feat(protocol): accept usage.v6, where webhook use counts any successful delivery

.github/workflows/security.yml

@@ -28,8 +28,8 @@ jobs:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           repository: PicPeak/picpeak
-          # Includes the English-only catalogs from PicPeak/picpeak#1330.
-          ref: 9396d019c6ab7cea81662193410c11ddfd77175c
+          # usage.v6 client (PicPeak/picpeak#1743): repin to its merge commit once it lands.
+          ref: 234a17c5d7c53656d76060d0931510c1606eb382
           path: picpeak
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:

README.md

@@ -85,12 +85,12 @@ Every build includes /source.tar.gz containing a fixed allowlist of application
 ## Contract and verification
 
 Old and partial reports remain readable after upgrades. The collector supports
-v1/v2/v3/v4/v5 and treats omitted or null measurements as unknown. Freshly signed
+v1/v2/v3/v4/v5/v6 and treats omitted or null measurements as unknown. Freshly signed
 delayed reports keep their original reporting date. Separate reception schemas
-at `/schema/ingress/usage.v1.json` (also v2/v3/v4/v5) describe this compatibility;
+at `/schema/ingress/usage.v1.json` (also v2/v3/v4/v5/v6) describe this compatibility;
 the original complete sender schemas, consent and privacy boundaries stay fixed.
 
-The [protocol reference](docs/PROTOCOL.md) defines every field and operation. JSON Schemas are served at `/schema/usage.v1.json`, `/schema/usage.v2.json`, `/schema/usage.v3.json` `/schema/usage.v4.json` and `/schema/usage.v5.json`, with the current EN/DE catalog at `/schema/features.v5.json`. PicPeak carries byte-identical protocol/catalog files in `backend/src/usage/`.
+The [protocol reference](docs/PROTOCOL.md) defines every field and operation. JSON Schemas are served at `/schema/usage.v1.json`, `/schema/usage.v2.json`, `/schema/usage.v3.json`, `/schema/usage.v4.json`, `/schema/usage.v5.json` and `/schema/usage.v6.json`, with the current EN/DE catalog at `/schema/features.v6.json`. PicPeak carries byte-identical protocol/catalog files in `backend/src/usage/`.
 
 The [full coverage matrix](docs/FEATURE_COVERAGE.md) covers 87 capabilities: 64 configured/used pairs and 23 configuration-only signals. ML face recognition is included without biometric results. v3 adds 13 specific capabilities, including invoice import, plus exactly two installation inventory totals: stored galleries and non-video photo records, including drafts and retained archived records. No contents, per-gallery breakdowns, visitor behavior or identities.
 

docs/FEATURE_COVERAGE.md

@@ -1,11 +1,14 @@
-# Product-usage coverage: usage.v5
+# Product-usage coverage: usage.v6
 
 ## What the numbers mean
 
 The 86 v4 capabilities have all been reviewed for the distinction between
 availability, a present configuration, and observed use. v5 asks 87 questions:
 six broad admin-management questions are replaced by precisely defined edit
 signals, and one question measures real template-mail transport acceptance.
+v6 asks the same 87 questions; its one change is that `webhooks` use counts
+any successful delivery (HTTP 2xx), automatic or manual, instead of only an
+explicit admin test/replay (issue 1740). Still one bit, no delivery data.
 There are 64 configured/used pairs and 23 configuration-only signals.
 Historical views retain all 94 keys separately. No old value is renamed,
 backfilled, reinterpreted, or combined with its replacement.
@@ -52,18 +55,18 @@ Reports retain the existing stable installation fingerprint, PicPeak version,
 daily date/generation time and gallery-layout enum. They are pseudonymous,
 not fully anonymous. Existing retention, access controls and deletion apply.
 
-Every v1–v4 wire schema/catalog remains immutable. New evidence is retained only
-under active, confirmed usage-consent.v5. The signed consent upgrade preserves
+Every v1–v5 wire schema/catalog remains immutable. New evidence is retained only
+under active, confirmed usage-consent.v6. The signed consent upgrade preserves
 identity and raw history, finishes pending old packets unchanged and resets
 markers only after the matching receipt. Opt-out wins over late receipts.
 A marker write failure must not retry a successfully sent email.
 Deploy the collector before the PicPeak client; existing clients keep working.
 
 ## Full audit
 
-The table is the decision for every active v5 capability. The route/flag/settings
-inventory is `usage-coverage.v5.json`; historical inventories remain unchanged.
-Exact definitions are served at `/schema/features.v5.json` and disclosed in the
+The table is the decision for every active v6 capability. The route/flag/settings
+inventory is `usage-coverage.v6.json`; historical inventories remain unchanged.
+Exact definitions are served at `/schema/features.v6.json` and disclosed in the
 PicPeak EN/DE consent catalog. A retired broad management signal remains under
 its original definition in the collector's earlier-measurements view/history.
 
@@ -118,7 +121,7 @@ its original definition in the collector's earlier-measurements view/history.
 | `seo_editing` — SEO customization | Built in; display a label, not a percentage. | An admin saved a real change to an allowlisted SEO setting since consent. Defaults, reading and unchanged saves do not count; no rules, paths or search-engine activity are collected. |
 | `admin_management` — Admin and role management | Enabled switch/capability; may be a default. | A documented successful authenticated admin capability operation was observed since consent to this schema. No actor, operation history, parameters or counts. |
 | `api_integration` — HTTP API integration | Technical configuration exists; may be a default, not activity. | Successful authenticated HTTP API capability call; only this bit, never URLs, request values, token/owner IDs or call counts. Does not trigger a report. |
-| `webhooks` — Outbound webhooks | Technical configuration exists; may be a default, not activity. | Successful explicit admin webhook test/replay; no automatic or visitor-triggered deliveries. |
+| `webhooks` — Outbound webhooks | Technical configuration exists; may be a default, not activity. | Successful delivery (HTTP 2xx) of any outbound webhook, whether triggered automatically by an event or by an explicit admin test/replay; no destinations, event types, payloads, timestamps or counts. |
 | `restore` — Restore | Built in; display a label, not a percentage. | A documented successful authenticated admin capability operation was observed since consent to this schema. No actor, operation history, parameters or counts. |
 | `portable_backup` — Portable PicPeak export/import | Built in; display a label, not a percentage. | A documented successful authenticated admin capability operation was observed since consent to this schema. No actor, operation history, parameters or counts. |
 | `database_backup` — Database backups | Technical configuration exists; may be a default, not activity. | A documented successful authenticated admin capability operation was observed since consent to this schema. No actor, operation history, parameters or counts. |

docs/PROTOCOL.md

@@ -1,4 +1,4 @@
-# Versioned usage protocol (usage.v1 / usage.v2 / usage.v3 / usage.v4 / usage.v5)
+# Versioned usage protocol (usage.v1 / usage.v2 / usage.v3 / usage.v4 / usage.v5 / usage.v6)
 
 Implements the backend-signs/backend-sends decision in
 [#1110's transport follow-up](https://github.com/PicPeak/picpeak/issues/1110#issuecomment-5367220785).
@@ -7,16 +7,16 @@ Browser transport is not implemented. CORS is not authentication.
 ## Exact envelope
 
 `POST /api/envelopes` accepts at most 16 KiB of uncompressed JSON. The complete
-closed sender JSON Schemas are at `/schema/usage.v1.json`, `/schema/usage.v2.json`, `/schema/usage.v3.json`, `/schema/usage.v4.json`, and `/schema/usage.v5.json`.
-The current field catalog is at `/schema/features.v5.json`; the v2/v3 catalogs retain their original definitions. Unknown fields are rejected at
+closed sender JSON Schemas are at `/schema/usage.v1.json`, `/schema/usage.v2.json`, `/schema/usage.v3.json`, `/schema/usage.v4.json`, `/schema/usage.v5.json`, and `/schema/usage.v6.json`.
+The current field catalog is at `/schema/features.v6.json`; the v2/v3 catalogs retain their original definitions. Unknown fields are rejected at
 every level. No arbitrary attributes or free-form telemetry are supported.
 
 | Field                    | Meaning                                                       |
 | ------------------------ | ------------------------------------------------------------- |
-| `packet.schema_version`  | Literal `usage.v1`, `usage.v2`, `usage.v3`, `usage.v4` or `usage.v5`; never inferred from payload |
+| `packet.schema_version`  | Literal `usage.v1`, `usage.v2`, `usage.v3`, `usage.v4`, `usage.v5` or `usage.v6`; never inferred from payload |
 | `packet.installation_id` | SHA-256 of Ed25519 SPKI public-key DER, lowercase hex         |
 | `packet.packet_id`       | UUIDv4 identifying an immutable operation                     |
-| `packet.action`          | `register`, `report`, `delete`, `feedback`, `vote`, `session`; v2/v3/v4/v5 also `consent` |
+| `packet.action`          | `register`, `report`, `delete`, `feedback`, `vote`, `session`; v2/v3/v4/v5/v6 also `consent` |
 | `packet.sequence`        | 0 at registration; increments per accepted operation          |
 | `packet.payload`         | Action-specific closed schema, below                          |
 | `public_key`             | Ed25519 SPKI DER, unpadded base64url                          |
@@ -53,7 +53,7 @@ The separate, closed reception schemas are published at
 `/schema/ingress/usage.v1.json`, `/schema/ingress/usage.v2.json` and
 `/schema/ingress/usage.v3.json` and `/schema/ingress/usage.v4.json`. For `report` only, they accept omitted or `null`
 measurements: `picpeak_version`, `features`, individual capabilities and their
-known `configured`/`used` members, `gallery_layouts`, and v3/v4/v5 `inventory` with
+known `configured`/`used` members, `gallery_layouts`, and v3/v4/v5/v6 `inventory` with
 either or both totals. Other supplied values retain their original types,
 bounds and per-version allowlists. A missing value is unknown, never false or
 zero; an explicit empty layout list is known and means no layouts were reported.
@@ -104,7 +104,7 @@ receipt was lost. No migration or rewriting of stored reports is required.
 
 ## Actions
 
-- `register`: the matching `usage-consent.v1`, `usage-consent.v2`, `usage-consent.v3`, `usage-consent.v4` or `usage-consent.v5`,
+- `register`: the matching `usage-consent.v1`, `usage-consent.v2`, `usage-consent.v3`, `usage-consent.v4`, `usage-consent.v5` or `usage-consent.v6`,
   with sequence zero. A second
   different registration for the same identity conflicts.
 - `report`: `picpeak_version`, `report_date`, `generated_at`, `features`, and
@@ -336,3 +336,20 @@ unknown; v1–v4 envelopes retain their exact allowlists and validation. Confirm
 unchanged, local markers reset only on the matching consent receipt, and late
 responses cannot reverse opt-out. The existing two inventory totals and stable
 pseudonymous installation identity remain unchanged. Deploy collector first.
+
+## usage.v6 webhook delivery evidence
+
+v6 keeps all 87 v5 keys, the 64 configured/used pairs, the 23 configuration-only
+signals and both inventory totals unchanged. The single change is the definition
+of `webhooks` use: any successful delivery (HTTP 2xx) of an outbound webhook,
+automatic event-triggered or explicit admin test/replay, instead of only an
+admin test/replay enqueue. The PicPeak client records the bit from its delivery
+worker on a 2xx, and only under confirmed `usage-consent.v6`; earlier consents
+keep the enqueue meaning, and route enqueue evidence stops being recorded at v6.
+No destination, event type, payload, timestamp or count enters the usage
+subsystem; it stays one installation-wide boolean.
+
+The v6 receiver schema is `/schema/ingress/usage.v6.json`. v1–v5 envelopes keep
+their exact allowlists and validation. Confirmed `usage-consent.v6` is required
+before a v6 report is accepted; pending packets finish unchanged and local
+markers reset only on the matching consent receipt. Deploy collector first.