Summary
Make webhook delivery replay-safe
Why this matters
Retries and worker restarts can cause lost or duplicate provider deliveries.
Scope
Add durable delivery states, idempotency keys, lease-based claiming, bounded exponential backoff, and terminal-failure visibility.
Acceptance criteria
Validation
Add regression coverage for existing behavior, failure modes, authorization boundaries, and compatibility. The implementation must pass the repository CI checks.
Non-goals
- Typo-only, formatting-only, or documentation-only changes.
- Unrelated refactors or dependency upgrades.
- Weakening existing security, authorization, CI, or production safeguards.
Contributor application
Before implementation, comment with relevant experience, a 1–4 bullet approach, and an estimate for opening the first draft PR. Wait for maintainer assignment before coding.
PR requirements
Use a feature branch, include Closes #<issue-number>, check every acceptance criterion, link criteria to code/tests, explain security and failure-mode considerations, and pass CI.
Reward-readiness
This is a substantive GrantFox campaign issue. Merge and CI success do not by themselves guarantee reward eligibility; final reward-readiness is determined by campaign review.
Summary
Make webhook delivery replay-safe
Why this matters
Retries and worker restarts can cause lost or duplicate provider deliveries.
Scope
Add durable delivery states, idempotency keys, lease-based claiming, bounded exponential backoff, and terminal-failure visibility.
Acceptance criteria
Validation
Add regression coverage for existing behavior, failure modes, authorization boundaries, and compatibility. The implementation must pass the repository CI checks.
Non-goals
Contributor application
Before implementation, comment with relevant experience, a 1–4 bullet approach, and an estimate for opening the first draft PR. Wait for maintainer assignment before coding.
PR requirements
Use a feature branch, include
Closes #<issue-number>, check every acceptance criterion, link criteria to code/tests, explain security and failure-mode considerations, and pass CI.Reward-readiness
This is a substantive GrantFox campaign issue. Merge and CI success do not by themselves guarantee reward eligibility; final reward-readiness is determined by campaign review.