carlos / platform Public

Merge pull request #240 from carlosframework/email

Tenant email sending for CARLOS: SMTP credentials issued by the platform, backed by SES multi-tenancy.

Merged with the required check unable to run — GitHub Actions has been billing-dead since ~2026-08-16 and every run on this branch has died in under 5s with zero executed steps. The gate was reproduced in full locally against the merge result instead: `go build ./...`, `go vet ./...` and `go test ./... -count=1` green across 31 packages, `gofmt` clean, and all three cross-compile targets (darwin/arm64, darwin/amd64, linux/arm64) building. The one job neither that nor amadan's runner covers is `minio-contract`, which needs a container runtime and remains genuinely unverified for this branch.

The branch was also pushed to the self-hosted amadan runner as a merge of main, which is what surfaced the role-gate defect fixed in f3483ca — all nine email doors 404'd for every caller on the merge result, invisible on the branch alone. See issuecomment-5386623767.

The feature is INERT on merge, by design: cmd/console/main.go constructs the SES provisioner only when CARLOS_MAIL_REGION is set and the Route53 writer only when CARLOS_MAIL_PLATFORM_SUFFIX is set. Both are unset on every deployment today, so every email door 404s and no AWS call happens at boot. Merging changes nothing in production until a console is rolled with those variables.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>