Sandbox sender: send through the sandbox route with the fixed sender identity

Map: Map: let teams send a first email before verifying their domain
Spec: Spec: sandbox sender

Cast: GPT-6.1 Sol (Michael, 2026-10-03)

Question

Can a send from the sandbox sender go out through the sandbox route, from the fixed address, with the PostHog-built display name and nothing the step overrides?

Delivers end to end. A workflow send, a workflow test run and a template test send on the sandbox sender reach SES (spec section "Send path"):

Prefactor first, no behavior change: sesRouteFor(integration, teamId, trackingEnabled) returns { tenantName, configurationSetName }; own-sender sends stay byte-identical.
provider = sandbox: TenantName = SES_SANDBOX_TENANT_NAME, ConfigurationSetName = SES_SANDBOX_CONFIGURATION_SET, From SES_SANDBOX_FROM_ADDRESS with the row's name, FeedbackForwardingEmailAddress the same address, no Reply-To. Step from.email, from.name and replyTo are ignored with one info log line.
Sandbox sends are untracked: no pixel, no link rewrite, email_untracked alongside email_sent for live sends as for any untracked send.
Global switch WORKFLOWS_SANDBOX_SENDER_ENABLED (default off): off skips every sandbox send with a clear log line, skipped = true, and { success: false } on the VM stack.
The team-level tier cap does not apply to sandbox sends and is not drained by them.
Analytics: workflows sandbox email sent on SES acceptance (is_test, recipient_count, source) and workflows sandbox email blocked with reason = switch_off. One small helper owns both events; later tickets add reasons.
New Node config keys in nodejs/src/cdp/config.ts: WORKFLOWS_SANDBOX_SENDER_ENABLED, SES_SANDBOX_TENANT_NAME, SES_SANDBOX_CONFIGURATION_SET, SES_SANDBOX_FROM_ADDRESS.

Test seams. EmailService.executeSendEmail with real Postgres fixtures, the real rate limiter and sesV2Client.send mocked; assert the SendEmailCommand input, logs, skipped, metrics and captured events. Parameterize test vs live where the behavior is the same.

Write scope. nodejs/src/cdp/services/messaging/email.service.ts, a new sandbox module beside it, nodejs/src/cdp/config.ts, and their tests.

Acceptance criteria

Own-sender sends produce the same SendEmailCommand as before (existing tests stay green unchanged).
A sandbox send uses the sandbox tenant, set, address and display name, whatever overrides the step carries.
Switch off: no SES call, a skip log line, and a blocked event with switch_off.
A sandbox send never claims the tier cap buckets.

How to build (map #225)

/tdd red-green-refactor, outside-in, at the seams named above. Real Postgres, Valkey and ClickHouse; mock only the SES client (Node and boto3) and the PostHog analytics client.
Repo skills apply where the diff touches their area: /writing-tests, /improving-drf-endpoints, /django-migrations, /writing-ui-components, /writing-kea-logics, /writing-user-facing-copy, /writing-code-comments.
Public repo: state sandbox rules as product rules. Cap values come from the private note the map points at; never quote it. Fixture addresses use example.com.
Shipped means a draft PR handed off by /qa-swarm (see the map's Notes for remotes and branches). Never mark ready, enqueue or merge.

Scope addition (conductor, from the outside-code checklist): every sandbox send carries a short identification footer that PostHog renders after templating, so a recipient can tell it came from the PostHog test sender and which organization sent it. The team cannot edit or remove it. No List-Unsubscribe header: recipients are members of the sending organization. Write the copy with /writing-user-facing-copy.

Note