ash_hooks HTTP adapter signing final method, URL, headers, and body bytes.

Configure http: RequestSeal.AshHooks.Http and http_opts: [request_seal: [spec: signing_spec, signer: custody_handle]]. Optional signing options are :clock (a zero-arity function) and :signing_timeout. Nonces are freshly generated for every attempt. The spec must cover @method, @authority, @path, content-digest, content-type, and webhook-id without component parameters. The digest defaults to SHA-256. URLs with a query must also cover @query. Incoming signature fields and transport-owned headers reject; case-colliding headers reject before conversion to the transport map.

Delegates one signed request to AshHooks.Http.Bounded with the remaining total timeout and unchanged transport options. ash_hooks continues to own SSRF resolve-and-pin, durable attempts, retries, secret references, rotation, and response classification. Signing failures return {:error, {:terminal, :request_seal_signing_failed}}; transport exceptions propagate unchanged. The terminal tag is for caller classification; ash_hooks 2.0 retries returned adapter errors other than :unsafe_destination. ash_hooks still requires its Standard Webhooks secret reference and emits those headers alongside RFC 9421 fields. Select the RFC label explicitly. Adapter options receive no endpoint or tenant identity; choose custody in static http_opts or its ash_hooks MFA resolver. No client or pool starts here.