Skip to main content
The verification email supports booking-linkage verification through the booking email already on file. Engine token consumption and verified-session state establish the proof. The message must be warm and safe, but never leak booking-private details.
The Guest Agent request/status flow and Engine email/token/session contracts were verified from source on 2026-08-12. The latest accepted Guest Agent same-deploy and model-provider proof remains the 2026-07-18 receipt for commit fbf77b662511cf004ee1f46787e05773a8a78d71; that receipt is not fresh delivery proof. Neither that pass nor this 2026-09-10 pass sent an email, consumed a live token, called a provider, or inspected live booking data.

​
Delivery Rule

Verification emails go only to the booking email already on file. Guest-entered email is never trusted as the destination. The guest may supply information that helps find a candidate booking, but the delivery destination is owned by the booking record.

​
Privacy Boundary

The verification email must not expose:
The guest-facing chat must not expose:

​
Source-implemented path — verified 2026-08-12

The source-reviewed implementation is:
This is source-implemented controlled-preview behavior, not a claim of currently proven delivery. End-to-end deliverability, rate limiting, replay and abuse behavior, and production consent copy require separate current evidence before they can be called live or production-ready.

​
The guest-mail family — 2026-09-10

The magic link is one member of the Engine’s guest-facing mail family. Since September that family rides Resend from the verified sending domain, and Postmark carries only the employee-facing Maintenance Inbox thread (LUCI-232; HLLC-41 audit read of the Engine’s outbound code and the Resend domain, 2026-09-10). Delivery of any one message is still proven only by a dated receipt. Rulings that bind the verification email as of 2026-09-10:
  • The sender is Lucia at Villa Valentin, plain i (LUCI-238, founder 2026-09-09). The sender display name on the Development Engine is an environment value the founder changes by hand; this pass did not read it, so the live value is treated as set by the founder’s hand, unverified.
  • Buttons are rectangles, 4 to 5px corners, centred, same colours (LUCI-237, founder 2026-09-09: “The super round pill shape doesn’t match our brand.”). The rule covers the whole family including the magic-link button. The Engine change was In Review on 2026-09-10 and is not written here as served; the Engine’s verification result page was still drawing a pill at the audit read.
  • Development never reaches a person. With the Development mail sink set, every guest-facing email, this one included, is delivered to one testing inbox with the intended recipient written into the subject, and both addresses are kept on the send ledger; production refuses to boot with a sink set (LUCI-231, completed 2026-09-09).

​
Tone Contract

The email should feel:
It should not feel:
The guest should understand that Lucia is helping verify the connection without seeing private booking information.

​
See Also