[Product/Roadmap] Triggers/webhooks + qveris listen

[linfangw]

This issue now tracks only the public client work for triggers/webhooks and a local qveris listen forwarder.

Per-user OAuth lifecycle work is tracked by #200, #227, and #228. Hosted MCP rollout is no longer tracked by this issue.

Status: blocked

Toolkit implementation must wait for a stable, public triggers/webhooks contract. Do not introduce guessed endpoints, event schemas, signatures, retry behavior, or CLI commands before that contract is available.

Scope

• Discover supported trigger types and their required configuration.
• Create, inspect, list, and delete trigger subscriptions.
• Receive signed webhook deliveries with documented verification, retry, idempotency, and deduplication semantics.
• Add a Stripe-CLI-style qveris listen command that forwards deliveries to a local target.
• Keep CLI, MCP, JavaScript SDK, and Python SDK behavior aligned where the public contract applies.

Start conditions

• Public OpenAPI or equivalent documentation defines trigger types, subscriptions, delivery payloads, and errors.
• Webhook signature verification, timestamp tolerance, retry, and idempotency rules are published.
• Stable test credentials and deterministic fixtures are available on every supported public deployment.
• The lifecycle and security model for local forwarding is documented.

Acceptance criteria

• Contract tests cover subscription lifecycle and representative delivery failures.
• Signature verification rejects invalid, expired, and replayed deliveries.
• qveris listen forwards valid events, reports actionable errors, and never logs credentials or signing secrets.
• Duplicate deliveries can be identified without dropping legitimate events.
• Public docs and examples match the deployed contract.

Out of scope

• Per-user OAuth, Device Flow, token refresh, and Agent delegation.
• Hosted MCP deployment or operations.
• Server-side trigger execution, webhook delivery infrastructure, or unpublished protocol behavior.

[linfangw]

更新:第 1 项(per-end-user OAuth / connected accounts)与第 3 项(hosted MCP endpoint mcp.qveris.ai)已从本跟踪 issue 拆出,各自作为独立的上游产品 feature issue推进(私有产品跟踪仓),优先级分别定为 P1 与 P2——OAuth 是最大的功能差距且是 hosted MCP 差异化价值的前置,hosted MCP 因底层 HTTP transport(#139)/发现文档(#140)已就绪、v1 可用 API Key 鉴权先行,故可与 OAuth 并行起步。

第 2 项(triggers/webhooks + qveris listen)仍留在本 issue 跟踪。toolkit 侧改动一律待对应服务端合同稳定后再动。

[ax2]

统一身份方案已建立客户端实施 issue #200，覆盖 API Key/OAuth Device Flow/Agent Delegation 的 CredentialProvider、安全存储、自动刷新和 CLI login/status/logout。#164 继续跟踪更大的产品路线图（connected accounts、triggers、hosted MCP）；#200 只负责 QVeris 自身统一授权协议的 SDK/CLI 接入，避免与 per-end-user third-party connected accounts 混淆。

[linfangw]

Status recheck against public API contract 2026-07-22.1:

• No public trigger type, subscription lifecycle, webhook delivery, signature, retry, or idempotency endpoint/schema is declared.
• No deterministic webhook fixture or local-forwarding security contract is available in this repository.

The issue remains correctly blocked. No CLI/MCP/SDK implementation should begin yet.