runbook: how to confirm the webhook URL match, and what the watch job does and does not cover

operator-token-runbook.md

@@ -65,10 +65,22 @@ cutover completed 2026-10-28 (`ADMIN_TOKEN_LEGACY=0`), verified on the wire:
   webhook URL configured on the collective, which needs Open Collective admin
   access — the same blocker as moving `OC_PERSONAL_TOKEN` (below) to a
   co-op-owned account.
-- **Unverified:** whether the collective's webhook URL was updated in step with
+- **Whether the collective's webhook URL matches the current token is still
-  that rotation. The route compares the URL token against the env var, so a
+  unconfirmed** (as of 2026-10-28). The route compares the URL token against the
-  mismatch makes OC's deliveries 401 and new-member provisioning waits for the
+  env var, so a mismatch means OC's deliveries 401 and new-member provisioning
-  nightly sweep (delayed, not lost). Treat the first real OC event as the test.
+  waits for the nightly sweep — delayed, not lost.
+- **To confirm it directly**, compare by hash rather than by reading the value
+  out: take the URL's last path segment in the collective's webhook settings and
+  run `printf %s '<token>' | sha256sum` LOCALLY, then compare its first 12 hex
+  characters against the same prefix of the portal's `WEBHOOK_TOKEN`. A hash
+  prefix of a live secret does not belong in this file or in chat.
+- **The monitor already covers the failure case.** The `portal webhook delivery
+  watch` cron job alerts on ANY failed delivery (401/404 = OC is posting to a URL
+  the portal rejects) and stays silent on the happy path, which is why silence in
+  its output means "nothing to report" and not "blind". Verified 2026-10-28 by
+  posting a benign event with the current token: the portal answered 200 and the
+  job reported it with `--verbose`. Run it with `--verbose` to see accepted
+  deliveries; run it plainly to see only problems.
 - **No caller may fall back from `ADMIN_TOKEN` to `WEBHOOK_TOKEN`.** The legacy
   token 403s, so a fallback turns "unset" into a confusing mid-run failure
   instead of a clear abort.