[Silthus]

Problem

The shared sandbox sender needs a durable SES tenant state before workers can honor provider pauses.

Supersedes PostHog#111820 (left open as the original draft), together with the following pause behavior layer.

Stack: layer 8 of 12, stacked on #451. Next: #453.

This fork PR moves to an upstream PostHog/posthog PR after review.

Warning

🟡 Merge risk: medium · two-way door (merge-risk rubric)

• The additive migration creates a small instance-global table with a unique tenant name and database defaults.
• No tenant data moves, and existing send paths do not read the table until the following layer.

Changes

Adds the shared SES tenant state model and migration 0037_sandbox_sender_tenant_state after master's 0036. The table holds the tenant name, its SES sending status and the last sync time. This layer changes no sending behavior.

How did you test this code?

Current evidence, 2026-10-24, head 822e7d0e022.

Owed proofs:

• Live run: rerun at the stack tip 8ac8853cc82, which contains this layer. The stack's cdp-api sent through the workflow test-run endpoint to a local SES fake that records each request. 9 of 9 cases pass. 12 of 13 recorded cases match the run at fa33d78fb36. Case 2c (an unverified member on To) now shows the verify-your-email guidance with reason recipient_unverified, and makes no SES request. For this layer: case 6, under cross-version below.
• Cross-version: live-run case 6, carried from fa33d78fb36 and rerun at 8ac8853cc82 with the same result. A tip worker on a database without migration 0037 skips sandbox sends (it fails closed, with no SES request), while own-sender sends go out.

Changes in this layer since the 2026-10-19 heads (restacked onto fork master 448d802: the migration is renumbered from 0035 to 0037 and depends on master's 0036):

• Round 1 fixed: the unused reputation_impact column is dropped; nothing read it.
• No change in this layer since round 2.
• Final read: GPT-6.1 Sol read the G4 layer range-diffs and found nothing.
• Round 4: no change in this layer.
• Final read 2: GPT-6.1 Sol read the round 4 range-diffs per group and found nothing.

Local gate at the stack tip 8ac8853cc82, shared by every layer

• Python suites for workflows, messaging, CDP validation and integrations: 3007 passed.
• Node CDP messaging, managers, rate limiter, hogflows and cdp-api: 42 suites, 1157 passed.
• Frontend Jest for the 17 changed suites: 292 passed.
• mypy: clean. Node tsc and frontend tsgo: clean.
• ruff, oxfmt, prettier, eslint and oxlint: clean on the 15 files changed in round 4.
• Per-layer suites during the round 4 fold: feat(workflows): restrict sandbox email to verified org members #434 Node 201 passed, feat(workflows): cap sandbox sends and refund ses throttles #441 222, feat(workflows): test templates with the sandbox sender #451 frontend 27, feat(workflows): honor shared sandbox tenant pauses #453 Python 93 and Node 234, feat(workflows): offer a switch from the sandbox sender #456 banner 15.
• Review: round 1, round 2, final read 1 and final read 2 per group. Every finding is fixed or recorded as a follow-up. Both final reads found nothing.

Test seams: migration dependency invariant, generated SQL and model drift check.

Test rationale: The existing database-placement invariant covers the additive model. SQL application and drift checks exercise migration safety; no trivial model-field tests are added.

Gaps: real AWS SES delivery and the AWS-side tenant pause (every proof uses a local SES fake or an unreachable SES), clustered Valkey, the production data shape (prod-shape gap until production read access on 2026-11-02), and fork CI, which fails during setup: path selection fails without a GitHub App client ID, and the Security aggregate rejects its fork-skipped path-filter job. Application CI is a verification gap.

Earlier evidence (superseded heads)

Round 3 heads, 2026-10-23. This layer's head: 27a38a9c8a2. Stack tip fa33d78fb36.

• Live run: run at the stack tip fa33d78fb36, which contains this layer. The stack's cdp-api sent through the workflow test-run endpoint to a local SES fake that records each request. 9 of 9 cases pass, identical to the earlier run. For this layer: case 6, under cross-version below.
• Local gate at fa33d78fb36: Python 3007 passed; Node CDP 42 suites, 1157 passed; email service suites at the final heads of feat(workflows): restrict sandbox email to verified org members #434, feat(workflows): cap sandbox sends and refund ses throttles #441, feat(workflows): test templates with the sandbox sender #451 and feat(workflows): honor shared sandbox tenant pauses #453 passed; frontend Jest 17 changed suites, 290 passed; mypy, Node tsc and frontend tsgo clean; ruff, oxfmt, oxlint, prettier and eslint clean on the files changed since round 2. Final read 1 found nothing.

Whole-stack QA swarm, 2026-10-19. Reviewed tip cfee7e148ae. This layer's head: 2220fc4f7d9.

• Live run at b9bd346ed0e (this stack's cdp-api against a local SES fake, workflow test-run endpoint): a sandbox send to a verified member went out from the fixed identity through the sandbox tenant and configuration set. The step's From name, From address and Reply-To were ignored with a log line. A non-member on CC and an unverified member were blocked with the clear message. A paused tenant state skipped sandbox sends while own-sender sends continued.
• Shadow diff: an own-sender send produced the same SES request and the same stored message on master and on this stack.
• Cross-version: a worker on master reports a sandbox send as sent without calling SES. See the deploy order in feat(workflows): provision a managed sandbox email sender #426's merge risk.
• Checks at the tip (Node suites at 1a0fe3663c2; later fixes touch no Node code): Node CDP messaging, members and rate limiter suites (including email-tracking.service.test.ts, which now runs), the cdp-api suite, the Python sandbox, tenant, tier, reputation and validation suites, the frontend Jest suites of this stack, ruff, and the strict pre-push preflight: pass.
• Gaps: real AWS SES delivery, clustered Valkey, and the production data shape (no production read access yet). Fork CI still fails during setup.

Rebased onto master 734468db6f9 (2026-10-19), head ae4332b07a5.

• Drift: Master added workflows migrations 0033_workflowidea and 0034_teamworkflowsconfig_replay_vision_scan_limits.
• Adapted: The migration is renumbered to 0035_sandbox_sender_tenant_state on top of 0034, and max_migration.txt follows. sqlmigrate emits one CREATE TABLE and its tenant_name pattern index. makemigrations --check reports no changes. The IDOR coverage check passes.
• This layer: Migration applied to an isolated test database. The tenant state suites pass at the tip (below).
• Gaps at modernize time: email-tracking.service.test.ts did not run then. It runs now; see the QA swarm block above. Fork CI still fails during setup, as noted below. Real AWS delivery and clustered Valkey remain unchecked.

Checks at the stack tip

Stack tip b9bd346ed0e (#456), shared by every layer:

• Python, 354 passed: sandbox sender, sender validation, CDP validation, reputation, SES tenant state and events, sending tier.
• Node CDP messaging, managers, and rate limiter: 17 suites, 599 passed.
• Frontend Jest, 37 suites, 487 passed. Five suites timed out under host load in the batch run and passed when rerun alone.
• Frontend tsgo: no errors. Node tsgo: no errors in CDP. The 23 errors it reports are all in session replay files that need the unbuilt Rust @posthog/replay-anonymizer module.
• ruff, oxfmt, oxlint, prettier, eslint, product:lint (workflows, cdp), IDOR coverage, hogli build:openapi (no diff), and the strict pre-push preflight: pass.
• Review: GPT-6.1 Sol read every conflict resolution in the stack and found no issues.

Observed targeted verification after QA fixes

Migration dependency invariant: 1 passed
Migration SQL: applied to isolated worker test database
Migration drift check: exit 0
product:lint workflows: All checks passed
ci:preflight --strict --against workflows-sandbox/ui-test-sends: failures 0

Observed combined-stack gate

Node.js typecheck and build: exit 0
Frontend typecheck and build: exit 0
Success: no issues found in 23388 source files
product:lint workflows: All checks passed
ci:preflight --strict: failures 0

👉 Stay up-to-date with PostHog coding conventions for a smoother review.

Release status

• No feature flag controls this change

Docs update

The following behavior layer updates the existing email sending tiers document.

🤖 Agent context

Autonomy: Human-driven (agent-assisted)

Decisions

Question	Answer	Who	Where
Unused reputation_impact column (G4-3)	Dropped before migration 0037 merges. The pause gate reads the SES sending status, which carries the managed reputation pause	🤖 Agent	decision comment

Involvement: restack onto fork master 448d802 on 2026-10-23; round 1 with GPT-6.1 Sol lanes plus Claude Opus 5.5 fresh eyes for group G4; round 2 on the fix diff; final read 1 by GPT-6.1 Sol per group, with no findings; proofs captured; final read 2 by GPT-6.1 Sol on the round 4 decisions, with no findings; the round 4 live run and a UI walk of the two changed surfaces. Before that: the 2026-10-19 whole-stack QA swarm and the modernize rebase (see Earlier evidence). No review bots run on the fork.

Agent: Codex with GPT-6.1 Sol (gpt-6.1-sol) built the original layers, orchestrated by Claude Code with Claude Opus 5.5 (claude-opus-5-5). Restack, review fixes and this description refresh: Claude Opus 5.5 (claude-opus-5-5). Review: GPT-6.1 Sol (gpt-6.1-sol). Fresh eyes: Claude Opus 5.5 (claude-opus-5-5).

Skills: tdd, pr, stacking-prs, writing-pr-descriptions, merge-risk, qa-swarm, django-migrations, running-ci-preflight, and writing-voice. The description refresh used pr-description, writing-pr-descriptions, writing-voice and merge-risk.

The schema prerequisite forms a separate layer so deployment order and instance-global scoping can be reviewed independently. No private session material is included.

🤖 Generated with Claude Code

[Silthus]

Note

🤖 Claude Opus 5.5 responding on behalf of Michael

Decision lines for this PR. The Decisions table in the description links each row here.

• 🤖 Unused reputation_impact column (G4-3) Dropped before migration 0037 merges. The pause gate reads the SES sending status, which carries the managed reputation pause

[Silthus]

Replaced by the re-sliced fork stack: #607. Tracked in Silthus/personal#71.