[blaipr]

A new notifications item tells another system what happened to an application. Every send goes out from this instance; nothing has to reach in.

Events (one per run, so one change never arrives twice): drift_detected (with reverted when auto_sync put it back), out_of_sync, sync_succeeded (with cause: commit or rollback), sync_failed, back_in_sync. Drift and commits are told apart by the commit the application was last in sync at. State-like events fire on entering the state, not on every check.

Types, each with its own block (a block of another type fails the configuration):

• webhook: any receiver; auth bearer, basic, none or {header: Name}; fixed headers; a body template with {{field}} placeholders checked at load; optional HMAC-SHA256 signing.
• ascender and awx: a job template or workflow job template, through its own webhook receiver (GitLab mode: the template's key, no user) or its launch API (a user's token, extra_vars, and a send that fails when the controller ignored them for lack of "Prompt on launch"). Checked against the receiver code of ctrliq/ascender and ansible/awx.

Message: event, application, status before and after, cause, commit, applied count, changes (kind, key, operation, names of changed fields, never values), first errors, time, UI link.

Sending: a bounded queue and a worker (8 at a time) so a run never waits; retries with backoff on no answer, 429 and 5xx, not on 4xx; redirects never followed; errors never carry the URL. GET /api/v1/notifications lists each with its last send, POST /api/v1/notifications/{id}/test sends a test now. Metrics unified_gitops_notifications_total and _duration_seconds. Notifications reload like applications and appear in the config API's summary and reload report.

Docs: docs/notifications.md, plus configuration, API, observability, README and CHANGELOG. 24 new tests (event detection, message, templates, each type's request, launch answers, retries, loader, end to end through the router, the real HTTP client against a local receiver).