Matter creation must have a real Git writer even if the higher-level forge is local. The content variables only relocate
the read-only files baked into the image. Navigator MCP uses NullRouter without the GCP project; contract review uses
StubContractReviewer without the same Vertex coordinates. The on-chain backend defaults to null, recording no
transaction. Scheduled cost and billing diagnostics stay disabled when their table or recipient variables are absent.
The GitHub webhook receiver is the exception to that degrade-quietly pattern, and where it runs is deliberate. It is
served at POST workflows.<domain>/webhooks/github/{secret} by workflows-service, on its own Axum listener
(WORKFLOWS_WEBHOOK_LISTEN, 9082) beside the worker's Restate endpoint; the Envoy sidecar routes /webhooks/github/*
to that listener and every other path to the Restate leg. It runs on the workflows host, not on www, because www
remains behind the firm's Tailscale tailnet perimeter — and GitHub, an external sender that cannot join a tailnet, can
only reach a public host. That split is the rule worth remembering: the tailnet protects the human surface (www, the
portal, the workbench), while a machine caller's endpoint stays public and is authenticated by the signature it carries,
not by the network it arrives from. GitHub signs each delivery, so the receiver verifies X-Hub-Signature-256 against
the raw body — which is why the Envoy leg to it stays HTTP/1.1 end to end and forwards the bytes unaltered.
Startup still requires the webhook secret, canonical repository, GitHub org, and app login, and RESTATE_INGRESS_URL
plus RESTATE_AUTH_TOKEN: a receiver that cannot verify a delivery or reach the Restate ingress has no safe reduced
mode. It is still one worker process — there is no separate receiver container — but it now owns a second listener port
that Envoy fronts, rather than sharing web's. The DevX Slack services DevxIssueTriage and devx-pr fold into
workflows-service alongside the legal workflows and the receiver; they alone read SLACK_WEBHOOK_URL and fail closed
when Slack is absent so Restate can retry instead of acknowledging a lost engineering notice. Only neon-law-stg is
allowed to mount the receiver or bind the GitHub services. It also requires positive NAVIGATOR_GITHUB_MAX_CONCURRENT,
NAVIGATOR_GITHUB_MAX_REVISE_ROUNDS, and NAVIGATOR_GITHUB_MAX_DAILY_TOKENS values: its singleton
devx-guardrails/global object serializes all reservations, defers work at the concurrency cap, and pauses new token
reservations through the UTC-day reset. Other deployments do not bind that object or read these limits.
The receiver watches two GitHub owners. The product code lives at github.com/neon-law/navigator and is always watched;
the firm's private per-Project repos live under github.com/neon-law-firm/<projects.code>, where neon-law-firm is
NAVIGATOR_GITHUB_ORG. A delivery is accepted when it comes from the canonical code repository or any repo owned by
that org.