WEBHOOK RECEIVER DECISION CHECKLIST
Original fictional receiver exercise. Checked October 28, 2026.
The companion Node.js lab runs locally without a server, network requests, files or real credentials.

PROVIDER CONTRACT
Provider and documentation date:
Subscribed event types and version:
Authoritative event ID versus delivery-attempt ID:
Payload encoding and original-byte access:
Actual signature scheme, header, key storage and rotation process:
Timestamp / replay protection required by this provider:
Expected response window and success/failure response semantics:
Actual automatic retry or manual redelivery policy:
Ordering guarantees, if any:
Reconciliation API and permitted recovery process:
Owner of changes to this contract:

RECEIVE PATH
Preserve the bytes required by the documented verification method.
Verify authenticity before trusting payload fields.
Validate event type, version, required fields and intended recipient.
Resolve the permitted workspace/resource binding from trusted configuration.
Use a stable scoped event identity for repeated-delivery handling.
Detect contradictory reuse of an already accepted identity.
Record accepted receipt and queued work according to the actual durable/atomic contract.
Choose the acknowledgment point deliberately. It should reflect what the endpoint has actually accepted.
Avoid doing slow, unrelated business work in the receipt path when a supported queue contract is appropriate.

WORK PATH
Identify the logical business operation separately from delivery identity.
Ensure repetition cannot create an unintended second business effect.
Record pending, retryable, completed and terminally failed work with owners and evidence.
Use bounded retry handling and a permitted manual recovery path.
Keep reconciliation able to find missed or unresolved work.
Retain only the data required for processing and support, with suitable access and retention.

LOCAL LAB CONTRACT
Fictional event: demo-export-service / export.completed / version 1.
Bound workspace: ws_alpha. Allowed job: job_a, unless a test supplies another explicit local configuration.
The six event fields are issuer, id, type, workspaceId, jobId and version.
Envelope: sha256= followed by lowercase HMAC-SHA256 hex over raw bytes.
This envelope illustrates a documented kind of signature check; it is not a universal webhook contract.
Receipt deduplication key: issuer + workspace + event ID.
Logical effect key: workspace + job ID + completion-notification.
A repeated delivery is duplicate. A conflicting event identity is conflict.
A simulated pre-commit worker failure leaves the local job pending.
A second distinct event for the same logical completion does not add a second local notification effect.

LIMITS
The lab uses memory, not a database or durable queue. It sends no HTTP acknowledgment.
Restarting loses its accepted-event and effect history.
It does not model concurrent workers, an actual external effect, network failure, key rotation, timestamp replay defenses or a provider callback.
Use maintained provider tooling and the real storage/transaction design for production work.