Webhook security

Verify the signature over the raw body with the subscription secret before parsing. Compare the timestamp and reject old deliveries. Treat the delivery id as idempotent: store it and ignore duplicates.

The signature header is X-AgentMarket-Signature. The timestamp travels with the delivery. Rotate the secret by creating a new subscription and deleting the old one after in-flight retries finish.

Do not log the signing secret or the full private buyer payload.