Specification: Partition Provisioning (Phase 2)

Specification: Partition Provisioning (Phase 2)

Driving document for the infrastructure worktree at projects/invitation-mail-server-worktrees/infrastructure (branch jmpicnic/invitation-mail-server). Satisfies requirements.md; verified per verification.md; construct blueprint in Design §12. Independent of Phase 1 — may run in parallel.

Skills to load: cdk-infrastructure. Respect the repo’s tools/ vs scripts/ split (logic in tools/, ergonomy in scripts/).

Worktree Strategy

Single worktree, single agent — no task worktrees needed.

Tasks

T2.1 — PartitionMail extension

systemServerTokenOpReference field (all four partitions) + accessor in src/main/cdk/platforms.ts (REQ-INF-001).

Verify: npm run build; existing platform tests green.

T2.2 — Pre-Deploy module

New tools/lib/partition-system-server.ts (ensureSystemEmailServer: list-by-name → create/read, vault custody + healing per REQ-INF-002..004), wired into tools/register-partition-mail-signature.ts behind --system-token-out (REQ-INF-005). Update the “no servers at provisioning time” header comment and its test assertion in tools/lib/partition-mail-signature.ts — an intentional invariant amendment, called out in the PR description.

Verify: BV-1-01..04, BV-1-06 green (npx jest tools/lib).

T2.3 — PartitionEmailStack extension

NoEcho param + SM secret + export + Built member per REQ-INF-006; no other resource may change (REQ-INF-008). Mind the RETAIN-rename trap: no logical-id or secretName changes to existing resources.

Verify: BV-1-05 green, including the existing-resources-identical assertion; full npm run synth matrix clean.

T2.4 — amm.sh wiring

Third temp file + mask + --parameters "{fqn}-Email:EmailSystemServerToken=…" (REQ-INF-007). Replicate the existing xtrace/mask/cleanup dance exactly.

Verify: manual diff review against the existing two-secret block; shellcheck if wired in repo tooling.

T2.5 — Drift checks

Server-exists + secret-exists per partition in tools/runtime-platform-drift.ts (REQ-INF-009), reusing the corporate-drift server-lookup pattern.

Verify: BV-7-01 green.

T2.6 — Quality gate and release prep

• npm run build && npm run lint; full Jest suite; synth matrix.
• CHANGELOG entry (direct-edit; make lint) under Added — one bullet: partition provisioning now creates the system email server and delivers its token as a partition secret.

STOP — review before PR

Present diff summary, test results, and the cdk diff expectation (additive only: 1 parameter, 1 secret, 1 export per partition). No push/PR until approved; after approval: push, PR, /pr-steward. Merging this phase does not deploy anything — deployment is Phase 4 operator work.

Acceptance Checklist

• REQ-INF-001..009 satisfied; verification rows implemented and green.
• Invariant amendment (servers at provisioning time) explicit in code comment, test, and PR description.
• cdk diff against a deployed partition (synth-level) shows only the three additive elements.
• No DNS/signature changes anywhere in the diff.
• CHANGELOG entry present; PR merged.

Open Questions and Decisions

#	Question	Options	Recommendation	Decision
1	Vault item creation mechanics — op item create via CLI from the Pre-Deploy tool (biometric on operator runs) vs. instructing the operator to pre-create empty items	(a) tool creates/updates the item (b) operator pre-creates	(a) — matches corporate-cli precedent and keeps the runbook one-step; same-Bash-call biometic rule applies	(a) per recommendation
2	Postmark server settings on create (color, SMTP disabled, tracking flags)	minimal defaults vs. configured	Minimal: Name, Color, tracking off, SMTP off — system mail needs none of it; extend later via PDEV-1250 console work	minimal per recommendation

---

---

Copyright: (c) Arda Systems 2025-2026, All rights reserved