fix(spec): reject undeliverable IOA webhooks (ARN-227)

[rita-aga]

Summary

IOA specs accepted kind = "webhook" / [[integration]] type = "webhook" and synthesized integration metadata, but production post-dispatch only executes wasm and adapter. Specs could verify and install while silently dropping declared outbound work.

This PR chooses the reject-until-durable-runtime boundary (ADR-0176):

• Reject outbound webhook action triggers and legacy webhook integrations at validation with a stable error: outbound IOA webhooks are unsupported until durable delivery is available
• Keep webhook syntax deserializable so users get that error (not an unknown-kind parse failure)
• Do not expand webhook triggers into integrations or custom effects
• Leave operator webhooks.toml trajectory subscribers and the standalone platform IntegrationEngine library (direct config only) in place
• Remove dead webhook integrations from fixtures; update docs/skills/MCP protocol text

Tests

• cargo test -p temper-spec --lib: 269 passed (includes 7 webhook rejection regressions)
• cargo test -p temper-spec --test migration_differential: 3 passed
• Fixture parse check (changed .ioa.toml): all parse with 0 webhook integrations
• Rejection cases: legacy type = "webhook", omitted type (defaults to webhook), and kind = "webhook" all fail with the durable-delivery message

ADR

• ADR-0176 docs/adrs/0176-reject-undeliverable-ioa-webhooks.md (unique; codex branch used 0171)

Linear

• Closes work for ARN-227

Residual risks

• Specs that previously installed with webhook declarations will now fail installation (intentional; they never executed)
• Future webhook support requires the journaled delivery gate listed in ADR-0176 (not a deferred phase of this PR)

[rita-aga]

Grok independent review — PR #399 (ARN-227 / ADR-0176)

Scope: Reject undeliverable outbound IOA webhooks (kind = "webhook" and legacy [[integration]] type = "webhook", including omitted type default) until durable delivery exists; stop synthesizing dead webhook integrations; align docs/skills/fixtures.

What was done well

• Closes a real certified-dead-work hole: webhooks were accepted, expanded into integrations, and never executed by production dispatch (wasm/adapter only). Rejecting at validation is the right fail-closed fix — not another “parse-only” comment.
• Stable durable-delivery error string is shared (OUTBOUND_IOA_WEBHOOK_UNSUPPORTED); both trigger expansion and integration validation fail with the same message; webhook field checks no longer mask the durability error (good regression: rejection precedes url/method validation).
• Syntax stays deserializable (TriggerKind::Webhook, webhook-ish fields, default_webhook for omitted legacy type) so the error is precise rather than a serde mystery.
• Fixtures and os-app specs that declared dead webhooks are cleaned; agent skill, MCP protocol blurb, ADRs 0046/0078, AGENT_GUIDE/PAPER updated so agents stop generating poison configs.
• Platform integration engine docs now tell the truth: directly configured, in-memory queue, not IOA-fed outbox — which is exactly why IOA webhooks must not claim durability.

Findings

Important (should fix / confirm)

1. Omitted [[integration]] type still defaults to "webhook" then rejects
   Intentional and tested (defaulted_legacy_webhook_integration_is_also_rejected). Confirm no internal/custom specs rely on bare [[integration]] blocks for non-webhook custom kinds without an explicit type — those would start failing parse after this lands. If custom kinds exist in the wild with omitted type, that is a breaking deploy footgun worth a release note.

Suggestions (nice to have)

2. default_webhook / type = "webhook" naming remains in serde for the rejection path — fine short-term; once durable delivery lands, rename the default helper so “default” does not imply webhook is a supported kind.

3. PR title fix(spec) is too thin for a behavior-breaking validation change; include ARN-227 / “reject IOA webhooks” for history.

4. Direct IntegrationEngine + reference integration.toml [[webhook]] blocks are still easy to misread as “IOA webhooks work.” Comments were improved; a one-line “not loaded by entity actors” in the TOML files themselves is already present — keep that language in any future operator docs.

Plan alignment

Matches ADR-0176: reject both surfaces, keep syntax for precise errors, no fake delivery, docs/skills/fixtures updated. Acceptance gate for future journaled delivery is recorded in the ADR rather than half-implemented.

Verdict

Correct fail-closed boundary with thorough parser tests and doc surface cleanup. Residual risk is deploy-time breakage of bare [[integration]] defaults — expected and tested.

Verdict: PASS

[rita-aga]

@greptile review

[rita-aga]

ARENA SHIPPABLE · Grok · 2026-07-14 11:57 PDT

PR: #399
HEAD: 1aa65b42424a · branch grok/arn-227-ioa-webhook-runtime
Linear: ARN-227 · ADR: 0176
Merge: nothing (arena rules)

Checklist

Gate	Evidence
RED→GREEN	on branch history
Independent same-model review	Verdict: PASS posted on PR
Greptile	requested after PASS
Local tests	targeted suite green before push
CI	GitHub Actions on head

Summary

reject undeliverable webhooks