Inspiration
A shopping agent can stay within budget and still choose the wrong product. We already had real-store shopping replays and simulated buyer tasks showing why price alone is not enough: a requirement may be missing from the product evidence, even when the agent proceeds toward checkout.
AgentCoSign is a purchase authorization and payment layer for personal agents. The user keeps shopping in their agent; they review their intent, approve an exact purchase, and receive a verified result.
What it does
The example personal agent browses and adds products. AgentCoSign checks a server-owned quote against buyer-confirmed requirements. Missing required evidence pauses authorization. The agent can replace the candidate; only the buyer can approve the exact quote. A changed quote invalidates the previous approval.
Channel3 supplies real product search and detail data, with product IDs, source merchants, retrieval times and response hashes. This feeds a test merchant: shipping, tax and pair units are simulated. No source-retailer order is placed, and retailer fulfillment is not verified. The example client is ours; integrations with Muse or Instinct are not implemented.
A separate PayPal sandbox path creates an order, captures the buyer-approved payment, and reconciles order/capture GET responses. The shopping agent has no buyer-approval or payment tools.
What the demo actually proves
The video first shows the Channel3 recovery and approval, then the separate historical store context and PayPal result.
Historical store replay: Original Nisolo pages and messages show the shopping experience. The resoling evidence gap was found after that visit, not blocked by CoSign during the historical run.
Real Channel3 recovery — report-recorded-02: This is a preset reject-and-retry challenge. The initial candidate is assigned. Missing material evidence pauses authorization; the controller reopens the same cart, and the model chooses a replacement and executes browser Remove/Add actions. Requirements stay unchanged. The buyer's human approval of the recovered $82.08 quote was recorded in the report. Intent confirmation was automated setup. This run made zero payment calls.
Separate PayPal sandbox purchase — recorded-work-01: A $210.34 purchase completed capture and order/capture GET verification. Two sequential repeated application requests returned the same capture, with one capture POST and one local merchant receipt. This is a different cart and order from the Channel3 recovery. It does not establish concurrent crash safety or universal exactly-once behavior.
Separate hosted acceptance — hosted-v5-acceptance-01: A clean browser on Render ran a real shopper and authorized a new $86.28 cart. Its intent confirmation and exact approval were automated test-buyer actions, not human approval. PayPal was disabled.
How we built it
Python and SQLite maintain versioned carts, confirmed intents and quote-bound approvals. Claude and Playwright choose and execute visible browser shopping actions. Deterministic checks compare product facts with the confirmed request; missing facts remain unknown. Channel3 discovery and credentials stay server-side. PayPal sandbox reconciliation checks recorded order/capture identity, payer, merchant, currency, items and amounts.
Docker packages the report, minimized replay assets and isolated live sessions. Render hosted the clean-browser acceptance. The public default main branch includes source, replay assets, an open-source license and reproduction instructions.
Challenges and what we learned
The hardest boundary is between finding a product and having enough evidence to authorize buying it. A budget check cannot resolve an unknown material, width or delivery date. Recovery must preserve the buyer's requirements, and a previous approval must not silently authorize a different quote.
We also learned to keep evidence boundaries visible: historical browsing is not a new execution, a staged recovery is not an unprompted retry strategy, and automated test approval is not human approval.
Accomplishments
We connected real browser shopping, an authorization refusal, browser replacement and a recorded human approval in one report. Separately, we verified a real PayPal sandbox capture and sequential duplicate-request handling. The published v5 clone passed 85 regression tests; these are software checks, not shopper accuracy measurements.
Existing work and new implementation
We reuse historical simulated-shopping failures and minimized synthetic profile/task extracts with provenance. New work includes the natural-language example client, intent confirmation, session-isolated quote review, Channel3 discovery, staged browser recovery, buyer approval, PayPal sandbox verification and the judge experience. Historical failures are not counted as new runs.
Try it and current limits
The repository links to the judge instructions. Recorded mode plays preserved evidence and cannot repeat historical approvals or payments. Optional live mode creates a new cart, records terms consent, confirms intent and runs the staged shopper challenge through exact buyer approval; payment is disabled.
Draft access status: Render passed hosted acceptance and was then suspended for cost control. It is not currently an available judging endpoint. The public demo video is available at https://youtu.be/U9pFpLiAj2w (2:10.44). Render is planned to resume November 11 and remain available through December 21; hosted availability must be rechecked before submission.
Recovery remains a staged demonstration, not a measured natural error rate. A 24-case human-review packet is prepared, but human labeling and an external usability session are pending. AI assistant labels are not human evidence. No comparative accuracy claim is made.
AI tools
Claude chooses browser actions. Codex assisted implementation, testing, documentation and evidence review. The demo uses the owner's English narration and small camera overlay, with run/source labels; it has no synthetic voice.
