coulomb/email-connect
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Draft the inactive user-engine caller policy.
Some checks failed
Transactional mail acceptance / mail (push) Failing after 33s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
The draft names the live registration binding and quotas, and records that current invitation envelopes are still denied. Ledger tasks stay waiting on pair custody.

Assistant: grok
Assistant-Session: 01a11cdb-f9fe-7011-947c-936e72007e54
This commit is contained in:
tegwick 2026-10-08 21:28:07 +02:00
parent 48823c8182
commit a60a729421
5 changed files with 199 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

42
docs/caller-policy-draft-2026-10-08.md Normal file
View file

@ -0,0 +1,42 @@
# User-engine caller policy draft — 2026-10-08
This file proposes the only caller that exists today. It is not mounted,
`EMAIL_CONNECT_CALLERS_FILE` is not set, and no token file was created.
EMAIL-WP-0008-T03 stays waiting until the bindings, quotas and token custody
are approved.
Source: `config/callers.user-engine.draft.json`.
## What the live caller does
user-engine sends invitation mail to `/v1/send` with source `user-engine` and
templates `family_member.invited` or `family_invitation.resent`. It reads
`/v1/status` and `/v1/delivery-status`. Registration uses
`/v1/registration-verifications`, consume and cancel. The live registration
allow-list is tenant `tenant:coulomb` and client `coulomb-social`
(`USER_ENGINE_REGISTRATION_TENANTS` / `USER_ENGINE_REGISTRATION_CLIENTS` in
`net-kingdom/sso-mfa/k8s/user-engine/runtime.yaml`). Mail and verification
share the current `user-engine-delivery` `mail-token`. Suppression is not a
user-engine operation and is omitted.
## Proposed limits
`rate_per_minute` 10 matches the live registration limit of 10 requests per
60 seconds. Burst 5 and an 8 KiB payload cap are below the receiver ceilings
(6000/minute, 600 burst, 128 KiB). They are proposals, not an approved quota.
`adopt_legacy_verifications` is proposed so this original caller can still
consume verification rows written before caller ids existed.
## Gap that blocks activation
Current invitation envelopes carry `tenant` and do not carry `client_id`.
Scoped send accepts a binding only when both fields are present and admitted,
or when both are absent and `legacy_invitation_binding` is set. A tenant
without a client id is denied. Family invitations also use tenants other than
`tenant:coulomb`. This draft therefore does not claim to carry current
invitation traffic. Activation needs a user-engine change that sends an
admitted tenant/client pair, or a separate reviewed contract change.
The token path in the draft does not exist. Selecting this file on the
running receiver would fail startup before serving traffic. Do not copy the
shared ingest token into that path as part of this draft.