The agent sorted the JSON body keys to tidy it up, and the request signature stopped matching

An agent sorts an outbound webhook's JSON keys to clean them up after signing, breaking HMAC verification because the receiver rehashes the reordered bytes. Explains why shape-only tests miss it, how to keep signing and transmission byte-identical, and which checks force the verified path.