Stop shipping webhook handlers that parse JSON before checking the signature. This kit gives freelancers and small teams a repeatable verify ritual: capture the raw body bytes exactly as received; run ./scripts/verify.sh with your provider and secret; paste stdout into the markdown verify report; and gate production with the acceptance checklist covering fail closed, replay, and rotation. Works on macOS/Linux CI and most cloud shells. Includes verify.sh, make-fixture.sh, GitHub/Stripe/generic fixtures, acceptance checklist, verify report, worked examples, and README. Instant zip for personal and internal commercial use of filled reports.