{
  "schema_version": "1.0",
  "notice_version": "2026-09-05.v3",
  "status": "send_disabled_until_all_gates_pass",
  "sending_domain": "mail.codecr.org",
  "runtime": {
    "common": [
      "EMAIL_PROVIDER",
      "EMAIL_SYSTEM_STATE",
      "EMAIL_PROVIDER_SECRET_KEY",
      "WEBHOOK_SIGNING_SECRET",
      "SUPPRESSION_API_ENDPOINT",
      "EMAIL_FROM",
      "EMAIL_REPLY_TO",
      "EMAIL_WEBHOOK_URL",
      "EMAIL_UNSUBSCRIBE_BASE_URL",
      "EMAIL_CONSENT_NOTICE_VERSION",
      "EMAIL_SEND_ENABLED"
    ],
    "resend": ["EMAIL_PROVIDER_SECRET_KEY", "PROVIDER_WEBHOOK_VERIFICATION_KEY"],
    "sendgrid": ["EMAIL_PROVIDER_SECRET_KEY", "PROVIDER_WEBHOOK_VERIFICATION_KEY"]
  },
  "dns": {
    "cloudflare_proxy": false,
    "provider_rule": "Select one provider and copy its generated records verbatim.",
    "resend": [
      {"type": "TXT", "name": "send.mail", "value": "v=spf1 include:amazonses.com ~all"},
      {"type": "MX", "name": "send.mail", "value": "[COPY EXACT RESEND-GENERATED MX TARGET]", "priority": 10},
      {"type": "TXT", "name": "[SELECTOR]._domainkey.mail", "value": "[COPY EXACT RESEND-GENERATED p= VALUE]"}
    ],
    "sendgrid": [
      {"type": "CNAME", "name": "em[NNNN].mail", "value": "u[ACCOUNT].wl[REGION].sendgrid.net."},
      {"type": "CNAME", "name": "s1._domainkey.mail", "value": "s1.domainkey.u[ACCOUNT].wl[REGION].sendgrid.net."},
      {"type": "CNAME", "name": "s2._domainkey.mail", "value": "s2.domainkey.u[ACCOUNT].wl[REGION].sendgrid.net."}
    ],
    "dmarc": {"type": "TXT", "name": "_dmarc.mail", "value": "v=DMARC1; p=none; rua=mailto:dmarc@codecr.org; adkim=r; aspf=r; pct=100"}
  },
  "endpoints": {
    "consent_request": "POST /v1/pilots/email-consent",
    "consent_confirmation_view": "GET /email/confirm/{single_use_token}",
    "consent_confirmation_write": "POST /v1/pilots/email-consent/confirm",
    "provider_events": "POST /v1/email/provider-events",
    "authenticated_suppression": "POST /v1/email/suppressions",
    "one_click_unsubscribe": "POST /email/unsubscribe/{single_use_token}"
  },
  "consent_states": ["not_requested", "pending_confirmation", "confirmed", "expired", "suppressed"],
  "unchecked_behavior": {"affirmative_action": false, "response": 204, "create_recipient": false, "allow_local_preflight": true},
  "response_codes": {
    "202": "valid consent request pending confirmation",
    "204": "accepted or idempotent no-content result",
    "400": "malformed or unsupported request",
    "401": "missing or invalid signature or credential",
    "403": "insufficient service scope",
    "413": "payload exceeds 256 KiB",
    "429": "rate limited",
    "503": "temporary dependency failure"
  }
}