# User-engine caller policy draft — 2026-10-08

This file proposes the only caller that exists today. It is not mounted,
`EMAIL_CONNECT_CALLERS_FILE` is not set, and no token file was created.
EMAIL-WP-0008-T03 stays waiting until the bindings, quotas and token custody
are approved.

Source: `config/callers.user-engine.draft.json`.

## What the live caller does

user-engine sends invitation mail to `/v1/send` with source `user-engine` and
templates `family_member.invited` or `family_invitation.resent`. It reads
`/v1/status` and `/v1/delivery-status`. Registration uses
`/v1/registration-verifications`, consume and cancel. The live registration
allow-list is tenant `tenant:coulomb` and client `coulomb-social`
(`USER_ENGINE_REGISTRATION_TENANTS` / `USER_ENGINE_REGISTRATION_CLIENTS` in
`net-kingdom/sso-mfa/k8s/user-engine/runtime.yaml`). Mail and verification
share the current `user-engine-delivery` `mail-token`. Suppression is not a
user-engine operation and is omitted.

## Proposed limits

`rate_per_minute` 10 matches the live registration limit of 10 requests per
60 seconds. Burst 5 and an 8 KiB payload cap are below the receiver ceilings
(6000/minute, 600 burst, 128 KiB). They are proposals, not an approved quota.
`adopt_legacy_verifications` is proposed so this original caller can still
consume verification rows written before caller ids existed.

## Gap that blocks activation

Current invitation envelopes carry `tenant` and do not carry `client_id`.
Scoped send accepts a binding only when both fields are present and admitted,
or when both are absent and `legacy_invitation_binding` is set. A tenant
without a client id is denied. Family invitations also use tenants other than
`tenant:coulomb`. This draft therefore does not claim to carry current
invitation traffic. Activation needs a user-engine change that sends an
admitted tenant/client pair, or a separate reviewed contract change.

The token path in the draft does not exist. Selecting this file on the
running receiver would fail startup before serving traffic. Do not copy the
shared ingest token into that path as part of this draft.