What Happened
services/event-bridge/src/server.js re-implements the BReg webhook signature contract (breg-webhook-signature-v1: fourteen length-prefixed fields, HMAC-SHA256, constant-time compare). It is correct today and has tests, but it is a second implementation of protocol security code that the product owns, and it will drift if the contract gains a field.
Expected Behavior
Once @registrystack/client exposes the verifier (requested in registry-stack), the bridge calls it and deletes the hand-written verification. The bridge keeps its own responsibilities: payload re-validation against the declared projection, forwarding with the OpenFn API key, and refusing redirects.
Triage: blocked on the client release that ships the verifier. Leave the current code in place until then.
What Happened
services/event-bridge/src/server.jsre-implements the BReg webhook signature contract (breg-webhook-signature-v1: fourteen length-prefixed fields, HMAC-SHA256, constant-time compare). It is correct today and has tests, but it is a second implementation of protocol security code that the product owns, and it will drift if the contract gains a field.Expected Behavior
Once
@registrystack/clientexposes the verifier (requested in registry-stack), the bridge calls it and deletes the hand-written verification. The bridge keeps its own responsibilities: payload re-validation against the declared projection, forwarding with the OpenFn API key, and refusing redirects.Triage: blocked on the client release that ships the verifier. Leave the current code in place until then.