Reconcile the iLert operator alert stream

.env.example

@@ -26,14 +26,41 @@ POSTIL_SESSION_SECRET=
 # settings page. Generate: openssl rand -hex 32
 GITHUB_WEBHOOK_SECRET=
 
-# Optional iLert outbound alert receiver. Generate a random password with
-# `openssl rand -hex 32`, set it here, and configure the iLert webhook URL as
-# https://postil-ilert:<URL-encoded-password>@<your-host>/api/webhooks/ilert.
-# Select alert-created, alert-assigned, alert-auto-escalated,
-# alert-auto-resolved, alert-acknowledged, alert-rejected, alert-raised, and
-# alert-resolved as trigger events. Leave unset to make the endpoint return 404.
+# iLert webhook receiver password. Generate with `openssl rand -hex 32`. The
+# reconciliation workflow loads this value from the secret record that also
+# supplies the deployed receiver's runtime secret. The reconciler embeds
+# URL-encoded HTTP Basic credentials for `postil-ilert` and this value in the
+# webhook URL.
+# Do not configure a custom `Authorization` header. Select alert-created,
+# alert-acknowledged, alert-comment-added, and alert-resolved trigger events.
+# Deployment preserves existing runtime secrets and stages no credential.
+# Disable iLert delivery through the managed alert-action configuration, and
+# revoke receiver access by rotating this credential under the applicable
+# change controls.
 POSTIL_ILERT_WEBHOOK_SECRET=
 
+# Canonical HTTPS origin of the deployed receiver. The reconciler accepts only
+# an origin without credentials, path, query, or fragment, and appends the
+# fixed `/api/webhooks/ilert` path.
+POSTIL_ILERT_RECEIVER_ORIGIN=https://your-host
+
+# Numeric iLert alert source identity. Configure this as the
+# `POSTIL_ILERT_ALERT_SOURCE_ID` GitHub Actions variable for the production
+# monitor, not as a secret. It selects the source whose Webhook alert action is
+# reconciled and verified.
+POSTIL_ILERT_ALERT_SOURCE_ID=
+
+# Workflow-only identity for live reconciliation and cancellation cleanup.
+# `--canary` and every `--finalize-canary` invocation require this identity and
+# scoped iLert management credentials. Finalization always performs a mandatory
+# terminal management sweep, including after the primary canary proves cleanup,
+# so it can resolve a delayed Event API duplicate. Each rerun uses a distinct
+# main alert key. The workflow carries the producer attempt to the finalizer
+# after an accepted ALERT; its running attempt is the sweep ceiling.
+# POSTIL_ILERT_CANARY_RUN_ID=
+# POSTIL_ILERT_CANARY_RUN_ATTEMPT=
+# POSTIL_ILERT_CANARY_SWEEP_ATTEMPT=
+
 # Numeric GitHub ids allowed to use operator-only surfaces. The alert stream
 # also requires a renewable `postil login` access token for an allowlisted id.
 POSTIL_OPERATOR_GITHUB_IDS=
@@ -163,6 +190,12 @@ POSTIL_CACHE_DIR=.cache
 # opens one private incident without stopping other monitor checks.
 POSTIL_MONITOR_INTERVAL_MS=300000
 POSTIL_MONITOR_ALERT_STATE_PATH=/var/lib/postil-monitor/alert-state.json
+# Optional iLert Event API integration credential for the monitor alert source.
+# The monitor and canary use it to send ALERT and RESOLVE events; it is not a
+# management API bearer credential. The monitor starts without it; each alert
+# delivery attempt then fails with a configuration error and stays queued for
+# retry until the key is set.
+# ILERT_INTEGRATION_KEY=
 # OPENROUTER_MANAGEMENT_API_KEY=
 # POSTIL_OPENROUTER_DEVELOPMENT_KEY_NAME=
 # POSTIL_OPENROUTER_PRODUCTION_KEY_NAME=

.github/actions/ilert-event/action.yml

@@ -22,7 +22,9 @@ inputs:
   require-delivery:
     description: >-
       Fail when no integration key is configured instead of recording the
-      undelivered event. Use for alerts whose delivery must be observable.
+      undelivered event. Production failure alerts, recovery resolves, and
+      delivery tests set this to true. False is reserved for explicitly
+      optional events that do not describe a production failure.
     required: false
     default: "false"
 
@@ -99,6 +101,7 @@ runs:
           --max-time 15 \
           --retry 3 \
           --retry-delay 5 \
+          --retry-max-time 45 \
           --retry-all-errors \
           --header 'Content-Type: application/json' \
           --data @"${RUNNER_TEMP}/ilert-event.json" \

.github/workflows/ci.yml

@@ -59,7 +59,10 @@ jobs:
           POSTIL_TEST_DATABASE_URL: postgresql://postgres@localhost:5432/postgres
           POSTIL_SEALING_KEY: 000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f
       - name: Verify event-driven iLert operator alerts on fresh Postgres
-        run: bun test --isolate tests/ilert-alert-stream.test.ts
+        run: >-
+          bun test --isolate
+          tests/ilert-alert-stream.test.ts
+          tests/ilert-canary-alert-key-migration.test.ts
         env:
           POSTIL_TEST_DATABASE_URL: postgresql://postgres@localhost:5432/postgres
       - run: bun test tests/model-override-migration.test.ts