Webhook Delivery Service · View 06 of 20 · Structure
The separations that matter
- The capture plane knows nothing about subscriptions. It validates, persists and acknowledges — which is why intake latency does not move when a tenant adds 500 endpoints (ADR-01).
- The delivery plane knows nothing about the product. It has a URL, a payload, a secret and a retry policy, and no route back into anything that matters (ADR-12).
- Evidence is its own layer because the attempt log is a system of record, not telemetry. It answers a customer's dispute, and it is what the queues are rebuilt from (ADR-15).
Only three edges drawn
- Committed events into fan-out, planned deliveries into the queues, and every attempt into the log. Those three carry the architecture.
- Omitted: circuit-state reads, replay re-enqueue, secret fetches and the whole observability fan-out. They are drawn where they are the subject — views 12, 14, 13 and 17.
Assumptions
- Strongly consistent subscription reads at fan-out time. An unsubscribe acknowledged must not be followed by a delivery; a stale subscription for minutes is a smaller harm than a delivery outage, but an unsubscribe is not (ADR-16).
