The live settings.
Loads a session as the CALLER (so row-level security is the first gate). For a link caller there is
no identity to load as, so the real port reads as the configured service principal.
Re-reads the session fresh, runs mutate on it, and persists the returned Config (trusted write).
Current time, epoch ms.
Publishes identity.verified to the session. Must not throw.
ProtectedResolveThe configured service principal (see SessionVerificationPortsBase).
Delivers an email. Must not throw; reports failure in the result.
Records the audit entry. Must not throw.
The production ports: SessionVerificationPortsBase plus the server configuration — the settings read from
realtime.identityVerification, the configured service principal, and delivery through the configured communication provider. Exported for tests and for hosts that want to compose their own workflow around them; application code should use RealtimeSessionVerificationService.