
+      await tx.insert(schema.followups).values({
+        missionId: action.missionId,
+        type: "email_followup",
+        dueAt: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000),
+        status: "scheduled",
+        payload: { actionId },
+      });
+    }
+
+    return {
+      actionId,
+      proofState: submissionResult.proofState,
+      status: succeeded ? "succeeded" : "failed",
+      attempt: {
+        id: attempt.id,
+        attemptNo: 1,
+        status: succeeded ? "succeeded" : "failed",
+      },
+    } satisfies ExecuteActionResponse;
+  });
+
+  return result;
+}

packages/adapters/package.json

@@ -21,6 +21,7 @@
     "@openrouter/ai-sdk-provider": "^2.9.0",
     "ai": "^6.0.191",
     "drizzle-orm": "^0.45.2",
+    "resend": "^6.12.4",
     "zod": "^4.4.3"
   },
   "devDependencies": {

packages/adapters/src/__tests__/regex-redaction.test.ts

@@ -0,0 +1,155 @@
+import { describe, it, expect } from "vitest";
+import { createRegexRedaction, RegexRedactionAdapter } from "../redaction/regex.js";
+
+describe("RegexRedactionAdapter", () => {
+  const adapter: RegexRedactionAdapter = createRegexRedaction();
+
+  // -----------------------------------------------------------------------
+  // Aadhaar
+  // -----------------------------------------------------------------------
+  it("detects Aadhaar with valid Verhoeff checksum", () => {
+    const spans = adapter.detect("My aadhaar is 1234 5678 9010");
+    const aadhaarSpans = spans.filter((s) => s.piiType === "AADHAAR");
+    expect(aadhaarSpans.length).toBe(1);
+    expect(aadhaarSpans[0]!.replacement).toBe("[PII:AADHAAR]");
+  });
+
+  it("does NOT detect Aadhaar with invalid Verhoeff checksum", () => {
+    const spans = adapter.detect("My aadhaar is 1234 5678 9012");
+    const aadhaarSpans = spans.filter((s) => s.piiType === "AADHAAR");
+    expect(aadhaarSpans.length).toBe(0);
+  });
+
+  it("detects compact Aadhaar (no spaces)", () => {
+    const spans = adapter.detect("Aadhaar: 123456789010");
+    const aadhaarSpans = spans.filter((s) => s.piiType === "AADHAAR");
+    expect(aadhaarSpans.length).toBe(1);
+  });
+
+  // -----------------------------------------------------------------------
+  // PAN
+  // -----------------------------------------------------------------------
+  it("detects PAN", () => {
+    const spans = adapter.detect("PAN: ABCPE1234F");
+    const panSpans = spans.filter((s) => s.piiType === "PAN");
+    expect(panSpans.length).toBe(1);
+  });
+
+  it("does NOT detect PAN with invalid 4th character", () => {
+    const spans = adapter.detect("PAN: ABCZE1234F");
+    const panSpans = spans.filter((s) => s.piiType === "PAN");
+    // Z is not in [ABCFGHLJPTK] → 4th char must be one of those
+    expect(panSpans.length).toBe(0);
+  });
+
+  // -----------------------------------------------------------------------
+  // Phone
+  // -----------------------------------------------------------------------
+  it("detects Indian phone with +91 prefix", () => {
+    const spans = adapter.detect("Call me at +919876543210");
+    const phoneSpans = spans.filter((s) => s.piiType === "PHONE_IN");
+    expect(phoneSpans.length).toBe(1);
+  });
+
+  it("detects Indian phone without prefix", () => {
+    const spans = adapter.detect("Call me at 9876543210");
+    const phoneSpans = spans.filter((s) => s.piiType === "PHONE_IN");
+    expect(phoneSpans.length).toBe(1);
+  });
+
+  it("does NOT detect invalid phone starting with 5", () => {
+    const spans = adapter.detect("Call me at 5123456789");
+    const phoneSpans = spans.filter((s) => s.piiType === "PHONE_IN");
+    expect(phoneSpans.length).toBe(0);
+  });
+
+  // -----------------------------------------------------------------------
+  // Email
+  // -----------------------------------------------------------------------
+  it("detects email address", () => {
+    const spans = adapter.detect("Email: test@example.com");
+    const emailSpans = spans.filter((s) => s.piiType === "EMAIL");
+    expect(emailSpans.length).toBe(1);
+  });
+
+  // -----------------------------------------------------------------------
+  // UPI VPA
+  // -----------------------------------------------------------------------
+  it("detects UPI VPA", () => {
+    const spans = adapter.detect("Pay to user@upi");
+    const upiSpans = spans.filter((s) => s.piiType === "UPI_VPA");
+    expect(upiSpans.length).toBe(1);
+  });
+
+  // -----------------------------------------------------------------------
+  // IFSC
+  // -----------------------------------------------------------------------
+  it("detects IFSC code", () => {
+    const spans = adapter.detect("IFSC: SBIN0123456");
+    const ifscSpans = spans.filter((s) => s.piiType === "IFSC");
+    expect(ifscSpans.length).toBe(1);
+  });
+
+  it("does NOT detect IFSC with non-zero 6th character", () => {
+    const spans = adapter.detect("IFSC: SBIN1123456");
+    const ifscSpans = spans.filter((s) => s.piiType === "IFSC");
+    expect(ifscSpans.length).toBe(0);
+  });
+
+  // -----------------------------------------------------------------------
+  // Bank account
+  // -----------------------------------------------------------------------
+  it("detects bank account number", () => {
+    const spans = adapter.detect("Account: 123456789012345678");
+    const bankSpans = spans.filter((s) => s.piiType === "BANK_ACCOUNT");
+    expect(bankSpans.length).toBe(1);
+  });
+
+  it("does NOT detect short number as bank account", () => {
+    const spans = adapter.detect("Number: 12345678");
+    const bankSpans = spans.filter((s) => s.piiType === "BANK_ACCOUNT");
+    expect(bankSpans.length).toBe(0);
+  });
+
+  // -----------------------------------------------------------------------
+  // redact() with mask mode (default)
+  // -----------------------------------------------------------------------
+  it("redacts Aadhaar in text", () => {
+    const result = adapter.redact("My aadhaar is 1234 5678 9010", "mask");
+    expect(result).toContain("[PII:AADHAAR]");
+    expect(result).not.toContain("1234 5678 9010");
+  });
+
+  it("redacts PAN in text", () => {
+    const result = adapter.redact("PAN: ABCPE1234F", "mask");
+    expect(result).toContain("[PII:PAN]");
+    expect(result).not.toContain("ABCPE1234F");
+  });
+
+  it("redacts multiple PII types in one string", () => {
+    const input = "Aadhaar: 1234 5678 9010, Email: test@example.com";
+    const result = adapter.redact(input, "mask");
+    expect(result).toContain("[PII:AADHAAR]");
+    expect(result).toContain("[PII:EMAIL]");
+    expect(result).not.toContain("1234 5678 9010");
+    expect(result).not.toContain("test@example.com");
+  });
+
+  it("redacts with remove mode", () => {
+    const result = adapter.redact("PAN: ABCPE1234F", "remove");
+    expect(result).not.toContain("ABCPE1234F");
+    expect(result).not.toContain("[PII:PAN]");
+  });
+
+  it("redacts with tag mode", () => {
+    const result = adapter.redact("PAN: ABCPE1234F", "tag");
+    expect(result).toContain("[PAN]");
+    expect(result).not.toContain("ABCPE1234F");
+  });
+
+  it("returns original text when no PII found", () => {
+    const input = "Hello, this is a normal message with no PII.";
+    const result = adapter.redact(input, "mask");
+    expect(result).toBe(input);
+  });
+});

packages/adapters/src/index.ts

@@ -37,6 +37,14 @@ export {
 // ---- Storage ------------------------------------------------------------
 export { createLocalFsStorage, LocalFsStorageAdapter } from "./storage/local-fs.js";
 
+// ---- Email / submission -------------------------------------------------
+export { createResendEmailAdapter } from "./submission/resend-email.js";
+export type { ResendEmailAdapter } from "./submission/resend-email.js";
+
+// ---- Redaction ----------------------------------------------------------
+export { createRegexRedaction } from "./redaction/regex.js";
+export type { RegexRedactionAdapter } from "./redaction/regex.js";
+
 // ---- Capability registry ------------------------------------------------
 
 /**
@@ -49,6 +57,8 @@ export function getCapabilities(): AdapterCapability[] {
   const waPhoneId = process.env["WHATSAPP_PHONE_NUMBER_ID"];
   const openrouterKey = process.env["OPENROUTER_API_KEY"];
   const opencodeKey = process.env["OPENCODE_API_KEY"];
+  const resendKey = process.env["RESEND_API_KEY"];
+  const resendFrom = process.env["RESEND_FROM"];
   const embeddingProvider = process.env["EMBEDDING_PROVIDER"] ?? process.env["AI_PROVIDER"] ?? "openrouter";
   const embeddingKeyAvailable = embeddingProvider === "opencode" ? !!opencodeKey : !!openrouterKey;
 
@@ -98,8 +108,8 @@ export function getCapabilities(): AdapterCapability[] {
     {
       adapter: "resend_email",
       action: "send_email",
-      status: "dev_only",
-      reason: "Resend adapter lands Day 4.",
+      status: resendKey && resendFrom ? "available" : "blocked",
+      reason: resendKey && resendFrom ? undefined : "RESEND_API_KEY and RESEND_FROM must be set.",
       requiredEnv: ["RESEND_API_KEY", "RESEND_FROM"],
       fallbackAction: "draft",
     },

packages/adapters/src/redaction/regex.ts

@@ -0,0 +1,155 @@
+import type {
+  RedactionPort,
+  RedactionSpan,
+  RedactionMode,
+} from "@courtmitra/ports";
+
+// ---------------------------------------------------------------------------
+// Verhoeff check-digit validation (Aadhaar)
+// ---------------------------------------------------------------------------
+
+const verhoeffD: number[][] = [
+  [0, 1, 2, 3, 4, 5, 6, 7, 8, 9],
+  [1, 2, 3, 4, 0, 6, 7, 8, 9, 5],
+  [2, 3, 4, 0, 1, 7, 8, 9, 5, 6],
+  [3, 4, 0, 1, 2, 8, 9, 5, 6, 7],
+  [4, 0, 1, 2, 3, 9, 5, 6, 7, 8],
+  [5, 9, 8, 7, 6, 0, 4, 3, 2, 1],
+  [6, 5, 9, 8, 7, 1, 0, 4, 3, 2],
+  [7, 6, 5, 9, 8, 2, 1, 0, 4, 3],
+  [8, 7, 6, 5, 9, 3, 2, 1, 0, 4],
+  [9, 8, 7, 6, 5, 4, 3, 2, 1, 0],
+];
+
+const verhoeffP: number[][] = [
+  [0, 1, 2, 3, 4, 5, 6, 7, 8, 9],
+  [1, 5, 7, 6, 2, 8, 3, 0, 9, 4],
+  [5, 8, 0, 3, 7, 9, 6, 1, 4, 2],
+  [8, 9, 1, 6, 0, 4, 3, 5, 2, 7],
+  [9, 4, 5, 3, 1, 2, 6, 8, 7, 0],
+  [4, 2, 8, 6, 5, 7, 3, 9, 0, 1],
+  [2, 7, 9, 3, 8, 0, 6, 4, 1, 5],
+  [7, 0, 4, 6, 9, 1, 3, 2, 5, 8],
+];
+
+function verhoeffValidate(digits: string): boolean {
+  let c = 0;
+  const n = digits.replace(/\s/g, "").split("").map(Number);
+  for (let i = n.length - 1; i >= 0; i--) {
+    const pos = n.length - 1 - i;
+    c = verhoeffD[c]![verhoeffP[pos % 8]![n[i]!]!]!;
+  }
+  return c === 0;
+}
+
+// ---------------------------------------------------------------------------
+// Regex patterns
+// ---------------------------------------------------------------------------
+
+interface PiiPattern {
+  type: string;
+  regex: RegExp;
+  validate?: (match: string) => boolean;
+}
+
+const PATTERNS: PiiPattern[] = [
+  {
+    type: "AADHAAR",
+    regex: /\b\d{4}\s?\d{4}\s?\d{4}\b/g,
+    validate: (m) => verhoeffValidate(m),
+  },
+  {
+    type: "PAN",
+    regex: /\b[A-Z]{3}[ABCFGHLJPTK][A-Z]\d{4}[A-Z]\b/g,
+  },
+  {
+    type: "EMAIL",
+    regex: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g,
+  },
+  {
+    type: "UPI_VPA",
+    regex: /[\w.-]+@[\w.-]+/g,
+  },
+  {
+    type: "IFSC",
+    regex: /\b[A-Z]{4}0[A-Z0-9]{6}\b/g,
+  },
+  {
+    type: "PHONE_IN",
+    regex: /(?<!\d)(?:\+?91[-.\s]?)?[6-9]\d{9}\b/g,
+  },
+  {
+    type: "BANK_ACCOUNT",
+    regex: /\b\d{9,18}\b/g,
+  },
+];
+
+// ---------------------------------------------------------------------------
+// Adapter
+// ---------------------------------------------------------------------------
+
+export class RegexRedactionAdapter implements RedactionPort {
+  detect(text: string): RedactionSpan[] {
+    const spans: RedactionSpan[] = [];
+    const seen = new Set<string>();
+
+    for (const pattern of PATTERNS) {
+      let match: RegExpExecArray | null;
+      const re = new RegExp(pattern.regex.source, "g");
+      while ((match = re.exec(text)) !== null) {
+        const value = match[0]!;
+        const key = `${match.index}:${value}`;
+        if (seen.has(key)) continue;
+        seen.add(key);
+
+        if (pattern.validate && !pattern.validate(value)) continue;
+
+        spans.push({
+          start: match.index,
+          end: match.index + value.length,
+          piiType: pattern.type,
+          replacement: `[PII:${pattern.type}]`,
+        });
+      }
+    }
+
+    spans.sort((a, b) => a.start - b.start);
+    return spans;
+  }
+
+  redact(text: string, mode: RedactionMode): string {
+    const spans = this.detect(text);
+    if (spans.length === 0) return text;
+
+    const mask = (span: RedactionSpan): string => {
+      switch (mode) {
+        case "remove":
+          return "";
+        case "tag":
+          return `[${span.piiType}]`;
+        default:
+          return `[PII:${span.piiType}]`;
+      }
+    };
+
+    const parts: string[] = [];
+    let cursor = 0;
+    for (const span of spans) {
+      if (span.start < cursor) continue;
+      if (span.start > cursor) {
+        parts.push(text.slice(cursor, span.start));
+      }
+      parts.push(mask(span));
+      cursor = span.end;
+    }
+    if (cursor < text.length) {
+      parts.push(text.slice(cursor));
+    }
+
+    return parts.join("");
+  }
+}
+
+export function createRegexRedaction(): RegexRedactionAdapter {
+  return new RegexRedactionAdapter();
+}

packages/adapters/src/submission/resend-email.ts

@@ -0,0 +1,185 @@
+import { createHmac, randomBytes } from "node:crypto";
+import { readFileSync, existsSync } from "node:fs";
+import { resolve } from "node:path";
+import { Resend } from "resend";
+import type {
+  SubmissionPort,
+  SubmissionRequest,
+  SubmissionResult,
+  EmailPort,
+  EmailSendRequest,
+  EmailSendResult,
+} from "@courtmitra/ports";
+import type { AdapterCapability } from "@courtmitra/contracts";
+
+function getEnv(name: string): string | undefined {
+  return process.env[name];
+}
+
+function buildReplyToken(
+  actionId: string,
+  missionId: string,
+  nonce: string,
+): string {
+  const key = getEnv("TOKEN_ENCRYPTION_KEY");
+  if (!key) throw new Error("Missing TOKEN_ENCRYPTION_KEY for reply token generation");
+  return createHmac("sha256", key)
+    .update(`${actionId}:${missionId}:${nonce}`)
+    .digest("hex");
+}
+
+function tryReadAttachment(storageKey: string): Buffer | undefined {
+  try {
+    const storageDir = getEnv("LOCAL_STORAGE_DIR") ?? ".storage";
+    const absPath = resolve(storageDir, storageKey);
+    if (existsSync(absPath)) {
+      return readFileSync(absPath);
+    }
+  } catch {
+    /* best effort */
+  }
+  return undefined;
+}
+
+type SendResult = {
+  proofState: "sent_by_email" | "failed";
+  providerMessageId: string | null;
+  proofRef: Record<string, unknown>;
+};
+
+export class ResendEmailAdapter implements SubmissionPort, EmailPort {
+  private readonly resend: Resend;
+  private readonly from: string;
+  private readonly replyDomain: string;
+
+  constructor() {
+    const apiKey = getEnv("RESEND_API_KEY");
+    const from = getEnv("RESEND_FROM");
+    const replyDomain = getEnv("RESEND_REPLY_DOMAIN");
+    this.resend = apiKey ? new Resend(apiKey) : new Resend("placeholder");
+    this.from = from ?? "";
+    this.replyDomain = replyDomain ?? "";
+  }
+
+  capabilities(): AdapterCapability[] {
+    const key = getEnv("RESEND_API_KEY");
+    const from = getEnv("RESEND_FROM");
+    return [
+      {
+        adapter: "resend_email",
+        action: "send_email",
+        status: key && from ? "available" : "blocked",
+        reason:
+          key && from
+            ? undefined
+            : "RESEND_API_KEY and RESEND_FROM must be set.",
+        requiredEnv: ["RESEND_API_KEY", "RESEND_FROM"],
+        fallbackAction: "draft",
+      },
+    ];
+  }
+
+  async submit(req: SubmissionRequest): Promise<SubmissionResult> {
+    const result = await this.doSend({
+      to: req.destination,
+      subject: req.subject ?? "No subject",
+      body: req.body,
+      actionId: req.actionId,
+      missionId: req.missionId,
+      attachments: req.attachments.map((a) => ({
+        filename: a.filename,
+        storageKey: a.storageKey,
+      })),
+    });
+    return {
+      proofState: result.proofState,
+      externalReference: result.providerMessageId,
+      proofRef: result.proofRef,
+    };
+  }
+
+  async send(req: EmailSendRequest): Promise<EmailSendResult> {
+    const result = await this.doSend({
+      to: req.to,
+      subject: req.subject,
+      body: req.body,
+      actionId: req.replyTo ?? "email",
+      missionId: req.to,
+      attachments: req.attachments ?? [],
+    });
+    return {
+      proofState: result.proofState,
+      providerMessageId: result.providerMessageId,
+      proofRef: result.proofRef,
+    };
+  }
+
+  private async doSend(
+    req: {
+      to: string;
+      subject: string;
+      body: string;
+      actionId: string;
+      missionId: string;
+      attachments: { filename: string; storageKey: string }[];
+    },
+  ): Promise<SendResult> {
+    if (!this.from || !getEnv("RESEND_API_KEY")) {
+      return {
+        proofState: "failed",
+        providerMessageId: null,
+        proofRef: { error: "RESEND_API_KEY and RESEND_FROM must be set." },
+      };
+    }
+
+    const nonce = randomBytes(8).toString("hex");
+    let replyTo: string | undefined;
+    try {
+      const token = buildReplyToken(req.actionId, req.missionId, nonce);
+      if (this.replyDomain) {
+        replyTo = `reply+${token}@${this.replyDomain}`;
+      }
+    } catch {
+      /* send without reply-token */
+    }
+
+    const resolvedAttachments = req.attachments
+      .map((a) => {
+        const content = tryReadAttachment(a.storageKey);
+        return content ? { filename: a.filename, content } : null;
+      })
+      .filter(Boolean);
+
+    try {
+      const { data, error } = await this.resend.emails.send({
+        from: this.from,
+        to: [req.to],
+        subject: req.subject,
+        html: req.body,
+        replyTo,
+        attachments:
+          resolvedAttachments.length > 0
+            ? (resolvedAttachments as { filename: string; content: Buffer }[])
+            : undefined,
+      });
+      if (error) throw error;
+      return {
+        proofState: "sent_by_email",
+        providerMessageId: data?.id ?? null,
+        proofRef: { id: data?.id },
+      };
+    } catch (err) {
+      return {
+        proofState: "failed",
+        providerMessageId: null,
+        proofRef: {
+          error: err instanceof Error ? err.message : String(err),
+        },
+      };
+    }
+  }
+}
+
+export function createResendEmailAdapter(): ResendEmailAdapter {
+  return new ResendEmailAdapter();
+}

packages/contracts/src/action.ts

@@ -64,3 +64,143 @@ export const ActionPreviewResponse = z.object({
   proofStateAfter: ProofState,
 });
 export type ActionPreviewResponse = z.infer<typeof ActionPreviewResponse>;
+
+// ---------------------------------------------------------------------------
+// Day 4 — Action preview, consent, execution, followup, public page
+// ---------------------------------------------------------------------------
+
+/** Input for POST /api/missions/:id/actions/preview — selects a route-plan step and fills the template. */
+export const CreateActionPreviewInput = z.object({
+  routePlanId: Uuid,
+  stepNo: z.number().int().min(0),
+  destination: z.string().min(1),
+  subject: z.string().optional(),
+  body: z.string().min(1),
+  attachments: z.array(ConsentPreviewAttachment).default([]),
+  piiDisclosed: z.array(z.string()).default([]),
+  risks: z.array(z.string()).default([]),
+});
+export type CreateActionPreviewInput = z.infer<typeof CreateActionPreviewInput>;
+
+/** Response for the preview endpoint — includes the created action row + metadata. */
+export const ActionPreviewDto = z.object({
+  action: Action,
+  canonicalPayloadHash: z.string(),
+  preview: ActionPreviewResponse,
+});
+export type ActionPreviewDto = z.infer<typeof ActionPreviewDto>;
+
+/** Empty body for POST /api/actions/:id/consent — consent is recorded server-side. */
+export const GrantConsentInput = z.object({}).default({});
+export type GrantConsentInput = z.infer<typeof GrantConsentInput>;
+
+/** Response for consent grant. */
+export const ConsentGrantResponse = z.object({
+  id: Uuid,
+  actionId: Uuid,
+  actionPreviewHash: z.string(),
+  grantedAt: IsoDateTime,
+});
+export type ConsentGrantResponse = z.infer<typeof ConsentGrantResponse>;
+
+/** Response for POST /api/actions/:id/execute. */
+export const ExecuteActionResponse = z.object({
+  actionId: Uuid,
+  proofState: ProofState,
+  status: ActionStatus,
+  attempt: z.object({
+    id: Uuid,
+    attemptNo: z.number().int(),
+    status: z.string(),
+  }).nullable(),
+});
+export type ExecuteActionResponse = z.infer<typeof ExecuteActionResponse>;
+
+/** A single action_attempts row (read model). */
+export const ActionAttemptDto = z.object({
+  id: Uuid,
+  adapterName: z.string(),
+  attemptNo: z.number().int(),
+  status: z.string(),
+  errorCode: z.string().nullable(),
+  errorMessage: z.string().nullable(),
+  startedAt: IsoDateTime.nullable(),
+  finishedAt: IsoDateTime.nullable(),
+});
+export type ActionAttemptDto = z.infer<typeof ActionAttemptDto>;
+
+/** A single submissions row (read model). */
+export const SubmissionDto = z.object({
+  id: Uuid,
+  proofState: ProofState,
+  externalReference: z.string().nullable(),
+  sentAt: IsoDateTime.nullable(),
+});
+export type SubmissionDto = z.infer<typeof SubmissionDto>;
+
+/** Full action detail returned by GET /api/actions/:id. */
+export const ActionDetailDto = z.object({
+  action: Action,
+  latestAttempt: ActionAttemptDto.nullable(),
+  submissions: z.array(SubmissionDto).default([]),
+});
+export type ActionDetailDto = z.infer<typeof ActionDetailDto>;
+
+/** Email-specific send input (for adapters). */
+export const EmailSendRequestDto = z.object({
+  to: z.string().email(),
+  subject: z.string().min(1),
+  body: z.string().min(1),
+  replyTo: z.string().optional(),
+  attachments: z.array(z.object({
+    filename: z.string(),
+    contentBase64: z.string().optional(),
+    contentType: z.string().optional(),
+  })).default([]),
+});
+export type EmailSendRequestDto = z.infer<typeof EmailSendRequestDto>;
+
+/** Email send result (adapter output). */
+export const EmailSendResultDto = z.object({
+  proofState: ProofState,
+  providerMessageId: z.string().nullable(),
+  proofRef: z.record(z.string(), z.unknown()),
+});
+export type EmailSendResultDto = z.infer<typeof EmailSendResultDto>;
+
+/** Followup row (read model). */
+export const FollowupDto = z.object({
+  id: Uuid,
+  missionId: Uuid,
+  type: z.string(),
+  dueAt: IsoDateTime,
+  status: z.string(),
+  payload: z.record(z.string(), z.unknown()).nullable(),
+});
+export type FollowupDto = z.infer<typeof FollowupDto>;
+
+/** Public case page (read model). */
+export const PublicCasePageDto = z.object({
+  id: Uuid,
+  missionId: Uuid,
+  slug: z.string(),
+  visibility: z.string(),
+  redactedSummary: z.string().nullable(),
+  createdAt: IsoDateTime,
+});
+export type PublicCasePageDto = z.infer<typeof PublicCasePageDto>;
+
+/** Error details returned when action execution is refused. */
+export const ActionExecutionRefused = z.object({
+  refused: z.literal(true),
+  reason: z.string(),
+  code: z.enum([
+    "consent_hash_mismatch",
+    "consent_not_found",
+    "idempotency_key_used",
+    "adapter_capability_blocked",
+    "action_not_approved",
+    "action_already_executed",
+  ]),
+});
+export type ActionExecutionRefused = z.infer<typeof ActionExecutionRefused>;

packages/domain/src/index.ts

@@ -4,3 +4,6 @@ export {
   canonicalConsentJson,
   canonicalizeConsentPreview,
 } from "./policies/consent-hash.js";
+
+export { canExecute } from "./policies/action-execution-policy.js";
+export type { CanExecuteResult, ExecutionRefusal, ExecutionAllowance } from "./policies/action-execution-policy.js";

packages/domain/src/policies/__tests__/action-execution-policy.test.ts

@@ -0,0 +1,147 @@
+import { describe, it, expect } from "vitest";
+import type { Action, ConsentPreview, AdapterCapability } from "@courtmitra/contracts";
+import { computeConsentHash } from "../../policies/consent-hash.js";
+import { canExecute } from "../../policies/action-execution-policy.js";
+
+function makeAction(overrides: Partial<Action> = {}): Action {
+  return {
+    id: "00000000-0000-0000-0000-000000000001",
+    missionId: "00000000-0000-0000-0000-000000000002",
+    routePlanId: null,
+    actionType: "send_email",
+    title: "Test action",
+    description: null,
+    target: null,
+    inputPayload: null,
+    canonicalPayloadHash: null,
+    consentRequired: true,
+    consentGrantId: "00000000-0000-0000-0000-000000000010",
+    status: "approved",
+    proofState: "draft_only",
+    proofRef: null,
+    idempotencyKey: null,
+    riskLevel: "low",
+    createdBy: "ai",
+    createdAt: "2025-01-01T00:00:00+00:00",
+    updatedAt: "2025-01-01T00:00:00+00:00",
+    ...overrides,
+  };
+}
+
+function makeConsentPreview(overrides: Partial<ConsentPreview> = {}): ConsentPreview {
+  return {
+    actionType: "send_email",
+    destination: "test@example.com",
+    public: false,
+    body: "Test body content",
+    attachments: [],
+    piiDisclosed: [],
+    risks: [],
+    ...overrides,
+  };
+}
+
+describe("canExecute", () => {
+  it("refuses when consent is null", () => {
+    const action = makeAction();
+    const preview = makeConsentPreview();
+    const caps: AdapterCapability[] = [];
+
+    const result = canExecute(action, null, preview, caps);
+
+    expect(result.refused).toBe(true);
+    if (result.refused) {
+      expect(result.code).toBe("consent_not_found");
+    }
+  });
+
+  it("refuses when consent hash does not match", () => {
+    const action = makeAction();
+    const consentGrant = { actionPreviewHash: "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" };
+    const preview = makeConsentPreview({ body: "Completely different body text" });
+    const caps: AdapterCapability[] = [];
+
+    const result = canExecute(action, consentGrant, preview, caps);
+
+    expect(result.refused).toBe(true);
+    if (result.refused) {
+      expect(result.code).toBe("consent_hash_mismatch");
+    }
+  });
+
+  it("refuses when action status is not approved", () => {
+    const action = makeAction({ status: "proposed" });
+    const preview = makeConsentPreview();
+    const hash = computeConsentHash(preview);
+    const consentGrant = { actionPreviewHash: hash };
+    const caps: AdapterCapability[] = [];
+
+    const result = canExecute(action, consentGrant, preview, caps);
+
+    expect(result.refused).toBe(true);
+    if (result.refused) {
+      expect(result.code).toBe("action_not_approved");
+    }
+  });
+
+  it("refuses when adapter capability is blocked", () => {
+    const action = makeAction({ actionType: "send_email" });
+    const preview = makeConsentPreview();
+    const hash = computeConsentHash(preview);
+    const consentGrant = { actionPreviewHash: hash };
+    const caps: AdapterCapability[] = [
+      {
+        adapter: "resend_email",
+        action: "send_email",
+        status: "blocked",
+        reason: "API key not set.",
+        fallbackAction: "draft",
+      },
+    ];
+
+    const result = canExecute(action, consentGrant, preview, caps);
+
+    expect(result.refused).toBe(true);
+    if (result.refused) {
+      expect(result.code).toBe("adapter_capability_blocked");
+    }
+  });
+
+  it("allows execution when all conditions pass", () => {
+    const action = makeAction({ actionType: "send_email" });
+    const preview = makeConsentPreview();
+    const hash = computeConsentHash(preview);
+    const consentGrant = { actionPreviewHash: hash };
+    const caps: AdapterCapability[] = [
+      {
+        adapter: "resend_email",
+        action: "send_email",
+        status: "available",
+        fallbackAction: "draft",
+      },
+    ];
+
+    const result = canExecute(action, consentGrant, preview, caps);
+
+    expect(result.refused).toBe(false);
+  });
+
+  it("allows execution with dev_only capability", () => {
+    const action = makeAction({ actionType: "send_email" });
+    const preview = makeConsentPreview();
+    const hash = computeConsentHash(preview);
+    const consentGrant = { actionPreviewHash: hash };
+    const caps: AdapterCapability[] = [
+      {
+        adapter: "resend_email",
+        action: "send_email",
+        status: "dev_only",
+        fallbackAction: "draft",
+      },
+    ];
+
+    const result = canExecute(action, consentGrant, preview, caps);
+
+    expect(result.refused).toBe(false);
+  });
+});

packages/domain/src/policies/action-execution-policy.ts

@@ -0,0 +1,126 @@
+/**
+ * ActionExecutionPolicy — pure rules for `canExecute`.
+ *
+ * Order: consent → idempotency → capability → rate-limit.
+ * Failure of any step returns `ActionExecutionRefused` with a typed reason.
+ * This is the invariant core of the Action spine (CLAUDE.md #2, #3, #5, #7).
+ */
+import type {
+  Action,
+  AdapterCapability,
+  ActionExecutionRefused,
+} from "@courtmitra/contracts";
+import { consentHashMatches } from "./consent-hash.js";
+
+// ---------------------------------------------------------------------------
+// Refusal result
+// ---------------------------------------------------------------------------
+
+export interface ExecutionRefusal {
+  refused: true;
+  reason: string;
+  code: ActionExecutionRefused["code"];
+}
+
+export interface ExecutionAllowance {
+  refused: false;
+}
+
+export type CanExecuteResult = ExecutionRefusal | ExecutionAllowance;
+
+// ---------------------------------------------------------------------------
+// Adapter capability check
+// ---------------------------------------------------------------------------
+
+function adapterForAction(action: Action): string | null {
+  switch (action.actionType) {
+    case "send_email":
+      return "resend_email";
+    case "post_social":
+      return "social_publisher";
+    case "generate_packet":
+      return "packet_generator";
+    default:
+      return null;
+  }
+}
+
+function capabilityIsAvailable(cap: AdapterCapability): boolean {
+  return cap.status === "available" || cap.status === "dev_only";
+}
+
+// ---------------------------------------------------------------------------
+// Public gate — pure function, zero side-effects
+// ---------------------------------------------------------------------------
+
+/**
+ * Evaluate whether an action may be executed.
+ *
+ * @param action — the Action row to execute.
+ * @param consentGrant — the consent grant (null if not yet granted).
+ * @param outgoingPreview — the ConsentPreview computed from the EXACT outgoing payload.
+ * @param allCapabilities — full capability registry (adapter list).
+ * @returns `{ refused: false }` or `{ refused: true, reason, code }`.
+ */
+export function canExecute(
+  action: Action,
+  consentGrant: { actionPreviewHash: string } | null,
+  outgoingPreview: Parameters<typeof consentHashMatches>[1],
+  allCapabilities: AdapterCapability[],
+): CanExecuteResult {
+  // 1. Consent must exist
+  if (!consentGrant) {
+    return {
+      refused: true,
+      reason: "Consent has not been granted for this action.",
+      code: "consent_not_found",
+    };
+  }
+
+  // 2. Consent hash must match the outgoing payload (CLAUDE.md #5)
+  if (!consentHashMatches(consentGrant.actionPreviewHash, outgoingPreview)) {
+    return {
+      refused: true,
+      reason:
+        "The action draft has changed since consent was given — re-approval required.",
+      code: "consent_hash_mismatch",
+    };
+  }
+
+  // 3. Action must be in an executable status
+  //    "executing" is allowed for retries — the worker sets it inside its tx.
+  const executableStatuses = new Set(["approved", "preview_ready", "executing"]);
+  if (!executableStatuses.has(action.status)) {
+    return {
+      refused: true,
+      reason: `Action status is "${action.status}", not "approved", "preview_ready", or "executing".`,
+      code: "action_not_approved",
+    };
+  }
+
+  // 4. Idempotency key must not already have been used (caller checks DB)
+  if (action.idempotencyKey && action.proofState === "sent_by_email") {
+    return {
+      refused: true,
+      reason: "This action has already been executed (idempotency key consumed).",
+      code: "idempotency_key_used",
+    };
+  }
+
+  // 5. Adapter capability must be available
+  const adapterName = adapterForAction(action);
+  if (adapterName) {
+    const matching = allCapabilities.find((c) => c.adapter === adapterName);
+    if (!matching || !capabilityIsAvailable(matching)) {
+      return {
+        refused: true,
+        reason: matching
+          ? `Adapter "${adapterName}" is not available (status: ${matching.status}). ${matching.reason ?? ""}`
+          : `No adapter found for "${adapterName}".`,
+        code: "adapter_capability_blocked",
+      };
+    }
+  }
+
+  return { refused: false };
+}

packages/ports/src/index.ts

@@ -157,6 +157,27 @@ export interface SubmissionPort extends CapabilityAware {
   submit(r: SubmissionRequest): Promise<SubmissionResult>;
 }
 
+// --- Email (dedicated port, separate from generic SubmissionPort) -----------
+
+export interface EmailSendRequest {
+  to: string;
+  subject: string;
+  body: string;
+  replyTo?: string;
+  /** Attachments as base64-encoded content (referenced by storage key). */
+  attachments?: { filename: string; storageKey: string; contentType?: string }[];
+}
+
+export interface EmailSendResult {
+  proofState: ProofState;
+  providerMessageId: string | null;
+  proofRef: Record<string, unknown>;
+}
+
+export interface EmailPort extends CapabilityAware {
+  send(req: EmailSendRequest): Promise<EmailSendResult>;
+}
+
 // --- Redaction ---------------------------------------------------------------
 
 export type RedactionMode = "mask" | "remove" | "tag";

pnpm-lock.yaml

@@ -176,6 +176,9 @@ importers:
       drizzle-orm:
         specifier: ^0.45.2
         version: 0.45.2(@opentelemetry/api@1.9.1)(@types/pg@8.20.0)(pg@8.21.0)
+      resend:
+        specifier: ^6.12.4
+        version: 6.12.4
       zod:
         specifier: ^4.4.3
         version: 4.4.3
@@ -1695,6 +1698,9 @@ packages:
   '@rolldown/pluginutils@1.0.1':
     resolution: {integrity: sha512-2j9bGt5Jh8hj+vPtgzPtl72j0yRxHAyumoo6TNfAjsLB04UtpSvPbPcDcBMxz7n+9CYB0c1GxQFxYRg2jimqGw==}
 
+  '@stablelib/base64@1.0.1':
+    resolution: {integrity: sha512-1bnPQqSxSuc3Ii6MhBysoWCg58j97aUjuCSZrGSmDxNqtytIi0k8utUenAwTZN4V5mXXYGsVUI9zeBqy+jBOSQ==}
+
   '@standard-schema/spec@1.1.0':
     resolution: {integrity: sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==}
 
@@ -2280,6 +2286,9 @@ packages:
   fast-safe-stringify@2.1.1:
     resolution: {integrity: sha512-W+KJc2dmILlPplD/H4K9l9LcAHAfPtP6BY84uVLXQ6Evcz9Lcg33Y2z1IVblT6xdY54PXYVHEv+0Wpq8Io6zkA==}
 
+  fast-sha256@1.3.0:
+    resolution: {integrity: sha512-n11RGP/lrWEFI/bWdygLxhI+pVeo1ZYIVwvvPkW7azl/rOy+F3HYRZ2K5zeE9mmkhQppyv9sQFx0JM9UabnpPQ==}
+
   fast-uri@3.1.2:
     resolution: {integrity: sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==}
 
@@ -2763,6 +2772,9 @@ packages:
     resolution: {integrity: sha512-r34yH/GlQpKZbU1BvFFqOjhISRo1MNx1tWYsYvmj6KIRHSPMT2+yHOEb1SG6NMvRoHRF0a07kCOox/9yakl1vg==}
     hasBin: true
 
+  postal-mime@2.7.4:
+    resolution: {integrity: sha512-0WdnFQYUrPGGTFu1uOqD2s7omwua8xaeYGdO6rb88oD5yJ/4pPHDA4sdWqfD8wQVfCny563n/HQS7zTFft+f/g==}
+
   postcss@8.4.31:
     resolution: {integrity: sha512-PS08Iboia9mts/2ygV3eLpY5ghnUcfLV/EXTOW1E2qYxJKGGBUtNjN76FYHnMs36RmARn41bC0AZmn+rR0OVpQ==}
     engines: {node: ^10 || ^12 || >=14}
@@ -2843,6 +2855,15 @@ packages:
     resolution: {integrity: sha512-QT7FVMXfWOYFbeRBF6nu+I6tr2Tf3u0q8RIEjNob/heKY/nh7drD/k7eeMFmSQgnTtCzLDcCu/XEnpW2wk4xCQ==}
     engines: {node: '>=9.3.0 || >=8.10.0 <9.0.0'}
 
+  resend@6.12.4:
+    resolution: {integrity: sha512-lRpJ2Hxd+ht+JPDm97juRcUp9HOMuZyxaRFRFmc9Tx8iNWiei94Dx9v6SWufgKk2667C/uCeKKspMotOHSpCSg==}
+    engines: {node: '>=20'}
+    peerDependencies:
+      '@react-email/render': '*'
+    peerDependenciesMeta:
+      '@react-email/render':
+        optional: true
+
   resolve-from@4.0.0:
     resolution: {integrity: sha512-pb/MYmXstAkysRFx8piNI1tGFNQIFA3vkE3Gq4EuA1dF6gHp/+vgZqsCGJapvy8N3Q+4o7FwvquPJcnZ7RYy4g==}
     engines: {node: '>=4'}
@@ -2936,6 +2957,9 @@ packages:
   stackback@0.0.2:
     resolution: {integrity: sha512-1XMJE5fQo1jGH6Y/7ebnwPOBEkIEnT4QF32d5R1+VXdXveM0IBMJt8zfaxX1P3QhVwrYe+576+jkANtSS2mBbw==}
 
+  standardwebhooks@1.0.0:
+    resolution: {integrity: sha512-BbHGOQK9olHPMvQNHWul6MYlrRTAOKn03rOe4A8O3CLWhNf4YHBqq2HJKKC+sfqpxiBY52pNeesD6jIiLDz8jg==}
+
   std-env@4.1.0:
     resolution: {integrity: sha512-Rq7ybcX2RuC55r9oaPVEW7/xu3tj8u4GeBYHBWCychFtzMIr86A7e3PPEBPT37sHStKX3+TiX/Fr/ACmJLVlLQ==}
 
@@ -4548,6 +4572,8 @@ snapshots:
 
   '@rolldown/pluginutils@1.0.1': {}
 
+  '@stablelib/base64@1.0.1': {}
+
   '@standard-schema/spec@1.1.0': {}
 
   '@swc/helpers@0.5.15':
@@ -5152,6 +5178,8 @@ snapshots:
 
   fast-safe-stringify@2.1.1: {}
 
+  fast-sha256@1.3.0: {}
+
   fast-uri@3.1.2: {}
 
   fastify-plugin@5.1.0: {}
@@ -5612,6 +5640,8 @@ snapshots:
       sonic-boom: 4.2.1
       thread-stream: 4.2.0
 
+  postal-mime@2.7.4: {}
+
   postcss@8.4.31:
     dependencies:
       nanoid: 3.3.12
@@ -5691,6 +5721,11 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  resend@6.12.4:
+    dependencies:
+      postal-mime: 2.7.4
+      standardwebhooks: 1.0.0
+
   resolve-from@4.0.0: {}
 
   resolve-pkg-maps@1.0.0: {}
@@ -5806,6 +5841,11 @@ snapshots:
 
   stackback@0.0.2: {}
 
+  standardwebhooks@1.0.0:
+    dependencies:
+      '@stablelib/base64': 1.0.1
+      fast-sha256: 1.3.0
+
   std-env@4.1.0: {}
 
   string-width@4.2.3: