Zero-Drift HMAC Webhook Verifier (MIC-01-HMAC)

[CORE IDENTITY] A cryptographic webhook security micro-cartridge that enforces HMAC-SHA256 signature verification on every inbound webhook — eliminating spoofed payload injection and replay attacks at the perimeter.

[TECHNICAL SPECIFICATIONS]

• Framework / Stack: HMAC-SHA256 signature verifier, timestamp drift validator, replay attack prevention window, Fastify/Express middleware integration
• Input Parameters: Webhook secret, signature header key, acceptable timestamp drift window
• Output / Execution: Cryptographically verified webhook acceptance or rejection with zero-drift timestamp enforcement and audit log

[DEPLOYMENT CONTEXT]

• Primary Environment: Node.js webhook receivers — Fastify, Express
• Target Persona: Backend Engineers securing webhook endpoints, Security Teams enforcing cryptographic origin verification

[SOVEREIGN COMPLIANCE] Instant digital fulfillment via automated webhooks.