Webhook Test Vectors

Publish deterministic test vectors for the partner scan-change webhook.

Partners building a receive-side verifier for AgentAvow's outbound scan-change events can reproduce the HMAC locally and confirm byte-for-byte agreement with our sender before a live shared secret is exchanged. The canonical form is identical to what production emits from src.trust.outbound_webhooks.

Canonical form: body_bytes = json.dumps(body, separators=(",", ":"), sort_keys=True).encode("utf-8")

Signature: X-Partner-Signature: sha256=<hex> where hex = hmac_sha256(shared_secret, body_bytes).hexdigest()

Replay window: X-Partner-Timestamp (ISO-8601) must be within ±5 minutes of receive time.