ADHOC-2026-10-09-T02: draft USER_ENGINE_MAIL_CLIENT_BINDINGS deployment value

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 445231@bnt-lap001
Assistant-Session: 024a807e-0cc5-4f2c-bc8a-b83322d1395d

workplans/ADHOC-2026-10-09.md

@@ -43,3 +43,33 @@ never carry `client_id`; `make test` and `make check-layer` pass.
 
 Not done here: activation. Deploy config, email-connect caller admission
 (EMAIL-WP-0008-T03) and token custody stay with their owners and the founder.
+
+## Draft the deployment binding value
+
+```task
+id: USER-WP-ADHOC-2026-10-09-T02
+status: done
+priority: medium
+```
+
+Draft only, not applied. When email-connect admits the user-engine caller
+(EMAIL-WP-0008-T03), add this to the user-engine container env in
+`net-kingdom/sso-mfa/k8s/user-engine/runtime.yaml`, next to
+`USER_ENGINE_MAIL_URL`:
+
+```yaml
+- name: USER_ENGINE_MAIL_CLIENT_BINDINGS
+  value: '[["tenant:coulomb","coulomb-social"],["tenant:*-family","coulomb-social"],["tenant:family-*","coulomb-social"]]'
+```
+
+It mirrors `bindings` plus `binding_patterns` in email-connect
+`config/callers.user-engine.draft.json` one-to-one. Both sides match with
+case-sensitive whole-string `fnmatchcase`, so user-engine sends only pairs the
+receiver admits. Checked with the loader: `tenant:coulomb`,
+`tenant:worsch-family` and `tenant:family-*` resolve to `coulomb-social`;
+`tenant:platform` is denied before either lane.
+
+Order matters. Apply the env var in the same rollout that switches
+`USER_ENGINE_MAIL_TOKEN` to the scoped caller token. Before then the receiver
+runs legacy mode, so leave the variable unset. If either side's patterns change,
+change the other in the same review.