{"schema":"https://policywatcher.online/schemas/webhook-conformance-suite/v1","suiteVersion":"1.0.0","contractVersion":"1.0.0","status":"public-test-fixture","executionMode":"local-receiver","deliveryAvailable":false,"caseCount":8,"cases":[{"id":"canonical-valid","title":"Accept the canonical vector","purpose":"Confirms exact HMAC-SHA256 construction over the recorded timestamp and raw body.","expectedCode":"valid","input":{"secret":"whsec_test_policywatcher_public_vector_v1","timestamp":1785326400,"rawBody":"{\"eventId\":\"pwe_7d94a2e87c1f1af16a93\",\"eventType\":\"policy.change.published\",\"schemaVersion\":\"1.0.0\",\"occurredAt\":\"2026-07-29T12:00:00.000Z\",\"subject\":{\"changeId\":\"11111111-1111-4111-8111-111111111111\"},\"links\":{\"change\":\"https://policywatcher.online/change/11111111-1111-4111-8111-111111111111\",\"evidence\":\"https://policywatcher.online/evidence/11111111-1111-4111-8111-111111111111\"}}","signatureHeader":"v1=72b5cde210f2adf69d92fcb65a9a236a327ec67d5032f6ef9277485cbec964ba","nowSeconds":1785326400,"toleranceSeconds":300}},{"id":"empty-secret","title":"Reject an empty secret","purpose":"Confirms fail-closed secret validation before digest construction.","expectedCode":"invalid_secret","input":{"secret":"","timestamp":1785326400,"rawBody":"{\"eventId\":\"pwe_7d94a2e87c1f1af16a93\",\"eventType\":\"policy.change.published\",\"schemaVersion\":\"1.0.0\",\"occurredAt\":\"2026-07-29T12:00:00.000Z\",\"subject\":{\"changeId\":\"11111111-1111-4111-8111-111111111111\"},\"links\":{\"change\":\"https://policywatcher.online/change/11111111-1111-4111-8111-111111111111\",\"evidence\":\"https://policywatcher.online/evidence/11111111-1111-4111-8111-111111111111\"}}","signatureHeader":"v1=72b5cde210f2adf69d92fcb65a9a236a327ec67d5032f6ef9277485cbec964ba","nowSeconds":1785326400,"toleranceSeconds":300}},{"id":"zero-timestamp","title":"Reject a zero timestamp","purpose":"Confirms that the receiver accepts only positive integer Unix timestamps.","expectedCode":"invalid_timestamp","input":{"secret":"whsec_test_policywatcher_public_vector_v1","timestamp":0,"rawBody":"{\"eventId\":\"pwe_7d94a2e87c1f1af16a93\",\"eventType\":\"policy.change.published\",\"schemaVersion\":\"1.0.0\",\"occurredAt\":\"2026-07-29T12:00:00.000Z\",\"subject\":{\"changeId\":\"11111111-1111-4111-8111-111111111111\"},\"links\":{\"change\":\"https://policywatcher.online/change/11111111-1111-4111-8111-111111111111\",\"evidence\":\"https://policywatcher.online/evidence/11111111-1111-4111-8111-111111111111\"}}","signatureHeader":"v1=72b5cde210f2adf69d92fcb65a9a236a327ec67d5032f6ef9277485cbec964ba","nowSeconds":1785326400,"toleranceSeconds":300}},{"id":"stale-timestamp","title":"Reject a stale timestamp","purpose":"Confirms enforcement immediately outside the candidate 300-second tolerance.","expectedCode":"timestamp_outside_tolerance","input":{"secret":"whsec_test_policywatcher_public_vector_v1","timestamp":1785326400,"rawBody":"{\"eventId\":\"pwe_7d94a2e87c1f1af16a93\",\"eventType\":\"policy.change.published\",\"schemaVersion\":\"1.0.0\",\"occurredAt\":\"2026-07-29T12:00:00.000Z\",\"subject\":{\"changeId\":\"11111111-1111-4111-8111-111111111111\"},\"links\":{\"change\":\"https://policywatcher.online/change/11111111-1111-4111-8111-111111111111\",\"evidence\":\"https://policywatcher.online/evidence/11111111-1111-4111-8111-111111111111\"}}","signatureHeader":"v1=72b5cde210f2adf69d92fcb65a9a236a327ec67d5032f6ef9277485cbec964ba","nowSeconds":1785326701,"toleranceSeconds":300}},{"id":"unsupported-version","title":"Reject an unsupported signature version","purpose":"Confirms strict parsing of the lowercase v1 signature prefix.","expectedCode":"invalid_signature_header","input":{"secret":"whsec_test_policywatcher_public_vector_v1","timestamp":1785326400,"rawBody":"{\"eventId\":\"pwe_7d94a2e87c1f1af16a93\",\"eventType\":\"policy.change.published\",\"schemaVersion\":\"1.0.0\",\"occurredAt\":\"2026-07-29T12:00:00.000Z\",\"subject\":{\"changeId\":\"11111111-1111-4111-8111-111111111111\"},\"links\":{\"change\":\"https://policywatcher.online/change/11111111-1111-4111-8111-111111111111\",\"evidence\":\"https://policywatcher.online/evidence/11111111-1111-4111-8111-111111111111\"}}","signatureHeader":"v2=72b5cde210f2adf69d92fcb65a9a236a327ec67d5032f6ef9277485cbec964ba","nowSeconds":1785326400,"toleranceSeconds":300}},{"id":"uppercase-digest","title":"Reject an uppercase digest","purpose":"Confirms the canonical lowercase hexadecimal encoding contract.","expectedCode":"invalid_signature_header","input":{"secret":"whsec_test_policywatcher_public_vector_v1","timestamp":1785326400,"rawBody":"{\"eventId\":\"pwe_7d94a2e87c1f1af16a93\",\"eventType\":\"policy.change.published\",\"schemaVersion\":\"1.0.0\",\"occurredAt\":\"2026-07-29T12:00:00.000Z\",\"subject\":{\"changeId\":\"11111111-1111-4111-8111-111111111111\"},\"links\":{\"change\":\"https://policywatcher.online/change/11111111-1111-4111-8111-111111111111\",\"evidence\":\"https://policywatcher.online/evidence/11111111-1111-4111-8111-111111111111\"}}","signatureHeader":"v1=72B5CDE210F2ADF69D92FCB65A9A236A327EC67D5032F6EF9277485CBEC964BA","nowSeconds":1785326400,"toleranceSeconds":300}},{"id":"body-byte-mutation","title":"Reject a raw-body byte mutation","purpose":"Confirms that whitespace and exact raw-body bytes remain signature material.","expectedCode":"signature_mismatch","input":{"secret":"whsec_test_policywatcher_public_vector_v1","timestamp":1785326400,"rawBody":"{\"eventId\":\"pwe_7d94a2e87c1f1af16a93\",\"eventType\":\"policy.change.published\",\"schemaVersion\":\"1.0.0\",\"occurredAt\":\"2026-07-29T12:00:00.000Z\",\"subject\":{\"changeId\":\"11111111-1111-4111-8111-111111111111\"},\"links\":{\"change\":\"https://policywatcher.online/change/11111111-1111-4111-8111-111111111111\",\"evidence\":\"https://policywatcher.online/evidence/11111111-1111-4111-8111-111111111111\"}} ","signatureHeader":"v1=72b5cde210f2adf69d92fcb65a9a236a327ec67d5032f6ef9277485cbec964ba","nowSeconds":1785326400,"toleranceSeconds":300}},{"id":"digest-mutation","title":"Reject a digest mutation","purpose":"Confirms rejection of a well-formed but nonmatching signature value.","expectedCode":"signature_mismatch","input":{"secret":"whsec_test_policywatcher_public_vector_v1","timestamp":1785326400,"rawBody":"{\"eventId\":\"pwe_7d94a2e87c1f1af16a93\",\"eventType\":\"policy.change.published\",\"schemaVersion\":\"1.0.0\",\"occurredAt\":\"2026-07-29T12:00:00.000Z\",\"subject\":{\"changeId\":\"11111111-1111-4111-8111-111111111111\"},\"links\":{\"change\":\"https://policywatcher.online/change/11111111-1111-4111-8111-111111111111\",\"evidence\":\"https://policywatcher.online/evidence/11111111-1111-4111-8111-111111111111\"}}","signatureHeader":"v1=62b5cde210f2adf69d92fcb65a9a236a327ec67d5032f6ef9277485cbec964ba","nowSeconds":1785326400,"toleranceSeconds":300}}],"expectedSummary":{"passed":8,"failed":0},"boundary":"This suite tests deterministic compatibility with the candidate receiver contract. It does not test endpoint identity, production secret custody, network delivery, retry behavior, replay storage, availability or implementation security outside these cases."}