What exists in code
- Self-serve configuration (
PUT /user/webhook): URL, secret, and event selection, with the secret masked on read-back. - The
webhook.v1delivery module: HMAC-signed payloads with a retry queue.
make all prints a key when the stack comes up.
What is proven, and what is not
- Live delivery — proven. Owner-witnessed production walk, 2026-07-19: POSTs arrived at an
external
webhook.siteinbox from production IPs, one per walk event, matched one-for-one by meeting-api’s delivery-outcome log atcode=200. - Delivery History — broken. The user-facing history reads a store real deliveries were never written to, so it lists none of them (#841, open). Do not read an empty history as “nothing was delivered.”
- CI does not exercise the network leg. The module and eval tests drive the real
WebhookSinkagainst a fake in-memory receiver, so a regression in the transport itself would not be caught by tests — only by another live walk. - No settings UI — configuration is API-only (
PUT /user/webhook). - Exactly-once emission (#519) and outage-durable retry (#520) both closed as completed in July.