{
  "schema": "hsimc.eperson-mail-address-registration-contract.v0.1",
  "artifact": "HRI-HSIMC-EPERSON-MAIL-ADDRESS-REGISTRATION-C0-001",
  "principle": "REGISTER_ADDRESS_DURABLY_RESOLVE_AUTHORITY_STATELESSLY",
  "objects": {
    "eperson_id": "Persistent HSIMC e-Person identity/addressable subject.",
    "mail_address_id": "Persistent mail-address object. May outlive a specific transport adapter.",
    "email_address": "Unique SMTP-compatible reachability address under hsimc.tech.",
    "transport_binding": "Provider-specific mailbox/alias/route object.",
    "work_authority": "Never inferred from registration or transport; resolved at action time."
  },
  "mandatory_eperson_mail": true,
  "capability_mail": "OPTIONAL_WHEN_USEFUL",
  "registration_states": [
    "REQUESTED",
    "ADDRESS_RESERVED",
    "AUTHORIZED_TO_PROVISION",
    "TRANSPORT_PROVISION_REQUESTED",
    "TRANSPORT_PROVISIONED",
    "TRANSPORT_CANARY_VERIFIED",
    "ADDRESS_BOUND",
    "ACTIVE_ROUTE",
    "SUSPENDED",
    "REVOKED",
    "RETIRED",
    "PROVISION_FAILED",
    "REJECTED"
  ],
  "authority_gate": {
    "rule": "ONLY_AUTHORIZED_TO_PROVISION_MAY_MUTATE_TRANSPORT",
    "ai_may_grant_authority": false,
    "email_sender_may_grant_authority": false,
    "historical_precedent": "C0-005 STAGED -> AUTHORIZED -> GRAPH_ACCEPTED deterministic gate"
  },
  "initial_transport_adapter": {
    "provider": "MICROSOFT_365_EXCHANGE_ONLINE",
    "preferred_canary_object": "SharedMailbox",
    "canonical_identity": "NOT_MICROSOFT_OBJECT_ID",
    "mailbox_password_required": false,
    "license_note": "Shared mailbox transport economics are separate from HSIMC identity economics."
  },
  "privacy": {
    "eperson_mailbox_class": "WORK_AND_INFRASTRUCTURE_MAIL_NOT_PRIVATE_HUMAN_PERSONAL_MAILBOX",
    "public_raw_mail_projection": false,
    "credentials_in_registration_request": false,
    "graph_access": "APPLICATION_RBAC_SCOPED",
    "retention": "EXPLICIT_POLICY_REQUIRED"
  }
}