docs: tenant-webhook category boundary now normative + enforced (spec

v0.1.25.38 / admin 0.1.25.50)

The reviewer flagged three tenant-self-service-boundary statements as
currently-false; the upstream fix landed — governance spec revision
v0.1.25.38 (cycles-protocol#126) makes category validation NORMATIVE on
both POST /v1/webhooks and PATCH /v1/webhooks/{id} (an admin-only
event_categories entry MUST be rejected 400 INVALID_REQUEST, since
categories are additive with types in delivery matching), and
cycles-server-admin 0.1.25.50 (released, tagged) enforces it and closes
the legacy empty-both match-ALL update door. So the statements are now
true AND enforced.

Verified against cycles-governance-admin-v0.1.25.yaml (version 0.1.25.38,
TENANT-ACCESSIBLE BOUNDARY NORMATIVE block at ~line 7243; "29 of 51
types") and the admin 0.1.25.50 CHANGELOG entry.

- protocol/webhook-event-delivery-protocol.md (~157, normative-ish home):
  added the one version-scoped note — boundary normative in spec
  v0.1.25.38 (both event_types AND event_categories validated, 400 on an
  admin-only entry, rationale: categories are additive); admin 0.1.25.50
  enforces the category check + closes the empty-both door; 0.1.25.49 and
  earlier validated event_types only; operators should audit existing
  tenant subscriptions (release-notes link).
- concepts/webhooks-and-events.md, how-to/webhook-integrations.md,
  admin-api/guide.md tenant-self-service lines: left as plain capability
  descriptions (now simply correct; not over-annotated per the single-
  note guidance). Counts were already 29 of 51 from the prior round.
- Fixed two stale "47-event-type" cross-reference mentions
  (admin-api/guide.md, how-to/webhook-integrations.md related-links) to
  51.

Tenant-context webhook-create examples (admin-api/guide, managing-
webhooks, webhook-integrations) all use tenant-accessible event_types
only, no event_categories, no admin category shown — no change needed.
Dated blog figure (real-time-budget-alerts, "27 of 41 as of post date;
live 29 of 51") left as-is — already points to the live count.

Author: amavashev

admin-api/guide.md

@@ -420,7 +420,7 @@ curl -X POST http://localhost:7979/v1/webhooks \
   }'
 ```
 
-See [Webhook Event Delivery Protocol](/protocol/webhook-event-delivery-protocol) for the full 47-event-type reference and delivery specification. See [Webhook Integrations](/how-to/webhook-integrations) for PagerDuty, Slack, and ServiceNow examples.
+See [Webhook Event Delivery Protocol](/protocol/webhook-event-delivery-protocol) for the full 51-event-type reference and delivery specification. See [Webhook Integrations](/how-to/webhook-integrations) for PagerDuty, Slack, and ServiceNow examples.
 
 ## List-endpoint features (v0.1.25.22+)
 

how-to/webhook-integrations.md

@@ -997,6 +997,6 @@ curl -X PUT http://localhost:7979/v1/admin/config/webhook-security \
 ## Next steps
 
 - [Managing Webhooks](/how-to/managing-webhooks) — create, test, replay, and monitor webhook subscriptions
-- [Webhook Event Delivery Protocol](/protocol/webhook-event-delivery-protocol) — full 47-event-type catalog, delivery headers, retry policy, and status lifecycle
+- [Webhook Event Delivery Protocol](/protocol/webhook-event-delivery-protocol) — full 51-event-type catalog, delivery headers, retry policy, and status lifecycle
 - [Deploying the Events Service](/quickstart/deploying-the-events-service) — deploy the async webhook delivery service
 - [Security](/security#webhook-security) — SSRF protection, signing secret encryption, and deduplication

protocol/webhook-event-delivery-protocol.md

@@ -154,7 +154,7 @@ The 51-type / 7-category count tracks the admin OpenAPI enum. The runtime spec's
 
 ### Tenant-accessible events
 
-Tenants creating self-service webhooks via `/v1/webhooks` can subscribe to budget, reservation, and tenant events: 29 of the 51 registered event types — including the `budget.*` and `reservation.*` cascade fan-out events the admin server emits on tenant close (see the next section). API key, policy, webhook lifecycle, and system events are admin-only.
+Tenants creating self-service webhooks via `/v1/webhooks` can subscribe to budget, reservation, and tenant events: 29 of the 51 registered event types — including the `budget.*` and `reservation.*` cascade fan-out events the admin server emits on tenant close (see the next section). API key, policy, webhook lifecycle, and system events are admin-only. The boundary is normative in governance spec revision v0.1.25.38: on `POST /v1/webhooks` and `PATCH /v1/webhooks/{id}`, both `event_types` **and** `event_categories` are validated against the tenant-accessible set, and an admin-only entry is rejected with `400 INVALID_REQUEST` — `event_categories` is additive with `event_types` in delivery matching, so validating types alone would leave the door open. cycles-server-admin **0.1.25.50** enforces the category check (and closes the legacy update path that left both arrays empty, matching every event class); **0.1.25.49 and earlier validated `event_types` only** — operators upgrading should audit existing tenant subscriptions for admin-only categories (see the [0.1.25.50 release notes](https://github.com/runcycles/cycles-server-admin/releases/tag/v0.1.25.50) for the audit one-liner).
 
 ### Tenant-close cascade fan-out