email-connect/workplans/EMAIL-WP-0006-verification-retry-safety.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	state_hub_workstream_id
EMAIL-WP-0006	workplan	Make registration verification delivery retry safe	infotech	email-connect	finished	codex	netkingdom	2026-10-07	2026-10-07	13fcc1a2-7b86-5c80-96ac-310ef08fedb9

Repeated verification requests currently mint and send another challenge, even when SMTP may already have accepted the previous message. CSOC-WP-0010-T04 identified this on source 73702b7 using synthetic requests. This workplan owns that correction; it does not admit new callers or change SMTP sender custody.

T01 — Reserve verification operations durably

id: EMAIL-WP-0006-T01
status: done
priority: high
state_hub_task_id: "6f5a70f5-b301-5cc7-9472-8bd7a9417217"

Implemented additive SQLite verification_attempts. Tenant/client/registration identity defines the operation; immutable applicant fields define its fingerprint. Correlation ID is tracing metadata and can change on retry. Reserve challenge and operation atomically before SMTP. Accepted replay returns the same request receipt. Unknown outcomes are terminal for automatic retry; only definitive retryable non-acceptance permits a new challenge, invalidating the old one. Legacy challenges remain usable and conservatively block another send. Consume/cancel use SQLite write transactions across independent connections. Plaintext handles remain only in mail, never in SQLite or HTTP receipts.

T02 — Prove failure, restart and SMTP mailbox behavior

id: EMAIL-WP-0006-T02
status: done
priority: high
state_hub_task_id: "e51ebecf-14e7-5f4d-8517-6ceb5fbe635f"

39 transactional cases pass, including separate-connection concurrency, restart, post-acceptance evidence failure, binding mutation, legacy challenge, definitive deferral/permanent refusal, consumption and cancellation. The existing real loopback SMTP/IMAP verification journey now retries after a store restart and requires exactly one mailbox message. Full repository suite with the pinned GreenMail harness running: 101 passed, zero skips. The synthetic SMTP/IMAP journey confirmed one message after restart and retry. Harness container/network were removed after validation.

T03 — Release the immutable candidate under a separate live gate

id: EMAIL-WP-0006-T03
status: done
priority: high
needs_human: false
decision_id: "8da41538-8482-4c72-b83d-e0fce1b662f0"
state_hub_task_id: "fcf55c0a-49b5-53a8-9497-3dfcc18c3828"

Prepare immutable image, live digest/headroom observation and exact image-only diff; capture SQLite consistently before release; use deployment owner path and preserve delivery/challenge records. Founder activation is required for this new live change. Do not rollback to old verification code with sending enabled: it ignores the new reservation table. Stop sending first and reconcile unknown operations. Platform sender/caller admission remains CSOC-WP-0010-T04/T05.

T04 — Retire the obsolete static ESO bootstrap

id: EMAIL-WP-0006-T04
status: done
priority: medium
state_hub_task_id: "f7c2ff5b-c012-5ed2-9a42-ed44f3bb314e"

Owner inbox records RPF-WP-0045 Kubernetes-auth recovery and retirement request 9d63cf96-333c-4142-a517-aa2633ae52eb. Bootstrap now fails closed without touching credentials or Kubernetes; the obsolete template contains only its retirement pointer. Documented package apply does not recreate the platform-owned store. No live custody change was made.

2026-10-07 candidate prepared: source7258505, published digest1e613d43734c44c5cd32c6083fda8b4da5d01ef43d10c6ca9c29a33c788cf75c; UID10001 network-disabled packaged smoke and exact live/server dry-run pass. 2026-10-07 live release completed after founder's Ok, go ahead, decision8da41538-8482-4c72-b83d-e0fce1b662f0 resolved. Digest1e613d43 is live, one Ready replica, health200, unauth401, authenticated template/invalid request400, SQLite integrity and new reservation schema verified. No mail sent by validation. Quiesced private SQLite backup40960 bytes/hash3b465106 passes isolated UID10001 network-disabled migration rehearsal, preserving rows in all four old tables. Initial probe omitted service token normalization and raised ValueError locally; sending was held stopped during correction. Fixed probe passes; final Ready20:33:16Z, release window227s, zero helper pods remain. Private backups are retained on node/workstation under0700/0600; receipt in the release review.

Residuals handed off BEFORE finish to existing live CSOC-WP-0010-T04 (ca41be06-3611-5647-b469-4f89f56f77f9): caller/tenant/template permissions, per-caller limits, platform sender custody and reservation-ledger recovery. CSOC-WP-0010-T05 (d9e165d9-dd0b-54c2-bda1-bd314b999b5b) owns inbox/reply/bounce operations and retention/custody of evidence and temporary private copies. CSOC-WP-0010-T06 (97a2da91-debe-5ce2-9b68-1965a5c5abfe) retains cross-owner browser/user acceptance. Parent source0dcca9e and its primary consistency sync record these live handoffs; neither parent workplan is marked finished.