01
Availability
There is no DewEngine LinkedIn send endpoint today
message.send appears in the target capability catalog, but the LinkedIn provider is decision-gated, uses an unresolved non-official session path, and has no implementation or conformance evidence. An application should hide or disable the action through capability discovery. This guide defines the customer-facing contract that would still need provider and legal approval before any external request.
- Do not ship sample code that suggests a released route
- Return a stable policy-gated state to product clients
02
Command input
Use internal account and conversation references
The host application should submit an opaque connected-account ID, an account-scoped conversation or recipient reference, final content, customer record reference, purpose, and idempotency key. It must not send provider credentials or guess global profile IDs. The service validates workspace ownership, account health, relationship context, and method support before creating any durable command.
- Reject foreign account, recipient, and conversation combinations
- Keep customer references opaque and length-bounded
03
Approval
Bind user intent to the final payload
Show the acting professional account, recipient, conversation context, and rendered message before authorization. Store the approving user, timestamp, policy version, and content hash. Editing text, switching sender, changing recipient, or adding media invalidates approval. A background automation may prepare a proposal but cannot broaden the approved purpose or silently replace the human sender.
- Expire approval after material context changes
- Let users cancel queued commands and see the result
04
Dispatch lifecycle
Persist before the provider boundary
A worker reserves account budget and records a pre-dispatch attempt before touching the provider. Outcomes distinguish acknowledged, definite pre-dispatch failure, provider rejection, throttling, and indeterminate after possible dispatch. An idempotency key deduplicates client retries, but it cannot make an unknown provider action safe to repeat. Reconciliation needs an approved read contract and exact evidence.
- Never infer recipient delivery from acknowledgement
- Prevent concurrent workers from using the same command
05
Reply loop
Complete the product with inbound ownership
A successful messaging feature routes authorized inbound observations to the correct tenant record, deduplicates them, and pauses stale follow-ups. The application needs a signed event with safe identifiers and truthful observation time, not the sender's whole inbox. Human ownership, response status, and internal notes remain customer workflow state rather than provider facts.
- Make webhook consumers replay-safe
- Keep private messages out of logs and generic analytics
06
Readiness
Fault-test every boundary before exposing the button
Release requires approved access, provider authorization, consented real-account tests, tenant substitution, stale approval, duplicate requests, concurrent dispatch, timeout, throttling, restriction, reconnect, reply race, suppression, retention, deletion, audit, budgets, and kill-switch proof. A working internal state machine does not make the provider method sellable. Public SDKs must remain absent until the manifest changes.
- Prove one command produces at most one provider attempt
- Prove account stop wins over all queued sends