v0.8 W66 — Alert routing adapters and activity/event webhooks

[ammarheidari]

Status

ACTIVE — shared W62 event/telemetry contracts are stable; provider-specific notifier work may proceed independently of W65.

Scope

• notifier adapter model for Webhook, Email, Slack, Teams, Telegram and PagerDuty;
• activity/event webhook subscriptions;
• typed destination profiles, event filters and safe payload projections;
• finite retry/backoff/deduplication/delivery evidence;
• provider-specific capability/error mapping.

Safety

• no arbitrary per-request destination URL;
• server-side secret references only;
• SSRF protection, HTTPS policy, redirect restrictions and destination allowlist;
• bounded payload size/rate/fanout/retry lifetime;
• protected record/query/secret data excluded unless separately and explicitly admitted.

Authority: scope #208; tracker #209; W61/W62 complete.

Activation boundary

Initial implementation should establish typed notifier/provider contracts, bounded delivery state and destination-validation/SSRF policy before enabling any real outbound adapter. No generic HTTP proxy, caller-controlled URL, secret-bearing event payload or unlimited retry loop is admitted.

Webhook runtime slice — COMPLETE / PROTECTED-MAIN

• PR feat(notifications): add W66 bounded webhook runtime #255: bounded webhook notification runtime;

• final exact head: c92ed6d3fcbc6fb622a535f4c3092cbe1f27ad6d;

• configured webhook profiles only;

• fixed safe event projection;

• endpoint resolution/pinning and opaque credential binding preserved;

• no generic HTTP proxy, arbitrary request URL/headers, retry loop, durable worker, subscriptions or API/UI activation;

• Email/Slack/Teams/Telegram/PagerDuty remain future slices.

• rebased without semantic changes onto protected-main cb2519bc853ed21da5b3e310530c6d062324ca20; exact-head CI and Codex are clean; fresh CODEOWNER approval remains.

• protected-main merge baseline: 67edb7950d09020bbb03e5441df932ce7b0f0a0f;

• rebased exact-head Quality/v03/v04/Dependency/Release/CodeQL: SUCCESS;

• Codex: CLEAN;

• CODEOWNER approval admitted;

• bounded webhook runtime is now protected-main admitted.

[ammarheidari]

W66 Slice 1 final exact head: 6e78003cbd996f6f7f3a476089be15580d5c657a. Typed credential references, shared destination-ID grammar, retry-lifetime cap and translated/tunneled IPv6 literal rejection are included; fresh gates active.

[ammarheidari]

W66 Slice 1 remains corrective-gated after PR #240 merge. Security corrective PR #242 is now on canonical exact head c89a9f5fb3bf88ad47e14e9fbe2c3818077b0c36: opaque credential binding IDs + profile revision authorization context + resolver-owned NAT64/address policy. Fresh exact-head gates are active.

[ammarheidari]

W66 Slice 1 corrective closeout

• initial contract PR feat(notifications): define bounded W66 delivery contracts #240 merged to protected main;
• post-merge security review found credential-scope and NAT64/DNS policy gaps;
• corrective PR fix(notifications): scope credentials and NAT64 resolution #242 final exact head: e89a7d8aea8ad83dffc84d2e39033e2808561db3;
• protected-main merge: 4a4ec6302b4209f25b7456f95d3687d32ff6b134;
• destination profiles now use opaque pre-provisioned credential binding IDs;
• credential resolution is bound to immutable profile revision context;
• DNS resolution is pinned and validated under resolver-owned deployment address policy;
• standard/network-specific RFC6052 NAT64 decoding, malformed u-octet cases and overlap ambiguity are fail-closed;
• exact-head quality/dependency/CodeQL/supply-chain/benchmarks: SUCCESS;
• CODEOWNER approval + Codex exact-head review: CLEAN;
• post-merge quality #1692: SUCCESS;
• post-merge CodeQL #1534: SUCCESS.

W66 Slice 1 is COMPLETE and protected-main verified. Later slices may add concrete outbound adapters only after provider-specific execution, redirect, DNS pinning and credential-resolution implementations preserve these Core boundaries.

[ammarheidari]

Live completion status

W66 is NOT complete yet.

Completed:

• typed destination/delivery/security contracts: PR feat(notifications): define bounded W66 delivery contracts #240;
• security corrective: PR fix(notifications): scope credentials and NAT64 resolution #242 / protected-main 4a4ec6302b4209f25b7456f95d3687d32ff6b134;
• post-merge quality #1692 + CodeQL #1534: SUCCESS.

Remaining to close W66:

1. concrete Webhook adapter with pinned DNS/HTTPS/redirect/credential-binding enforcement;
2. Email, Slack, Teams, Telegram and PagerDuty typed adapters/capability mapping;
3. durable finite retry/backoff/dedup delivery worker;
4. activity/event subscription lifecycle;
5. safe payload projection and provider-specific error mapping;
6. API/UI for destinations/subscriptions/delivery evidence;
7. integration/security tests and final post-merge verification.

Generic HTTP proxy/arbitrary per-request destination remains prohibited.