feat(webhook): accept Standard Webhooks signatures

[HwangJohn]

What does this PR do?

Adds Standard Webhooks header support to the generic webhook adapter so providers such as GitLab can authenticate with webhook-id, webhook-timestamp, and webhook-signature.

This reuses the existing Svix-compatible validator because the signed content and v1,<base64-hmac-sha256> format are the same: {id}.{timestamp}.{raw_body}. It also uses webhook-id as the delivery ID fallback so retries dedupe correctly.

Existing GitHub X-Hub-Signature-256, GitLab X-Gitlab-Token, Svix, and generic X-Webhook-Signature paths are preserved for requests that do not send Standard Webhooks headers. Requests that do send webhook-id are treated as Standard Webhooks requests and fail closed unless the required Standard Webhooks fields validate.

Fixes #47451

Related Issue

Fixes #47451

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• Accepted webhook-id as an alias for svix-id.
• Accepted webhook-timestamp as an alias for svix-timestamp.
• Accepted webhook-signature as an alias for svix-signature.
• Used webhook-id as the webhook delivery ID fallback for idempotency.
• Added tests for valid Standard Webhooks signatures, raw-body mismatch rejection, and webhook-id deduplication.
• Updated webhook security documentation.

How to Test

1. Configure a webhook route with a shared secret.
2. Send a POST with webhook-id, webhook-timestamp, and webhook-signature.
3. The signature should validate when it signs {id}.{timestamp}.{raw_body} with HMAC-SHA256 and the route secret.
4. Reusing the same webhook-id should return the duplicate response on retry.

Validation run:

• DGX Spark Linux: scripts/run_tests.sh tests/gateway/test_webhook_adapter.py tests/gateway/test_webhook_signature_rate_limit.py tests/gateway/test_webhook_integration.py -> 78 passed.
• DGX Spark Linux: ~/.hermes/hermes-agent/venv/bin/python -m ruff check gateway/platforms/webhook.py tests/gateway/test_webhook_adapter.py -> passed.
• DGX Spark Linux: git diff --check origin/main...fix/47451-standard-webhook-signature -> passed after rebase.
• Windows: .\\.venv\\Scripts\\python -m pytest tests\\gateway\\test_webhook_adapter.py tests\\gateway\\test_webhook_signature_rate_limit.py tests\\gateway\\test_webhook_integration.py -q -> 78 passed.
• Windows: .\\.venv\\Scripts\\python -m ruff check gateway\\platforms\\webhook.py tests\\gateway\\test_webhook_adapter.py -> passed.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this feature
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes
• I've tested on my platform: Windows local and DGX Spark Linux

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings)
• I've updated cli-config.yaml.example if I added/changed config keys — N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide
• I've updated tool descriptions/schemas if I changed tool behavior — N/A

Screenshots / Logs

Not applicable. This is a webhook signature validation change covered by tests.

[teknium1]

Thanks for the focused Standard Webhooks implementation. Current main still only extracts svix-id, svix-timestamp, and svix-signature in gateway/platforms/webhook.py:912-921, while delivery deduplication only considers svix-id at gateway/platforms/webhook.py:660-667; the reported protocol therefore remains unsupported.

The proposed aliases correctly reuse _validate_svix_signature() (gateway/platforms/webhook.py:1010-1058), which already verifies the same signed-content layout, timestamp window, and v1,<base64> signature format. The existing partial-Svix test at tests/gateway/test_webhook_adapter.py:396-400 also confirms the shared validator fails closed when required fields are absent.

GitHub marks this PR dirty after merged #58508 changed nearby webhook tests and documentation, but #58508 implements generic V2 replay hardening rather than these Standard Webhooks aliases. This should be a mechanical salvage with conflict resolution against the current documentation/test context.

Automated hermes-sweeper review.

[teknium1]

Thanks @HwangJohn — this was the right fix. Your commit has been salvaged (authorship preserved) onto current main in #92024, with additional hardening tests (expired-timestamp reject, incomplete-headers fail-closed) added on top; the branch here had gone stale against the reworked test file. Leaving this open until #92024 lands, then it will be closed with credit.