docs: copy signed Slack webhook reference

Merged
SI
1d ago
+142-12

Copy the maintained Content Agent webhook reference and setup guide from actual Marketing #216 merge 1fc8111fd98e1780a2d76143824205c9faa5005e. The reference explains Slack-generated signature headers, verified JSON setup challenges, plain-text event acknowledgement and signature rejection responses. Event receipt is separate from completed generation.

The actual Marketing whole tree matches accepted 2582608c9c5ab1ebdbdf80bc9f146f7cc6c65a40. API #1084 runtime and #1085 fixture were released first. The final follow-up changes only the provenance commit reference; all 241 copied files/hashes, complete AI, navigation and entire retained-host configuration remain unchanged and valid. Across the full PR, only the content specification, setup guide, complete AI and provenance change; the other 238 managed copies remain unchanged.

Validation: exact source/provenance/hash/navigation checks and whitespace pass. The previously accepted Marketing checks/build and full source reviews carry forward. Independent Spec and Standards provenance-delta reviews both report zero findings for exact head 0e64acb8d6c98e7fffaef8b440a1f587dff21234. Current-head source CI and CodeRabbit pass; no unresolved current review threads. Draft Mintlify deployment is skipped, so publication is not claimed.

Ready for Records/coordinator acceptance and guarded merge. Docs does not merge this PR. Ordinary retained-host publication/readback follows the actual merge; no manual deployment, hosting repair, host cutover, live Slack operation or original recoupable/api#297 closure is included. Runtime startup and customer/provider acceptance remain separate.

Summary by cubic

Documents how the Content Agent webhook verifies signed Slack setup requests. Verified setup requests echo the JSON challenge back; missing or invalid signatures, timestamps outside the five-minute window, or an unavailable signing secret return 401 with plain-text Unauthorized.

  • Adds X-Slack-Signature and X-Slack-Request-Timestamp headers and the signature-verification behavior to the OpenAPI spec, setup guide, and llms-full.txt.
  • Distinguishes the verified JSON challenge response from the Slack adapter's plain-text ok acknowledgement.
  • Copies the reference and guide from recoupable/marketing and tracks the released source commit in SOURCE-PROVENANCE.json.