Complete procedures with a way back.

Create a production-oriented GitHub App that verifies webhook signatures, deduplicates deliveries, obtains short-lived installation authentication, proposes labels and duplicate candidates, and requires a named human to approve every external label write.

Build a single-mailbox production reference that incrementally reads Gmail, classifies untrusted messages, treats attachments as quarantined metadata, prepares bounded reply proposals, and creates—but never sends—a Gmail draft only after an identified reviewer approves the exact proposal.