Enforce the automated sender before company mail submission #6082

🤖 Generated by the Agentic Engineer

Problem

Invitation email needs an enforced automated sending identity. The existing native SMTP investigation shows that an optional DATA hook is not sufficient by itself: a missing hook can be skipped. Customers must not gain an unrestricted mail credential when this component is unavailable or misconfigured.

Proposed delivery

Implement a default-off internal SMTP submission component with separate application and upstream credentials. Authenticate the application over verified TLS, validate the exact envelope and single message author, then synchronously submit through the existing company Email service using its separate send-only credential. The application credential must not work against the upstream service. Preserve direct company delivery; introduce no hosted relay, paid service, new mailbox access or public endpoint.

This child delivers the executable and bounded native protocol proof. Packaging, private credential provisioning and deployed transport remain separate acceptance on the parent. Ordinary email is unchanged.

Acceptance criteria

• No default listener. Explicit startup refuses missing, unresolved, reused or invalid private inputs without revealing their values.
• Real TLS SMTP tests accept the approved sender and refuse anonymous submission, wrong credentials, mismatched envelope, missing/duplicate/grouped/multiple message authors and alternate author headers. Preserve the message and recipient for valid submission.
• Application credentials cannot authenticate to the separately credentialled native upstream fixture. An unavailable upstream, absent STARTTLS, incorrect CA/name, refusal and missing final acknowledgement cannot produce acceptance.
• Bound connections, message/recipient sizes, request duration, authentication attempts and sending rate. Perform no background retry; document acknowledgement ambiguity and retain caller-owned retry policy.
• Credentials, message contents, invitation links and addresses never enter operational logs or error responses. Exercise secret/message canaries and revocation by restart.
• Pass tests, dependency/security checks, substantive exact-head review and normal protected merge. Keep production sending and portal activation off.

Priority High; effort Medium; Standard. The success signal is structural enforcement through the actual SMTP protocol even without an optional upstream hook, with zero acceptance on failed submission. This is a delivery child of #5400; real invitation delivery remains open there.