Webhook routes exist in the governed v1 namespace, but production delivery remains
capability controlled. Build the receiver against the simulator before production
enablement.
Verify before processing
Authenticate delivery before mutating internal state.
Return quickly
Persist the event identity, respond promptly, then process business work
asynchronously.
Deduplicate
Consumers must tolerate delivery retries and process each event idempotently.
Reconcile critical state
Use the authoritative resource endpoint for consequential financial state.
