changelog.d/5045-routine-reliability.md

Rama main · réplica de lectura del repositorio original.

- ⚠️ **Behaviour change: `wait.event_filter` now filters signals (#5045).** The filter was validated but ignored at run time, so any signal completed the wait. It now takes `path == value` terms joined by `&&`; non-matching signals leave the wait parked and malformed filters are rejected on save.
- **A signed routine webhook can wake a parked wait without knowing the run (#5045).** Wait steps accept `correlation_key`, and `crewship routine webhooks` gains `--signal-event-type`, `--signal-correlation-path` and `--clear-signal`. A delivery is identified by its signed body: the same body is a duplicate for 30 days whatever its `Idempotency-Key`, and a reused key with another body returns `409`.
- **Webhook secrets can rotate without downtime (#5045).** `--previous-secret-ttl` keeps the replaced secret valid for 60s to 7d on routine and agent webhooks, with early revocation and an audit entry for each use. `--grace` stays as an alias.
- **Cron schedules can spread their fire times (#5045).** `crewship routine schedules --spread` applies a stable offset without changing occurrence identity or catch-up. The spread plus the 30s scheduler poll must fit inside the shortest cron interval.
- **Skills can be locked against autonomous rewrites (#5045).** `crewship skill lock|unlock` protects a skill from agents, promotion and lifecycle ageing. Blocked writes, including delete, return HTTP 423 and are journaled as `skill.write_blocked`. Skills are shared across the instance, so locking needs an instance administrator; assigning a skill grants no right to lock it. Bundled skills cannot be locked.
- **Webhook signal deliveries are identified by their signed body (#5045).** A delivery that arrives before its wait is armed answers `503` with `Retry-After` and is not consumed, so a redelivery wakes the wait. Once processed, the same body counts as a duplicate for 30 days, a reused delivery ID with a different body returns 409, and wait claims commit with the receipt. The signature has no timestamp, so replay protection ends when the receipt expires.
- **Signal payloads are fenced in agent prompts (#5045).** `{{ steps.<wait>.output }}` of a `wait: event` step is wrapped in the untrusted-ingress fence in every run, not only webhook-triggered ones.