Charge it once

An AI agent proposes a purchase, but it cannot pay on its own. Every purchase must pass through the Agent Middleware authorization loop first — under an operator-issued, scoped permit — and only then does a PayPal Sandbox order get created.

The centerpiece is a live replay: submit the identical action again with the same idempotency key and the second attempt produces no second debit and no second PayPal order, with a signed receipt to prove what happened.

The precise claim: never a duplicate charge, not always a charge.

How it works:

1. The agent proposes a structured purchase (item, amount, currency, payee). It cannot mint a permit, raise a budget, or bypass the authorization call.
2. The app derives an idempotency key from the canonical action (SHA-256 of item + amount + currency + wallet + permit) and makes one governed call to Agent Middleware. One accepted key yields at most one gateway dispatch and at most one ledger debit.
3. Only after the authorization leg returns a successful receipt does the app create a PayPal Sandbox order (Orders API: create, buyer approval in Sandbox, capture).
4. Re-submitting the identical action returns the original receipt; no second PayPal order is created for that key.
5. If a capture outcome is unconfirmed, the run is receipted as delivery_uncertain, never redispatched automatically, and a reconcile step settles it from PayPal's own order record.

All money movement is PayPal Sandbox only. Agent Middleware credits are closed-loop pilot metering, not payment rails; the metering debit and the PayPal order are shown side by side and never confused.

What the demo proves:

1. Happy path: exactly one ledger debit, exactly one PayPal Sandbox order, one signed receipt.
2. Replay: same key resubmitted — debit count stays 1, PayPal order count stays 1.
3. Denial: a tool outside the permit scope is refused by the gateway, charged nothing, and PayPal is never called.
4. Uncertain outcome: receipted as delivery_uncertain, no automatic redispatch, reconciled from PayPal's record.
5. Receipt proof: Ed25519-signed receipt binding the ledger entry, idempotency record, and dispatch attempt; verifiable offline.

Test status (verified 2026-11-04): 15 of 15 automated checks passed against the real Agent Middleware staging service, and the live end-to-end run through the HOSTED app passed the same night: hosted run run-ef9569c9e8 — AMW authorized once (receipt rcpt-4526e84e7f724c5a, 1 credit), the app created real PayPal Sandbox order 8KJ36213EG376911T, buyer approval registered on PayPal's record, captured exactly once (capture 5KJ84214FJ3366901, $1.00, no real money), and a replay produced no second debit and no second order. Gate 1 also passed against the real PayPal Sandbox on 2026-11-04 (order 41985033XC001692P COMPLETED, capture 7EY55543J62267303). Hosted demo: https://charge-it-once-production.up.railway.app

Built With

• agent-middleware
• ed25519
• paypal
• python
• railway