epic: WebhookSink + Caliber.Webhooks.Testing (webhook sink & delivery test harness)

[williamdewitt]

North-star: a local, signature-aware webhook sink + delivery test harness — the second portfolio artifact. It dogfoods the M1 delivery loop and drives the M3 receiver-verifier API.

Design + rationale: docs/design/webhook-sink-design.md.

Incubated in-repo (samples/WebhookSink + src/Caliber.Webhooks.Testing) against the shipped M1 surface; extracted to its own repo once concrete.

Slices (filed as ready as predecessors land)

• S0 — scaffold samples/WebhookSink minimal-API (first ready issue)
• S1 — catch-all capture → bounded in-memory store; GET /api/hooks
• S2 — live dashboard (SSE list + detail)
• S3 — per-bucket fault injection (status / latency / drop)
• S4 — signature panel (hand-rolled HMAC + timestamp freshness; WebhookVerifier swap @ M3)
• S5 — Caliber.Webhooks.Testing package (in-proc host + WaitForAsync + assertion extensions)
• S6 — dogfood: publish through Caliber.Webhooks into the sink + docs + retry-storm GIF

Merge gate (per the routing table)

• samples/** → risk:low (CI green + light human approval)
• src/Caliber.Webhooks.Testing → risk:core (CODEOWNERS approval)
• docs → risk:trivial (auto-merge)

Building is autonomous; merging code is the deliberate human touchpoint.

[williamdewitt]

Decomposed into agent-sized slices (2026-06-28). Sequential chain — each Blocked by its predecessor, so the scheduled dispatcher advances one per merge:

#53 (S0b) → #64 (S1 capture) → #65 (S2 dashboard) → #66 (S3 fault-injection) → #67 (S4 signature panel) → #68 (S5 Caliber.Webhooks.Testing — risk:core) → #69 (S6 dogfood+docs)

All ready+agent; samples/** slices auto-merge on green once the samples auto-merge relaxation (#52) lands, so this epic builds unattended. S5 (src/**) stays human-merge.