Problem
The central Orb App (gittensory-api) shows GitHub webhook delivery failures (Recent Deliveries) on bursty events (check_suite/check_run), yet every event is recorded status:"received" in orb_webhook_events (verified in cloud D1: all recent rows received, zero errors).
Root cause: handleOrbWebhook awaits forwardOrbEvent before returning the 202. In push mode that forward POSTs to the brokered self-host's relay URL with a 10s timeout (relay.ts AbortSignal.timeout(10_000)); a slow path (e.g. a Tailscale-Funnel container) pushes the Orb's response past GitHub's ~10s delivery deadline → GitHub marks the delivery FAILED, even though the Orb received + queued the event.
Fix
ACK GitHub immediately; run the relay forward (and its orb_relay_failures persistence for the retry cron) AFTER the response via executionCtx.waitUntil (fire-and-forget fallback where no execution context exists). Extracted into a fail-safe relayForward helper. No event is lost (waitUntil keeps the Worker alive; retry cron + self-host pull-sweep backstop). Fixed in #1620-to-be (fix/orb-ack-before-relay-forward).
Follow-up to evaluate: a tailnet self-host is arguably better served by pull mode than push (registerOrbRelayTarget defaults to push).
Problem
The central Orb App (
gittensory-api) shows GitHub webhook delivery failures (Recent Deliveries) on bursty events (check_suite/check_run), yet every event is recordedstatus:"received"inorb_webhook_events(verified in cloud D1: all recent rows received, zero errors).Root cause:
handleOrbWebhookawaitsforwardOrbEventbefore returning the 202. In push mode that forward POSTs to the brokered self-host's relay URL with a 10s timeout (relay.tsAbortSignal.timeout(10_000)); a slow path (e.g. a Tailscale-Funnel container) pushes the Orb's response past GitHub's ~10s delivery deadline → GitHub marks the delivery FAILED, even though the Orb received + queued the event.Fix
ACK GitHub immediately; run the relay forward (and its
orb_relay_failurespersistence for the retry cron) AFTER the response viaexecutionCtx.waitUntil(fire-and-forget fallback where no execution context exists). Extracted into a fail-saferelayForwardhelper. No event is lost (waitUntil keeps the Worker alive; retry cron + self-host pull-sweep backstop). Fixed in #1620-to-be (fix/orb-ack-before-relay-forward).Follow-up to evaluate: a tailnet self-host is arguably better served by pull mode than push (registerOrbRelayTarget defaults to push).