The agent sorted the JSON body keys to tidy it up, and the request signature stopped matching
The agent sorted the webhook body's JSON keys alphabetically after signing. Shape-only tests passed, CI went green, but production returned 401 signature_invalid: the receiver rehashed the reordered bytes and got a different digest. Order is cosmetic to a parser; bytes are everything to a signature.