tegwick
a60a729421
The draft names the live registration binding and quotas, and records that current invitation envelopes are still denied. Ledger tasks stay waiting on pair custody. Assistant: grok Assistant-Session: 01a11cdb-f9fe-7011-947c-936e72007e54
2.1 KiB
User-engine caller policy draft — 2026-10-08
This file proposes the only caller that exists today. It is not mounted,
EMAIL_CONNECT_CALLERS_FILE is not set, and no token file was created.
EMAIL-WP-0008-T03 stays waiting until the bindings, quotas and token custody
are approved.
Source: config/callers.user-engine.draft.json.
What the live caller does
user-engine sends invitation mail to /v1/send with source user-engine and
templates family_member.invited or family_invitation.resent. It reads
/v1/status and /v1/delivery-status. Registration uses
/v1/registration-verifications, consume and cancel. The live registration
allow-list is tenant tenant:coulomb and client coulomb-social
(USER_ENGINE_REGISTRATION_TENANTS / USER_ENGINE_REGISTRATION_CLIENTS in
net-kingdom/sso-mfa/k8s/user-engine/runtime.yaml). Mail and verification
share the current user-engine-delivery mail-token. Suppression is not a
user-engine operation and is omitted.
Proposed limits
rate_per_minute 10 matches the live registration limit of 10 requests per
60 seconds. Burst 5 and an 8 KiB payload cap are below the receiver ceilings
(6000/minute, 600 burst, 128 KiB). They are proposals, not an approved quota.
adopt_legacy_verifications is proposed so this original caller can still
consume verification rows written before caller ids existed.
Gap that blocks activation
Current invitation envelopes carry tenant and do not carry client_id.
Scoped send accepts a binding only when both fields are present and admitted,
or when both are absent and legacy_invitation_binding is set. A tenant
without a client id is denied. Family invitations also use tenants other than
tenant:coulomb. This draft therefore does not claim to carry current
invitation traffic. Activation needs a user-engine change that sends an
admitted tenant/client pair, or a separate reviewed contract change.
The token path in the draft does not exist. Selecting this file on the running receiver would fail startup before serving traffic. Do not copy the shared ingest token into that path as part of this draft.