Skip to content

[GrantFox][High] Make webhook delivery replay-safe #1142

Description

@greatest0fallt1me

Summary

Make webhook delivery replay-safe

Why this matters

Retries and worker restarts can cause lost or duplicate provider deliveries.

Scope

Add durable delivery states, idempotency keys, lease-based claiming, bounded exponential backoff, and terminal-failure visibility.

Acceptance criteria

  • One event key can produce at most one successful delivery.
  • Concurrent workers cannot claim the same delivery.
  • Restart recovery preserves pending and retryable work.
  • Tests cover duplicate, timeout, restart, concurrency, and malformed payloads.

Validation

Add regression coverage for existing behavior, failure modes, authorization boundaries, and compatibility. The implementation must pass the repository CI checks.

Non-goals

  • Typo-only, formatting-only, or documentation-only changes.
  • Unrelated refactors or dependency upgrades.
  • Weakening existing security, authorization, CI, or production safeguards.

Contributor application

Before implementation, comment with relevant experience, a 1–4 bullet approach, and an estimate for opening the first draft PR. Wait for maintainer assignment before coding.

PR requirements

Use a feature branch, include Closes #<issue-number>, check every acceptance criterion, link criteria to code/tests, explain security and failure-mode considerations, and pass CI.

Reward-readiness

This is a substantive GrantFox campaign issue. Merge and CI success do not by themselves guarantee reward eligibility; final reward-readiness is determined by campaign review.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions