Module webhook 

The webhook notify-only channel (06 §4.2): the POST payload and its optional HMAC signature. Notify-only by ruling — v0.1’s single-process local architecture has no authenticable inbound HTTP face, so responses NEVER come back this way; collection stays with the cli channel (store-arbitrated). Transport (the actual POST) lives with the assembly layer; this module is the pure, testable half.

Evidence BYTES are never embedded (06 §4.2): the inbox entries carry values and references only, and the envelope names the local store as the forensics path plus the recovery hint for responding.

Structs

WebhookNotification

One ready-to-send webhook notification.

Constants

SIGNATURE_HEADER

The HTTP header carrying the body signature.

Functions

build_notification

Builds the notification for one run’s pending inbox entries: a CLI-owned envelope (pointlockWebhook: 1, precedent: pointlockReport) around the R14 inbox DTO projections, with the local forensics path and the recovery hint (06 §4.2). Receivers deduplicate by each entry’s requestId — re-notification after another suspension is legal and expected (notify is idempotent).

signature_for

The sha256=<hex> HMAC-SHA256 signature of body under secret (06 §4.2’s X-Pointlock-Signature). Computed over the exact body bytes — any reformatting on the receiving side must verify against the raw payload.