docs(m4.2): reconcile InboundAPI (Bearer/audit-timing/type-validation), Security (cookie session, role names), Notification (Email-only, AuditKind vocab) to code

This commit is contained in:
Joseph Doherty
2026-06-16 20:27:43 -04:00
parent 9106efafd8
commit c3b046457e
3 changed files with 41 additions and 29 deletions
@@ -15,7 +15,7 @@ Central cluster only. The Notification Service manages definitions in the centra
### Definitions (Central)
- Store notification lists in the configuration database: list name, list **type**, and type-specific targets (e.g. recipients for an `Email` list).
- Store email server configuration (SMTP settings).
- Managed by users with the Design role.
- Managed by users with the Designer role.
- Notification lists and SMTP configuration are **not deployed to sites** — they exist centrally only. There is no deploy-to-sites artifact and no local SQLite copy.
### Delivery Adapters (Central)
@@ -87,7 +87,7 @@ Each `Deliver(...)` call returns one of `success | transient failure | permanent
- **Configuration Database (MS SQL)**: Stores notification list definitions (name, type, type-specific targets) and SMTP config.
- **Notification Outbox**: Invokes the delivery adapters supplied by this component and asks it to resolve notification lists at delivery time.
- **Security & Auth**: Design role manages notification lists.
- **Security & Auth**: Designer role manages notification lists.
- **Configuration Database (via IAuditService)**: Notification list changes are audit logged.
## Interactions