[shuv1337]

Summary

• Add an optional self-host operator feedback webhook, independent of usage analytics. EXECUTOR_FEEDBACK_WEBHOOK_URL and optional EXECUTOR_FEEDBACK_WEBHOOK_SECRET configure delivery; no setting preserves existing analytics/disabled behavior.
• Await a 2xx response, bound delivery to 10 seconds, refuse redirects, and return sanitized FeedbackUnavailable on failure. Include submission time, organization, authenticated user/email, available caller attribution and instance origin. Generic title/body support notification receivers without another service.
• Keep the production change isolated to a new self-host module and its route wiring. No schema migration; receiver owns retention. Update operator/agent docs and keep the fork's CI running the focused scenarios.

Verification

• Five focused real self-host scenarios passed: both new webhook cases, analytics fallback, analytics opt-out, and hosted feedback contract.
• Covers bearer set/unset, analytics off, rejection, timeout, redirect refusal, no early acceptance, API/app caller attribution and secret-free server logs.
• Mutation check: temporarily accepting receiver failures made the test fail (expected 503, got 200); reverted.
• bun run check, actionlint, and the packaged-image regression passed on 512237ad62b57c1f6ce130dea138f3652124788a.
• New named Docker scenario: released image delivers operator feedback with analytics disabled (run via e2e/docker-release.config.ts, not the normal self-host suite).
• Opus review found workerd rejects redirect: "error"; fixed to manual, added native-image regression coverage and addressed the nonblocking docs/logging/origin/test findings. Native-image verification passed: actual Go/workerd product accepted the attributed payload with analytics off and refused redirects and 503 responses. No remaining known review finding.

Deployment

Own fork only. Live image currently has no PostHog destination and no webhook, so feedback is disabled rather than reaching upstream. A persistent SHark receiver has been created with its URL stored privately; production wiring/deployment follows green CI. No ports, firewall, network, allowlist or tunnel changes.

feedback-webhook.spec.ts
feedback.spec.ts
instance-analytics.spec.ts

[shuv1337]

Opus high-effort review completed. Its sole blocker (workerd rejects redirect:"error") is fixed using manual redirects and the existing non-2xx rejection. Also addressed origin reuse, safe failure logging, startup validation, docs, per-delivery key semantics, 302 coverage, caller attribution and log leakage assertions. Verification on head 512237a: bun run check passed; five focused self-host cases passed; the new packaged Docker scenario passed (actual Go/workerd product, analytics off, accepted payload/identity, 302 and 503 refused). The image test uses a network-none container and an HTTP driver in that same namespace, with no published ports. CI remains the merge gate.

[shuv1337]

Deployed to the self-host instance at 12:27 PST on November 12. Live tools.executor.feedback.submit with "feedback sink test, ignore" returned accepted. The persistent SHark receiver logged the exact test text and sender under title "Executor feedback" at 12:28 PST, with 5 device deliveries accepted. Analytics remain off. Configured EXECUTOR_FEEDBACK_WEBHOOK_URL only; optional bearer secret not needed. Public/loopback health 200, zero restarts. Product and Motel backups verified on-host and off-box; current volumes preserved. No port, network, firewall, allowlist, proxy or tunnel settings changed; other container identities unchanged. Own-DB feedback retention remains a documented follow-up (SHark retains the truncated notification).