Sent when an artifact generation fails. Deliveries are best effort and not guaranteed: up to 5 attempts with backoff that starts around 60 seconds and roughly doubles per retry, and a 10-second delivery timeout, so respond with a 2xx promptly. Retries can produce duplicates; deduplicate on envelope id.
Signature header t=<unix-seconds>,v1=<hex>. Compute HMAC-SHA256 with the webhook secret over the timestamp ASCII bytes, a literal . byte, and the exact raw request-body bytes; hex-encode and compare v1 in constant time. Reject timestamps outside your accepted skew. No bearer token is sent.