amadan
worktree-tenant-email-senders
Answers discussions #147 and #148 with one idea: the sender. A sender owns a From address, a credential, a cap, a pause and its own counts. Its scope is the app or one instance of it, and its source is either a domain CARLOS verified or an address under an SES identity CARLOS does not own.
This branch carries the design, five plans, and the code for plan 2 of 5.
Plan 2 is built: the sender record, the migration from email.json to email/senders/app.json with a read fallback, one function that owns every AWS name inside IAM's and SES's 64-character bounds, a reverse index from an IAM caller identity back to its sender, SES tenant resource associations, per-sender counts in a new table, and caps, pauses and status keyed per sender. No app gains or loses a capability. The one deliberate behaviour change is that an SES event is now charged to the sender that sent it rather than to every app sharing the domain, and README carries the roll note.
Plans 1 and 3 to 5 are documents, not code. Plan 1 is the SES spike, already run against the live API on 2026-09-15; its answers are in the spec at §4.1 and they changed the design twice. Plan 3 is #147. Plans 4 and 5 are #148, which is what Tito Go needs.
Two things must be true before any of this rolls, both in README and in the spec at §4.2: the control-plane role needs ses:CreateTenantResourceAssociation and ses:DeleteTenantResourceAssociation, and every domain provisioned before this release has no tenant association and nothing will create one, so a backfill is needed before any release that sends with a tenant header.
Discussions
- No discussions on this branch yet.
Tasks 5/7 done
- Spike: prove the SES tenant facts against the live API Done
- Plan 2: the sender record, migration, names and caller index Done
- Plan 2: per-sender counts, caps, pauses and status Done
- Plan 2: roll note and the two rollout prerequisites Done
- Plan 3 (#147): external identities and address senders Not started
Activity
- task updated: Plan 4 (#148): the per-instance config layer and delivery ack
- task updated: Spike: prove the SES tenant facts against the live API
- task updated: Plan 2: the sender record, migration, names and caller index
- task updated: Plan 2: per-sender counts, caps, pauses and status
- task updated: Plan 2: roll note and the two rollout prerequisites
- claude agent, operated by paul@keymail.dev added task Plan 2: roll note and the two rollout prerequisites
- claude agent, operated by paul@keymail.dev added task Plan 3 (#147): external identities and address senders
- claude agent, operated by paul@keymail.dev added task Plan 4 (#148): the per-instance config layer and delivery ack
- claude agent, operated by paul@keymail.dev added task Plan 5 (#148): instance senders, per-instance mode and the doors
- claude agent, operated by paul@keymail.dev added task Spike: prove the SES tenant facts against the live API
- claude agent, operated by paul@keymail.dev added task Plan 2: the sender record, migration, names and caller index
- claude agent, operated by paul@keymail.dev added task Plan 2: per-sender counts, caps, pauses and status