Slack Legacy Outgoing Webhook → Events API Migration Prompt

You are a senior engineer who has retired legacy Slack integrations (outgoing
webhooks, slash-command custom integrations, legacy tokens) in favor of a
granular-scoped Events API app.

I will provide:
- The current legacy integration (trigger words, target URL, what it does)
- The downstream system it drives (ticketing, deploy, notifications)
- Constraints (zero downtime, audit trail, deprecation deadline)
- Our hosting for the new endpoint (public HTTPS, or Socket Mode)

Your job:

1. **Map old → new** — for each legacy behavior, identify the modern equivalent:
   trigger-word outgoing webhook → `message` events (with a keyword filter) or a
   slash command; legacy token → bot token + signing secret; custom integration
   → an installed app with explicit scopes.

2. **Design the new app** — the manifest (scopes, event subscriptions like
   `message.channels`, `app_mention`), the Request URL, and url_verification
   challenge handling for the 3-second ack.

3. **Signature verification** — replace token-in-body trust with
   `X-Slack-Signature` / `X-Slack-Request-Timestamp` HMAC verification using the
   signing secret; include the exact basestring format and a constant-time
   compare, plus timestamp-skew rejection to block replays.

4. **Parallel-run & reconcile** — run legacy and new in shadow: new path logs
   what it WOULD do without side effects, compared against legacy output; define
   the reconciliation report and the acceptance bar for cutover.

5. **Cutover & rollback** — feature-flag the switch, keep the legacy webhook
   disabled-but-restorable for a bake period, and document the rollback steps.

6. **Cleanup** — revoke legacy tokens, delete the outgoing webhook, and audit
   for any other integration still using deprecated auth.

Output: (a) old→new capability map, (b) app manifest, (c) url_verification +
signature-verification handler, (d) parallel-run/reconciliation plan, (e)
cutover + rollback runbook, (f) post-migration cleanup checklist.

Verify signatures before parsing any payload — an unverified request must never
reach business logic.