GovOPlaN/govoplan-mail
1
0
Fork 0
Code Issues 10 Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add durable mail delivery outbox

Browse Source
This commit is contained in:
Albrecht Degering
2026-07-30 14:26:53 +02:00
parent dec5a4e350
commit b8029c24d6
13 changed files with 1913 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
docs/MAIL_HANDBOOK.md
View File

@@ -82,10 +82,20 @@ effect.
### Provider outcomes
SMTP acceptance, recipient refusal, temporary/permanent failure, connection
loss, and unknown outcome are distinct. IMAP append is a separate operation and
outcome. Mail returns a sanitized transport result; the consuming domain owns
the durable business job and its retry/reconciliation semantics.
SMTP acceptance, partial or complete recipient refusal, temporary/permanent
failure, connection loss, and unknown outcome are distinct. IMAP append is a
separate operation and outcome. Ordinary Campaign recipient delivery retains
its Campaign-owned job ledger. Mail owns an encrypted durable command and
attempt ledger for report delivery and other effects that do not have such a
consumer ledger.
The Mail worker commits an attempt before it starts SMTP and then commits an
effect-start marker before opening the provider effect. Worker redelivery may
recover a stale pre-effect claim, but an accepted, partially accepted,
in-progress-after-effect, or unknown command is never sent automatically.
Unknown outcomes require a separately authorized reconciliation with an
external evidence reference. A deliberate resend creates a new command with a
new idempotency key and links it to the prior command.
## User tasks
@@ -354,11 +364,11 @@ Security invariants:
Credential replacement/deletion emits canonical non-secret Mail audit events.
Profile/policy create/update/deactivate currently emits change-feed evidence,
but connection tests and the complete administrative lifecycle do not yet have
equivalent canonical audit events. Consumer send/retry/reconciliation evidence
belongs primarily to the consuming module today. A Mail-owned restricted
provider-attempt ledger with correlation, retention, and unknown-outcome
reconciliation remains part of the durable outbox work in
[`govoplan-mail#17`](https://git.add-ideas.de/GovOPlaN/govoplan-mail/issues/17).
equivalent canonical audit events. Mail delivery commands emit request,
terminal-outcome, reconciliation, and deliberate-resend events without
addresses or raw provider responses. MIME, envelope addresses, detailed
refusals, and reconciliation notes are encrypted and minimized after their
retention deadline while hashes, counts, attempts, and decisions remain.
## Acceptance checklist