v0.2.0: Native Rust Gateway & Observability

What's Changed in v0.2.0

AetherRelay has been fully rewritten in native Rust (Axum 0.8 + Tokio 1.x) with embedded SQLite WAL storage, providing a lightweight, crash-resilient buffer for incoming webhooks.

Key Features

• Zero-Copy Ingest: Accepts payloads immediately with HTTP 202 Accepted while preserving raw request bytes for cryptographic verification.
• Constant-Time Crypto Adapters: Multi-provider support for GitHub (HMAC-SHA256), Stripe (v1 timestamped with replay window), Midtrans (SHA-512), Discord (Ed25519), and Generic HMAC.
• Atomic Deduplication: Events are deduplicated on ingest using SQLite compare-and-swap transactions on (endpoint_id, idempotency_key).
• Reliable Dispatch Loop: Asynchronous background worker using AWS decorrelated jitter exponential backoff, per-endpoint circuit breaker, and dead-letter queue (DLQ) with replay API.
• Prometheus Observability: Structured JSON logging, /health check, and Prometheus /metrics endpoint with counters, histograms, and dispatch gauges.
• Minimal Footprint: Static musl binary (~10.6 MB) and unprivileged scratch Docker image (~9.7 MB) with < 15 MB RAM usage under load and ~10 ms cold start.

v0.1.1: Webhook Ingestion Gateway & Hardening Crucible

Changelog

All notable changes to this project will be documented in this file.
The format is based on Keep a Changelog,
and this project adheres to Semantic Versioning.

[0.1.1] - 2026-09-22

Fixed

• crypto: normalize 13-digit millisecond Stripe timestamps to 10-digit epoch seconds to avoid false-positive replay rejections under server clock skew (#8).

---

[0.1.0] - 2026-09-22

Added

• init: bootstrap project foundation, architecture specs, PRD, test crucible, and quality gates contracts.
• db: implement SQLite WAL mode storage engine with Kysely migrations for endpoints, incoming_events, delivery_attempts, and dead_letter_queue (#3).
• core: implement atomic CAS idempotency state machine using SQLite BEGIN IMMEDIATE transactions to prevent duplicate webhook arrivals (#2, #3).
• api: stream-optimized Fastify ingestion gateway with zero-copy raw body preservation for cryptographic checks (#4).
• crypto: multi-provider webhook signature verification adapters supporting GitHub (HMAC-SHA256), Stripe (v1 timestamped), Midtrans (SHA-512), and generic HMAC (#4).
• crypto: constant-time signature comparison using crypto.timingSafeEqual wrapped in 32-byte SHA-256 digests to eliminate timing attacks and length discrepancy vulnerabilities.
• worker: dispatch loop with AWS-standard Decorrelated Jitter Exponential Backoff formula and downstream circuit breaker state machine (#4).
• api: dead-letter queue (DLQ) forensic inspection and atomic replay API (POST /v1/dlq/:id/replay).
• observability: Prometheus metrics exporter route (/metrics) and health check route (/health).
• test: 14 unit, integration, and chaos test cases covering schema integrity, concurrency floods, downstream failure cascades, and crash durability drills.