Signed, at-least-once, replayable.

Signature

Every delivery carries an X-Locus-Signature header. Verify it before trusting the body; reject clock skew over 5 minutes (replay protection). Each endpoint has its own secret, rotatable with the same dual-validity pattern as API keys.

X-Locus-Signature: t=<unix>,v1=hex(hmac_sha256(secret, t + "." + body))

Delivery semantics

• At-least-once, exponential backoff: 8 attempts over 24 hours.
• The dead-letter queue is visible in the console, with manual redrive.
• Event ids double as idempotency keys for receivers; dedupe on them.
• The envelope is versioned like every other schema.

Event types (v1)

• bulk.job.completed a scheduled bulk job finished; the manifest is ready (wave 2)
• monitor.change.detected a watched location changed between vintages (after the second NFHL vintage)
• key.expiring a key approaches its max age; rotate ahead of cutoff