The agent
It talks outward only: hello, then a heartbeat with what the rig has and what it is still running; a long poll for the next job it was granted; the stages, the log and the evidence as the job goes. A rig never listens for the farm, so a rig needs no address, no port and no inbound rule.
The end of a run is written to disk before it is sent, so a farm that is unreachable, or a rig that restarts, loses no verdict.
The health check
Firmware that answers. It says which board it is, proves the serial path both ways, and drives the pins a wiring check reads from the other end, so a board that is present but miswired is found before a suite blames the firmware under test.
It lives in its own repository and has its own releases; each rig release pins one version of it, and a rig installs that one with the rig software.
Why it is open
A rig runs on hardware you own, in a room you control, and it reports to a farm you may not. That is a reasonable thing to want to read before you run it. The agent and the health check are public; the portal that schedules them stays ours.