[Phase 1] Configure Forgejo webhooks — observation-only #6

New issue

Open

opened 2026-07-14 01:19:30 +00:00 by starsetbyte · 0 comments

starsetbyte commented

2026-07-14 01:19:30 +00:00

Owner

Context

Wire up Forgejo webhooks for the starsetbyte/aether repo (and optionally starsetbyte/Carin) in observation-only mode. The webhook receiver validates, normalizes, and logs — but does not wake agents or write to Aether.

Network constraint

Forgejo (durandal.exe.xyz) may not be able to reach the Aether relay on Sera (hermes-sera.exe.xyz) directly. Two deployment options:

Direct: Forgejo -> Sera webhook endpoint (if reachable)
Via ingress: Forgejo -> Carin or small ingress service -> validate + re-sign -> forward to Sera

Test reachability first. If direct doesn't work, the ingress pattern is acceptable.

What to build

Register webhook on starsetbyte/aether:
- Events: issues, issue_comment, pull_request, pull_request_comment, label, assign
- NOT: push (during Phase 1)
- HMAC-SHA256 secret
- Content type: JSON
Webhook receiver endpoint:
- Validate HMAC signature
- Validate repository (reject events from unexpected repos)
- Validate event type
- Record delivery ID for deduplication
- Normalize to internal event shape (actor/origin model from issue #4)
- Log normalized event
- Return 202 Accepted
- Do NOT wake agents, do NOT write to Aether journal, do NOT update Forgejo labels
Store delivery IDs in SQLite for idempotency (TTL: 7 days)

Acceptance

Webhook registered and receiving events
HMAC validation rejects tampered payloads
Unknown repos/events are rejected with logged reason
Duplicate delivery IDs are detected and skipped
Normalized events are logged (observation mode)
No agents are woken, no Aether state is written, no labels are changed

## Context Wire up Forgejo webhooks for the `starsetbyte/aether` repo (and optionally `starsetbyte/Carin`) in observation-only mode. The webhook receiver validates, normalizes, and logs — but does not wake agents or write to Aether. ## Network constraint Forgejo (durandal.exe.xyz) may not be able to reach the Aether relay on Sera (hermes-sera.exe.xyz) directly. Two deployment options: 1. **Direct:** Forgejo -> Sera webhook endpoint (if reachable) 2. **Via ingress:** Forgejo -> Carin or small ingress service -> validate + re-sign -> forward to Sera Test reachability first. If direct doesn't work, the ingress pattern is acceptable. ## What to build 1. Register webhook on `starsetbyte/aether`: - Events: `issues`, `issue_comment`, `pull_request`, `pull_request_comment`, `label`, `assign` - NOT: `push` (during Phase 1) - HMAC-SHA256 secret - Content type: JSON 2. Webhook receiver endpoint: - Validate HMAC signature - Validate repository (reject events from unexpected repos) - Validate event type - Record delivery ID for deduplication - Normalize to internal event shape (actor/origin model from issue #4) - Log normalized event - Return 202 Accepted - Do NOT wake agents, do NOT write to Aether journal, do NOT update Forgejo labels 3. Store delivery IDs in SQLite for idempotency (TTL: 7 days) ## Acceptance - [ ] Webhook registered and receiving events - [ ] HMAC validation rejects tampered payloads - [ ] Unknown repos/events are rejected with logged reason - [ ] Duplicate delivery IDs are detected and skipped - [ ] Normalized events are logged (observation mode) - [ ] No agents are woken, no Aether state is written, no labels are changed

starsetbyte added the

phase-1

ingestion

labels

2026-07-14 01:19:30 +00:00