# Implementation plan — Notify

## Delivery phases
- **Phase 1 – Core rules engine & delivery ledger**  
  Implement rules/channels schema, event ingestion, rule evaluation, idempotent deliveries, and audit logging.
- **Phase 2 – Connectors & rendering**  
  Ship Slack/Teams/Email/Webhook connectors, template rendering, localization, throttling, retries, and secret referencing.
- **Phase 3 – Console & CLI authoring**  
  Provide UI/CLI for rule authoring, previews, channel health, delivery browsing, digests, and test sends.
- **Phase 4 – Governance & observability**  
  Add approvals, RBAC, tenant quotas, Notify metrics/logs/traces, dashboards, Notify-specific alerts, and Notify runbooks.
- **Phase 5 – Offline & compliance**  
  Produce Offline Kit bundles (rules/channels/deploy scripts), signed exports, retention policies, and auditing for regulated environments.

## Work breakdown
- **Service & worker**
  - REST API for rules/channels/delivery history, idempotency middleware, digest scheduler.
  - Worker pipelines for event intake, rule matching, template rendering, delivery execution, retries, and throttling.
  - Delivery ledger capturing payload metadata, response, retry state, DSSE signatures.
- **Connectors**
  - Slack/Teams/Email/Webhook plug-ins with configuration validation, rate limiting, error classification.
  - Secrets referenced via Authority/Secret store; no plaintext storage.
- **Console & CLI**
  - Console module for rules builder, condition editor, preview, test send, delivery insights, digests and schedule configuration.
  - CLI (`stella notify rule|channel|delivery`) for automation, export/import.
- **Integrations**
  - Event sources: Concelier, Excititor, Policy Engine, Vuln Explorer, Export Center, Attestor, Zastava, Scheduler.
  - Notify events to Notify (meta) for failure escalations, accepted-risk expiration reminders.
- **Observability & ops**
  - Metrics: delivery success/failure, retry counts, throttle hits, digest generation, channel health.
  - Logs/traces with tenant, rule ID, channel, correlation ID; dashboards and alerts.
  - Runbooks for misconfigured channels, throttling, event backlog, incident digest.
- **Docs & compliance**
  - Update Notifications Studio guides, channel runbooks, security/RBAC docs, Offline Kit instructions.
  - Provide compliance checklist (audit logging, retention, opt-out).

## Acceptance criteria
- Rules evaluate deterministically per event; deliveries idempotent with audit trail and DSSE signatures.
- Channel connectors support retries, rate limits, health checks, previews; secrets referenced securely.
- Console/CLI support rule creation, testing, digests, delivery browsing, and export/import workflows.
- Observability dashboards track delivery health; alerts fire for sustained failures or backlog; runbooks cover remediation.
- Offline Kit bundle contains configs, rules, digests, and deployment scripts for air-gapped installs.
- Notify respects tenancy and RBAC; governance (approvals, change log) enforced for high-impact rules.

## Risks & mitigations
- **Notification storms:** throttling, digests, dedupe windows, preview/test gating.
- **Secret compromise:** secret references only, rotation workflows, audit logging.
- **Connector API changes:** versioned adapter layer, nightly health checks, fallback channels.
- **Noise vs signal:** simulation previews, metrics, rule scoring, recommended defaults.
- **Offline parity:** export/import of rules, connectors, and digests with signed manifests.

## Test strategy
- **Unit:** rule evaluation, template rendering, connector clients, throttling, digests.
- **Integration:** end-to-end events from core services, multi-channel routing, retries, audit logging.
- **Performance:** burst throttling, digest creation, large rule sets.
- **Security:** RBAC tests, tenant isolation, secret reference validation, DSSE signature verification.
- **Offline:** export/import round-trips, Offline Kit deployment, manual delivery replay.

## Definition of done
- Notify service, workers, connectors, Console/CLI, observability, and Offline Kit assets shipped with documentation and runbooks.
- Compliance checklist appended to docs; ./TASKS.md and ../../TASKS.md updated with progress.