diff --git a/‎.changeset/22825-inbound-hook-timestamped-guidance.md‎
Lines changed: 16 additions & 0 deletions b/‎.changeset/22825-inbound-hook-timestamped-guidance.md‎
Lines changed: 16 additions & 0 deletions
diff --git a/‎docs/qa/platform-checklist/areas/automation.json‎
Lines changed: 8 additions & 2 deletions b/‎docs/qa/platform-checklist/areas/automation.json‎
Lines changed: 8 additions & 2 deletions
diff --git a/‎examples/app-showcase/src/automation/flows/index.ts‎
Lines changed: 7 additions & 5 deletions b/‎examples/app-showcase/src/automation/flows/index.ts‎
Lines changed: 7 additions & 5 deletions
diff --git a/‎packages/lint/src/rule-explanations.ts‎
Lines changed: 5 additions & 3 deletions b/‎packages/lint/src/rule-explanations.ts‎
Lines changed: 5 additions & 3 deletions
diff --git a/‎packages/lint/src/validate-flow-trigger-readiness.ts‎
Lines changed: 4 additions & 3 deletions b/‎packages/lint/src/validate-flow-trigger-readiness.ts‎
Lines changed: 4 additions & 3 deletions
diff --git a/‎skills/objectstack-automation/SKILL.md‎
Lines changed: 3 additions & 3 deletions b/‎skills/objectstack-automation/SKILL.md‎
Lines changed: 3 additions & 3 deletions
@@ -0,0 +1,16 @@
+---
+'@objectstack/lint': patch
+'@objectstack/skills': patch
+---
+
+docs(automation): every text that teaches a sender of an inbound `api` hook teaches the timestamped `x-objectstack-signature` form only — `t=<unix seconds>,v1=<hex>`, the HMAC-SHA256 of `<t>.<raw body>` under the flow's secret, refused when `t` is more than 300 seconds from the server clock
+
+Clause-②: no
+
+The inbound hook door has accepted the timestamped form since `signHttpBodyAt` landed in `@objectstack/core`, and it is the only form that stops a captured post from verifying forever; the published teaching still showed the body-only `sha256=<hex>` form. The guidance converges first; the door's refusal of the body-only form is a later change of its own.
+
+- **`@objectstack/skills`.** The `objectstack-automation` skill's Inbound webhook section teaches `t=<unix seconds>,v1=<hex>`: `v1` is the HMAC-SHA256 of `<t>.<raw body>` under the start node's `secret`, and the door refuses a `t` more than 300 seconds from its clock. The body-only form is no longer shown.
+- **`@objectstack/lint`.** The hint of `flow-api-trigger-secret-missing` and its `os explain` entry describe the same form. The rule's id, severity, verdict sentence and judgement are unchanged.
+- The showcase example's comment and the platform checklist's intake recipe sign the same way.
+
+**Nothing to migrate for an author.** A sender that already signs with `signHttpBodyAt` is unchanged. **The outbound contract stays as published:** the messaging outbox and the flow `http` node keep signing body-only (`signHttpBody`) for third-party receivers, and the inbound door's accept set is not changed by this release.
@@ -530,7 +530,7 @@
       "title": "Every flow trigger type fires and produces a run of its bound flow; the run's trigger block records the launch event",
       "since": "v15",
       "status": "active",
-      "revision": 2,
+      "revision": 3,
       "priority": "P1",
       "surface": "mixed",
       "personas": [
@@ -554,7 +554,7 @@
         "boot showcase isolated (dogfood §0); sign in as the dev admin",
         "record_change (create leg): POST /api/v1/data/showcase_task with priority='urgent' — showcase_urgent_task_alert fires via record-after-write with previous == null (#3427)",
         "record_change (update leg): POST a normal-priority task, then PATCH priority→'urgent'; also PATCH a task status→'done' and confirm a further save WITHOUT a transition fires nothing",
-        "api: POST /api/v1/automation/hooks/showcase_inbound_task_webhook/intake with JSON {title, assignee, project} and header x-objectstack-signature: sha256=<HMAC-SHA256 of the raw body, key 'showcase-webhook-secret'> — expect a 202 ACK; then find the created showcase_task",
+        "api: POST /api/v1/automation/hooks/showcase_inbound_task_webhook/intake with JSON {title, assignee, project} and header x-objectstack-signature: t=<unix seconds>,v1=<HMAC-SHA256 of '<t>.<raw body>', key 'showcase-webhook-secret'> — signHttpBodyAt(rawBody, 'showcase-webhook-secret', Math.floor(Date.now() / 1000)) from @objectstack/core writes it, and the door refuses a t more than 300 s from the server clock — expect a 202 ACK; then find the created showcase_task",
         "schedule: wait up to ~60s for showcase_scheduled_digest (interval 60000ms) to tick; wait a second interval for a second tick",
         "screen: from /apps/showcase_app/showcase_task run the row action showcase_bulk_reassign, fill the dialog, submit",
         "autolaunched: POST /api/v1/automation/showcase_batch_reminders/trigger {params:{tasks:[…]}}",
@@ -630,6 +630,12 @@
           "date": "2026-10-05",
           "change": "clause 1, step 9 and the title re-pointed (assertion defect, #21784 VF4). The service-automation engine's buildRunTrigger sets trigger.type = context.event ?? 'manual': the launch event, not Flow.type, and execution.zod.ts describes trigger.type as a free string. This predates 17.6.0 (#7533). The verifier's wording is used: the kind is identified through the run's flow, and trigger.type is recorded as the launch event",
           "ref": "#21797"
+        },
+        {
+          "revision": 3,
+          "date": "2026-10-11",
+          "change": "api step: the intake recipe signs with the timestamped x-objectstack-signature form t=<unix seconds>,v1=<hex> that signHttpBodyAt in @objectstack/core writes (HMAC-SHA256 of '<t>.<raw body>' under the secret; the door refuses a t more than 300 s from its clock), no longer with the body-only form. Guidance step of the inbound-hook convergence; the door's refusal of the body-only form is the follow-up card",
+          "ref": "#22825"
         }
       ]
     },
 
@@ -1578,13 +1578,15 @@ export const ReleaseSignoffFlow = defineFlow({
  * or a schedule. The start node's config arms the hook:
  *
  *   POST /api/v1/automation/hooks/showcase_inbound_task_webhook/intake
- *   x-objectstack-signature: sha256=<hmac-sha256 of the raw body, key below>
+ *   x-objectstack-signature: t=<unix seconds>,v1=<hmac-sha256 of "<t>.<raw body>", key below>
  *   { "title": "...", "assignee": "...", "project": "<showcase_project id>" }
  *
- * The trigger validates the HMAC (constant-time), enqueues, and ACKs 202; a
- * queue consumer runs the flow with the JSON payload as the trigger record —
- * so `{record.title}` here reads straight from the webhook body, exactly like
- * a record-change flow reads its record.
+ * `signHttpBodyAt(rawBody, secret, Math.floor(Date.now() / 1000))` from
+ * `@objectstack/core` writes that header value. The trigger validates the HMAC
+ * (constant-time) and refuses a `t` more than 300 s from its own clock, then
+ * enqueues and ACKs 202; a queue consumer runs the flow with the JSON payload
+ * as the trigger record — so `{record.title}` here reads straight from the
+ * webhook body, exactly like a record-change flow reads its record.
  */
 export const InboundTaskWebhookFlow = defineFlow({
   name: 'showcase_inbound_task_webhook',
 
@@ -1460,9 +1460,11 @@ const FLOW_API_TRIGGER_SECRET_MISSING_EXPLANATION: RuleExplanation = {
   covers: 'why an inbound api flow needs a secret',
   paragraphs: [
     'An inbound api hook is armed only with a per-flow secret that every post is HMAC-verified against ' +
-      '(ADR-0041): the `x-objectstack-signature` header carries \'sha256=\' and the hex HMAC-SHA256 of ' +
-      'the raw body. A usable secret is a string that is not blank after trimming, on the start node\'s ' +
-      '`config.secret`; absent, blank and non-string are one verdict.',
+      '(ADR-0041): the `x-objectstack-signature` header carries `t=<unix seconds>,v1=<hex>`, where the hex ' +
+      'is the HMAC-SHA256 of `<t>.<raw body>` under the secret, and the door refuses a `t` more than 300 ' +
+      'seconds from its own clock, so a captured post stops verifying. A usable secret is a string that is ' +
+      'not blank after trimming, on the start node\'s `config.secret`; absent, blank and non-string are one ' +
+      'verdict.',
     'The automation engine refuses to register a flow bound to the api trigger without one — a ' +
       'hardcoded check in `registerFlow`, before any trigger is consulted and whatever the flow\'s ' +
       '`status` — and the trigger refuses to arm it, so the flow never receives a post. The `/automation` ' +
 
@@ -934,9 +934,10 @@ export function validateFlowApiTriggerSecret(
         `refuses to register the flow`,
       hint:
         `Set a non-blank string config.secret on the start node, and sign each post with it: the ` +
-        `x-objectstack-signature header carries 'sha256=' and the hex HMAC-SHA256 of the raw body. A flow that is ` +
-        `only ever started explicitly and never receives inbound posts is type: 'autolaunched', with no ` +
-        `triggerType: 'api' on its start node — that flow needs no secret.`,
+        `x-objectstack-signature header carries t=<unix seconds>,v1=<hex>, the hex being the HMAC-SHA256 of ` +
+        `'<t>.<raw body>' under the secret, and a t more than 300 seconds from the server clock is refused. ` +
+        `A flow that is only ever started explicitly and never receives inbound posts is type: 'autolaunched', ` +
+        `with no triggerType: 'api' on its start node — that flow needs no secret.`,
     });
   });
   return findings;
 
@@ -48,7 +48,7 @@ A **Flow** is a directed graph of nodes — the primary automation building bloc
 | `screen` | Interactive — presents UI screens to the user (wizards, forms) |
 | `schedule` | Runs on a cron/interval cadence declared on the **start node's `config.schedule`** (daily cleanup, weekly reports) — or a **per-record date sweep** via `config.timeRelative`, see *Time-relative triggers* |
 | `record_change` | Fires automatically on record create/update/delete (bind via the `start` node's `triggerType`). `autolaunched` + the same `record-*` binding behaves identically — the engine reads the start node either way; `record_change` also opts into the trigger-readiness lint |
-| `api` | Inbound **webhook** — every `api` flow is bound to its hook endpoint and needs a start-node `secret` (see *Inbound webhook triggers* below); a flow only ever started explicitly is `autolaunched` |
+| `api` | Inbound **webhook** — needs a start-node `secret` (see *Inbound webhook triggers* below); a flow only ever started explicitly is `autolaunched` |
 
 ### Flow Node Types
 
@@ -348,9 +348,9 @@ node `config`** (the start `config` is a free-form record with no Zod shape):
 | `hookId` | URL path token (default `'default'`). **Rotate it to revoke** a leaked endpoint |
 | `secret` | HMAC-SHA256 shared secret. **Required** — without a non-blank one the flow is refused at registration (`os validate` too) and never armed at boot; the signature goes in `x-objectstack-signature` |
 
-- **Signature:** `sha256=<hex>` (GitHub/Stripe style).
+- **Signature:** `t=<unix seconds>,v1=<hex>` — `v1` = HMAC-SHA256 of `<t>.<raw body>` under `secret`; refused when `t` is over 300 s from the server clock.
 - **Idempotency:** `x-idempotency-key` dedupes retries — author the flow to be idempotent (delivery is at-least-once).
-- **Queue-backed:** the endpoint ACKs `202` and enqueues; the flow runs on the consumer, never in-band. Requires the `queue` service (see prerequisite).
+- **Queue-backed:** the endpoint ACKs `202` and enqueues; the flow runs on the consumer, never in-band.
 - The JSON body surfaces to the flow as the trigger record (`record.*` / bare fields) plus `params`.
 
 ### Trigger Types (start-node `config.triggerType`)