@@ -0,0 +1,32 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+import { describe, it, expect } from 'vitest';
+import { HTTP_SIGNATURE_HEADER, signHttpBody } from '../index.js';
+
+/**
+ * The scheme's wire form, pinned by literal values rather than by recomputing
+ * an HMAC here: a test that rebuilt the value with the same `createHmac` call
+ * would agree with any change made to both. Every sender and every receiver of
+ * `X-Objectstack-Signature` relies on exactly these bytes.
+ */
+describe('the outbound HTTP signature scheme', () => {
+    it('is carried in X-Objectstack-Signature', () => {
+        expect(HTTP_SIGNATURE_HEADER).toBe('X-Objectstack-Signature');
+    });
+
+    it('signs the empty body a bodyless request carries', () => {
+        expect(signHttpBody('', 'flow-hook-secret')).toBe(
+            'sha256=28c9179fd9763c0e7d41dc5241d9d77607270f8912e3b7692426f677bd5187f7',
+        );
+    });
+
+    it('is sha256= plus the lowercase hex HMAC-SHA256 of the exact body bytes', () => {
+        expect(signHttpBody('{"a":1}', 'shh')).toBe(
+            'sha256=dfb8cf3fc9778c70386e30f5e0776d37f9ee9c8756d3cbd7df0902150644358d',
+        );
+        // One byte of difference in the body is a different signature — the
+        // receiver verifies over what it received, so a sender must sign what
+        // it sends, not an equivalent re-serialization.
+        expect(signHttpBody('{"a": 1}', 'shh')).not.toBe(signHttpBody('{"a":1}', 'shh'));
+    });
+});
@@ -0,0 +1,39 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+import { createHmac } from 'node:crypto';
+
+/**
+ * The outbound HTTP signature scheme — the ONE definition every ObjectStack
+ * sender signs with and every receiver verifies against.
+ *
+ * A request carries {@link HTTP_SIGNATURE_HEADER} whose value is
+ * {@link signHttpBody} of the exact bytes of its body under the shared secret:
+ * `sha256=` followed by the lowercase hex HMAC-SHA256. A request with no body is
+ * signed over the empty string, which is what its receiver reads.
+ *
+ * It lives in `@objectstack/core` because two senders that cannot import each
+ * other at runtime both sign with it: `@objectstack/service-messaging`'s durable
+ * HTTP outbox (which signs at enqueue) and `@objectstack/service-automation`'s
+ * flow `http` node, whose inline arm — and its durable arm's fallback when no
+ * outbox is wired — calls `fetch` itself. `service-messaging` re-exports both
+ * names unchanged, so its published surface still carries them. ⛔ Never a
+ * second copy of this HMAC input anywhere: two copies are how one key comes to
+ * mean two things on two arms.
+ *
+ * What the scheme does NOT own is WHICH bytes are the body — each sender signs
+ * the serialization it actually sends.
+ */
+
+/** Header carrying the HMAC-SHA256 signature of the request body. */
+export const HTTP_SIGNATURE_HEADER = 'X-Objectstack-Signature';
+
+/**
+ * Compute the {@link HTTP_SIGNATURE_HEADER} value for a body: `sha256=<hex>` of
+ * `HMAC-SHA256(body, secret)`.
+ *
+ * The output is safe to persist (it is handed to the receiver on the wire
+ * anyway); the `secret` argument is NOT.
+ */
+export function signHttpBody(body: string, secret: string): string {
+    return `sha256=${createHmac('sha256', secret).update(body).digest('hex')}`;
+}
@@ -48,6 +48,12 @@ export {
   type VerifyIntegrityResult,
 } from './plugin-artifact-integrity.js';
 
+// The outbound HTTP signature scheme (`X-Objectstack-Signature`) — one
+// definition shared by the messaging outbox and the flow `http` node's inline
+// arm, which cannot import each other; `@objectstack/service-messaging`
+// re-exports both names unchanged.
+export { HTTP_SIGNATURE_HEADER, signHttpBody } from './http-signature.js';
+
 // `PluginConfigValidator` / `createPluginConfigValidator` were RETIRED here on
 // 2026-08-27 (#11982, ADR-0049 enforce-or-remove; recorded in ADR-0025 §3.7).
 // The kernel never received a plugin's config to validate — factories close
 
@@ -8,7 +8,9 @@ import {
     MemoryHttpOutbox,
     HttpDispatcher,
     signHttpBody,
+    HTTP_SIGNATURE_HEADER,
 } from '@objectstack/service-messaging';
+import { signHttpBody as coreSignHttpBody, HTTP_SIGNATURE_HEADER as CORE_HTTP_SIGNATURE_HEADER } from '@objectstack/core';
 import { AutomationEngine } from '../engine.js';
 import { registerHttpNodes } from './http-nodes.js';
 
@@ -315,3 +317,16 @@ describe('http node signing — durable arm with the outbox wired', () => {
         expect(received).toHaveLength(0);
     });
 });
+
+/**
+ * One scheme, not two copies: the signer the node uses (`@objectstack/core`'s)
+ * and the one `@objectstack/service-messaging` publishes to receivers are the
+ * SAME binding, not two implementations that happen to agree today.
+ */
+describe('http signature scheme — one binding', () => {
+    it("service-messaging's published signer and header are @objectstack/core's own", () => {
+        expect(signHttpBody).toBe(coreSignHttpBody);
+        expect(HTTP_SIGNATURE_HEADER).toBe(CORE_HTTP_SIGNATURE_HEADER);
+        expect(HTTP_SIGNATURE_HEADER.toLowerCase()).toBe(SIGNATURE_HEADER_LC);
+    });
+});
@@ -1,5 +1,6 @@
 // Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
 
+import { HTTP_SIGNATURE_HEADER, signHttpBody } from '@objectstack/core';
 import type { PluginContext } from '@objectstack/core';
 import { defineActionDescriptor, HttpConfigSchema } from '@objectstack/spec/automation';
 import type { HttpConfigParsed } from '@objectstack/spec/automation';
@@ -32,6 +33,14 @@ import { parseNodeConfig } from './parse-config.js';
  *    path; that descriptor key was retired in #6748 — a suspending HTTP node
  *    would declare `supportsPause: true` plus a `resumeAuthority` and return
  *    `suspend: true`, which is the mechanism the engine actually enforces.)
+ *
+ * `signingSecret` means `X-Objectstack-Signature` on EVERY arm, with ONE scheme
+ * (`@objectstack/core`'s `signHttpBody`): the outbox signs the body it will
+ * POST, and the inline call — including the durable arm's no-outbox fallback —
+ * signs the exact bytes it hands `fetch`, the empty string when there is no
+ * body. An authored `''` sends unsigned on purpose, on every arm; a non-empty
+ * value that renders to nothing at run time refuses the node rather than let
+ * the call leave unsigned.
  */
 
 /** Structural view of `service-messaging`'s HTTP outbox surface (ADR-0018 M3). */
@@ -122,6 +131,21 @@ export function registerHttpNodes(engine: AutomationEngine, ctx: PluginContext):
             const timeoutMs = cfg.timeoutMs;
             const signingSecret = cfg.signingSecret;
 
+            // A secret the author SET that rendered to nothing — a `{token}`
+            // with no value in this run — cannot sign, and sending anyway is
+            // the one outcome the key exists to prevent: the receiver gets a
+            // request it cannot authenticate while the run reports success.
+            // Only an authored `''` means "unsigned on purpose" (the outbox
+            // reads it the same way). A non-string result never reaches here:
+            // the contract parse above already refused it, naming the key.
+            if (typeof raw.signingSecret === 'string' && raw.signingSecret !== '' && !signingSecret) {
+                return refuseNode(
+                    `http '${node.id}': config.signingSecret is set but resolved to no value in this run, so the ` +
+                        `request cannot carry ${HTTP_SIGNATURE_HEADER} and was not sent. Give the value its template ` +
+                        `reads to the run, or author signingSecret: '' to send unsigned on purpose.`,
+                );
+            }
+
             // ── Durable mode: enqueue onto the messaging HTTP outbox ──────────
             if (durable) {
                 const messaging = getMessaging();
@@ -208,7 +232,8 @@ export function registerHttpNodes(engine: AutomationEngine, ctx: PluginContext):
                         return { success: false, error: `http (durable) failed to enqueue: ${(err as Error).message}` };
                     }
                 }
-                // No outbox available — degrade to a best-effort inline call.
+                // No outbox available — degrade to a best-effort inline call,
+                // which signs exactly as the outbox would have.
                 ctx.logger.warn(
                     `[http] node '${node.id}' requested durable delivery but no messaging HTTP outbox is wired; falling back to inline fetch`,
                 );
@@ -222,11 +247,19 @@ export function registerHttpNodes(engine: AutomationEngine, ctx: PluginContext):
             const reads = /^(GET|HEAD|OPTIONS)$/i.test(method);
             const controller = new AbortController();
             const timer = timeoutMs ? setTimeout(() => controller.abort(), timeoutMs) : undefined;
+            // The exact bytes this arm sends, and therefore the bytes it signs.
+            // They are this arm's own serialization, not the outbox's
+            // `deliveryBody`; a receiver verifies over what it received, so each
+            // arm signs what it sends. No body is signed as the empty string.
+            const requestBody = body !== undefined && body !== null ? JSON.stringify(body) : undefined;
+            const requestHeaders = signingSecret
+                ? { ...headers, [HTTP_SIGNATURE_HEADER]: signHttpBody(requestBody ?? '', signingSecret) }
+                : headers;
             try {
                 const response = await fetch(url, {
                     method,
-                    headers,
-                    body: body !== undefined && body !== null ? JSON.stringify(body) : undefined,
+                    headers: requestHeaders,
+                    body: requestBody,
                     signal: controller.signal,
                 });
                 const data = await readBody(response);
 
@@ -1,6 +1,7 @@
 // Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
 
-import { createHmac, randomUUID } from 'node:crypto';
+import { randomUUID } from 'node:crypto';
+import { HTTP_SIGNATURE_HEADER, signHttpBody } from '@objectstack/core';
 import type { HttpAckResult, HttpDelivery } from './http-outbox.js';
 
 /**
@@ -10,19 +11,26 @@ import type { HttpAckResult, HttpDelivery } from './http-outbox.js';
  * stateless attempt (`sendOnce`) plus the retry-schedule classifier
  * (`classifyAttempt`). The dispatcher owns claim/ack; this module owns the wire.
  *
- * It also owns both halves of the HMAC contract — {@link deliveryBody} (the exact
- * bytes that are signed AND sent) and {@link signBody} (how they are signed) — so
- * the enqueue-time signer and the send-time transport cannot drift into signing
- * one string and posting another. See {@link HttpDelivery.signature} for why the
- * signature is computed once, at enqueue, instead of re-derived at send time from
- * a secret carried on the row.
+ * It also owns the outbox's half of the HMAC contract — {@link deliveryBody}, the
+ * exact bytes that are signed AND sent — so the enqueue-time signer and the
+ * send-time transport cannot drift into signing one string and posting another.
+ * HOW those bytes are signed is not this module's: the scheme is
+ * `@objectstack/core`'s `signHttpBody` / `HTTP_SIGNATURE_HEADER`, shared with the
+ * flow `http` node's inline arm, and re-exported below under this module's
+ * historical names. See {@link HttpDelivery.signature} for why the signature is
+ * computed once, at enqueue, instead of re-derived at send time from a secret
+ * carried on the row.
  */
 
 /** Default per-request timeout. */
 export const DEFAULT_HTTP_TIMEOUT_MS = 15_000;
 
-/** Header carrying the HMAC-SHA256 signature of the request body. */
-export const SIGNATURE_HEADER = 'X-Objectstack-Signature';
+/**
+ * The signature header and the signer — the SAME bindings `@objectstack/core`
+ * exports, never a second implementation: the outbox and the flow `http` node's
+ * inline arm must mean one thing by one `signingSecret`.
+ */
+export { HTTP_SIGNATURE_HEADER as SIGNATURE_HEADER, signHttpBody as signBody };
 
 /**
  * The exact request body for a delivery — the bytes that get POSTed, and
@@ -39,17 +47,6 @@ export function deliveryBody(payload: unknown): string {
     return typeof payload === 'string' ? payload : JSON.stringify(payload ?? null);
 }
 
-/**
- * Compute the `X-Objectstack-Signature` value for a body: `sha256=<hex>` of
- * `HMAC-SHA256(body, secret)`.
- *
- * The output is safe to persist (it is handed to the receiver on the wire
- * anyway); the `secret` argument is NOT — see {@link HttpDelivery.signature}.
- */
-export function signBody(body: string, secret: string): string {
-    return `sha256=${createHmac('sha256', secret).update(body).digest('hex')}`;
-}
-
 /** Truncate response bodies to keep storage cost predictable. */
 const RESPONSE_BODY_CAP = 16 * 1024;
 
@@ -105,7 +102,7 @@ export async function sendOnce(
     // signing secret is not on the row for this attempt — or any other — to
     // carry. #7722.
     if (delivery.signature) {
-        headers[SIGNATURE_HEADER] = delivery.signature;
+        headers[HTTP_SIGNATURE_HEADER] = delivery.signature;
     }
 
     const timeoutMs = delivery.timeoutMs ?? DEFAULT_HTTP_TIMEOUT_MS;
 
@@ -173,7 +173,10 @@ export {
     newDeliveryId as newHttpDeliveryId,
     DEFAULT_HTTP_TIMEOUT_MS,
     // The signing pair (#7722) — exported so a receiver-side verifier (or a
-    // test) recomputes the HMAC over exactly the bytes the sender signed.
+    // test) recomputes the HMAC over exactly the bytes the sender signed. The
+    // signer and the header are `@objectstack/core`'s own bindings
+    // (`signHttpBody` / `HTTP_SIGNATURE_HEADER`), re-exported under the same
+    // names: one scheme for the outbox and the flow `http` node's inline arm.
     deliveryBody as httpDeliveryBody,
     signBody as signHttpBody,
     SIGNATURE_HEADER as HTTP_SIGNATURE_HEADER,