# description
The §Y change-notification webhook envelope a consumer POSTs to a broker-configured receiver ([OM-HOOK-002]). Signed per §Y (OpenOM-Signature); this schema validates the JSON body a receiver parses. Human-readable mirror is spec Part II §5b.

# properties.id.description
stable event id (== OpenOM-Event-Id, stable across retries)

# properties.sourceUrl.description
[M6] Attacker-controlled data even on a valid signature (the signer only proves it holds the shared secret). MUST be https; a receiver MUST re-check it with assertSafeUrl before fetching (SSRF), never fetch it blindly.

# properties.payloadHash.description
The §C integrity hash of `payload`. JSON Schema cannot bind it to `payload`, so a receiver MUST recompute and compare (verifyEnvelopePayloadHash) after verifying the signature - a schema-valid envelope can still carry a mismatched hash ([OM-HOOK], #120).

# properties.verification.description
[M6] The SENDER's self-reported results. A receiver MUST recompute its own (signature + payloadHash, and origin from sourceUrl if it wants an origin claim) and MUST NOT surface these values as its own trust state - doing so would let a sender self-assert 'origin verified'.