Pact

The problem

Agents are starting to hire each other, and the payment rails for that are shipping fast. The trust layer is not. Nothing in the current stack checks what was actually delivered before the money settles, and nothing makes a cheating seller lose more than time.

The human version of this market already shows what that costs. In a Freelancers Union study, 71 percent of freelancers had trouble getting paid at some point, losing about $6,000 a year on average to clients who never paid. A 2019 Upwork and Freelancers Union study found 74 percent had faced late or non payment, and only 28 percent consistently worked under a written contract. When a marketplace deal does go wrong, the binding fix is priced out of reach for small jobs: Upwork charges $675 in total arbitration fees for claims under $20,000 and the process takes about 30 days. On a $150 logo job, a binding decision costs more than four times the job itself.

Paying directly does not fix it either. PayPal Purchase Protection covers Item Not Received and Significantly Not as Described claims, but PayPal's own page lists services and intangible items as not covered. A freelance service paid with a plain PayPal payment has no escrow, no milestone, and no check of the delivery against anything the two sides agreed. The agent payment systems shipping now have the same hole. They authorize spending and settle payments. None of them verifies a delivery against negotiated acceptance checks, and none of them makes the seller post a bond. That is the open slot Pact sits in.

What Pact does

Pact is agent to agent commerce with verified settlement. Two agents negotiate a deal for a digital service, write the acceptance checks themselves as part of the negotiation, put real money behind the deal through PayPal, and let a separate verifier judge the delivered work against those checks before anyone gets paid. If the work passes, the seller is paid and its bond comes back. If some checks pass and some fail, the seller gets one revision round, and after the rounds are spent the deal settles graded: the seller is paid for the checks that passed, the buyer is refunded the rest, and the bond is slashed only for the failed share. If the work passes nothing, the buyer is refunded in full and the whole bond is paid to the buyer.

Settlement is graded, not all or nothing. A delivery that passes 3 of 5 checks pays the seller 3 fifths of the price and returns 3 fifths of the bond, while the buyer is refunded the other 2 fifths and the bond is slashed by the same 2 fifths. The split is computed in integer cents, rounded half-even once, so no cent is lost or created. A seller that never delivers can also be timed out: after the agreed window, 7 days on a single-issue deal, the buyer may end the deal for a full refund and a full bond slash. A deal in revision cannot time out, because the seller delivered once and the buyer is waiting on the re-delivery.

The pitch in one line: in every other system, a cheating seller loses nothing but time. In Pact, cheating costs money.

How a deal runs

A buyer agent and a seller agent negotiate the price. Each side concedes a share of the remaining gap on its turn, every move carries a written rationale, and the round cap is real. If the seller floor sits above the buyer ceiling, the deal walks away and no money moves.
The agents then write the contract. The buyer proposes a value for each acceptance check, the seller accepts or counters, and numeric counters settle at the midpoint. The settled checks freeze into the deal spec. The seller is later judged only on terms it agreed to.
The buyer pays the agreed price through a PayPal order. The seller posts a performance bond, 20 percent of the price, through a second PayPal order. Both captures happen only after the account holders approve, and the price is then marked held.
The seller delivers the work inside the app.
A verifier agent tests the delivery against every negotiated check and records a pass or fail per check, with the measured value and a plain reason.
All checks pass: the price is paid out to the seller and the bond is returned.
Some checks pass and some fail: the seller gets exactly one revision round. A delivery that passes nothing skips revision and settles at once.
A final verdict that passes some checks settles graded: the seller is paid the passed share of the price, the buyer is refunded the rest, and the bond is split the same way. A final verdict that passes no check: the buyer is refunded in full, and the whole bond is slashed and paid to the buyer.
Every event lands in an audit ledger: each negotiation move, the frozen contract, each order, approval, capture, delivery, verdict, payout, refund, bond move, and reputation change.

Reputation sits next to each agent and moves with outcomes. A completed deal raises it. A revision costs 3 points. A refund costs 12. A slashed bond costs 20 more. On a graded settlement the seller takes one delta: the passed share of the 6 point release gain minus the failed share of the 20 point slash hit.

The build ships with fifteen scenarios: a logo and brand kit, landing page copy, a scoped coding task, a market research brief, an Amazon product listing, and a cheat attempt where the seller delivers recycled generic copy and gets caught twice, plus eight more covering data labeling, podcast editing, newsletters, product photography, book covers, API integration, spreadsheet work, and an AC repair service job.

There is also a multi-issue mode, turned on per deal. After the price is locked, the agents trade three more terms: the delivery window, the revision rounds included, and the bond percent inside a 10 to 30 band. Each side carries simple utility weights, and on each turn the side to move concedes where its concession buys the other side the most. In practice the buyer concedes the delivery window and the seller concedes revision rounds, while the bond settles near the middle at 23.54 percent. The negotiated terms freeze into the contract, the bond charged is the negotiated percent, and the verify endpoint allows exactly the negotiated revision rounds. A 196 run sweep shows the terms phase never changes whether a deal agrees: every multi-issue run agreed exactly where its single-issue twin did. The delivery window is enforced for deals where the seller never delivers: after the deadline the buyer can time the deal out for a full refund and a full bond slash. A deal in revision cannot time out.

What makes it different

Three pieces, and the combination is the point.

First, the acceptance checks are authored by the negotiation itself. They are not a platform template and not one side's terms imposed on the other. The buyer proposes, the seller counters, and the settled values are what the verifier enforces.

Second, the seller posts a per deal performance bond. A refund alone only returns the buyer's money; the seller risks nothing but time, so a low effort delivery is a free lottery ticket. A slashed bond changes that math. Failure costs the side that caused it.

Third, the whole loop runs on PayPal fiat rails: Orders, Payouts, and capture refunds, with the account holder approval step PayPal requires kept in the open. No separate crypto economy, no stablecoin, no new wallet for a freelancer who needs to pay rent. The agent payment protocols in the field today settle instantly and finally, which means no refund path at all. Pact is built on the rails that already have recourse.

For the hiring reader

Three decisions carry this build. The money moves on the deterministic verifier's verdict, never on a model's word: the optional language model only rewrites wording, and every price, check value, verdict, and payment comes from the deterministic engine, which the 275 check accuracy battery judged without an error. Cheating costs money, not just a refund: the seller posts a 20 percent performance bond, and on a failed deal the buyer is refunded in full while the bond is paid to the buyer, as the October 22 sandbox cheat run shows (deal-0004: seller paid $36.19 of the $180.96 price, buyer refunded $144.77, $28.95 of the $36.19 bond slashed, seller reputation 64 to 46). The contract travels with the money: the SHA-256 of the frozen spec is written onto both PayPal orders and recorded in the verification summary, so a judge can match the hash on PayPal's own order record to the contract that judged the delivery. The production path is a Commerce Platform integration with the seller as payee, delayed disbursement, and the bond as authorize with void on pass and capture on fail. What I would build next with a team: real seller onboarding, a dispute flow inside the 28 day window, repeat buyer mandates, and richer checks. PactBench is already built and runs in the repo: 337 labeled deliveries and 1,685 judged checks in the verifier battery, 10,000 simulated settlement deals with zero money conservation violations, a 401 case property suite (5,285 checks), a chaos suite, and a 50 deal load run, all summarized on the Evidence page in the demo and the README.

My part

I am Ashish. I chose the problem: agent commerce has payment rails but no trust layer, and the market research in the repo is what convinced me the hole is real. I designed this system and I wrote the code. I sometimes used an AI assistant to speed up the manual coding, with me controlling the code throughout, and every decision below is mine. The pitch line, that cheating must cost money and not just a refund. The 20 percent bond slash on a failed deal. The cheat scenario as the flagship, because a trust system is only worth showing if it survives an adversary. Keeping PayPal's human approval step instead of working around it. The sponsor and scenario calls: Channel3 procurement grounded in live market data, and the AG Grid audit ledger. The bar from October 22: production depth over feature count, worked on until submission day, secret scan as the gate before the code goes public. I ran every test and read every output.

Proof: it already ran on the real PayPal sandbox

This is not a mockup. The full loop ran end to end on the PayPal sandbox on October 22, 2026, with toolkit order creation, account holder approval of both orders, capture, delivery, verification, and settlement, all recorded with real PayPal sandbox transaction IDs.

Deal	Scenario	Price	Bond	Outcome	PayPal records
deal-0001	Logo and brand kit	$222.17	$44.43	Released, 5 of 5 checks passed	Captures 2XX57477S7535341X and 76U34250RE4380745. Payouts DZNF5GE6AEUHN and Y4BT2Q3N8QR7J
deal-0002	Landing page copy	$324.21	$64.84	Released, 5 of 5 checks passed	Captures 5V6374204C639882V and 0FJ792206C854335V. Payouts A2EXK2WL4D4BG and L35MAUZEMNY92
deal-0003	Logo kit, poor delivery	$222.17	$44.43	Refunded, bond slashed, 0 of 5 checks passed	Refund 02S348440D980433R. Slash payout PWMV585KHNEM6
deal-0004	Cheat attempt	$180.96	$36.19	Caught in both rounds, settled graded: seller paid $36.19, buyer refunded $144.77, $28.95 bond slashed	Refund 9VH98649B6022315A. Slash payout X3BT5KNKEF8CL

On November 12, 2026, I read all 16 money legs behind these four deals back from the PayPal sandbox: every capture, every payout batch and its item, and every refund. The read moved no money. Every status PayPal reports now matches the outcome recorded when the deals settled. The released deals show captures COMPLETED and payouts SUCCESS. The failed deals show the price capture REFUNDED, the refund COMPLETED, and the bond slash payout SUCCESS to the buyer account. 16 of 16 matched.

The cheat deal is the one to look at. The seller delivered recycled copy that ignored the contract. The verifier passed only the one check the copy happened to satisfy, sent the deal to its single revision round, caught the near identical second delivery again, and settled graded: the seller was paid $36.19 of the $180.96 price, the buyer was refunded $144.77, and $28.95 of the $36.19 bond was slashed to the buyer. The cheating seller's reputation fell from 64 to 46 on that one deal.

The numbers behind the build, all from test runs in the repo: the verifier judged 275 checks across 55 constructed deliveries with zero errors. A negotiation sweep of 196 runs reached agreement in every run where a deal zone existed and walked away in every run where it did not. Ten end to end settlement paths matched an independent rules oracle on every field. Eight more deals were priced from live Fiverr and Upwork listings (a listing at $74.06, a logo kit at $120.64, a coding task at $49.22, a research brief at $78.52, a labeling batch at $54.00) and settled the way the market says they should, including an under delivered listing refunded with its $14.81 bond slashed and a social pack cheat at $137.09 settled graded: the seller was paid $27.42, the buyer was refunded $109.67, and $21.94 of the $27.42 bond was slashed. A ninth, a procurement deal for Sony WH-1000XM5 headphones grounded in a live Channel3 offer capture ($239.97 to $336.99 across five retailers, median $298), negotiated to $270.52 and released after all five checks passed. A tenth, a podcast edit package at $120.00 priced from current Upwork editing tiers ($66 to $170 by episode length), negotiated with the multi issue terms phase (12 day window, 3 revision rounds, 23.54 percent bond) and released after all five checks passed. An eleventh, a written newsletter issue at $95.25 priced from current Upwork newsletter tiers ($10 to $635 by scope), released after all five checks passed. A twelfth, a book cover design package at $75.75 priced from current Upwork and Fiverr cover tiers ($5 to $1,200 by scope), released after all five checks passed. A thirteenth, a product photography set at $126.75 priced from current Upwork photography tiers ($5 to $1,450 by scope), released after all five checks passed. A fourteenth, a scoped API integration task at $177.00 priced from current Upwork integration tiers ($65 to $4,000 by scope), released after all five checks passed. A fifteenth, a residential AC repair service report at $213.00 priced from 2026 cost guides ($150 to $400, most common average $175), released after all five checks passed. A sixteenth, a spreadsheet cleanup with a written change report at $60.00 priced from current Upwork cleanup tiers ($8 to $120 by scope), released after all five checks passed. A seventeenth, full landing page copy at $324.22 priced from current Upwork landing page tiers ($20 to $1,000 by scope) and Fiverr 2026 price guides ($50 to $800), released after all five checks passed. An eighteenth, a data labeling batch cheat at $54.00 priced from current Upwork annotation tiers ($10 to $700 by scope): the seller shipped a paragraph of assurances with no labeled rows, no guide, and no flagged rows, failed all five checks, the revision round was skipped because there was nothing to revise against, and the buyer was refunded with the $10.80 bond slashed. A nineteenth, a podcast edit package cheat at $120.00 priced from current Upwork podcast editing tiers ($30 to $500 by scope): the seller shipped a paragraph of assurances with no chapter markers, no timestamped notes, no transcript, and no show notes, failed all five checks, the revision round was skipped because there was nothing to revise against, and the buyer was refunded with the $24.00 bond slashed. A twentieth, a written newsletter issue cheat at $95.25 priced from current Upwork newsletter writing tiers ($150 to $635 by scope): the seller shipped a paragraph of assurances with no subject line, no sections, no calls to action, and no unsubscribe line, failed all five checks, the revision round was skipped because there was nothing to revise against, and the buyer was refunded with the $19.05 bond slashed. A twenty-first, a product photography set cheat at $126.75 priced from current Upwork photography tiers ($35 to $655 by scope): the seller shipped a paragraph of assurances with a download link and no shot manifest, no hero shot, no usage license, and no retouch notes, failed all five checks, the revision round was skipped because there was nothing to revise against, and the buyer was refunded with the $25.35 bond slashed. A twenty-second, a book cover design package cheat at $75.75 priced from current Upwork and Fiverr cover tiers ($5 to $1,200 by scope): the seller shipped a paragraph of assurances with no concept directions, no spine design, no back cover layout, no palette, and no typography pairing, failed all five checks, the revision round was skipped because there was nothing to revise against, and the buyer was refunded with the $15.15 bond slashed. A twenty-third, an API integration task cheat at $177.00 priced from current Upwork integration tiers ($35 to $1,400 by scope): the seller shipped a paragraph of assurances with no wrapped endpoints, no authentication section, no error handling, no worked examples, and no README, failed all five checks, the revision round was skipped because there was nothing to revise against, and the buyer was refunded with the $35.40 bond slashed. A twenty-fourth, an AC repair service cheat at $213.00 priced from 2026 cost guides ($80 to $400 by scope, Angi average $250): the seller shipped a paragraph of assurances with no diagnosis, no capacitor named, no system readings, and no warranty, failed all five checks, the revision round was skipped because there was nothing to revise against, and the buyer was refunded with the $42.60 bond slashed. A twenty-fifth, a spreadsheet cleanup and report cheat at $60.00 priced from current Upwork cleanup tiers ($15 to $325 by scope) and Fiverr cleanup gigs ($15 to $150): the seller shipped a paragraph of assurances with no per-column fixes, no findings, no methodology, and no duplicate count, failed all five checks, the revision round was skipped because there was nothing to revise against, and the buyer was refunded with the $12.00 bond slashed. A twenty-sixth, a full landing page copy cheat at $324.22 priced from current Upwork landing page tiers ($150 to $1,000 by scope): the seller shipped a paragraph of assurances with no headline section, no subheadline, no benefit sections, and no calls to action, failed all five checks, the revision round was skipped because there was nothing to revise against, and the buyer was refunded with the $64.84 bond slashed. A twenty-seventh, a logo and brand kit cheat at $222.17 priced from current Fiverr and Upwork logo tiers ($15 to $5,000 by scope): the seller shipped a paragraph of assurances with no logo concepts, no hex codes, no typography section, and no tagline section, failed all five checks, the revision round was skipped because there was nothing to revise against, and the buyer was refunded with the $44.43 bond slashed. A twenty-eighth, a Python script task cheat at $49.22 priced from current Fiverr bug fix tiers ($5 to $95) and Upwork catalog tiers ($15 to $120): the seller shipped recycled ad copy with no code at all, no agreed function, no validation section, no README, and no usage examples, failed all five checks, the revision round was skipped because there was nothing to revise against, and the buyer was refunded with the $9.84 bond slashed. A twenty-ninth, a market research brief cheat at $78.52 priced from current Upwork research rates (a desk research brief at $500 to $2,000 a project, a platform demand brief at $75 to $225): the seller shipped recycled ad copy with no named sources, no data points, no competitor section, and no risks section, failed all five checks, the revision round was skipped because there was nothing to revise against, and the buyer was refunded with the $15.70 bond slashed. A 162 check hardening suite covers settlement resumability, per deal locking, payout follow through, the approval payer check, and the contract hash on both PayPal orders, all green. I also attacked the system from both sides with an adversarial battery. What it found is in the challenges section, because it changed the code.

Why this is good business for PayPal

One Pact deal puts up to four paid money movements on PayPal rails instead of one: the payment capture, the bond capture, and then two payouts, or a refund and one payout. At PayPal's published US rates (3.49 percent plus $0.49 to receive a commercial transaction, $0.25 per Payouts API payout, and original capture fees kept on refunds), a completed $250 deal with a $50 bond earns PayPal about $11.95 in gross fees. A refunded deal earns about $11.70, because the capture fees are collected up front and never returned. Failure costs PayPal almost nothing. That works out to an effective take of about 4.0 percent on the $300 captured per deal (total gross fees over captured volume, one definition everywhere), against a blended PayPal take rate of roughly 1.6 percent. At a million deals a month, on stated assumptions, the demo plumbing gives roughly $143 million a year in gross fees on $3.6 billion of new volume. The production path is a PayPal Commerce Platform integration: the seller becomes the payee with delayed disbursement, the platform takes a platform fee in the disbursement instruction, the bond runs as authorize and void on a pass, and the two payout fees disappear. On the same $250 and $50 numbers that path earns about $115 million a year. The full analysis with sources is in the repo.

The strategic point matters more than the fee point. PayPal CEO Enrique Lores has said trust is going to be even more important in an agentic world, and that trust is the position PayPal needs to occupy. Verified settlement with a seller bond is that position built as a product: escrow style holding, a computed verdict instead of a support queue, refunds that actually happen, and a funded bond to make the buyer whole instead of PayPal's own balance. PayPal absorbed about $1.3 billion in transaction losses in 2025 across fraud, chargebacks, and protection payouts. A layer that settles most disputes by arithmetic before they become claims works directly on that line.

How I built it

PayPal Agent Toolkit (primary rail for orders). Orders run through PayPal's official Agent Toolkit, the PyPI package paypal-agent-toolkit. Pact calls its dispatch core, PayPalAPI.run: create_order to create, pay_order to capture, get_order_details to read. The toolkit builds the payloads and validates the parameters against its own schemas. If the toolkit cannot be imported in some environment, order actions fall back to a direct REST client, and the ledger records which rail actually ran.

Orders, Payouts, and capture refunds. The Toolkit ships no payout tool and no capture refund tool, so settlement runs on a small direct REST client: OAuth, Orders create and capture, Payouts create, and capture refund, all against the sandbox base URL from the environment. Release to the seller, bond return, bond slash to the buyer, and the buyer refund are all real sandbox calls, as the transaction IDs above show.

The hold. The held state in the ledger maps to PayPal delayed disbursement, the platform's native hold primitive, where a capture is disbursed only when the platform is told to release it. This build models the hold in the app ledger, moves the money with a real sandbox capture, and releases with a real payout. One honest limit: in this build both captures land in the platform's own account, so the platform is holding both sides' money and absorbing both capture fees. On a full PayPal Commerce Platform integration the same step captures with delayed disbursement and disburses on a verification pass, with the seller as the payee and the platform taking its own fee in the disbursement instruction.

The contract travels with the money. When the agents freeze the spec, the app computes its SHA-256 and writes the deal id plus that hash onto both PayPal orders: the purchase unit custom_id on the REST path, the line item name on the Agent Toolkit path, because the toolkit's create_order exposes no custom_id. The ledger records which field carried it. The verification summary records the same hash. A judge can compare the hash on PayPal's order record against the hash of the frozen spec and know the contract that judged the delivery is the contract the money moved under. Change any single check and the hash changes.

Webhooks. The webhook endpoint verifies each event's signature with PayPal when a webhook ID is configured and rejects events that fail. Verified events can advance reconciliation: a payout completion event naming a batch the deal recorded lets the app read that batch back from PayPal through the same follow through path as a normal payout check. This is idempotent, recorded as a ledger event naming the webhook event id, and it never authorizes a settlement decision. The deal leaves the verifying state only through the verify endpoint, so a forged or replayed webhook cannot move money.

AG Grid. The audit ledger is an AG Grid table, vendored locally (AG Grid Community 32.3.3, no CDN dependency), themed to the app with the AG Grid Theming API, custom pill renderers that color events by family (money, verification, reputation, deal events), row tinting on refunds and slashes, a quick filter, column filters with floating filters, human readable event labels, openable payload rows, an Amount column, KPI tiles (money held, bond at risk, checks passed, event count), CSV export, a custom empty overlay, and column state persisted across reloads. If the grid cannot load, the ledger falls back to a plain table and says so.

Procurement grounded in live market data (Channel3). One scenario buys a real physical product instead of selling a service. When a procurement deal is created, Pact calls the Channel3 API once and searches for the product the buyer wants. Channel3 returns real products with real offers from real retailers, each with a current price and a buy link. Those offers set the deal: the buyer ceiling is the median offer price, the seller floor is the lowest offer price, and the product title, retailer, and buy link are written into the contract checks. With no API key configured, the deal grounds in a Channel3 response captured from the live API on October 22, 2026 and shipped in the repo, and the ledger labels that data as cached with its capture date. Cached data is never presented as live.

Hardening from red team attacks. Settlement records each money leg (price payout, bond return, price refund, bond slash) as it completes, so a failed leg leaves the deal resumable and a retry runs only the missing legs, with deterministic idempotency keys so no leg can run twice. A per deal lock around every state changing endpoint means parallel calls get exactly one 200 and the rest 409, so live mode cannot create duplicate orders or interleave negotiation moves. Every payout is read back after acceptance: the deal stays pending until PayPal reports success, and a denied payout writes a correcting ledger event and retries with a fresh key instead of marking a release that never happened. At approval confirmation in live mode, both orders are read back and the payer must match the expected buyer and seller sandbox accounts, or capture is refused and logged. These four defenses are covered by the 162 check hardening suite.

Production hardening beyond the red team. Money math runs on integer cents, not floats, with one documented rounding boundary, so a settled price can never drift by representation noise. Deal ids are random and unguessable, and every state changing call carries a per deal role token, so a guessed id gets a 404 and a wrong token gets a 403. API errors never leak a raw PayPal body or a stack trace: they return a clean code and a correlation id, and the full detail goes to the audit ledger and the server log. Deal creation is rate capped per client address and globally, and oversized negotiation and delivery bodies get a clean 413. The demo UI carries the role tokens so the click through stays frictionless. These defenses are covered by their own test files: 74 clean error checks, 47 access checks, 37 abuse limit checks, and 68 webhook reconciliation checks, all green.

FastAPI and a single page UI. The backend is one Python FastAPI service: negotiation engine, contract writing, a deterministic rule based verifier with five check kinds (counted items with content, hex colors, hashtags, word counts, required strings), the payment rails, and the store for deals, ledger, and reputation. The frontend is one page that runs the whole loop and shows the negotiation thread, the frozen contract, the deliverable, the checklist, and the ledger.

AI tools, stated plainly. Two separate things. At runtime, an optional language model layer (any OpenAI compatible endpoint, gpt-4o-mini by default) can rewrite the wording of negotiation rationales and verdict reasons so they read naturally. It never decides anything: prices, check values, verdicts, and every money movement come from the deterministic engine, and the app runs fully offline with no key set. During development, I sometimes used an AI assistant (Claude) to speed up the manual coding, with me controlling the code throughout. The design, the experiments, and the results are mine. I ran every test myself and read the outputs, and the places where the tools were wrong are recorded in the test suite rather than hidden. PayPal also publishes an MCP server; Pact's backend does not embed an MCP host, so the server is not in the runtime path, and the repo carries a ready to paste host configuration for anyone who wants to drive the same PayPal tools from one.

Demo mode honesty. With no PayPal credentials set, the app runs in demo mode with a local payment simulator. Every result is stamped demo in the UI badge, the health response, and the ledger. Nothing in demo mode pretends a PayPal call happened.

Agent SDK (APIMatic). Pact's API is built for other agents to call, so it ships a generated Python SDK. APIMatic generated it from the OpenAPI spec the app serves. sdk/agent_example.py drives a full deal through it: create, negotiate, pay, deliver, verify, then download the dispute packet. It boots its own demo-mode server with a throwaway database, so no PayPal account is touched. Two honest limits: the generated client assumes https, so the example patches the base URI to http for the local run, and the spec does not declare the per-deal role token header, so the example carries the tokens on one requests session per role. The hosted APIMatic developer portal is not published yet.

Challenges I ran into

The approval checkpoint. My first design assumed code could capture a wallet payment on its own. It cannot. Capturing an order right after creating it fails with ORDER_NOT_APPROVED, because PayPal requires the account holder to approve the order in its own checkout first. I rebuilt the payment step as two phases: the agents prepare both orders, the app parks the deal in an awaiting approval state with one approval link per order, and capture runs only after both approvals, with each capture guarded so a retry after one approval is safe. I kept the checkpoint instead of working around it, because it is PayPal's own model for agentic payments: agents propose and prepare, people approve money movement. The ledger records both approvals as events.

A hashtag bug that testing caught. The first hashtag counter used a plain token pattern, and a hex color code such as #AABBCC matched it. A delivery with no hashtags at all and two color codes passed a hashtag check it should have failed. The accuracy battery caught it. The fix is a ruling inside the counter: a token that is exactly a six digit hex code counts as a color and never as a hashtag. The case stays in the test set as a regression test.

An item counting bug that an attack caught. The item counter originally counted bare markers. A delivery that listed its section markers with the content stripped out passed checks it had no business passing. The adversarial battery found it, not the happy path tests. The fix requires at least three words of content after a marker before the item counts. The same battery also showed a zero percent bond and a negative price were accepted at deal creation. Both are rejected now, because a zero bond makes cheating free.

Accomplishments I am proud of

The full trust loop ran on the real PayPal sandbox, not a simulator: negotiation, agent written checks, approval, capture, verification, release, refund, and bond slash, with transaction IDs anyone can check against the table above.
Every money path is exercised and proven: release payout, bond return payout, capture refund, and slash payout.
The evaluation is real. 275 verifier checks with zero errors, a 196 run negotiation sweep, ten settlement paths matched against an independent oracle, twenty-nine deals priced from live marketplace listings, and an adversarial battery that found two genuine holes, both fixed and covered by tests.
The system is honest about its own limits. One attack still works: padding a delivery with repeated words passes the length check, because a length check measures length. It is documented as a residual risk in the repo, and the other four checks plus the bond still bind. A translation case marks the same boundary: counting proves length and the presence of required terms, not craft.
The work produced a research paper as a byproduct, written from the same experiments, including the defects the testing found and the fixes that followed.

Try it yourself

Try the hosted demo first: https://pact-agentic-commerce.onrender.com. It runs in sandbox mode with test money only. The free host sleeps after a while idle, so the first load can take a minute. Deals on the hosted demo now survive a host restart. You can also run it yourself locally in sandbox mode. One step needs you: the approval step described above. Use these PayPal generated sandbox test accounts:

Buyer account: [email protected] / RB%_"1jJ
Seller account: [email protected] / SU_6sPa,

Pick a scenario in the setup card, create the deal, and run the negotiation.
Press Pay. The deal parks in awaiting approval with two PayPal links.
Open the payment link, sign in with the buyer account, and approve. Open the bond link, sign in with the seller account, and approve. Keep each account's pre selected funding source as it is.
Back in Pact, press the capture button, then run delivery and verification and watch the settlement and the audit ledger.

Run the cheat attempt scenario to see the graded path: one revision, then the seller is paid for the one check that passed, the buyer is refunded the rest, most of the bond is slashed, and the reputation hit.

Run the app locally with no PayPal credentials set and press Play the tour for a narrated run of one logo and brand kit deal, $222.17 with a $44.43 bond, from negotiation to payout in under a minute.

What is next

A richer check language, starting with schema checks on structured artifacts and test based checks on code, so the verifier can prove more than delivery shape. Negotiated check sets, where agents can propose new check kinds instead of only haggling over values. And a production treatment of mandates, so repeat buyers can pre approve a bounded budget and the approval step stops being per deal.

Built With

ag-grid
apimatic
channel3
fastapi
javascript
paypal-agent-toolkit
paypal-orders-api
paypal-payouts-api
python
render