DL-309

Real-App webhook validation is a LIVE TUNNEL ROUND-TRIP in the livegithub tier: a smee.io-style tunnel receiver gives the oracle a public ingress, the real GitHub App and real Linear app webhooks register against the tunnel, and one real delivery per provider is asserted end to end through the mounted handlers (NewGitHubWebhookHandler/NewLinearWebhookHandler) with fail-closed signature verify — chosen over capture-and-replay, accepting the live-ingress machinery in CI; the one-time registration + PEM-rotation runbook stays

Status: Active (Matt, 2026-08-31)

Record: ../../server/compass-forge-app-credentials/design.md