- Shipped
- November 7, 2026 at 11:41 PM UTC
- Author
- Kamo
- Commit
- 181d69b
DocsService sent X-Internal-Auth from internal.auth.secret, which is ESigService's secret (***). EmailService's InternalAuthFilter compares against mlos-internal-auth's INTERNAL_AUTH_SECRET, so every hr.package_* letter (assigned, needs review, returned, approved, reminders), every careers letter and every training letter was refused with 403 and never left the building. The three email clients now read email.internal-auth-secret, mapped from EMAIL_INTERNAL_AUTH_SECRET **************** internal.auth.secret keeps its one job: the e-sign client. Found by the Legal & Compliance review end-to-end run in sp00verify.