Treat Instagram notifications as verified observations

Event coverage must come from the approved product

A webhook design begins with the exact Instagram account type, provider application, permissions, subscribed resource, and event types that are authorized. DewEngine has not approved or implemented that path. Neither scraped polling nor provider-control evasion is accepted; anti-detection is rejected as well. Unsupported changes must remain documented gaps, while any claimed event waits for provider fixtures and consented real-account conformance.

Authenticate callbacks before tenant lookup

A future receiver should enforce HTTPS, request size and time limits, provider origin or signature validation where specified, safe parsing, and replay controls before accepting an observation. Verification challenges and production events belong to separate code paths. Raw callbacks may be retained briefly under a defined encrypted diagnostic policy, but credentials and unnecessary private content must not enter application logs, traces, metrics, or support search.

Resolve workspace and account from provider evidence

Inbound data must map to the exact connected account through an indexed provider-scoped identifier established at authorization. Customer-supplied workspace values inside a callback cannot be trusted. Unknown or retired identities should enter a bounded quarantine path instead of being attached by display name. Account fencing ensures that a late event from a prior grant cannot revive disconnected state or advance commands owned by a replacement identity.

Make repeated and delayed delivery harmless

Provider notifications may repeat, arrive late, or describe state older than a later observation. The ingest ledger needs an immutable provider event key or a documented deterministic substitute scoped to the account. Applying an event should compare native version or occurrence evidence rather than arrival order alone. Duplicate delivery can still create a delivery-attempt record, but it must not duplicate a message, post, workflow transition, or customer webhook.

Use a callback to trigger the right authoritative read

Some notifications may contain a complete resource; others may only say that something changed. The adapter manifest should label that distinction for each event. Hint events enqueue a bounded authorized read through the same account and quota controls, then create canonical state only after reconciliation. If the read fails or permission disappeared, the resource becomes delayed or degraded rather than being guessed from an incomplete callback payload.

Measure provider and customer delivery separately

Acceptance requires approved subscriptions, callback validation fixtures, unknown-account handling, duplicates, disorder, replay, large payloads, secret rotation, missed-interval recovery, account deletion, and every advertised event against consented accounts. DewEngine's outgoing webhooks then need their own signing, retries, dead-letter state, replay, fairness, and measured latency. A provider callback received quickly does not by itself prove a customer-facing real-time objective.

• Publish known event omissions and whether each payload is authoritative
• Track provider-ingest lag separately from outgoing webhook delivery lag