carlos / platform Public

What we want

Jelly runs as an app in two Tito accounts: jam (Tito's own) and stripe (Stripe's). Both should send as jelly@tito.io.

Why carlos email enable --from jelly@tito.io can't do it today

tito.io is already a verified SES identity in the Tito deployment's AWS account (665106592142). Tito Classic owns it and has for years: Easy DKIM SUCCESS, MAIL FROM mail.tito.io, no default configuration set. The tenant-email walk would damage it:

1. EnsureIdentity adopts the existing identity, then rewrites it. PutEmailIdentityMailFromAttributes would move MAIL FROM from mail.tito.io to mail-eu-west-1.tito.io, which has no MX/SPF. That changes bounce handling and SPF alignment for every Classic send from @tito.io.
2. SetIdentityConfigSet binds carlos-<acct> as the identity's DEFAULT configuration set. Every message any system sends from @tito.io would then publish events onto carlos-ses-events. Classic's volume would count against one Jelly account's daily cap and could trip its automatic abuse pause.
3. The domain claim is account-scoped and first-come. Once jam claims tito.io, stripe is refused. If stripe got past that, VerifyDomain would rebind the default configuration set to carlos-bam, and the two accounts would fight over one identity.
4. Teardown calls DeleteIdentity. Disabling email on the claiming app would delete Classic's tito.io identity.

What would make it work (a sketch, your call)

An address-scoped sender under an identity CARLOS does not own:

• No CreateEmailIdentity, PutEmailIdentityMailFromAttributes or SetIdentityConfigSet, and never DeleteIdentity.
• The send policy pins the existing identity ARN plus ses:FromAddress = jelly@tito.io, which SendPolicyJSON already renders.
• Events come from a configuration set named per message (delivered X-SES-CONFIGURATION-SET, or the policy's config-set resource) rather than the identity's default.
• The claim is on the ADDRESS, operator-granted, and more than one account may hold it.

Until then, Jelly can't send as @tito.io on tenant email.

Context

Tenant email was enabled on the Tito deployment on 2026-09-14 (teamtito/carlos-infrastructure#16; CARLOS_MAIL_REGION on the IE console, no platform suffix). The first sending domain is mail.go.tito.io for titogo.