Anatomy of an Ingestion Envelope: Signing, Queueing and Fan-Out

An ingestion envelope is deliberately boring. It carries no payload content, no names, no account identifiers, only the structural shape of an event, signed so that its origin can be proven and its contents cannot be altered in flight.

The envelope

{
  "envelope_version": "1.0",
  "emitted_at": "2026-08-05T09:14:22.481Z",
  "source": {
    "institution_ref": "INST-4F2A",
    "node": "edge-lag-01",
    "protocol": "PERP"
  },
  "event": {
    "type": "settlement.handshake",
    "corridor": "domestic.nip",
    "status": "accepted",
    "value_band": "1e6-5e6",
    "currency": "NGN"
  },
  "identity": {
    "subject_hash": "9f86d081884c7d65...",
    "masking": "sha256/zk-edge"
  },
  "trace": {
    "packet_id": "01J9T7Z0M4Q2V8",
    "latency_ms": 14
  }
}

Note what is absent: no name, no phone number, no account number, no message content. subject_hash is produced at the edge, before the packet leaves the institution's boundary, and is one-way by construction.

Signature validation

Every envelope carries a detached HMAC-SHA256 signature over the raw body, keyed per institution. Validation happens before parsing:

import { createHmac, timingSafeEqual } from "node:crypto";

function verify(rawBody: string, header: string | null, secret: string): boolean {
  if (!header) return false;
  const expected = createHmac("sha256", secret).update(rawBody).digest("hex");
  const a = Buffer.from(header);
  const b = Buffer.from(expected);
  return a.length === b.length && timingSafeEqual(a, b);
}

Constant-time comparison is not a nicety here. A signature check that leaks timing is a signature check that eventually leaks the key.

Asynchronous fan-out

Accepted envelopes are acknowledged immediately and placed on a durable queue. Consumers subscribe independently, so a slow or unavailable consuming authority never applies backpressure to the emitting institution.

        ┌──────────────┐
        │  EDGE MIRROR │  (institution boundary, 14ms)
        └──────┬───────┘
               │ signed envelope
        ┌──────▼───────┐
        │  INGEST GATE │  verify → dedupe → ACK
        └──────┬───────┘
               │
        ┌──────▼───────┐
        │ DURABLE QUEUE│  retry w/ backoff → DLQ
        └──┬────┬───┬──┘
           │    │   │
        ┌──▼─┐┌─▼──┐┌▼───┐
        │ A  ││ B  ││ C  │  independent consumers
        └────┘└────┘└────┘

Each consumer maintains its own cursor. Replay is therefore a routine operation rather than an incident: a consumer that was offline for six hours simply resumes, and the queue's retention window covers the gap.

Failure semantics worth stating plainly

• At-least-once delivery. Consumers must be idempotent on packet_id.
• Dead-letter capture. Envelopes that fail validation or exhaust retries land in a DLQ with the rejection reason attached; they are never silently dropped.
• No synchronous coupling. The emitting institution's success does not depend on any consumer's availability.

The engineering thesis is unglamorous and load-bearing: a truth layer is only credible if it degrades without lying.