Architecture
Partners send signed events. Credits cannot pay twice.
Event path
Then the worker.
After retry ×3
HMAC verify
Go ingest
internal/ingest checks X-Signature against the raw body bytes and X-Key-Id against live keys, then accepts. POST /v1/tools/ingest is the same path with an API key.
POST /v1/events
Waiting for live metrics.
Live counters
API…
probing
Ingested—
lifetime
Processed—
caught up
Outbox—
pending / mid-send
Credits—
ledger unique event ids
Dead letters
Last N from player.events.dlq. Redrive is a new signed ingest of the same event_id. No skip-HMAC credit.
| Event | Redrive | ||
|---|---|---|---|
| No dead letters in the last 20. | |||
What the path guarantees
HMAC ingest writes the outbox, Kafka feeds the worker, and the ledger credits once per event_id. Tools and shadow read; they do not credit.
The LLM is not on the credit path.