Document webhook delivery signing and fix endpoint_url name

[rawwerks]

I'm an AI agent (Claude Code) opening this PR on behalf of Ray (@rawwerks). He asked for this fix and approved opening the PR, but he did not write the text below.

Two doc fixes found while an agent set up a new webhook job using only this repo's docs:

1. How to sign a webhook delivery was not documented. job create returns signing_secret and endpoint_url, but neither the guide nor docs/service/jobs.md said how a sender uses them. The required X-OpenProse-Delivery header and the HMAC-SHA256 over deliveryId + "\n" + rawBody were only in the service's web setup text, so a sender working from this repo got 400 / 401.
2. The guide named the wrong field. guide.v1.md said result.endpointUrl, and cli/shared/schemas/README.md said endpointUrl in job show. The result, schema and jobs.md all use endpoint_url.

Changes

• cli/shared/service/guide.v1.md:
  • endpointUrl → endpoint_url.
  • "Create a webhook job" gains the two headers, an openssl + curl signing recipe, and what 202 / test_only / 400 / 401 / 413 mean.
• docs/service/jobs.md: new "Sending events to a webhook" section with:
  • the same recipe, a response table and the retry rule;
  • a note that last_event_at records live deliveries only;
  • a note that live needs a contract;
  • a note that the secret is visible in the process arguments.
• cli/shared/schemas/README.md: endpointUrl → endpoint_url.
• cli/conformance/cases/service/framework/service-guide-{human,json,jsonl}.json: regenerated with python3 cli/ci/render_service_help.py --write.

No code changes. The guide stays ASCII and free of internal nouns.

Evidence

Hosted service. Checked with a dev-endpoint build, using a test-mode webhook with no program, so no runs and no spend:

Request	Response
The documented openssl + curl recipe	202 {"accepted":true,"duplicate":false,"test_only":true}
Missing delivery id	400
Body that isn't JSON	400 {"error":"Webhook payload must be valid JSON"}
Body over 256 KiB	413 {"error":"Webhook payload is too large"}
Wrong signature	401; shows in job deliveries as rejected / invalid_signature
Reused id in test mode, even with a different body	202, recorded again
job update to live without a contract	SERVICE_REQUEST_REJECTED ("Runs stay disabled. Connect a contract to this webhook first.")

Not observed live. The live-mode duplicate:true and 409 rows need an attached contract, which means paid runs. They match the service's webhook handler and its own sender instructions, and the table marks them "Live mode".

Local gates. Run on macOS with Python 3.10.21 and Rust from rust-toolchain.toml. These nine pass:

• shared-contracts
• service-help
• public-surface-files
• differential-conformance: 64 cases × 2 products
• service-operations-corpus
• service-operations-rust-build
• service-operations-rust: 1089 cases
• service-operations-bun-build
• service-operations-bun: 1089 cases

Also passing:

• render_service_help.py --check
• test_user_text.py
• test_service_contract.py

Not run. The full run_local.py. Two bun-tests cases (dev-endpoint.test.ts, build-identity.test.ts) fail identically on unmodified main @ 8e2a258 on this machine. It has Bun 1.4.2 instead of the pinned 1.3.5, and this PR touches no Bun code.

🤖 Generated with Claude Code