Aglet

Verify webhook replay protection

Replay verification must test authentication, recency, event identity, and side-effect deduplication as separate controls. Exercise a new event with an old business timestamp and a repeated event with a fresh delivery timestamp. Inspect final state and acknowledgement for every case.

Check whether the outcome improved

  1. Define repeat outcomes

    Write expected disposition for fresh event, same event again, stale signed event, manual resend, old business timestamp, missing ID, and duplicate worker race. State whether acknowledgement, review, or processing is allowed.

  2. Run identity and time cases

    Feed fixtures through signature, timestamp, deduplication claim, and handler. Confirm a stable event ID controls repeated effects while a delivery ID tracks attempts. Check clock boundary and invalid timestamp paths without widening tolerance.

  3. Exercise recovery safely

    Replay a rejected or pending event through the approved review path, then compare resource state and side-effect count. Verify a duplicate acknowledgement cannot trigger another sender retry or local effect.

What to carry forward

Accept when fresh events process, repeats become safe no-ops or review states, stale input is rejected or quarantined, and old business time does not decide freshness. Keep sender-specific replay behavior partial. Record time, identity, and effect fixtures. Preserve the event record for later reconciliation before closing the review.

Technical background: Coinbase developer documentation.

Keep the decision with the work.

Use a Work Item in Aglet to record the problem, the evidence you have, and the next decision. Add an owner and priority, then keep updates in the discussion so the next person can follow the reasoning.

Create an account See the product workflow