Webhooks

Signed partner sync events notify external systems when policies, controls, risks, or coverage change — and accept remediation lifecycle claims back. Payloads are metadata-only; policy bodies are never embedded.

Maturity: Contract published (Early Access). Events carry hash-chained integrity (payload_hash); they are not on-chain seals. Status names are lifecycle signals — see Lifecycle and Verification.

Maturity

Surface	Status
Event envelope + OpenAPI webhooks (`partner-events.openapi.yaml`)	Contract published (Early Access)
Live delivery / DLQ / reconcile	Tracked with partner sync rollout — confirm maturity on Integration Surfaces

Machine-readable contract: partner-events.openapi.yaml. Generate typed validators from that artifact; do not hand-maintain event fiction.

Envelope

{
  "event_id": "evt_…",
  "schema_version": "arbiter.partner.events.v1",
  "tenant_id": "org_…",
  "event_type": "policy.published",
  "aggregate_type": "policy",
  "aggregate_id": "pol_…",
  "aggregate_version": 12,
  "occurred_at": "2026-07-22T00:00:00.000Z",
  "correlation_id": "corr_…",
  "idempotency_key": "idem_…",
  "classification": "metadata_only",
  "payload_hash": {
    "alg": "sha256",
    "canonicalization": "arbiter.jcs.v1",
    "value": "…"
  },
  "payload": {}
}

classification is always metadata_only for v1. Partners fetch authorized content via Partner Read using hashes and references.

Outbound events

Type	When
`policy.published`	Material policy version change
`control.updated`	Control definition / implementation / mapping change
`risk.status_changed`	Risk characterization or status change
`coverage.updated`	Estate or obligation coverage posture change

Inbound events

Type	Effect
`remediation.acknowledged`	Record partner receipt
`remediation.progress_reported`	Append progress projection
`remediation.evidence_submitted`	Record submitted `evidence_hash`
`remediation.completion_claimed`	Record claim only — does not auto-close Arbiter state

Transport

Auth: HMAC-SHA256 (X-Partner-Signature: sha256=<hex>)
Replay window: X-Partner-Timestamp within ±5 minutes
Retries with DLQ; reconcile against Partner Read snapshots on miss

Production checklist

Verify HMAC and timestamp before trusting payload.
Treat idempotency_key as exactly-once at your boundary.
Never overwrite Arbiter governance fields from partner workflow state.
Retrieve bodies via authorized Partner Read — not from the webhook.

Read the Disclosure Boundary