amadan
tenant email spec: the SMTP password does NOT travel across regions
Found in review of the enable walk. Section 8 claimed 'one credential works across regions'. That is true of the IAM user and access key, which are global, and false of the password, which is derived per region. Records the coupling before it bites: the day *_SMTP_HOST becomes per-instance, *_SMTP_PASS must move with it, or a fleet-wide password derived for one region is wrong for every instance outside it — presenting as email silently not working in the second region.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
1 file changed,
+12
−2
docs/superpowers/specs/2026-08-19-tenant-email-design.md+12 −2
diff --git a/docs/superpowers/specs/2026-08-19-tenant-email-design.md b/docs/superpowers/specs/2026-08-19-tenant-email-design.md| index 86d5060ba..01e0c6c9e 100644 |
| --- a/docs/superpowers/specs/2026-08-19-tenant-email-design.md |
| +++ b/docs/superpowers/specs/2026-08-19-tenant-email-design.md |
| @@ -414,8 +414,18 @@ the domain record's `regions` map and hands over |
| `email-smtp.<region>.amazonaws.com`. With one region provisioned this is a |
| map with one entry; the code path is the same on the day there are three. |
| -One credential works across regions: IAM users and keys are global, and |
| -§4's policy simply lists the ARNs for every `(domain, region)` pair. |
| +One credential works across regions **only in part, and the exception is |
| +easy to miss**. The IAM user and access key are global, and §4's policy |
| +simply lists the ARNs for every `(domain, region)` pair — so the *username* |
| +travels. The **password does not**: it is derived per region (§3), so a |
| +password derived for `eu-west-1` does not authenticate in `us-east-1`. |
| + |
| +The consequence is a coupling, recorded here before it bites: **the day |
| +`*_SMTP_HOST` becomes per-instance, `*_SMTP_PASS` must move with it.** A |
| +per-instance host paired with a fleet-wide password is wrong for every |
| +instance outside the deriving region, and it presents as "email silently |
| +does not work" in the second region — the exact failure shape this design |
| +tries to avoid everywhere else. |
| ## 9. Bounces, complaints, caps and the pause |