# Notifier (Notifications Studio Host)

**Status:** Implemented
**Source:** `src/Notifier/`
**Owner:** Notify Guild

> **Note:** Notifier is the **deployment host** for the Notifications Studio. For the underlying notification toolkit (engine, storage, queue, connectors), see [`../notify/`](../notify/).

## Purpose

Notifier provides the deployable WebService and Worker that compose the Notify libraries into the Notifications Studio experience. It's the entry point for notification delivery, rule management, and delivery history.

## Latest Updates

- `2026-04-15`: production `Notifier` runtime no longer shadows the shared Notify persistence/queue stack with in-memory repositories.
- `2026-04-15`: pack-approval ingestion persists durably in `notify.pack_approvals` and uses durable `notify.locks` idempotency coordination.
- `2026-04-15`: restart-survival proof now exists via `NotifierDurableRuntimeProofTests`, covering submit -> persist -> process -> readback on real Postgres + Redis.
- `2026-04-16`: `NullNotifyEventQueue` is no longer available in `Development`; only the `Testing` environment may use the null queue fallback.
- `2026-04-16`: non-testing throttle and operator-override admin APIs now persist through PostgreSQL-backed suppression services and legacy compat adapters; restart-survival proof is covered by `NotifierSuppressionDurableRuntimeTests`.
- `2026-04-16`: non-testing escalation-policy and on-call schedule APIs now persist through PostgreSQL-backed services and legacy compat adapters; restart-survival proof is covered by `NotifierEscalationOnCallDurableRuntimeTests`.
- `2026-04-16`: non-testing quiet-hours calendars and maintenance windows now persist through PostgreSQL-backed runtime services and legacy compat adapters; restart-survival proof is covered by `NotifierQuietHoursMaintenanceDurableRuntimeTests`.
- `2026-04-20`: compat `/api/v2/notify/quiet-hours/*` schedules that persist non-projectable cron expressions now evaluate natively after restart, and canonical `/api/v2/quiet-hours/calendars/*` reads surface the original `cronExpression` and `duration` metadata instead of leaving those schedules as inert `00:00` placeholders.
- `2026-04-16`: non-testing webhook security, tenant isolation, dead-letter administration, and retention cleanup state now persist through PostgreSQL-backed runtime services and legacy compat adapters; restart-survival proof is covered by `NotifierSecurityDeadLetterDurableRuntimeTests`.
- `2026-04-20`: non-testing worker dispatch now composes adapter-backed `Email`, `PagerDuty`, and `OpsGenie` delivery channels alongside webhook/chat dispatch, and durable delivery persistence now preserves provider `externalId` plus `incidentId` metadata for restart-safe external acknowledgements.
- `2026-04-20`: PagerDuty and OpsGenie inbound acknowledgement webhooks no longer depend on a process-local bridge map; restart-survival proof is covered by `NotifierAckBridgeRuntimeDurableTests` and live worker DI proof by `NotifierWorkerHostWiringTests`.
- `2026-04-20`: legacy `/api/v2/notify/simulate*` endpoints now use the same DI-composed simulation runtime as `/api/v2/simulate*`, and maintenance-window suppression parity is covered by `SimulationEndpointsBehaviorTests.LegacySingleEventSimulation_UsesQuietHoursEvaluator_ForMaintenanceSuppression`.
- `2026-04-20`: the live Notifier worker now composes scheduled digest services through `AddDigestServices(...)`; `DigestScheduleRunner` resolves tenant IDs from schedule configuration instead of the in-memory tenant stub, and worker-host proof is covered by `NotifierWorkerHostWiringTests`.
- `2026-04-20`: the orphaned cron-based `IDigestScheduler` path was retired from the worker. Scheduled digests are now documented as configuration-driven only, while `/digests` remains the admin surface for open digest windows rather than schedule CRUD.
- `2026-04-20`: WebService startup now registers durable quiet-hours, suppression, escalation/on-call compat, security, and dead-letter services directly for non-testing hosts. The remaining in-memory variants are isolated to the `Testing` environment, and startup-contract proof lives in `StartupDependencyWiringTests`.

## Relationship to Notify

| Component | Path | Purpose |
|-----------|------|---------|
| **Notify** | `src/Notify/` | Reusable toolkit: engine, models, connectors, queue |
| **Notifier** | `src/Notifier/` | Host: WebService and Worker that compose Notify |

Per **2025-11-02 module boundary decision**: Maintain separation for packaging, offline kit parity, and cross-module governance.

## Components

**Deployables:**
- `StellaOps.Notifier.WebService` - REST API for rules/channels CRUD, test send, delivery browsing
- `StellaOps.Notifier.Worker` - Event consumers, evaluators, renderers, delivery workers

**Integration Points:**
- Uses `StellaOps.Notify.Models`, `StellaOps.Notify.Queue`
- Channels: Slack, Teams, Email, Webhook, PagerDuty, OpsGenie
- Storage: PostgreSQL (notify schema)
- Queue: Valkey Streams / NATS JetStream

## Related Documentation

- Notify Architecture: `../notify/architecture.md`
- Authority: `../authority/` (OAuth clients)
- Scheduler: `../scheduler/` (event sources)