Under the hood

Intake checks the HMAC signature against the raw bytes, stores the payload and headers in raw_events, acknowledges, and queues a job. A database trigger makes raw_events append-only. Messages with a bad signature are kept for audit but never queued.

-- Stored provider payloads are evidence: no edits, no deletes.
-- A row goes only with its tenant (ON DELETE CASCADE), and the tenant
-- is looked up in the table's own schema, never the caller's path.
CREATE OR REPLACE FUNCTION guard_append_only() RETURNS trigger
LANGUAGE plpgsql AS $$
DECLARE
  tenant_exists boolean;
BEGIN
  EXECUTE format(
    'SELECT EXISTS (SELECT 1 FROM %I.tenants WHERE id = $1)',
    TG_TABLE_SCHEMA
  ) INTO tenant_exists USING OLD.tenant_id;

  IF tenant_exists THEN
    RAISE EXCEPTION 'Audit records are append-only';
  END IF;
  RETURN OLD;
END;
$$;

CREATE TRIGGER raw_events_immutable
  BEFORE UPDATE OR DELETE ON raw_events
  FOR EACH ROW EXECUTE FUNCTION guard_append_only();

Simplified from the source for reading; behavior unchanged.