Method emitBlockedOutbound

internal/agent/screening.go:292–307

emitBlockedOutbound fires the fire-and-forget email.blocked event for an outbound send refused by screening (applied action = block). messageID is the stable soft-ref (blockAuditID) since no message row is persisted, so the deterministic id keeps retries idempotent. reason_source mirrors the protect

(agent *identity.AgentIdentity, messageID string, req outbound.SendRequest, v outboundVerdict)

// keeps retries idempotent. reason_source mirrors the protection_events vocabulary
// (recipient_gate / outbound_scan).
func (a *API) emitBlockedOutbound(agent *identity.AgentIdentity, messageID string, req outbound.SendRequest, v outboundVerdict) {
	e := webhookpub.NewEvent(webhookpub.EventEmailBlocked, agent.UserID, map[string]interface{}{
		"message_id":    messageID,
		"agent":         map[string]interface{}{"id": agent.ID, "email": agent.EmailAddress(), "domain": agent.Domain},
		"direction":     "outbound",
		"recipients":    allRecipients(req),
		"subject":       req.Subject,
		"reason":        v.Reason,
		"reason_source": v.ReviewReason,
	})
	e.AgentID = agent.ID
	e.ConversationID = req.ConversationID
	e.MessageID = messageID
	e.ID = webhookpub.DeterministicEventID(messageID, webhookpub.EventEmailBlocked)
	a.publishAsync(e)
}