[Reliability] Deliver Campaign reports through a durable Mail outbox #17

New Issue

zemion · 2026-07-21T16:56:52+02:00

zemion commented

2026-07-21 16:56:52 +02:00

Outcome

Campaign report delivery is requested once through a Mail-owned durable command, survives worker/process failure, cannot be blindly duplicated, and can be reconciled when the provider outcome is unknown. Until this exists, non-dry report email remains fail-closed.

Ownership

Campaign owns report intent/content, authorization, recipient-export policy, and the linked business audit event. Mail owns the delivery command, selected profile use, SMTP effect, provider-facing attempt diagnostics, throttling, retry safety, and reconciliation evidence. Campaign stores a stable command/result reference, not SMTP configuration or raw provider internals.

Acceptance

Submitting the same idempotency key and canonical request returns the same command; conflicting reuse fails.
A worker atomically claims a command and records attempt start before crossing SMTP. Late-ACK redelivery cannot send an in-progress/accepted/unknown command again.
Mail re-authorizes the profile and compares the expected Mail-owned transport revision in the same effect call.
Accepted, partially refused, temporary failure, permanent failure, and outcome unknown remain distinct. Safe refusal classifications are retained per requested recipient.
Unknown outcomes require explicit evidence-backed reconciliation before retry; deliberate resend is a separately authorized/audited command.
Campaign readers see business-safe state only; raw provider diagnostics require Mail diagnostic authority and remain bounded/redacted.
Audit/commit failure after provider acceptance cannot turn the command into ordinary retryable failure.
Retention/minimization for report addresses, generated attachments, provider attempts, and reconciliation notes is defined.
Failure-injection tests cover worker loss before/during/after SMTP, duplicate queue delivery, partial refusal, audit failure, and profile drift.
The report-email API is re-enabled only after the durable path and target-provider acceptance gate pass.

## Outcome Campaign report delivery is requested once through a Mail-owned durable command, survives worker/process failure, cannot be blindly duplicated, and can be reconciled when the provider outcome is unknown. Until this exists, non-dry report email remains fail-closed. ## Ownership Campaign owns report intent/content, authorization, recipient-export policy, and the linked business audit event. Mail owns the delivery command, selected profile use, SMTP effect, provider-facing attempt diagnostics, throttling, retry safety, and reconciliation evidence. Campaign stores a stable command/result reference, not SMTP configuration or raw provider internals. ## Acceptance - Submitting the same idempotency key and canonical request returns the same command; conflicting reuse fails. - A worker atomically claims a command and records attempt start before crossing SMTP. Late-ACK redelivery cannot send an in-progress/accepted/unknown command again. - Mail re-authorizes the profile and compares the expected Mail-owned transport revision in the same effect call. - Accepted, partially refused, temporary failure, permanent failure, and outcome unknown remain distinct. Safe refusal classifications are retained per requested recipient. - Unknown outcomes require explicit evidence-backed reconciliation before retry; deliberate resend is a separately authorized/audited command. - Campaign readers see business-safe state only; raw provider diagnostics require Mail diagnostic authority and remain bounded/redacted. - Audit/commit failure after provider acceptance cannot turn the command into ordinary retryable failure. - Retention/minimization for report addresses, generated attachments, provider attempts, and reconciliation notes is defined. - Failure-injection tests cover worker loss before/during/after SMTP, duplicate queue delivery, partial refusal, audit failure, and profile drift. - The report-email API is re-enabled only after the durable path and target-provider acceptance gate pass.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-mail#17