# Agent protocol

All requests use HTTPS, JSON, a timestamp and HMAC-SHA256 signature over `timestamp + "." + raw_body`.
Headers: `X-Site-ID`, `X-Timestamp`, `X-Agent-Secret`, `X-Signature`.
The current starter includes the polling/heartbeat endpoints. Production rollout must add:
- A secure one-time registration flow that issues a random site secret once and stores only its SHA-256 hash.
- Timestamp replay cache/nonces.
- Explicit command application and reconciliation for the selected platform (Core PHP/Laravel/WordPress).
- An allowlist for recovery, login and payment routes before suspension is enabled.
Do not treat the included agent as a universal server-level suspension tool. It cannot suspend a site unless the relevant platform-specific middleware or web-server integration is installed.