Matter creation must have a real Git writer even if the higher-level forge is local. The content variables only relocate
the read-only files baked into the image. Navigator MCP uses NullRouter without the GCP project; contract review uses
StubContractReviewer without the same Vertex coordinates. The on-chain backend defaults to null, recording no
transaction. Scheduled cost and billing diagnostics stay disabled when their table or recipient variables are absent.
The GitHub webhook receiver is the exception to that degrade-quietly pattern, and where it runs is deliberate. It is
served at POST workflows.<domain>/webhooks/github/{secret} by workflows-service, on its own Axum listener
(WORKFLOWS_WEBHOOK_LISTEN, 9082) beside the worker's Restate endpoint; the Envoy sidecar routes /webhooks/github/*
to that listener and every other path to the Restate leg. It runs on the workflows host, not on www, because www
remains behind the firm's Tailscale tailnet perimeter — and GitHub, an external sender that cannot join a tailnet, can
only reach a public host. That split is the rule worth remembering: the tailnet protects the human surface (www, the
portal, the workbench), while a machine caller's endpoint stays public and is authenticated by the signature it carries,
not by the network it arrives from. GitHub signs each delivery, so the receiver verifies X-Hub-Signature-256 against
the raw body — which is why the Envoy leg to it stays HTTP/1.1 end to end and forwards the bytes unaltered.
Startup still requires the webhook secret, canonical repository, GitHub org, and app login, and RESTATE_INGRESS_URL
plus RESTATE_AUTH_TOKEN: a receiver that cannot verify a delivery or reach the Restate ingress has no safe reduced
mode. It is still one worker process — there is no separate receiver container — but it now owns a second listener port
that Envoy fronts, rather than sharing web's. The DevX Slack services DevxIssueTriage and devx-pr fold into
workflows-service alongside the legal workflows and the receiver; they alone read SLACK_WEBHOOK_URL and fail closed
when Slack is absent so Restate can retry instead of acknowledging a lost engineering notice. Only rows with the
explicit NAVIGATOR_GITHUB_AUTOMATION_HOME capability may mount the receiver or bind the GitHub services. Those rows
also require positive NAVIGATOR_GITHUB_MAX_CONCURRENT, NAVIGATOR_GITHUB_MAX_REVISE_ROUNDS, and
NAVIGATOR_GITHUB_MAX_DAILY_TOKENS values; the singleton devx-guardrails/global object serializes reservations,
defers work at the concurrency cap, and pauses new token reservations through the UTC-day reset. Unmarked rows do not
bind that object or read these limits.
The receiver watches the canonical source repository and the organization configured for the marked row. A delivery is
accepted when it comes from that canonical repository or a repository owned by the configured organization.