hmac verification looks correct against the docs but test it against real live deliveries. the timestamp never gets validated, so captured payloads could replay if zenrows doesn't check freshness server side

watch loop only treats completed and stopped as terminal, so verify whether failed and deleted need handling before leaving this running. polling ceilings are best effort since in-flight tasks overshoot, so use api key credit caps as your actual backstop with a buffer