AutoCore SMS and Messaging Boundary
Clarifies the audited SMS, OTP, and WhatsApp implementation boundary.
SMS delivery is not implemented in the reviewed release candidate. Phone authentication is a placeholder provider, the OTP model exists for future work, and a notification preference alone does not prove a sender exists.
Release candidate source
This article reflects the audited AutoCore source revision 7a504f6e430c16d4fcb03ebdea3cc3fb7816df60 and immutable release-candidate tag v1.0.0-rc.1 at 9edfb109f44cc80385784c694b96392cfc04e70f. Configuration and external provider behavior remain deployment-dependent.
Source boundary
| Control | Source-verified behavior |
|---|---|
| SMS | No active SMS provider or sender implementation was found; keep SMS disabled and describe it as unsupported. |
| Phone auth | PhoneAuthProvider is not implemented and returns the documented unavailable behavior. |
| A non-production logger may exercise opt-in paths; it is not a delivery provider. | |
| Future work | Adding SMS requires provider selection, OTP abuse controls, consent, templates, delivery evidence, and incident handling. |
Operational controls
Use the smallest verified control for the task. Keep provider, host, legal, and operator responsibilities separate from application behavior. When a control is not implemented or not verified, leave it disabled or mark it as a limitation.
Verification
Verify the route, relevant API or configuration state, negative path, audit/evidence result, and public effect before closing the task. Record unknown or configuration-dependent behavior as a limitation.