[cursor]

Summary

Documentation-only PR to catch up operator and architecture docs with merged auth work (#12): SMTP-backed verification and password reset, explicit Better Auth rate limits, managed-AI IP throttling, and production origin rules.

Docs added/updated

File	Change
docs/architecture.md	New Authentication and transactional email section; process-ownership row; 2026-10-09 decision log entry; verification date
docs/self-host.md	Transactional email subsection with env example and troubleshooting table
README.md	Split SMTP_URL / SMTP_FROM from VAPID in the configuration table
docs/README.md	Map verification date

Codepaths covered

• packages/auth/src/index.ts — verification, reset, rate limit pinning, trustedOrigins
• packages/auth/src/auth-emails.ts — SMTP degradation and copy
• packages/adapters/src/smtp-email.ts — SMTP_URL / SMTP_FROM
• apps/api/src/app.ts — isTrustedOrigin, email sender wiring
• apps/api/src/managed-ai.ts — 60 req/min IP limit on /v1/managed-ai/responses
• apps/web/src/pages/ResetPassword.tsx — reset UI (referenced, not duplicated)

Knowledge gaps addressed

• Operators did not have a runbook for enabling auth mail or interpreting silent non-delivery.
• Architecture doc still read as pre-auth-foundation (no email/rate-limit/origin narrative).
• README env table lumped SMTP with push and did not mention SMTP_FROM.

Out of scope

• docs/plans/user-journey-audit-2026-09-10.md remains the detailed audit; architecture links to it for pending emailVerified gates.
• No Mintlify (apps/docs) changes this run.

  

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
sentrabot-site	Ready	Preview	Oct 9, 2026 12:05pm UTC