fix(spec,cli): redirect webhook authorWarn from now-live url to still-dead props (#3490)

Second half of the Test Core lockstep the bound-class + ledger flip require. The
bridge (#3489) made `url` live, so the CLI compile lint's per-webhook author
warning must move OFF it onto the props that are STILL dead + misleading:
retryPolicy/body/payloadFields/includeSession now carry `authorWarn` (folded into
definition_json but never read — authored retry/body/field-projection/session do
nothing). `tags` stays unmarked (benign display). `lint-liveness-properties.test.ts`
asserts the new behavior: a webhook that authors only now-live props is silent,
and the showcase-shaped webhook warns exactly once — on its inert `retryPolicy`,
not on `url`. isActive test comment updated (it is live now, not "unmarked dead").

Verified: lint-liveness-properties.test.ts (17) + proof-registry.test.ts (23)
green; liveness gate still green (webhook 17 classified, proofs resolve).

Author: os-zhuang

packages/cli/src/utils/lint-liveness-properties.test.ts

@@ -159,27 +159,26 @@ describe('lintLivenessProperties', () => {
     expect(findings).toEqual([]);
   });
 
-  // ── webhook (#3462) ───────────────────────────────────────────────────────
-  // The ENTIRE WebhookSchema authoring surface is disconnected from the
-  // sys_webhook dispatcher (#3461): authoring `webhooks:` never materializes a
-  // dispatchable row. Rather than warn on all 16 dead props, the ledger warns
-  // once per webhook via the required `url` carrier — one no-op heads-up per
-  // artifact. These run against the REAL webhook.json ledger.
-
-  it('warns once per authored webhook via the url carrier', () => {
+  // ── webhook (#3461 bridge landed → #3490) ─────────────────────────────────
+  // The WebhookSchema authoring surface is now materialized into dispatchable
+  // sys_webhook rows on boot (#3489), so most props are live. The author warning
+  // moved OFF the now-live `url` carrier onto the props that are STILL dead and
+  // misleading — retryPolicy/body/payloadFields/includeSession (folded into
+  // definition_json but never read) — plus experimental `authentication`. These
+  // run against the REAL webhook.json ledger.
+
+  it('does not warn on a webhook that only authors now-live props (#3490)', () => {
     const findings = lintLivenessProperties({
-      webhooks: [{ name: 'w1', url: 'https://hooks.example/x' }],
+      webhooks: [{ name: 'w1', object: 'task', triggers: ['create'], url: 'https://hooks.example/x', method: 'POST', isActive: true }],
     });
-    const f = findings.find((x) => x.message.includes('`url`'));
-    expect(f).toBeDefined();
-    expect(f!.where).toBe("webhook 'w1'");
-    expect(f!.hint.toLowerCase()).toContain('sys_webhook');
+    expect(findings).toEqual([]);
   });
 
-  it('emits exactly one warning for a fully-authored (showcase-shaped) webhook', () => {
-    // object/triggers/method/retryPolicy/isActive/description are all dead too,
-    // but only `url` carries authorWarn — so the whole no-op artifact yields ONE
-    // finding, not one-per-prop. (isActive is default(true), deliberately unmarked.)
+  it('emits exactly one warning for the showcase webhook — its still-dead retryPolicy', () => {
+    // object/triggers/url/method/isActive/description are live now; only
+    // retryPolicy is still dead + misleading (the messaging dispatcher owns a
+    // fixed retry schedule), so the showcase-shaped webhook yields ONE finding,
+    // not one-per-prop.
     const findings = lintLivenessProperties({
       webhooks: [{
         name: 'showcase_task_changed',
@@ -193,7 +192,8 @@ describe('lintLivenessProperties', () => {
       }],
     });
     expect(findings.length).toBe(1);
-    expect(findings[0].message).toContain('`url`');
+    expect(findings[0].message).toContain('`retryPolicy`');
+    expect(findings[0].where).toBe("webhook 'showcase_task_changed'");
   });
 
   it('also warns on authentication (experimental — HMAC-secret-only)', () => {
@@ -203,7 +203,7 @@ describe('lintLivenessProperties', () => {
     expect(paths(findings).some((m) => m.includes('`authentication`'))).toBe(true);
   });
 
-  it('does NOT warn on isActive (default(true) boolean, deliberately unmarked)', () => {
+  it('does NOT warn on isActive (live now — remapped to sys_webhook.active by the bridge)', () => {
     const findings = lintLivenessProperties({
       webhooks: [{ name: 'w1', url: 'https://hooks.example/x', isActive: true }],
     });

packages/spec/liveness/webhook.json

@@ -40,14 +40,20 @@
     },
     "body": {
       "status": "dead",
+      "authorWarn": true,
+      "authorHint": "The dispatcher always sends its own fixed envelope (object/recordId/action/timestamp + full record); a custom `body` is never sent (#1878).",
       "note": "No consumer. The bridge folds it into definition_json (bootstrap-declared-webhooks.ts:203), but parseRow never reads a custom body and the dispatcher always sends its own fixed envelope (object/recordId/action/timestamp + full record, auto-enqueuer.ts:336-342). Enforce-or-remove (#1878)."
     },
     "payloadFields": {
       "status": "dead",
+      "authorWarn": true,
+      "authorHint": "No field projection — the full record is always sent; `payloadFields` is ignored (#1878).",
       "note": "No consumer. In definition_json now, but there is no field projection — the full record is always sent (auto-enqueuer.ts:341). Enforce-or-remove (#1878)."
     },
     "includeSession": {
       "status": "dead",
+      "authorWarn": true,
+      "authorHint": "No session is injected into the webhook payload; `includeSession` is ignored (#1878).",
       "note": "No consumer. In definition_json now, but no session is injected into the enqueue payload (auto-enqueuer.ts:336-342). Enforce-or-remove (#1878)."
     },
     "authentication": {
@@ -57,7 +63,9 @@
     },
     "retryPolicy": {
       "status": "dead",
-      "note": "No consumer. In definition_json now, but retry is not in EnqueueHttpInput (service-messaging/src/http-outbox.ts:87-98) — the messaging HttpDispatcher owns a fixed retry schedule; authored maxRetries/backoffStrategy/initialDelayMs/maxDelayMs are ignored. (The showcase's TaskChangedWebhook still authors a retryPolicy that does nothing.) Enforce-or-remove (#1878)."
+      "authorWarn": true,
+      "authorHint": "The retry schedule is owned by the shared messaging HTTP dispatcher — authored maxRetries/backoffStrategy/initialDelayMs/maxDelayMs are ignored (#1878). Remove them until enforcement lands.",
+      "note": "No consumer. In definition_json now, but retry is not in EnqueueHttpInput (service-messaging/src/http-outbox.ts:87-98) — the messaging HttpDispatcher owns a fixed retry schedule; authored maxRetries/backoffStrategy/initialDelayMs/maxDelayMs are ignored. (The showcase's TaskChangedWebhook still authors a retryPolicy that does nothing.) Enforce-or-remove (#1878). Now that authoring is otherwise live, this is the misleading-dead prop that carries the author warning (previously `url` did, as the whole-artifact-dead heads-up)."
     },
     "timeoutMs": {
       "status": "live",