Routine Chaining & Webhook Security

For advanced operations and engineering teams, Tishtar supports multi-agent routine chaining and cryptographically signed incoming/outgoing webhooks.

---

1. Composable Routine Chaining (Multi-Agent Pipelines)

Instead of cramming ten unrelated tasks into a single giant prompt, you can chain specialized routines together where the verified output of Routine A automatically triggers and feeds Routine B:

[Routine A: Competitor Price & Stock Watcher]
       │  (Fires only when price drop > 5% is detected)
       ▼
[Routine B: Ad Copy & Promo Hook Generator]
       │  (Drafts counter-offer campaign copy)
       ▼
[Destination: Telegram Marketing Channel + Google Sheets]

Why Chain Routines?

1. Drop Efficiency: Routine B only wakes up and consumes Drops when Routine A detects a real delta change.
2. Modular Isolation: Each routine maintains its own focused skill persona and sliding memory.

---

2. Incoming Event Triggers (Webhook-In)

Every routine can generate a unique Incoming Webhook URL. Sending an HTTP POST request with a JSON body to this URL wakes up the routine immediately and injects your payload into the Sources Block:

curl -X POST "https://api.tishtar.app/api/v1/hooks/trigger/rt_982410" \
  -H "Authorization: Bearer YOUR_TRIGGER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"event": "new_competitor_url", "url": "https://example.com/pricing"}'

---

3. Verifying Outgoing Webhook Signatures (X-Tishtar-Signature)

When Tishtar dispatches results to your backend webhook endpoint, it signs the raw JSON request body using HMAC-SHA256 with your endpoint’s secret key.

Node.js / TypeScript Verification Example

import crypto from 'node:crypto';

export function verifyTishtarWebhook(
  rawBody: string,
  signatureHeader: string,
  webhookSecret: string
): boolean {
  const expectedSignature = crypto
    .createHmac('sha256', webhookSecret)
    .update(rawBody, 'utf8')
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(signatureHeader, 'hex'),
    Buffer.from(expectedSignature, 'hex')
  );
}

Python Verification Example

import hmac
import hashlib

def verify_tishtar_webhook(raw_body: bytes, signature_header: str, secret: str) -> bool:
    expected = hmac.new(
        secret.encode("utf-8"),
        msg=raw_body,
        digestmod=hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, signature_header)