Webhook Delivery Service · View 07 of 20 · Structure
Decisions
- The delivery plane sits in its own egress subnets with no route inward. The SSRF guard is a control; the network topology is the control that holds when the guard has a bug (ADR-12).
- Circuit breaker and SSRF guard are drawn inside the worker, not as services. Both must run on every attempt, and a per-attempt network call to a shared service would make them the bottleneck and the outage.
- Replay runs on its own worker pool so a bulk replay cannot consume the capacity that first-attempt deliveries need (ADR-10).
Deliberately omitted
- Replay re-enqueue, the notification path, the audit writer, and every observability edge. Four edges on a container view read better than ten.
- The entitlement filter is shown but its policy source is not — it reads the product's own plan data, which is outside this boundary.
Open
- How endpoints map onto physical SQS queues is the unresolved question this view papers over: 40,000 queues is a service-limit and cost problem, one shared queue with message groups isolates ordering but not throughput (ADR-03).
