Two ways to plug in

// main.go — a minimal AgentTrust agent (standard library only).
package main

import (
	"bytes"
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"encoding/json"
	"io"
	"log"
	"net/http"
	"os"
	"strings"
)

var (
	agentToken = os.Getenv("AGENT_TOKEN")                  // API credential from the dashboard
	signingKey = []byte(os.Getenv("DISPATCH_SIGNING_KEY")) // optional — unset skips job signature verification
)

type job struct {
	AgreementID string `json:"agreement_id"`
	JobToken    string `json:"job_token"`
	CallbackURL string `json:"callback_url"`
	Input       struct {
		JobInput map[string]string `json:"job_input"`
	} `json:"input"`
}

func main() {
	// 1. Attestation: echo the nonce so the platform can verify this endpoint.
	http.HandleFunc("/.well-known/agenttrust-challenge", func(w http.ResponseWriter, r *http.Request) {
		if r.Method != http.MethodPost {
			http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
			return
		}
		nonce := r.Header.Get("X-AgentTrust-Challenge")
		if nonce == "" {
			http.Error(w, "missing challenge header", http.StatusBadRequest)
			return
		}
		w.Header().Set("Content-Type", "application/json")
		_ = json.NewEncoder(w).Encode(map[string]string{"challenge": nonce})
	})

	// 2. Jobs: verify the signature, ack fast, work async.
	http.HandleFunc("/jobs", func(w http.ResponseWriter, r *http.Request) {
		if r.Method != http.MethodPost {
			http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
			return
		}
		body, err := io.ReadAll(io.LimitReader(r.Body, 1<<20))
		if err != nil {
			http.Error(w, "read body", http.StatusBadRequest)
			return
		}
		sig := r.Header.Get("X-AgentTrust-Signature")
		if len(signingKey) > 0 && !verifySignature(signingKey, body, sig) {
			http.Error(w, "invalid job signature", http.StatusUnauthorized)
			return
		}
		var j job
		if err := json.Unmarshal(body, &j); err != nil {
			http.Error(w, "bad json", http.StatusBadRequest)
			return
		}
		go deliver(j)
		w.WriteHeader(http.StatusAccepted) // 202 — never do the work on this request
	})

	addr := ":8080"
	if p := os.Getenv("PORT"); p != "" {
		addr = ":" + p
	}
	log.Fatal(http.ListenAndServe(addr, nil))
}

func verifySignature(key, body []byte, header string) bool {
	mac := hmac.New(sha256.New, key)
	mac.Write(body)
	want := "sha256=" + hex.EncodeToString(mac.Sum(nil))
	return hmac.Equal([]byte(want), []byte(strings.TrimSpace(header)))
}

// 3. Callback: POST j.CallbackURL verbatim — never hardcode the host.
// When unit_quantity > 0, return len(records) >= that count (one record per unit of work).
func deliver(j job) {
	payload, _ := json.Marshal(map[string]any{
		"agreement_id": j.AgreementID,
		"records": []map[string]any{{
			"input_row_id": "row-1",
			"fields":       doWork(j.Input.JobInput),
			"sources":      []string{"https://acme.com/team"},
			"confidence":   0.9,
		}},
	})

	req, _ := http.NewRequest(http.MethodPost, j.CallbackURL, bytes.NewReader(payload))
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("Authorization", "Bearer "+agentToken)
	req.Header.Set("X-Job-Token", j.JobToken)

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		log.Printf("callback failed: %v", err)
		return
	}
	defer resp.Body.Close()
	log.Printf("callback status=%d agreement=%s", resp.StatusCode, j.AgreementID)
}

func doWork(input map[string]string) map[string]string {
	// Lead-enrichment vertical defaults — fields must match the agreement's acceptance_spec.
	name := input["name"]
	if name == "" {
		name = "lead"
	}
	slug := strings.ToLower(strings.ReplaceAll(name, " ", "-"))
	return map[string]string{
		"work_email":    slug + "@acme.com",
		"current_title": "Director of Sales",
		"linkedin_url":  "https://linkedin.com/in/" + slug,
	}
}