Alerts

#Channels

Owners and admins set a Slack incoming webhook, a Microsoft Teams incoming webhook (the URL of a Teams Workflows flow such as Send webhook alerts to a channel, which posts the Adaptive Card it receives) and a generic webhook in Settings > Alerts: each channel connects, is replaced and disconnects on its own (disconnecting forgets its saved address). Teams gets the same content as Slack: the rule and the act quoted, a signal alert's accuracy and its prompt for a coding agent, and a button that opens it in Duet Machines. A spike is at least 5 production occurrences in 24 hours and at least 3 times the daily mean of the 7 days before. An alert is recorded once per issue, kind and key, so it never repeats, and its delivery shows on the issue's timeline. Signals alert through the same channels.

Send test beside each saved channel sends it a test message (a signed webhook body has "event": "test") and shows exactly what the channel answered: delivered with its HTTP status, or the status and the channel's error (Slack answers no_service for a revoked webhook), or why it could not be reached. Once a channel is connected, choose Outcome-guard sample above the channels to send a sample of the outcome guard's alert, labeled a test.

Each member opts in to email for themselves in Settings > Profile and email, per kind: new issues, regressions, spikes, signal spikes and thresholds, new model verdicts and outcomes lost after a switch. Email needs the deployment's email provider; without one, Profile and email says Unavailable and nothing is sent.

#Verify webhook signatures

Webhook bodies are JSON. Each request carries X-Duet-Timestamp and X-Duet-Signature, which is sha256= followed by the hex HMAC-SHA256, keyed with your signing secret, of <X-Duet-Timestamp>.<body>. Recompute it over the raw body and reject requests whose signature differs or whose timestamp is old.