Webhook & Validation Pipeline

Channel settings → Integrations → Webhooks → New Webhook → copy URL. Treat this like a password the moment it's copied.

Confirm .env is in .gitignore before you save — every time, don't assume the template already did it.

AGENTRUST_WEBHOOK_URL=https://discord.com/api/webhooks/YOUR_ID/YOUR_TOKEN
AGENTTRUST_WEBHOOK_EVENTS=block,escalate

This separates "is my filter/URL correct" from "is my agent producing the decision I expect" — two different failure classes.

# Terminal 1 — disposable local sink
python3.11 demo/webhook_receiver.py

# Terminal 2 — run the demo agents
export $(grep -v '^#' .env | grep -v '^$' | xargs)
python3.11 examples/06_webhook_integration.py

Works with any @harness-wrapped function, no other code changes required.

export AGENTRUST_WEBHOOK_URL="https://discord.com/api/webhooks/YOUR_ID/YOUR_TOKEN"
export AGENTRUST_WEBHOOK_EVENTS="block,escalate"

Registrations land in SQLite and survive process restart — do this once per environment, not once per boot.

dispatcher.register(url=DISCORD_URL, events=["block","escalate"], name="discord-oncall")
dispatcher.register(url=SLACK_URL,   events=["all"],              name="slack-audit-log")

dispatcher.list_webhooks() — check url_masked, events, and enabled for each entry. You're confirming shape and filter, not the literal secret — that's the point of the mask.

The JWT tier claim needs to be signed and checked, not just read

embed_gateway() issues a JWT-shaped token with tier: team in the payload to stop _apply_tier_mask from stripping scores. Confirm auth.py actually verifies a signature — a token whose claims are trusted on read alone is a local convenience, not an access control, the moment this gateway is reachable from anywhere but localhost.

Deterministic rules will both over- and under-trigger at the edges

The financial pack matches on agent_id glob (payment-*, loan-*...). An agent named outside that pattern handling money gets none of those critical checks; one named inside it but doing something unrelated inherits rules it doesn't need. Treat the glob list as something the team reviews on every new agent, not a one-time setup.

Confidence and policy weights silently renormalise around missing signals

With judge_score and historical_reliability absent in embedded mode, their 15% combined weight redistributes across the remaining five signals. That's correct math, but it also means embedded-mode confidence numbers are not directly comparable to a future deployment where the LLM judge is wired in.

Client-side fan-out still doesn't scale past one process

Multiple worker processes each read the same SQLite registry independently — no shared rate limit, no dedup. A single block replicated across N workers means N near-simultaneous POSTs to the same channel. Fine for one process; revisit before running this across a fleet.

Fail-open with no retry means a flaky network during an incident drops the alert silently

A timeout becomes a WARNING log line and nothing else. For anything routed to on-call, I'd want at least one retry with backoff, or a local fallback log you can replay — as shipped, a missed page during an actual outage looks identical to a quiet day.

The audit table grading itself 100% green is a smell, not a guarantee

A self-reported parity table against Adrian with zero caveats reads like changelog copy. Before presenting "real validation engine" to stakeholders as fact, I'd want someone other than the author to have run tests/test_webhooks.py and read _real_validator.py directly — v0.0.2a1 is still an alpha version string.