{
  "schema": "codecr.enterprise_onboarding_sequence.v2",
  "status": "fail_closed_pending_operator_inputs",
  "purpose": "vpc_sandbox_two_message_onboarding",
  "notice_version": "2026-09-05.v4",
  "provider": {
    "selected": "resend",
    "supported_adapters": [
      "resend"
    ],
    "secrets_location": "server runtime only",
    "required_activation_gates": [
      "codecr-specific provider API secret",
      "verified codecr.org sending domain and DKIM",
      "Resend webhook signing secret",
      "controller legal name, contact, and physical postal address",
      "published Pilot Privacy Notice and retention schedule",
      "live preference endpoint and durable suppression list",
      "recorded legal and security approval for this notice version"
    ]
  },
  "consent_copy": {
    "field_label": "Work email for deployment operations",
    "field_helper": "Used only to verify this request and, if you opt in below, deliver the two-message VPC sandbox onboarding sequence. Never include source code, credentials, or repository data.",
    "processing_notice": "By continuing, you ask codecr to prepare and administer your enterprise sandbox request. We process the work email and deployment-control metadata described in the Pilot Privacy Notice for this purpose.",
    "optional_unchecked_checkbox": "Send me the two-message VPC sandbox onboarding sequence. I agree that codecr may use my work email to send (1) the deployment-boundary confirmation and (2) the Day-2 isolation checklist. This is optional; the local preflight still works without it. I can withdraw at any time using the link in either email.",
    "double_opt_in_helper": "We will first send one verification email. The onboarding sequence remains inactive until you confirm the single-use link. The link expires after 30 minutes.",
    "confirmation_success": "Email verified. Consent recorded for the two-message VPC sandbox onboarding sequence. Email 1 is queued; Email 2 remains suppressible.",
    "unsubscribe": "Stop the VPC sandbox onboarding sequence. You will receive no further onboarding emails. This does not cancel your sandbox request or security notices strictly necessary to administer it.",
    "email_footer": "You received this message because you confirmed the codecr VPC sandbox onboarding sequence for {{work_email}}. Unsubscribe immediately or manage preferences. Rashad Elkersawy / codecr, Friedrich-Naumann-Str. 66, 26125 Oldenburg, Germany. Privacy: privacy@codecr.org."
  },
  "double_opt_in": {
    "request_endpoint": "POST /v1/pilots/email-consent",
    "confirmation_view": "GET /email/confirm/{{single_use_token}}",
    "confirmation_endpoint": "POST /v1/pilots/email-consent/confirm",
    "token_ttl_seconds": 1800,
    "token_storage": "sha256 hash only",
    "states": [
      "not_requested",
      "pending_confirmation",
      "confirmed",
      "suppressed",
      "expired"
    ],
    "activation_event": "pilot.email_consent.confirmed",
    "required_evidence": [
      "opaque consent ID",
      "purpose",
      "notice version",
      "affirmative action",
      "captured timestamp",
      "confirmed timestamp",
      "source URL",
      "locale",
      "recipient reference",
      "confirmation request ID"
    ]
  },
  "consent_request": {
    "headers": {
      "Content-Type": "application/json",
      "Idempotency-Key": "consent_{{preflight_id}}_2026-09-05.v4"
    },
    "body": {
      "schema_version": "1.0",
      "event": "pilot.email_consent.requested",
      "preflight_id": "pilot_01J...",
      "recipient": {
        "email": "vp.engineering@example.com",
        "locale": "en-DE"
      },
      "consent": {
        "purpose": "vpc_sandbox_two_message_onboarding",
        "notice_version": "2026-09-05.v4",
        "affirmative_action": true,
        "double_opt_in": true,
        "captured_at": "2026-09-05T18:00:00Z",
        "source_url": "https://codecr.org/#evaluation"
      },
      "pilot": {
        "deployment_topology": "VPC Peering",
        "identity_provider": "Okta",
        "repository_scope": "3–10 non-production repositories",
        "policy_assignment": "P0 security baseline"
      }
    },
    "accepted_response": {
      "http_status": 202,
      "state": "pending_confirmation",
      "sequence_active": false,
      "permitted_message": "double-opt-in verification only"
    }
  },
  "provider_send_envelope": {
    "message_key": "pilot_{{preflight_id}}_email_{{sequence}}",
    "provider": "resend",
    "to": [
      {
        "email": "{{verified_work_email}}"
      }
    ],
    "from": {
      "email": "onboarding@codecr.org",
      "name": "codecr Enterprise Operations"
    },
    "template": "vpc-boundary-confirmation",
    "template_version": "2026-09-05.v1",
    "variables": {
      "preflight_id": "{{preflight_id}}",
      "deployment_topology": "{{deployment_topology}}",
      "identity_provider": "{{identity_provider}}",
      "repository_scope": "{{repository_scope}}",
      "policy_assignment": "{{policy_assignment}}",
      "preference_url": "https://codecr.org/email/preferences/{{opaque_token}}"
    },
    "headers": {
      "List-Unsubscribe": "<https://codecr.org/email/unsubscribe/{{opaque_token}}>",
      "List-Unsubscribe-Post": "List-Unsubscribe=One-Click"
    },
    "metadata": {
      "preflight_ref": "{{opaque_preflight_id}}",
      "consent_ref": "{{opaque_consent_id}}"
    }
  },
  "adapter_mapping": {
    "resend": {
      "fields": [
        "from",
        "to",
        "subject",
        "html",
        "text",
        "headers",
        "tags"
      ],
      "idempotency": "HTTP Idempotency-Key header",
      "metadata_rule": "opaque tags only"
    }
  },
  "provider_webhook": {
    "verification_order": [
      "read raw request body",
      "verify svix-id, svix-timestamp, and svix-signature against WEBHOOK_SIGNING_SECRET",
      "reject failed verification",
      "parse and normalize event",
      "deduplicate provider_event_id",
      "write suppression before queued-send evaluation",
      "return HTTP 204"
    ],
    "normalized_event": {
      "schema_version": "1.0",
      "provider": "resend",
      "provider_event_id": "evt_opaque",
      "provider_message_id": "msg_opaque",
      "event": "delivered | bounced | complained | unsubscribed",
      "occurred_at": "2026-09-05T18:05:00Z",
      "recipient_ref": "recipient_opaque",
      "preflight_id": "pilot_01J...",
      "signature_verified": true
    }
  },
  "suppression": {
    "write_before_send": true,
    "terminal_events": [
      "recipient.unsubscribe",
      "provider.hard_bounce",
      "provider.complaint",
      "pilot.withdrawn",
      "security.hold",
      "legal.hold"
    ],
    "email_2_only_events": [
      "cluster.provisioning.authorized"
    ],
    "tracking": "open and click tracking disabled by default"
  },
  "emails": [
    {
      "sequence": 1,
      "send_at": "T+0 after pilot.email_consent.confirmed and all activation gates pass",
      "subject": "codecr VPC pilot preflight received — boundary confirmation required",
      "preheader": "No infrastructure has been provisioned. Confirm identity, network, repository, and KMS ownership.",
      "cta": "Review deployment control record",
      "body": [
        "VP Engineering,",
        "Your codecr microVM test-cluster preflight is prepared. No cloud resource, repository token, or identity connection was created by the website action.",
        "CONTROL RECORD",
        "Deployment topology: {{deployment_topology}}",
        "Identity provider: {{identity_provider}}",
        "Repository scope: {{repository_scope}}",
        "Policy baseline: {{policy_assignment}}",
        "Preflight ID: {{preflight_id}}",
        "Before provisioning, Platform Engineering and Security must approve the private route, customer KMS authority, SSO group, signed artifact digest, repository allowlist, and rollback owner. The cluster remains blocked until that evidence is attached to the deployment record.",
        "Review deployment control record: {{control_record_url}}",
        "Risk posture: bounded by default. No source code enters analysis until the control record is authorized.",
        "codecr Enterprise Operations"
      ]
    },
    {
      "sequence": 2,
      "send_at": "T+48 hours when cluster.provisioning.authorized is not true and no suppression exists",
      "subject": "Day 2 control gate — prove isolation before code enters the sandbox",
      "preheader": "Six evidence objects are required to authorize controlled cluster provisioning.",
      "cta": "Authorize controlled cluster provisioning",
      "body": [
        "VP Engineering,",
        "The pilot remains deliberately unprovisioned. Authorization now depends on evidence—not intent.",
        "ATTACH THESE SIX CONTROLS",
        "1. Approved VPC peering routes with public ingress denied.",
        "2. Successful SSO test for the pilot-only group and named break-glass owner.",
        "3. Customer KMS decrypt success from the workload identity plus a denied unauthorized decrypt test.",
        "4. Signed release artifact digests and the rollback version.",
        "5. Final allowlist of 3–10 non-production repositories.",
        "6. Resolved .codecr.yaml inheritance digest with named policy owners.",
        "Authorize controlled cluster provisioning: {{authorization_url}}",
        "If any evidence is incomplete, keep the gate closed. codecr will not treat a calendar deadline as security approval.",
        "codecr Enterprise Operations"
      ]
    }
  ],
  "legal_boundary": "This contract supports evidence collection and suppression. Legal counsel must approve the controller identity, lawful basis, notices, retention, jurisdictions, and message classification before activation."
}