Local agent

The local agent (erp-preflight-agent, container image infra/docker/Dockerfile.local-agent) runs inside your network next to private SAP landscapes and only makes outbound HTTPS calls to ERP Preflight.

1. In Integrations → Local agents, an organization owner issues a single-use enrollment token.
2. On the agent host run erp-preflight-agent enroll <apiUrl> <enrollmentToken> --name <deviceName>. The agent generates its device key pair locally; only the public key is registered.
3. Start the loop with erp-preflight-agent daemon. It sends signed heartbeats, fetches jobs, verifies each job's signature and executes it locally.

Jobs are queued per device in Integrations → Local agents: Scan directory (only inside the directories listed in ERP_PREFLIGHT_AGENT_SCAN_ROOTS on the host — the SaaS cannot make the agent read anything else) and Probe SAP URL (TLS is always validated). Files are hashed (SHA-256) and secrets are redacted on the host; by default only a manifest leaves the network. Devices can be revoked at any time.

Other commands: status, scan <directory> (local only, uploads nothing), probe <sapUrl>, check-update and verify-update (signed update manifests).

Uploads through the web app, the API or the CLI remain available for every engine; the agent is optional. Scheduled read-only extraction of further SAP artifact types by the agent will be documented here when it ships.