CoSource: Human-Controlled AI Procurement

Inspiration

AI can research faster than people, but procurement needs more than fast answers. Real buying decisions require traceable evidence, explicit assumptions, visible unknowns, and a clear record of who changed what. Procurement often begins in a message, expands into browser tabs and spreadsheets, and then loses the connection between the original requirement, the evidence, and the final approval.

We built CoSource to give AI useful responsibility without giving it purchasing authority.

What it does

CoSource turns a resource requirement into an evidence-backed, human-approved procurement plan. It guides the user through seven focused workspaces:

1. Overview — understand the project and safest next action.
2. Define — turn a need into a committed, structured requirement.
3. Discover — source catalogue evidence against that committed requirement.
4. Compare — examine known, conflicting, and missing evidence across retained candidates.
5. Plan — create a costed resource plan without placing an order.
6. Review — separate pending proposals, agent activity, human decisions, and applied changes.
7. Decision Intelligence — resolve evidence, assess suppliers, compare scenarios, and supervise operations.

The demo uses a realistic requirement: equip a 12-person mobile design team with reliable business laptops. The maximum is £1,500 per laptop and £18,000 overall, with 32 GB RAM, 1 TB SSD, a three-year warranty, repairability preferences, and refurbished devices excluded.

How we built it

CoSource uses React, TypeScript, Vite, and Zod for the browser workspace, with one canonical application kernel owning goal, evidence, plan, proposal, activity, and approval state. The same kernel serves both human interaction and 13 browser-native WebMCP tools, preventing an agent-only state model from drifting away from the interface the user sees.

A Cloudflare Worker serves the production application, health endpoint, UCP agent profile, and six static assets. The public UCP profile uses version 2026-04-08, advertises exactly three catalogue capabilities, and exposes zero payment handlers. The current read-only commerce connector targets Shopify Global Catalog. If the upstream provider cannot respond, CoSource returns a bounded provider error rather than presenting fixture data as live evidence.

The public build has a strict Content Security Policy and security headers. Project state persists locally in the browser, and the repository supports both Cloudflare and Node deployment paths.

The role of AI

Agents can read the committed requirement, search and inspect catalogue evidence, evaluate retained products and plans, compare candidates, identify evidence gaps, and propose bounded goal or plan changes.

Humans alone commit the active requirement, retain accepted evidence, approve consequential changes, and apply plan decisions. CoSource cannot purchase, pay, place an order, accept licence terms, or contact a supplier.

Challenges

The hardest engineering problem was preserving one authoritative state model across the human interface, persistent browser projects, provider adapters, and WebMCP tools. We also had to make stale evidence and provider failure explicit without allowing deterministic fixtures to masquerade as live results.

Accomplishments

• A deployed product rather than a concept page.
• Exactly 13 browser-native WebMCP tools with explicit read and proposal boundaries.
• One canonical kernel shared by people and agents.
• Human-owned draft and committed-requirement separation.
• Evidence retention, comparison, cost planning, scenarios, operations, and proposal review.
• UCP 2026-04-08 profile with three catalogue capabilities and zero payment handlers.
• 85 automated test files with 748 passing tests.
• TypeScript, ESLint, client build, server build, browser-boundary, and Cloudflare checks passing.
• Deployment on Cloudflare Workers Free with no paid resource.

What we learned

Useful agentic software needs clear authority more than unrestricted autonomy. Separating proposals from applied changes made both the product and the agent tools easier to reason about. Procurement evidence also needs an explicit lifecycle: current, stale, incomplete, retained, or rejected.

What's next

The current build proves the controlled decision kernel through equipment sourcing. Next we will add provider-neutral evidence sources across services, software, and licensed resources; shared team projects; organisation-level approval policies; and supervised supplier and quote workflows. Payment and binding acceptance will remain behind explicit human authority.

Built With

• cloudflare
• typescript