Verify the Agent Server through its real API

Prove what an API consumer observes, not that a handler returned or CI passed. The consumers are agents and the programs that carry them: the SDK's RemoteConversation/RemoteWorkspace, the TypeScript client, Agent Canvas and automations. Three parts work together:

1. control-agent-server (scripts/) is the lever. It launches this checkout as an isolated real server (private HOME, persistence dir, config file, session key, secret key, port), and turns every API step into a command you can rerun: REST calls, WebSocket captures, LLM-backed conversations, fixtures, SDK programs.
2. The feature map (references/feature-map/) lists every agent-facing behavior with stable IDs, the routes each family owns, entry points (REST, WebSocket, SDK and TypeScript client methods), exact control-agent-server recipes, observable results and gotchas.
3. Evidence: saved request/response exchanges, WebSocket frames, webhook deliveries and program transcripts, plus a pass/fail/blocked/not-run ledger that survives cleanup.