Developers
Webhooks
Publishing after a commit loses events when the process dies in the gap. Publishing before one fabricates events for transactions that roll back. Neither failure is visible when it happens.
What it changes
- The transactional outboxAn event row is written inside the caller’s transaction — the function takes a transaction client rather than a database handle, so there is no way to emit an event for a change that did not commit.
- Ordering per aggregateA message waits behind any older unpublished message for the same aggregate, so a burn cannot overtake the mint that preceded it.
- At-least-once, and honest about itA reclaimed lease may redeliver. The alternative loses events, and a lost event is undetectable while a duplicate is something a consumer is built to tolerate. Every envelope carries a stable id.
What it includes
Retry with backoffTwelve attempts, then a dead letter a person can see and replay.
Lease-based claimingA relay that dies mid-publish does not strand a message.
Event cataloguePayments, allocations, issuance, distributions, corporate actions and redemptions.
What this deployment does not do
Stated plainly
The relay is complete and nothing schedules it, and no subscriber is registered. Outbound HTTP delivery is deliberately not written: it means requests to tenant-supplied URLs from inside the network, and SSRF egress control is on the not-mitigated list.
See it against something real.
Bring an instrument you are actually considering. Structuring it is the only way to judge whether the model fits.