One red flag. One next test.
Stated scenario
A synthetic webhook workflow receives a support request containing event_id: evt_demo_1042, creates a ticket record, and returns an acknowledgement. The sender may retry the same event if the acknowledgement is delayed.
A retry can create a duplicate ticket.
Evidence in the supplied synthetic artifact: the path writes a new record immediately after the webhook, and the supplied path shows no lookup, uniqueness check, or idempotency decision using event_id before that write.
Inference: if the sender retries evt_demo_1042, the workflow may execute the write again. This is a risk hypothesis, not proof that a duplicate has occurred.
Why it matters: two tickets for one request can split ownership and trigger conflicting replies.
Replay the exact same synthetic event twice.
Send the same fully synthetic payload twice with event_id: evt_demo_1042.
Observable pass condition: after both executions, exactly one ticket record exists for evt_demo_1042; the second execution is visibly classified as a duplicate and creates no additional record.
This sample intentionally stops here. Implementation, production access, and an exhaustive audit are outside the USD 5 scope.
Request a USD 5 check