Outbound webhooks
Webhook creation and delivery are separate. Domain changes record durable payloads, and the delivery worker claims rows with a lease before making an attempt. It signs the payload, applies bounded transport and SSRF checks, then settles delivery and endpoint health together under the current lease.
A webhook POST receives one attempt per round. Persistent policy decides when to retry. Respect Retry-After without making a request hold the whole cron tick indefinitely. Test a lost response and expired lease; a network timeout does not prove that the receiver rejected the event.
Extend
Add event contracts to the existing event definitions and enqueue work in the domain transaction. Keep secrets and private payloads out of logs. Test duplicate delivery, lease fencing, disabled configuration and identity transitions.