Webhook And Event Lifecycle
Purpose
Make inbound messaging events trustworthy, prompt, idempotent, and diagnosable. This skill owns the event boundary; it does not own application business logic, persistent conversation policy, or a platform transport implementation.
Workflow
- Read current official delivery and signature-verification documentation for the selected platform.
- Capture the platform's request signature, timestamp/replay guard, response deadline, retry policy, event ID, ordering guarantees, and rate limits.
- Verify authenticity before parsing or enqueueing work. Reject an invalid request with a descriptive operator-facing log that identifies the platform, validation stage, and likely cause without exposing secrets.
- Deduplicate on the platform event identity before side effects. Persist an explicit processing state when retries can outlive a request.
- Acknowledge on time, then execute slow work through the selected app runtime. Use platform-native deferred responses where they exist.
- Record correlation IDs, delivery outcome, retry count, and a privacy-safe error summary. Do not log raw message content or tokens by default.
Required Output
Document the request verifier, acknowledgement path, duplicate rule, retry and failure behavior, ordering assumption, response/update path, and targeted replay test. Hand service implementation to the chosen server stack skill.
Guards
- Do not use a shared webhook wrapper merely because multiple providers use HTTP.
- Do not acknowledge an event as successful before a required signature or idempotency check.
- Do not claim a webhook works without a platform test delivery, local signed fixture, or observed request trace.
1---2name: webhook-and-event-lifecycle3description: Design and repair secure inbound events, webhooks, interactions, retries, acknowledgements, and delivery observability for messaging and collaboration platforms.4---56# Webhook And Event Lifecycle78## Purpose910Make inbound messaging events trustworthy, prompt, idempotent, and diagnosable. This skill owns the event boundary; it does not own application business logic, persistent conversation policy, or a platform transport implementation.1112## Workflow13141. Read current official delivery and signature-verification documentation for the selected platform.152. Capture the platform's request signature, timestamp/replay guard, response deadline, retry policy, event ID, ordering guarantees, and rate limits.163. Verify authenticity before parsing or enqueueing work. Reject an invalid request with a descriptive operator-facing log that identifies the platform, validation stage, and likely cause without exposing secrets.174. Deduplicate on the platform event identity before side effects. Persist an explicit processing state when retries can outlive a request.185. Acknowledge on time, then execute slow work through the selected app runtime. Use platform-native deferred responses where they exist.196. Record correlation IDs, delivery outcome, retry count, and a privacy-safe error summary. Do not log raw message content or tokens by default.2021## Required Output2223Document the request verifier, acknowledgement path, duplicate rule, retry and failure behavior, ordering assumption, response/update path, and targeted replay test. Hand service implementation to the chosen server stack skill.2425## Guards2627- Do not use a shared webhook wrapper merely because multiple providers use HTTP.28- Do not acknowledge an event as successful before a required signature or idempotency check.29- Do not claim a webhook works without a platform test delivery, local signed fixture, or observed request trace.
gaelic-ghost