carlos / platform Public

Fixes items 1 and 2 of #216. Item 3 (shared SES reputation) is a design decision and is left open.

What changes

1. No adoption of identities this account did not create. EnsureIdentity takes adopt; without it, an existing identity is refused untouched. EnsureDomain reuses an existing identity only in two cases: the account's record already names it (re-runs, sibling apps, legacy records), or the claim says this account's walk created it (identity_regions, stamped right after create). Anything else needs proof of DNS control: TXT _carlos-mail.<domain> = carlos-mail-account=<acct>, checked through Deployment.Resolver (net.DefaultResolver in cmd/console; nil always refuses). An unproven refusal releases a claim with no record behind it. A proven adoption is recorded as adopted. - Deletion is created-only everywhere. Teardown, domains rm and both orphan sweeps delete an SES identity only when the claim's identity_regions says this account's walk created it. Adopted identities and identities whose claim another account now holds are left in SES. So are identities behind records written before this change. Such a record may have adopted a foreign identity (the #216 attack on main, or an operator domain shared with another product), and nothing on it says which. Only this account's tenant association is removed.
2. Unverified claims lapse. Another account can take a claim older than 7 days (ClaimLapse) if nothing says it was ever verified: not the claim's new verified_at stamp, not the holder's record, and not SES's live status. The claim moves first, under CAS against the etag the lapse was judged on. A holder that verifies in between moves the etag via verified_at, so the takeover fails and the holder keeps everything. After the move, the lapsed holder's half-made identity is deleted only if its claim says its walk created it and SES, asked again, still hasn't verified it. Otherwise the new holder needs proof. The stale record of the lapsed holder can no longer verify or delete anything. The claimed 409 now reads as the neutral "sending domain unavailable". The foreign-identity 409 names the TXT record to publish.

Wire shape: additive only. New fields are omitempty (identity_regions, verified_at on claims; adopted on region state). Schema is unchanged.

Tests: internal/mail/walk_identityowner_test.go covers:

• refusal without mutation
• wrong and right proof
• teardown sparing an adopted identity
• own identity after a crash
• legacy record: verify works, teardown leaves the identity
• legacy adopting record plus domains rm: the identity survives
• lapse windows; a verified claim and an SES-verified claim do not lapse
• the lapsed holder's verify and teardown
• a holder that verifies mid-takeover keeps claim and identity

There are also provisioner-level adopt tests (aws stub and MemProvisioner) and a console 409 test. No AWS calls.

Gates: gofmt is clean; build and vet pass. Tests pass for mail, console, cmd/console and the root email CLI tests. make test fails only on known environment failures that also fail on main: socket path length, and the root package reading ~/.carlos/config.

Known limits / roll notes

• Identities behind pre-change records and pre-change orphaned claims are no longer deleted. They leak, which is the safe direction. An operator can clean them up.
• Legacy pinned claim: claimLapsed treats SES verified status as "holder verified" even when someone else verified the identity. So a legacy claim with no record whose domain is verified in SES outside CARLOS never lapses. An operator fixes it by releasing the claim object.
• A crash between a lapse takeover's CAS and its delete leaves the old identity in place, so the new holder needs proof.
• An identity adopted via proof stays in SES after teardown.
• No new IAM actions are needed.