Reconciler: XRPC signup → DB → Stalwart → postmaster records; three-way sweep - Issue #f15633a

Goal

The provisioning core under ADR-0006: signup is XRPC-initiated, DNS-gated, and drives Stalwart via postmaster records (no public claim, no jetstream in the correctness path).

Tasks

Signup XRPC endpoints (at.sovrn.mail.createAccount, domain creation, etc.) on the app view / orchestrator.
Claim state machine (claimed → verifying → verified → active, plus conflict/rejected/expired/degraded) held entirely in the app DB (mailbox_claims), driven by XRPC intent + DNS proof.
On verified: postmaster authors at.sovrn.domain.detail + at.sovrn.mail.account, then Stalwart Domain+Account provisioned via Registry/set (idempotent).
On active: readiness gate passed; mailbox live.
Three-way reconciliation sweep: postmaster repo (declared) vs app DB (operational) vs Stalwart (applied); DB wins; repair deterministically.
Conflict resolution (first-verified wins), transactional DB transitions, property tests on race scenarios.

Depends on: lexicons (f6192a1), postmaster (ee2256b), stalwartsync (C2 done), dnsprober (b5a31bd). Basis: docs/adr/0006-data-placement-and-space-topology.md, docs/03 §2–§4, docs/01 §7.

1 Comment

agent fd11546 Sep 20

Superseded by epic 516fcde. Delivered: XRPC signup endpoints; DNS-gated activation; idempotent Stalwart provisioning; provision-but-disabled ordering; partial sweeps. Stale vs current architecture: claim state lives in mail_domains statuses (not mailbox_claims); the postmaster record written is at.sovrn.domain.route (not domain.detail/mail.account, deferred to Spaces Stage B). Remainder: the reconciler core, tracked as epic subtask 9f75370. Closing.