Webhook delivery MVP with HMAC and retries

[JoshuaAFerguson]

Summary

Webhook contracts are drafted but not implemented. Deliver lifecycle events with signing, retries, and idempotency.

Scope

• Control plane webhook sender and subscriptions

Acceptance Criteria

• Deliver events (session.started/stopped/failed/hibernated/resumed, optionally agent status) via POST with HMAC signature headers.
• Retries with exponential backoff and idempotent delivery_id; optional DLQ/log for failures.
• Tests: success path, retry path, signature verification, duplicate handling.

References

• ../streamspace-design-and-governance/03-system-design/webhook-contracts.md

---

Priority: P2 - Medium (v2.0-beta.2)
Milestone: v2.0-beta.2