v1.0.0 — Transaction Outbox, Event Replay, Schema Registry, Fan-Out Delivery Groups

The v1.0.0 milestone — enterprise-grade reliability patterns for mission-critical webhook delivery.

What's New

📮 Transaction Outbox Pattern

Every outbound webhook event is durably recorded BEFORE delivery, guaranteeing at-least-once delivery semantics. Survives process crashes — pending entries can be recovered and replayed.

🔁 Event Replay

Re-deliver events from any time range with filter criteria (event type, endpoint, source). Batched execution with progress tracking, cancellation, and override-target support for endpoint migration.

📋 Schema Registry & Validation

Register versioned JSON Schemas per event type. Validate payloads before delivery — strict mode blocks invalid payloads, non-strict mode warns. Supports schema evolution with multiple active versions.

📡 Fan-Out Delivery Groups

Deliver to named endpoint groups with three strategies:

• parallel — all active members concurrently (bounded by max_concurrent)
• sequential — one at a time, early-stop when failure strategy is satisfied
• weighted — canary / blue-green rollouts by member weight

Failure strategies: all_must_succeed, any_success, majority_success, ignore.

Stats

• Tests: 743 → 924 (+181, all passing)
• MCP tools: 82 → 105 (+23)
• New modules: outbox.py, fanout.py + models, store, service, CLI, MCP, REST integration

v0.9.0 — Retry-After, Multi-Secret Rotation, Endpoint Verification

What's New in v0.9.0

Three production-grade features for enterprise webhook delivery.

1. Retry-After Header Support (RFC 7231)

When a downstream server returns 429/503 with a Retry-After header, the engine now:

• Parses both integer-seconds (Retry-After: 120) and HTTP-date formats
• Uses the server-requested delay instead of computed backoff
• Clamps the delay to max_delay_seconds for safety
• Stores retry_after_seconds in the attempt metadata

2. Multi-Secret Rotation (Zero-Downtime Key Rotation)

Full lifecycle HMAC signing key rotation via SecretRotationManager:

• initiate — demotes current primary to 'previous', promotes new secret to 'rotating'
• verify — confirms new secret working, retires old with 24h grace period
• complete — cleans up expired retired secrets
• Old secrets remain valid for incoming verification during grace period
• Cancel mid-rotation reverts to previous primary

3. Endpoint Verification Challenge

Prove endpoint ownership before activation via ChallengeManager:

• Generates 256-bit cryptographic random token
• Endpoint must echo token in header (X-Webhook-Verify-Challenge) or body field
• Configurable: location (header/body/either), TTL (default 10min), max attempts (default 3)
• Constant-time token comparison prevents timing attacks

Stats

• MCP tools: 73 → 82 (+9 new)
• Tests: 661 → 743 (+82 new)
• New modules: secret_rotation.py, verification.py
• New model field: DeliveryAttempt.metadata

v0.7.0 — Webhook delivery for agents

agent-webhook v0.7.0

Send, receive, and verify webhooks for autonomous agents. HMAC-signed delivery, retry, and event routing.

Features

• Outbound webhook delivery with HMAC-SHA256 signing
• Automatic retry with exponential backoff
• Inbound webhook verification middleware
• Event routing (multiple subscribers per event)
• REST API (FastAPI) + Python SDK
• Delivery log with full audit trail

Tests

• 612 tests, all passing (Python 3.10–3.13)
• CI: green