Decision — MC ↔ orchestrator wire = HMAC-signed POSTs

Decision

Every request crossing the MC ↔ orchestrator boundary is an HMAC-SHA256-signed POST. Both sides verify the signature on receipt. No JWTs, no API keys, no mTLS.

Rationale

• Symmetric: same primitive on both ends; trivial to reason about.
• Stateless: no token rotation infrastructure, no JWKS endpoint.
• Tamper-evident: any body change invalidates the signature.

Scope

• Shared secret: AGENT_HMAC_SECRET (≥32 chars, zod-validated at startup on both sides).
• Header name: x-agent-signature (MC reads; orchestrator sends).
• Signed scope: the raw body bytes only. No URL, headers, or timestamp.

Future

A timestamp + replay-cache may be added if replay attacks become a concern. Not currently in scope.

Reference

• Workspace CLAUDE.md hard constraint
• mission-control/lib/hmac.ts, orchestrator/src/lib/transitions.ts