AgentPay Commerce — Governed AI shopping

Inspiration

AI agents can discover thousands of products, but shoppers still need hard guarantees: the human's rules hold, paid placement does not secretly win, the model cannot invent a product, and the exact item stays human-approved before checkout.

What it does

AgentPay Commerce is governed shopping for humans and their agents.

Buyer Constitution — category, merchant, budget, returns, delivery, freshness, and approval gates run deterministically before AI participates
Live Shopify UCP — search and verify exact variants without caching catalog results or checkout URLs
GPT-5.6 closed-world compiler — sees opaque candidates only; can reorder evidence, cannot invent or widen the market
Exact human approval — sandbox merchant checkout review + signed receipt; no payment taken
Append-only ledger — signed decisions, role-separated approvals, no self-approve
Seller Studio — Demand Radar and Catalog Truth across search/agent channels

How we built it

Codex drove the post–July 13 commerce extension inside the AgentPay monorepo: product strategy, adversarial architecture, Worker API + Next.js BFF, MCP/OpenAPI contracts, Buyer Constitution UI, live UCP adapter, procurement ledger, and submission evidence. GPT-5.6 is integrated as a constrained commerce decision compiler — not chat copy.

Challenges

Keeping buyer organizations independent from seller merchants; refusing catalog caches per Shopify UCP rules; binding decisions to the full constitution hash and exact request; enforcing requester/approver separation; fail-closed compiler budgets without inventing products when the model fails.

Accomplishments

Working Need Deck → constitution → live/sandbox shortlist → exact approval → signed receipt path; append-only ledger with PGlite-validated migrations; adversarial route tests for cross-org access, decision substitution, idempotency, expiry, and unauthorized approval; keyboard-accessible shopper controls.

What's next

Deploy UCP + ledger routes together, apply the commerce migration, publish the narrated YouTube demo, and run a controlled merchant pilot — still merchant-owned checkout, still no payment enablement in the sandbox demo.