Requirements: Partition Provisioning (Phase 2)

Functional requirements for the infrastructure changes. Behavior definitions in Design §9.1/§9.7; construct blueprint in Design §12.

Configuration

REQ-INF-001 — PartitionMail (src/main/cdk/platforms.ts) SHALL carry a per-partition systemServerTokenOpReference (op://Arda-{Env}OAM/SystemEmailServer/credential) with a partition-aware accessor; the canonical op:// mapping SHALL live only there (never in bash).

REQ-INF-002 — The Pre-Deploy step SHALL idempotently ensure a Postmark Server named SystemEmailServer-{fqn} exists on the partition’s Postmark account: list-by-name; absent → create and capture ApiTokens[0]; present → no Postmark mutation (Design §9.1 — Ensure-server idempotency).
REQ-INF-003 — On server creation, the token SHALL be written to the partition-vault 1Password item SystemEmailServer (field credential) before any other consumption; on subsequent runs the token SHALL be read from the vault, not from Postmark (DQ-002).
REQ-INF-004 — Custody divergences SHALL behave per Design §9.1/§9.7: server present + item missing → heal (re-read via GET /servers/{id}, create item); item present + server missing → hard error naming both sides, no automatic recreation.
REQ-INF-005 — The token SHALL be emitted only via a 0600 temp file (--system-token-out), following the existing temp-file discipline; the prior “no servers at provisioning time” invariant comment and test SHALL be updated to name the SystemEmailServer as the sanctioned exception.

REQ-INF-006 — PartitionEmailStack SHALL gain a NoEcho CfnParameter EmailSystemServerToken and an SM secret {fqn}-I-EmailSystemServerToken (secretObjectValue: { token: … }, RemovalPolicy.RETAIN) plus a typed export {fqn}-API-EmailSystemServerTokenArn; Built SHALL expose the secret. All existing resources SHALL be template-identical after the change (DQ-003; Design §8 — PartitionEmailStack).
REQ-INF-007 — amm.sh SHALL pass the third NoEcho parameter on the existing --force deploy with the established masking discipline (set +x, ::add-mask::); Pre-Deploy failure SHALL abort the partition run before any CFN change.
REQ-INF-008 — No DNS records, zones, or Sender Signatures SHALL be added or modified (DQ-001).

REQ-INF-009 — runtime-platform-drift SHALL assert, per active partition: (a) a Postmark server named SystemEmailServer-{fqn} exists; (b) the SM secret {fqn}-I-EmailSystemServerToken exists. Checks SHALL work with Arda-SystemsOAM shared account tokens only (existence, never values).