diff --git a/.planning/quick/260721-n49-fix-classifier-mimecast-tenant-scope/260721-n49-PLAN.md b/.planning/quick/260721-n49-fix-classifier-mimecast-tenant-scope/260721-n49-PLAN.md
new file mode 100644
index 0000000..100463e
--- /dev/null
+++ b/.planning/quick/260721-n49-fix-classifier-mimecast-tenant-scope/260721-n49-PLAN.md
@@ -0,0 +1,186 @@
+---
+phase: quick-260721-n49
+plan: 01
+type: execute
+wave: 1
+depends_on: []
+files_modified:
+ - lib/services/campaign-classifier.ts
+ - lib/services/campaign-classifier.test.ts
+autonomous: true
+requirements: [FIX-CLASSIFIER-TENANT]
+
+must_haves:
+ truths:
+ - "gatherCampaignEvidence() resolves the reporting company's own Mimecast tenant before calling getBlastRadius() when an enabled mimecast_tenants row exists for that company"
+ - "When the reporting company has no enabled mimecast_tenants row (or no companyId), getBlastRadius() is still called with no second argument — global env fallback preserved, unchanged from today"
+ - "getBlastRadius receives a tenant-scoped client + cacheScope matching the companyId for companies that have their own tenant row"
+ artifacts:
+ - path: "lib/services/campaign-classifier.ts"
+ provides: "Per-company Mimecast tenant resolution in the auto-classification evidence path"
+ contains: "getMimecastClientForTenant"
+ - path: "lib/services/campaign-classifier.test.ts"
+ provides: "Coverage for both tenant-scoped and global-fallback blast-radius calls"
+ contains: "mimecast_tenants"
+ key_links:
+ - from: "lib/services/campaign-classifier.ts gatherCampaignEvidence()"
+ to: "mimecast_tenants table"
+ via: "postgresClient.query WHERE company_id = $1 AND enabled = true"
+ pattern: "mimecast_tenants[\\s\\S]*company_id = \\$1 AND enabled = true"
+ - from: "lib/services/campaign-classifier.ts gatherCampaignEvidence()"
+ to: "getBlastRadius second argument"
+ via: "{ client, cacheScope } tenant options"
+ pattern: "getBlastRadius\\([\\s\\S]*cacheScope"
+---
+
+
+Fix `gatherCampaignEvidence()` in `lib/services/campaign-classifier.ts` so the automatic campaign classifier queries the reporting company's OWN Mimecast tenant (from `mimecast_tenants`) before calling `getBlastRadius()`, instead of always falling back to the global env-configured (Wulf) Mimecast client.
+
+Purpose: `classifyCampaign()` runs automatically on ticket creation/webhook and persists verdict+confidence to `classifications`. Today, any company with its own `mimecast_tenants` row has its auto-classification computed against the WRONG tenant's Mimecast data — a silent, systemic false-"clean" signal (verified live against ticket 700716 / company 29683407 "Seubert and Associates"). The correct, already-shipped, already-tested pattern lives in `app/api/phishing/campaigns/[id]/route.ts` (marked "Bug 2 (D-05)") — mirror it, do not invent a new one.
+
+Output: `gatherCampaignEvidence()` threads `company_id` through and resolves a per-company tenant client exactly as the route does; tests cover both the tenant-scoped and global-fallback branches.
+
+
+
+@$HOME/.claude/get-shit-done/workflows/execute-plan.md
+@$HOME/.claude/get-shit-done/templates/summary.md
+
+
+
+@.planning/STATE.md
+
+The file to fix (evidence-gathering path only):
+@lib/services/campaign-classifier.ts
+
+The ALREADY-CORRECT reference to mirror (tenant-resolution block, roughly lines 256-313, "Bug 2 (D-05)"):
+@app/api/phishing/campaigns/[id]/route.ts
+
+
+
+
+From lib/services/mimecast-client.ts:
+```typescript
+export function getMimecastClientForTenant(tenant: {
+ client_id: string;
+ client_secret: string;
+ base_url?: string;
+}): MimecastClient;
+```
+
+From lib/services/mimecast-blast-radius.ts:
+```typescript
+export async function getBlastRadius(
+ input: { sender: string; recipient: string; subject: string; dateWindow: { start: Date; end: Date } },
+ options?: { client?: MimecastClient; cacheScope?: string }
+): Promise;
+// When options is omitted, falls back to the global env-configured getMimecastClient()
+// (gated by isMimecastConfigured()). This is the current classifier behavior for ALL companies.
+```
+
+The exact tenant row shape + query used by the route (mirror verbatim):
+```typescript
+interface MimecastTenantRow {
+ client_id: string;
+ client_secret: string;
+ base_url: string | null;
+}
+// SELECT client_id, client_secret, base_url
+// FROM mimecast_tenants
+// WHERE company_id = $1 AND enabled = true
+// ORDER BY id LIMIT 1
+```
+
+Route's tenantOptions build (mirror verbatim in the classifier):
+```typescript
+let tenantOptions: { client: ReturnType; cacheScope: string } | undefined;
+if (primaryReport.companyId) {
+ const tenantRes = await postgresClient.query(/* query above */, [primaryReport.companyId]);
+ const tenantRow = tenantRes.rows[0];
+ if (tenantRow) {
+ tenantOptions = {
+ client: getMimecastClientForTenant({
+ client_id: tenantRow.client_id,
+ client_secret: tenantRow.client_secret,
+ base_url: tenantRow.base_url ?? undefined,
+ }),
+ cacheScope: primaryReport.companyId,
+ };
+ }
+}
+```
+
+
+
+
+
+
+ Task 1: Resolve per-company Mimecast tenant in gatherCampaignEvidence()
+ lib/services/campaign-classifier.ts
+
+ - When primaryReport.companyId is set AND an enabled mimecast_tenants row exists for it: getBlastRadius is called with a second argument { client, cacheScope: companyId } where client was built via getMimecastClientForTenant using that row's client_id/client_secret/base_url.
+ - When primaryReport.companyId is null/empty: getBlastRadius is called with NO second argument (global fallback — unchanged from today).
+ - When primaryReport.companyId is set but no enabled tenant row exists: getBlastRadius is called with NO second argument (global fallback — unchanged from today).
+ - When the campaign has no linked reports: blastRadius is still synthesized as { status: 'unavailable', reason: 'not_configured' } without any Mimecast or tenant lookup (unchanged).
+
+
+ Mirror the route's "Bug 2 (D-05)" tenant-resolution block. Do NOT invent a new pattern and do NOT touch computeConfidence() semantics or the blast-radius query-scope (the recipient param is already handled by task 260721-mmf — leave it).
+
+ 1. Add `import { getMimecastClientForTenant } from './mimecast-client';` (relative sibling import — this file already imports getBlastRadius from './mimecast-blast-radius' the same way).
+ 2. Add a local `MimecastTenantRow` interface matching the route's shape ({ client_id: string; client_secret: string; base_url: string | null }).
+ 3. Extend the `ReportDbRow` interface with `company_id: string | null` and add `r.company_id::text AS company_id` to the reports SELECT list in gatherCampaignEvidence().
+ 4. Extend `CampaignReportSummary` with `companyId: string | null` and set it in the `reportsRes.rows.map(...)` mapping (`companyId: r.company_id`).
+ 5. Inside the `if (primaryReport) { ... }` branch, BEFORE the `getBlastRadius(...)` call, build `tenantOptions` exactly as the route does: if `primaryReport.companyId` is truthy, query `mimecast_tenants` (`WHERE company_id = $1 AND enabled = true ORDER BY id LIMIT 1`), and if a row exists, build the client via `getMimecastClientForTenant({ client_id, client_secret, base_url: tenantRow.base_url ?? undefined })` with `cacheScope: primaryReport.companyId`.
+ 6. Pass `tenantOptions` as the second argument to `getBlastRadius(...)`. Keep the existing input object (sender/recipient/subject/dateWindow) untouched. When tenantOptions is undefined, passing it as the second arg is equivalent to today's no-arg call — getBlastRadius already treats `options?.client` and `options?.cacheScope` as optional; the global fallback is preserved.
+
+ Judgment note on the optional shared helper (`resolveMimecastTenantOptions(companyId)`): default to an equivalent inline block in the classifier — it is the safe drop-in and matches the route's own inline style. Only extract a shared helper if it is a clean, behavior-preserving drop-in for BOTH call sites; if extracting would require editing the route's already-correct/already-tested block in any behavior-affecting way, do NOT extract — leave the route alone and keep the classifier's block inline.
+
+ Add a short inline comment tagging this as the same "Bug 2 (D-05)" per-company tenant resolution mirrored from the campaigns/[id] route, so the parity is discoverable.
+
+
+ npx tsc --noEmit --pretty 2>&1 | grep -i campaign-classifier || echo "TSC CLEAN for campaign-classifier"
+
+
+ gatherCampaignEvidence() selects company_id, threads it to primaryReport.companyId, and passes a tenant-scoped { client, cacheScope } to getBlastRadius() when an enabled mimecast_tenants row exists — otherwise calls with no scoping (global fallback). tsc has no new errors in this file.
+
+
+
+
+ Task 2: Extend campaign-classifier tests for tenant resolution vs. global fallback
+ lib/services/campaign-classifier.test.ts
+
+ Extend the existing vitest suite (which mocks `postgresClient` via `queryMock` and `getBlastRadius` via `getBlastRadiusMock`) to cover the two new branches. Match the existing `stageQueries` / SQL-substring-routing discipline — do NOT rewrite the mocking approach.
+
+ 1. In `stageQueries`, add a routing branch for the tenant lookup: `if (sql.includes('FROM mimecast_tenants'))` returns a staged tenant row array (default empty). Add an optional `mimecastTenants?: Array<{ client_id: string; client_secret: string; base_url: string | null }>` field to the `StagedRows` interface and route it through. Order the branch so it does not collide with the existing `FROM reports` / `FROM messages` / `FROM indicators` checks (the mimecast_tenants SQL contains none of those substrings, so any position before the final throw works).
+ 2. Add `company_id` to the `ReportFixtureRow` interface (`company_id: string | null`) and include it in the report fixtures used by the two new tests.
+ 3. New test A (tenant-scoped): stage a report with `company_id: '29683407'` and an enabled `mimecastTenants` row (`client_id`, `client_secret`, `base_url`). After `classifyCampaign('campaign-1')`, assert `getBlastRadiusMock` was called with a second argument whose `cacheScope === '29683407'` and whose `client` is defined (truthy). Assert the tenant SQL was actually issued (a queryMock call whose SQL includes `FROM mimecast_tenants` and `company_id = $1 AND enabled = true`).
+ 4. New test B (global fallback preserved): stage a report whose company has NO enabled tenant row — cover both sub-cases in one or two tests: (b1) `company_id: null`, and (b2) `company_id` set but `mimecastTenants: []`. After classify, assert `getBlastRadiusMock` was called with either exactly one argument or a second argument of `undefined` (i.e. no tenant scoping) — inspect `getBlastRadiusMock.mock.calls[0]` and assert `calls[0][1]` is `undefined`.
+ 5. Keep existing tests green — the current report fixtures omit `company_id`; ensure the added interface field is optional-compatible or updated in-place so existing `stageQueries` calls still typecheck (prefer making `company_id` present on fixtures, or `string | null` with existing rows getting `company_id: null`).
+
+ Do not use real Mimecast/Postgres — everything stays mocked, same as the existing file.
+
+
+ npm test -- campaign-classifier 2>&1 | tail -20
+
+
+ New tests assert: (a) a company WITH an enabled mimecast_tenants row → getBlastRadius called with { client, cacheScope: companyId }; (b) a company with NO enabled tenant row (null companyId AND empty-tenant cases) → getBlastRadius called with no second argument. All existing campaign-classifier tests still pass.
+
+
+
+
+
+
+- `npx tsc --noEmit --pretty` reports no new errors.
+- `npm test -- campaign-classifier` passes, including the two new branch tests.
+- Manual re-read confirms the classifier's tenant-resolution block is a behavior-parity mirror of `app/api/phishing/campaigns/[id]/route.ts` (same query, same `getMimecastClientForTenant` build, same `{ client, cacheScope }` shape), and that the route file was not changed in a behavior-affecting way (only touched if a clean shared-helper extraction was possible).
+
+
+
+- Auto-classification (`classifyCampaign` → `gatherCampaignEvidence`) queries the reporting company's own Mimecast tenant when one exists, matching the live blast-radius display path.
+- Global env fallback is preserved unchanged for companies without an enabled `mimecast_tenants` row and for reports without a companyId.
+- No change to confidence semantics or the already-shipped query-scope fix (260721-mmf).
+- Tests prove both branches.
+
+
+