Harden webhook payload parsing and gateway status topology

[c0nSpIc0uS7uRk3r]

Summary

• Reject malformed JSON webhook request bodies with HTTP 400 instead of silently falling through to form parsing.
• Keep form-encoded webhook payload fallback working for non-JSON callers.
• Clear stale platforms entries when gateway runtime status transitions to starting, so a fresh gateway boot does not report adapters from an old topology.

Why

The webhook adapter currently attempts JSON parsing first, then falls back to form parsing on JSONDecodeError. That is useful for genuine form payloads, but it also means malformed JSON bodies with Content-Type: application/json can be reinterpreted instead of failing closed. For a webhook dispatch surface, JSON media types and JSON-looking bodies should reject malformed input before agent dispatch.

Gateway runtime status also preserves old platforms data across a new starting write. On a fresh boot, the adapter topology is redefined by the current run; stale platform entries from a previous gateway process can make status output claim adapters are present when the current gateway has not connected them.

Tests

Run against current origin/main with this PR commit only:

/home/cabo/.hermes/hermes-agent/.venv/bin/python -m py_compile gateway/platforms/webhook.py gateway/status.py tests/gateway/test_status.py tests/gateway/test_webhook_adapter.py
/home/cabo/.hermes/hermes-agent/.venv/bin/python -m pytest tests/gateway/test_webhook_adapter.py tests/gateway/test_webhook_signature_rate_limit.py tests/gateway/test_status.py -q

Result:

140 passed in 1.58s

[teknium1]

Thanks for the focused gateway hardening. The two reported current-main behaviors are verified: gateway/platforms/webhook.py:550-564 falls back to form parsing after JSON decode failure, and gateway/status.py:811-845 retains the prior platforms map when writing gateway_state="starting". The proposed changes address those paths while preserving subsequent platform updates through BasePlatformAdapter._mark_connected() at gateway/platforms/base.py:2692-2703.

Automated hermes-sweeper review.