From 5c3dcab6bf0540524a24ef26cda621d028c0515b Mon Sep 17 00:00:00 2001
From: Tom Roth <info@tomroth.consulting>
Date: Fri, 31 Jul 2026 07:21:33 +0200
Subject: [PATCH] ADR-002: resolve form backend as AWS SES via API Gateway +
 Lambda

---
 specification/02-architecture-decisions.md | 19 ++++++++++---------
 specification/99-open-questions.md         |  5 ++---
 2 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/specification/02-architecture-decisions.md b/specification/02-architecture-decisions.md
index 14ed581..096e331 100644
--- a/specification/02-architecture-decisions.md
+++ b/specification/02-architecture-decisions.md
@@ -16,17 +16,18 @@ This file records stable architectural decisions and their rationale. Items here
 - **Consequences**:
   - Contact form delivery must be handled via a static-compatible approach (see ADR-002)
 
-## ADR-002 — Form backend: existing AWS service
-- **Status**: Partially accepted (details pending)
+## ADR-002 — Form backend: AWS SES via API Gateway + Lambda
+- **Status**: Accepted (endpoint details to be confirmed at implementation)
 - **Context**: The site must collect quote request form submissions (FR-3, FR-5). The site is static, so a backend service is required.
-- **Decision**: Use an **existing AWS service** owned/operated by the stakeholder.
+- **Decision**: Use **AWS SES (Simple Email Service)** to deliver form submissions to Diana's inbox. The static form will POST to an **AWS API Gateway + Lambda** endpoint (existing infrastructure) that calls SES to send the email.
 - **Rationale**:
-  - Reuses existing infrastructure
-  - Avoids new third-party service dependencies
-- **Remaining open items** (blocking `38-lead-capture-spec.md`):
-  - Which AWS service is used (e.g. SES, API Gateway + Lambda)?
-  - What is the form submission endpoint URL?
-  - What spam protection is in place or expected (e.g. honeypot, reCAPTCHA, AWS WAF)?
+  - Reuses existing AWS infrastructure
+  - SES is reliable, cost-effective, and avoids third-party form service dependencies
+  - API Gateway + Lambda provides a clean, CORS-friendly endpoint for the static site
+- **Remaining items** (to confirm before `38-lead-capture-spec.md` implementation):
+  - Endpoint URL for the API Gateway
+  - Recipient email address configured in SES
+  - Spam protection approach (e.g. honeypot field, reCAPTCHA, or AWS WAF — to specify in `38-lead-capture-spec.md`)
 - **See also**: OQ-3
 
 ## ADR-003 — Mobile-first, performance-first design
diff --git a/specification/99-open-questions.md b/specification/99-open-questions.md
index f81ab99..bca864c 100644
--- a/specification/99-open-questions.md
+++ b/specification/99-open-questions.md
@@ -11,9 +11,8 @@ This log tracks uncertainties and deferred decisions. Each item should be resolv
 - **Resolution**: **No analytics, no tracking scripts, no cookie consent banner** for v1. No privacy policy required at launch. Revisit if analytics are added later.
 
 ## OQ-3 — Form backend + spam protection approach (ADR-002)
-- **Status**: Partially resolved
-- **Resolution**: Form submissions will be handled via an **existing AWS service**. Specific service (e.g. SES, API Gateway + Lambda, or similar) and the endpoint URL/configuration need to be confirmed before `38-lead-capture-spec.md` implementation. See ADR-002.
-- **Remaining**: Confirm which AWS service/endpoint and provide connection details.
+- **Status**: Resolved (endpoint details deferred to implementation)
+- **Resolution**: Form submissions will be sent via **AWS SES**, triggered by a POST to an existing **AWS API Gateway + Lambda** endpoint. Recipient email and API endpoint URL to be provided at implementation time. Spam protection approach to be defined in `38-lead-capture-spec.md`. See ADR-002.
 
 ## OQ-4 — Minimum quote form fields for "qualified leads"
 - **Status**: Resolved