Identity-owned webhook subscriptions with safe reconciliation

[dimavrem22]

Executive Summary

Deferred for now. Existing separate webhook subscriptions remain supported; this optional mixed-event reconciliation upgrade is not required for current installations. The branch is retained so this work can be reopened later.

Make Claude Code notification subscriptions identity-owned, independent of channel provisioning, and safe to reconcile alongside existing receivers.

Description

Startup creates one mixed subscription for the receiver's existing event set. Compatible legacy rows and event supersets are preserved; missing events are added with a revision precondition, with bounded rereads after conflicts. Incoming-call routing remains separate.

Capacity errors now stop immediately with actionable migration guidance instead of retrying as revision conflicts. URL changes are explicitly documented as a manual transition: a matching path on another host does not prove ownership, so different destinations are never automatically repointed or deleted.

Reason

Channel provisioning should not dictate webhook ownership, and gateway restarts must not overwrite independently configured events, context, credentials, or destinations.

Decisions

• Preserve compatible split coverage rather than consolidating or deleting rows during startup.
• Rollout: No consolidation job is planned. Installed plugins may keep their existing separate event-family subscriptions; upgrading them is not a prerequisite for the ownership migration.
• Stop on ambiguous bearer authentication or received-event context; do not select an arbitrary configuration.
• Keep the receiver's existing event set. Allowing every API event does not automatically select additional events.
• Require exact previous-destination ownership review and revision-checked URL updates for host transitions; never infer ownership from URL paths.
• Fail visibly on capacity exhaustion instead of reporting healthy intake without a subscription.

Testing

The full offline suite passed with the actual rebuilt SDK 0.7.1 wheel installed: 587 passed. Changed-source Ruff and uv lock --check passed. Full-repository Ruff reports one unchanged tests/test_bootstrap.py issue, verified identical on main. These runs include the setup, reconciliation, and review-fix regressions.

Coverage includes no-channel creation, superset and legacy coverage preservation, concurrent edit/create recovery, context/authentication ambiguity, unrelated destination isolation, distinct capacity errors, and bounded retries. No live channel tests, package publication, or deployment were performed.

Release dependency

Depends on SDK identity webhook support and an API supporting mixed identity subscriptions, resolved legacy-owner listing, and revision-checked mutations. Publish the exact SDK 0.7.1 artifact before registry-based installs or dependent registry CI. This PR remains draft so live-stack workflows do not run.

The uv source and lockfile pin the immutable SDK Git revision and install without waiting for PyPI. Ordinary pip installs still require publication.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Rebased SDK dependency

SDK 0.7.0 shipped from main while this stack was under review, so the identity-webhook release is now 0.7.1. Dependency pins, setup minimums, and installation guidance now require 0.7.1; SDK contact-call compatibility was checked and the full suite above rerun. Registry-based CI remains release-gated until that exact SDK is published. No test-skipping or workflow bypass was added.