Inspiration
Store search matches words, not intent. "Warm coat for winter walks" returns nothing while the parka sits in stock, the shopper is gone inside a minute, and owners won't let a bot spend money nobody authorized. Existing chatbots either quote prices and stock they never read which becomes a refund waiting to happen or they're bolted on with full access and zero limits. I built the version a fixed-price store can actually trust: buyer-only, no negotiation, no synthetic prices, a human always holds the final click.
What it does
One script tag mounts an assistant bubble on any store. The shopper asks in plain language; Macham reads the store's live catalog server-side (the store's own rows, never the model's memory), answers with real prices and stock, and proposes a cart. Nothing is charged until a person approves then PayPal Orders v2 creates, authorizes, and captures exactly the approved total. A settlement receipt is anchored on Rialo so the capture can be read back. Stores that never integrated can still be shopped through the Macham browser extension, which mounts the same widget behind an isolated world.
How we built it
Node 22 + TypeScript gateway (server/assist.mjs, src/), a Vite static landing page, an esbuild IIFE loader for the widget, and a Chrome MV3 extension. Catalog reads ride a ladder: Elasticsearch (the store's own free text ranked first) → Shopify Storefront GraphQL / WooCommerce / JSON-LD public reads → Kernel (cloud browser) for client-hydrated JSON-LD → Channel3 for cross-retailer lookup. Groq qwen/qwen3.8-27b is the primary brain, DeepSeek fails over, and every answer passes a safety harness with effects restricted to none or proposal — model keys never leave the server; merchants hold only a publishable mch_ key, metered per key against the free plan. PayPal Orders v2 (sandbox) handles create → authorize → capture, with a tolerance of the lesser of 115% or +$75 over the authorization — outside that, the capture is refused. Rialo anchoring is fail-closed: a chain problem can never block or void a payment. Ordering is proven by 63 tests (npm test), and the whole thing was deployed end-to-end — Vercel (site) + Render (gateway). A 38-second launch film was rendered frame-by-frame from a deterministic clock (no screen recording), with a fully scripted human VO.
Challenges we ran into
- LLM honesty: the assistant must sound natural but could never invent a price. Answer: narrate only the rows the catalog lane returns, and refuse everything outside them.
- Keeping secrets server-side while the widget runs in arbitrary browsers: solved with publishable, metered mch_ keys; model keys and PayPal credentials never ship.
- Ephemeral disks on Render (fresh keystore every boot): bootstrap the named mch_ keys from env at startup.
Cold starts + CORS from the deployed site to a just-created free-tier gateway: solved with a retry-backed rail chip and an explicit allowlist.
Accomplishments that we're proud of
A live, fully deployed full-stack product, not a demo: macham.vercel.app, live gateway, real Groq answers through the deployed pipeline, real PayPal sandbox capture flow with the tolerance enforced, Rialo anchor fail-closed.
63 tests passing and a public repo with an OpenAPI contract, postman collection, and architecture docs.
No hallucinated catalog: the single strongest differentiator is that Macham literally cannot answer with data the store didn't just give it.
What we learned
Scope is the feature: buyer-only, fixed prices, human-click-before-money. Every connected ambition (seller console, negotiation, autonomous buying) deletes trust.
"Fail closed, visibly" beats "fail gracefully, invisibly." Every risky path refuses with a clear state, and the operator sees it in logs.
Infrastructure lies in small ways: DNS flakes, cold starts, fork protection, ephemeral disks. Measure real behavior instead of trusting build success.
What's next for Macham
Pilot merchants (starting with the own-store dataset shipped in-repo), the OpenAPI contract published as an APIMatic context plugin so agent tooling can discover the surface, live PayPal credentials per merchant, post-checkout reconciliation dashboards, voice-first shopping, and settlement-proof verification flows read back from Rialo.
Built With
- agents
- ai
- api
- chrome
- deepseek
- devtools
- elasticsearch
- extension
- ffmpeg
- groq
- json-ld
- llm
- node.js
- openapi
- opencode
- orders
- paypal
- playwright
- render
- rialo
- sandbox
- shopify
- typescript
- vercel
- woocommerce
