push subscription echoes secret

invalid — rejected by its schema, as intended schema: push-subscription · raw JSON

This example exists to prove the schema refuses something the specification forbids. Validator output at build time:

/ must NOT have additional properties

{
  "specVersion": "0.4",
  "type": "push-subscription",
  "subscriptionId": "sub_Vq8nR3kX0bT5wLz2Hc7Ym4Pd",
  "status": "active",
  "events": [
    "intent.matches.delivered"
  ],
  "expiresAt": "2026-11-26T14:00:00Z",
  "refreshBefore": "2026-11-23T14:00:00Z",
  "delivery": {
    "url": "https://agent.example.com/hooks/isto",
    "secret": "whsec_MfKQ9r8GKYqrTwjUPD8ILPZIo2LaLaSw"
  }
}