[DeePrincipal-dev-lang]

I’ll base the PR text on the pushed commit and its actual diff, including the test status and any relevant caveats, so the description is ready to paste without overstating verification.

Ran terminal command: git show --format=fuller --stat HEAD && git status --short

PR Title

Add signed webhook delivery, bounded retries, and idempotency keys

Description

Summary

Webhook deliveries now authenticate the exact JSON request body with HMAC-SHA256, identify events consistently across retries, and stop after a configurable maximum number of attempts. Failed deliveries are recorded in the dead-letter queue with their payload, final error, timestamps, and attempt count.

Changes

• Sign each request using the subscription’s secret and send X-Webhook-Signature: sha256=<hex-digest>. The secret is not sent in the request.
• Add create_with_secret so callers can provide a per-subscription secret loaded from configuration. The existing create method remains available and generates a secret.
• Send the payload event ID in Idempotency-Key, keeping the value stable across retries.
• Add an explicit retry attempt limit. The default is five total attempts: the initial request plus four retries using the documented delay schedule.
• Record deliveries that exhaust the attempt limit in the DLQ.
• Update the webhook documentation and add unit and local HTTP receiver tests for HMAC verification, idempotency headers, retry limits, and dead-letter recording.

Verification

• git diff --check and editor diagnostics passed.
• Cargo tests were not run because Cargo is unavailable in the container.

closes #1501

[drips-wave]

@DeePrincipal-dev-lang Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits