CloudEvents subscriber

Subscribe to platform events — decision-created, action-executed, outcome-observed, seal-anchored, and more. CloudEvents 1.0, HMAC-SHA256 signed, dead-letter retry, all documented.

Event types

Live today

Signature

HMAC-SHA256

Spec

CloudEvents 1.0

How to subscribe

Authenticate to the LUU API with your workspace API key.
POST /api/admin/attestation/subscriptions with { url, eventTypes, secret }.
We deliver every matching event to your URL with a X-LUU-Signature header.
Verify the HMAC-SHA256 signature using the secret you provided. ACK with HTTP 200 within 5 seconds.
On non-2xx, we retry per the policy below.

Reference receiver (Node.js)

// minimal Node receiver: verify signature + acknowledge fast
import express from "express";
import crypto from "crypto";

const app = express();
const SUB_SECRET = process.env.LUU_SUB_SECRET!;

app.post("/luu-events", express.raw({ type: "*/*" }), (req, res) => {
  const expected = crypto
    .createHmac("sha256", SUB_SECRET)
    .update(req.body)
    .digest("hex");
  const got = req.header("X-LUU-Signature") ?? "";
  const ok =
    got.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(got), Buffer.from(expected));
  if (!ok) return res.status(401).send("invalid signature");

  // ACK fast (LUU retries on >5s); enqueue real work
  res.status(200).end();
  process.nextTick(() => {
    const ev = JSON.parse(req.body.toString());
    enqueue(ev); // your downstream
  });
});

app.listen(8080);

Full reference at scripts/scoda-receiver-sample.ts in the repo.

Signature

Each delivery carries an X-LUU-Signature header. Compute HMAC-SHA256 over the raw request body using your subscription secret and compare. Use timing-safe comparison.

Header: X-LUU-Signature

Algorithm: HMAC-SHA256

Delivery & retry

Retry: Exponential backoff: 30s → 1m → 5m → 30m → 2h → 12h. Stops after 6 attempts.

DLQ: Failed deliveries land in the cloudEventsUndelivered table for manual replay via /admin/attestation/subscriptions.

Event types

org.luu.scoda.decision.createdDecision Record createdLIVE

Trigger: When a tenant logs a strategic decision via the SCO-DA API.

The most common event. Fires once per DecisionRecord create. Useful for downstream auditing, BI dashboards, or mirroring the decision into your own system of record.

Sample payload

{
  "specversion": "1.0",
  "id": "evt_2A8x9KCkR8",
  "source": "https://leadershipunderuncertainty.org/api/v1/scoda",
  "type": "org.luu.scoda.decision.created",
  "time": "2026-04-28T12:34:56.000Z",
  "datacontenttype": "application/json",
  "data": {
    "decisionId": "dec_3kJq2",
    "workspaceId": "ws_abc",
    "title": "Approve $5M renewable capex",
    "decidedAt": "2026-04-28T12:34:56.000Z",
    "rationaleHash": "sha256:f04...",
    "sealId": "seal_2026-04-28_42"
  }
}

org.luu.scoda.decision.updatedDecision Record updatedLIVE

Trigger: When a tenant amends an existing decision (e.g., updates rationale or status).

Includes the previous-version hash so consumers can chain updates. Order is guaranteed within a decision.

Sample payload

{
  "specversion": "1.0",
  "id": "evt_3B9y0LDlS9",
  "source": "https://leadershipunderuncertainty.org/api/v1/scoda",
  "type": "org.luu.scoda.decision.updated",
  "time": "2026-04-28T12:34:56.000Z",
  "data": {
    "decisionId": "dec_3kJq2",
    "previousHash": "sha256:f04...",
    "newHash": "sha256:9b1...",
    "updateSequence": 2
  }
}

org.luu.scoda.action.requestedAction RequestedLIVE

Trigger: When the strategic-cognition layer emits an action request to a downstream system.

Bridges the analytical layer to operational systems (Jira, Slack, ServiceNow).

Sample payload

{
  "specversion": "1.0",
  "id": "evt_4C0z1MEmT0",
  "source": "https://leadershipunderuncertainty.org/api/v1/scoda",
  "type": "org.luu.scoda.action.requested",
  "time": "2026-04-28T12:34:56.000Z",
  "data": {
    "actionId": "act_8nP4z",
    "decisionId": "dec_3kJq2",
    "targetSystem": "jira",
    "actionType": "create_initiative"
  }
}

org.luu.scoda.action.executedAction ExecutedLIVE

Trigger: When a downstream system reports back that the requested action ran.

Closes the loop on requested actions. Includes status (success/failure), execution latency, and external system reference.

Sample payload

{
  "specversion": "1.0",
  "id": "evt_5D1a2NFnU1",
  "source": "https://leadershipunderuncertainty.org/api/v1/scoda",
  "type": "org.luu.scoda.action.executed",
  "time": "2026-04-28T12:34:56.000Z",
  "data": {
    "actionId": "act_8nP4z",
    "status": "success",
    "externalRef": "JIRA-INIT-1234",
    "executedAt": "2026-04-28T12:34:56.000Z"
  }
}

org.luu.scoda.outcome.observedOutcome ObservedLIVE

Trigger: When a previously-decided question resolves with a measurable outcome.

Triggers Brier-score recomputation and Intelligence ROI updates.

Sample payload

{
  "specversion": "1.0",
  "id": "evt_6E2b3OGoV2",
  "source": "https://leadershipunderuncertainty.org/api/v1/scoda",
  "type": "org.luu.scoda.outcome.observed",
  "time": "2026-04-28T12:34:56.000Z",
  "data": {
    "decisionId": "dec_3kJq2",
    "observedOutcome": 1,
    "observedAt": "2026-04-28T12:34:56.000Z",
    "brierScore": 0.0625
  }
}

org.luu.scoda.aar.recordedAfter-Action Review recordedLIVE

Trigger: When a tenant logs a retrospective review of an executed decision.

Carries learnings, missed signals, and assumption updates. Important input for the metacognition learning loop.

Sample payload

{
  "specversion": "1.0",
  "id": "evt_7F3c4PHpW3",
  "source": "https://leadershipunderuncertainty.org/api/v1/scoda",
  "type": "org.luu.scoda.aar.recorded",
  "time": "2026-04-28T12:34:56.000Z",
  "data": {
    "aarId": "aar_9oQ5a",
    "decisionId": "dec_3kJq2",
    "learningCount": 3,
    "assumptionsUpdated": 1
  }
}

org.luu.scoda.seal.anchoredDaily Seal AnchoredLIVE

Trigger: When the daily Merkle seal commits to the public anchors GitHub repository.

The integrity event. Anyone listening can fetch the rootHash and verify forecasts against it.

Sample payload

{
  "specversion": "1.0",
  "id": "evt_8G4d5QIqX4",
  "source": "https://leadershipunderuncertainty.org/api/v1/scoda",
  "type": "org.luu.scoda.seal.anchored",
  "time": "2026-04-28T12:34:56.000Z",
  "data": {
    "dateKey": "2026-04-28",
    "rootHash": "0a174fc5e51aa19fb3cdd2a212228556240bd182341728834e369acddc604a80",
    "commitSha": "abc1234",
    "leafCount": 12
  }
}

org.luu.scoda.testTest eventLIVE

Trigger: Sent to webhook receivers when an admin clicks the 'Test' button in the subscriptions UI.

Use this to verify your receiver implementation without producing real platform activity.

Sample payload

{
  "specversion": "1.0",
  "id": "evt_TEST_synth",
  "source": "https://leadershipunderuncertainty.org/api/v1/scoda",
  "type": "org.luu.scoda.test",
  "time": "2026-04-28T12:34:56.000Z",
  "data": {
    "hello": "world",
    "subscriptionId": "sub_xyz"
  }
}

Why this matters

If you're building a GRC, audit, or BI surface that needs to know what AI-assisted decisions are happening in your tenant — these events are how you stream them out without polling. The same stream powers our internal admin dashboards. Your integration is structurally identical to ours.

Want this for your team?

Drop your email and we'll be in touch when access opens for your vertical.