Webhooks: Specification
Signed outbound webhooks with HMAC over the raw body, a stable delivery identity, bounded retries into a dead-letter, clock-skew tolerant timestamps, and no secret material in callback URLs.
Domain mutations and outbox rows share one database transaction; a relay publishes at-least-once; consumers are idempotent; writing the database and a broker independently without an outbox is forbidden.