docs(webhooks): the signing secret is no longer in definition_json (#7799)

[huangyiirene]

Docs follow-up to #7799 / PR #7901 (merged), which moved the webhook HMAC signing secret out of sys_webhook.definition_json into an encrypted signing_secret column.

content/docs/automation/webhooks.mdx still taught the shape that PR removed — P3, the sys_webhook field table, the runtime-matching paragraph and §6 all told readers the key rides inside definition_json. This restates them against the encrypted column, adds its row to the field table, and notes in §6 that the dispatcher resolves the key server-side so neither table returns it over the data API. A callout records the v17 move and that authoring is unchanged (defineWebhook({ secret }) is written exactly as before).

Provenance — please read before reviewing

The commit was authored and pushed by the os-dev cloud session that implemented #7901 (session_01S1CYfQTgc1hRzTXnk8n3Q2), in response to the docs-drift check flagging PR #7901. The session was archived by the services PM before it opened the PR, so the branch sat on the remote with no PR attached. This PR is a wrapper opened by the PM over already-authored dev work — the PM wrote none of the diff. Recorded here because "who wrote this" should not have to be reconstructed from a session id.

That miss is the PM's: the archive happened without reading the session's final turn, which had already reported the staged branch. Logged to the domain:services seat post (#6021) as a standing rule — read a cloud session's last turn before archiving it, since an archive releases the container and anything not pushed is gone.

Scope

• content/docs/automation/webhooks.mdx only.
• ⛔ content/docs/releases/** untouched — release notes are written centrally at release time, never accreted per PR.
• No code, no spec, no schema; gen:schema / gen:docs do not apply (this is hand-written prose, not a generated reference under content/docs/references/**).

Follow-up to #7799.

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
objectstack	Ignored		Aug 12, 2026 3:36am

[huangyiirene]

Check Changeset 红 ⇒ 已按门禁自述的路线 1 打上 skip-changeset。

判据(门禁日志原话:「A wrong 'skip-changeset' label is caught by review; a wrong empty changeset is caught by nobody」,所以这里写明理由供复核):本 PR changed_files: 1,唯一文件是 content/docs/automation/webhooks.mdx —— 手写散文,不在任何 workspace 包内,不发布任何东西。没有包版本会因它变动,故 route 1 是正确解。

⛔ 没有改用空 frontmatter changeset —— 按 #5471 那已不是第三条路,且 #4898 记录了全空集合会让发布静默且绿地停摆。
⛔ 未触 content/docs/releases/**(已逐文件核过 diff)。
✅ 所述内容与 PR #7901 实际落地的形状一致:signing_secret 走 Field.secret() 加密列、definition_json 不再带密钥、授权面 defineWebhook({ secret }) 不变、存量行开机迁移。

标签变更会重跑该门禁;转绿后本席转 ready 并挂 auto-merge。

---

Generated by Claude Code