---
id: TASK-14
title: Send approved outreach through Stalwart SMTP
status: Done
assignee: []
created_date: '2026-06-03 19:14'
updated_date: '2026-06-05 19:06'
labels:
  - mvp
  - email
  - smtp
dependencies:
  - TASK-13
references:
  - PRD.md
priority: high
ordinal: 14000
---

## Description

<!-- SECTION:DESCRIPTION:BEGIN -->
Implement approved email sending through the self-hosted Stalwart mail server using SMTP/SMTPS and Nodemailer. The system must never send automatically before manual approval and must log recipient, subject, audit link, status, and errors in Convex.
<!-- SECTION:DESCRIPTION:END -->

## Acceptance Criteria
<!-- AC:BEGIN -->
- [x] #1 Nodemailer is configured for Stalwart SMTP/SMTPS using environment or Convex secrets
- [x] #2 E-Mail freigeben und senden sends only the currently approved/editable email draft to the visible recipient
- [x] #3 A final send action shows recipient, subject, sender, and audit link before sending
- [x] #4 Convex records sent timestamp, recipient, subject, audit link, SMTP result, and any error details
- [x] #5 SMTP failures keep the lead in a retryable review state and do not mark the lead as contacted
<!-- AC:END -->

## Implementation Plan

<!-- SECTION:PLAN:BEGIN -->
1. Analyse und TDD-Testergänzung
2. Implementierung backend Claims/Record + Guard-Fixes
3. Typing/Actions straffen + package lock
4. Typechecks lokal ausführen
<!-- SECTION:PLAN:END -->

## Implementation Notes

<!-- SECTION:NOTES:BEGIN -->
Implemented TASK-14 via subagent-driven TDD. Verification passed: targeted outreach tests (27/27), pnpm test (278/278), pnpm exec tsc -p tsconfig.json --noEmit, pnpm lint (0 errors, 2 generated BetterAuth warnings), pnpm build (passed with network-enabled run for Google Fonts). Task remains In Progress until explicit user confirmation after manual SMTP testing.
<!-- SECTION:NOTES:END -->

## Final Summary

<!-- SECTION:FINAL_SUMMARY:BEGIN -->
Shipped approved outreach sending through Stalwart SMTP/SMTPS with Nodemailer, final confirmation UI, Convex send-attempt logging, retryable failure handling, and verification coverage. Verified with targeted outreach tests, full pnpm test, strict TypeScript, lint, and production build.
<!-- SECTION:FINAL_SUMMARY:END -->