feat: harden shared platform contracts

src/govoplan_core/celery_app.py

@@ -20,6 +20,7 @@ from govoplan_core.core.events import (
     publish_platform_event,
 )
 from govoplan_core.core.module_management import load_startup_enabled_modules, startup_candidate_module_ids
+from govoplan_core.core.mail import CAPABILITY_MAIL_DELIVERY_OUTBOX, MailDeliveryOutboxProvider
 from govoplan_core.core.modules import ModuleContext
 from govoplan_core.core.notifications import CAPABILITY_NOTIFICATIONS_DISPATCH, NotificationDispatchProvider
 from govoplan_core.core.postbox import (
@@ -51,6 +52,8 @@ celery.conf.update(
         "govoplan.campaigns.append_sent": {"queue": "append_sent"},
         "govoplan.notifications.deliver": {"queue": "notifications"},
         "govoplan.notifications.deliver_pending": {"queue": "notifications"},
+        "govoplan.mail.dispatch_outbox": {"queue": "mail"},
+        "govoplan.mail.purge_outbox": {"queue": "mail"},
         "govoplan.calendar.dispatch_outbox": {"queue": "calendar"},
         "govoplan.dataflow.dispatch_runs": {"queue": "dataflow"},
         "govoplan.dataflow.purge_runs": {"queue": "dataflow"},
@@ -69,6 +72,16 @@ celery.conf.update(
             "schedule": 60.0,
             "args": (None, 100),
         },
+        "mail-outbox-every-five-seconds": {
+            "task": "govoplan.mail.dispatch_outbox",
+            "schedule": 5.0,
+            "args": (None, 25),
+        },
+        "mail-outbox-retention-daily": {
+            "task": "govoplan.mail.purge_outbox",
+            "schedule": 24 * 60 * 60.0,
+            "args": (250,),
+        },
         "dataflow-triggers-every-minute": {
             "task": "govoplan.dataflow.dispatch_triggers",
             "schedule": 60.0,
@@ -151,6 +164,16 @@ def _calendar_outbox() -> CalendarOutboxProvider | None:
     return capability
 
 
+def _mail_delivery_outbox() -> MailDeliveryOutboxProvider | None:
+    registry = _platform_registry()
+    if not registry.has_capability(CAPABILITY_MAIL_DELIVERY_OUTBOX):
+        return None
+    capability = registry.require_capability(CAPABILITY_MAIL_DELIVERY_OUTBOX)
+    if not isinstance(capability, MailDeliveryOutboxProvider):
+        raise RuntimeError("Mail delivery outbox capability is invalid")
+    return capability
+
+
 def _dataflow_trigger_dispatcher(
     registry: PlatformRegistry | None = None,
 ) -> DataflowTriggerDispatcher | None:
@@ -265,6 +288,51 @@ def deliver_pending_notifications(self, tenant_id: str | None = None, limit: int
         return result
 
 
+@celery.task(name="govoplan.mail.dispatch_outbox", bind=True, max_retries=0)
+def dispatch_mail_outbox(
+    self,
+    tenant_id: str | None = None,
+    limit: int = 25,
+):
+    """Drain durable Mail commands; retry and reconciliation live in Mail."""
+
+    from govoplan_core.db.session import get_database
+
+    with get_database().SessionLocal() as session:
+        provider = _mail_delivery_outbox()
+        if provider is None:
+            return {
+                "selected": 0,
+                "accepted": 0,
+                "partially_refused": 0,
+                "retrying": 0,
+                "failed": 0,
+                "outcome_unknown": 0,
+                "command_ids": [],
+            }
+        return dict(
+            provider.dispatch_due(
+                session,
+                tenant_id=tenant_id,
+                limit=limit,
+                worker_id=getattr(self.request, "hostname", None),
+            )
+        )
+
+
+@celery.task(name="govoplan.mail.purge_outbox", bind=True, max_retries=0)
+def purge_mail_outbox(self, limit: int = 250):
+    """Minimize expired Mail payloads while retaining delivery evidence."""
+
+    from govoplan_core.db.session import get_database
+
+    with get_database().SessionLocal() as session:
+        provider = _mail_delivery_outbox()
+        if provider is None:
+            return {"purged": 0}
+        return dict(provider.purge_expired(session, limit=limit))
+
+
 @celery.task(name="govoplan.calendar.dispatch_outbox", bind=True, max_retries=0)
 def dispatch_calendar_outbox(self, tenant_id: str | None = None, limit: int = 50):
     """Drain durable Calendar operations; retry timing lives in the database."""