# Notifier (Notifications Studio Host)

**Status:** Implemented
**Source:** `src/Notifier/`
**Owner:** Notify Guild

> **Note:** Notifier is the **deployment host** for the Notifications Studio. For the underlying notification toolkit (engine, storage, queue, connectors), see [`../notify/`](../notify/).

## Purpose

Notifier provides the deployable WebService and Worker that compose the Notify libraries into the Notifications Studio experience. It's the entry point for notification delivery, rule management, and delivery history.

## Latest Updates

- `2026-04-15`: production `Notifier` runtime no longer shadows the shared Notify persistence/queue stack with in-memory repositories.
- `2026-04-15`: pack-approval ingestion persists durably in `notify.pack_approvals` and uses durable `notify.locks` idempotency coordination.
- `2026-04-15`: restart-survival proof now exists via `NotifierDurableRuntimeProofTests`, covering submit -> persist -> process -> readback on real Postgres + Redis.
- `2026-04-16`: `NullNotifyEventQueue` is no longer available in `Development`; only the `Testing` environment may use the null queue fallback.
- `2026-04-16`: non-testing throttle and operator-override admin APIs now persist through PostgreSQL-backed suppression services and legacy compat adapters; restart-survival proof is covered by `NotifierSuppressionDurableRuntimeTests`.
- `2026-04-16`: non-testing escalation-policy and on-call schedule APIs now persist through PostgreSQL-backed services and legacy compat adapters; restart-survival proof is covered by `NotifierEscalationOnCallDurableRuntimeTests`.
- `2026-04-16`: non-testing quiet-hours calendars and maintenance windows now persist through PostgreSQL-backed runtime services and legacy compat adapters; restart-survival proof is covered by `NotifierQuietHoursMaintenanceDurableRuntimeTests`.
- `2026-04-16`: non-testing webhook security, tenant isolation, dead-letter administration, and retention cleanup state now persist through PostgreSQL-backed runtime services and legacy compat adapters; restart-survival proof is covered by `NotifierSecurityDeadLetterDurableRuntimeTests`.

## Relationship to Notify

| Component | Path | Purpose |
|-----------|------|---------|
| **Notify** | `src/Notify/` | Reusable toolkit: engine, models, connectors, queue |
| **Notifier** | `src/Notifier/` | Host: WebService and Worker that compose Notify |

Per **2025-11-02 module boundary decision**: Maintain separation for packaging, offline kit parity, and cross-module governance.

## Components

**Deployables:**
- `StellaOps.Notifier.WebService` - REST API for rules/channels CRUD, test send, delivery browsing
- `StellaOps.Notifier.Worker` - Event consumers, evaluators, renderers, delivery workers

**Integration Points:**
- Uses `StellaOps.Notify.Models`, `StellaOps.Notify.Queue`
- Channels: Slack, Teams, Email, Webhook (via Notify connectors)
- Storage: PostgreSQL (notify schema)
- Queue: Valkey Streams / NATS JetStream

## Related Documentation

- Notify Architecture: `../notify/architecture.md`
- Authority: `../authority/` (OAuth clients)
- Scheduler: `../scheduler/` (event sources)