---
id: NET-IN-0005
kind: intake
title: "Expose a recipient-bound opaque delivery handoff for provider password setup"
status: open
flavor: implementation
origin: cross-repo
origin_ref: USER-WP-0035-T02
priority: high
owner: net-kingdom
repo: net-kingdom
requested_by: user-engine
created: "2026-10-11"
updated: "2026-10-11"
related: [EMAIL-IN-0001, NK-WP-0047]
---

The identity-provisioner currently generates `password_setup_url` in the
provision response. `PasswordSetupGrants` has a 900-second default lifetime,
stores only a digest, revokes the prior grant on reissue, invalidates grants on
restart and consumes before applying the password. The URL reaches User Engine's
provider-owned setup screen; there is no supported issuer-to-mail delivery
operation. Existing NK-WP-0047 proves Authelia reset-mail delivery and personal
sign-in, not this separate identity-provisioner setup grant.

Prepare the provider side of the fixed email-connect capability requested in
EMAIL-IN-0001. Return an exact owner implementation work record and public
handoff contract. User Engine should receive a non-secret opaque receipt with
provider/request identity, expiry and accepted/uncertain/rejected status; the
single-use bearer URL should go directly from the issuer through the reviewed
recipient-bound delivery actuator. Do not add an OpenBao client, directory
credential, mailbox-admin token or password setter to User Engine.

Bind delivery to the provider-authoritative subject/recipient and the approved
user/tenant lifecycle intent. Preserve existing authenticated provisioning and
PDP admission; a successful mail request is not new authorization. Define stable
request identity and behavior on duplicate, provider timeout, restart, reissue,
cancel and recipient mismatch. A retry must not silently issue a new grant and
invalidate the message the intended person already received. Keep the grant
single-use, expiring and provider-owned; no raw link in durable application
outboxes, audit events or work records.

Publish synthetic and owner-reviewed native evidence for the exact handoff,
private intended-person receipt and setup completion separately. Do not claim
that invitation acceptance, registration mailbox verification or Authelia's
completed reset journey proves this path. No live changes, mail, credential or
setup-grant reads occurred in this request. This is owner preparation first,
not a per-item founder approval question or a founder-ready attended command.