two terminal action nodes deliver the verdict outbound. the SSRF boundary
(guarded-fetch) is the crux: https only rejected at save AND on the resolved
IP at delivery (TOCTOU), no redirects, private/reserved/metadata ranges
refused v4 and v6, 10s timeout, body capped and discarded. HMAC-SHA256
signing over the exact wire body (sign once), X-Delivery-ID + Idempotency-Key
= the stable action row id so retries dedupe. delivery runs async through a
scheduled job, retried like the surface sweeper; failures record the class
never the url. urls + signing secrets are set-only masked to the client and
kept out of logs. a test-connection button probes reachability; a webhook
node pointed at a discord url warns. at-rest encryption is a tracked gap
(WEBHOOK-SECURITY-GAP.md).
