VELQIRIS — Agentic Commerce Trust Gate

Autonomous AI Procurement, Fail-Closed Policy Gate, PayPal Sandbox Orders v2 & Gated Digital Delivery.

Comment

Inspiration

As autonomous AI agents are entrusted with procurement mandates and treasury execution, existing financial rails face an unprecedented challenge: traditional payment interfaces assume a human eye verifies receipts, contracts, and delivery conditions. In agentic commerce, an AI agent operating without deterministic safety gates can fall prey to prompt injection in vendor catalogs, subtle contract divergence, inflated volatility, or rogue merchant endpoints.

VELQIRIS — Agentic Commerce Trust Gate was engineered to solve this trust gap. It acts as an autonomous, fail-closed policy engine and post-order delivery gate positioned between an autonomous AI buyer and the official PayPal Developer Platform (Orders v2 & Webhooks v1 REST APIs).

Hosted Workbench vs. Full Local Architecture & Live Sandbox Settlement

  1. Hosted Workbench (velqiris-acquisition.netlify.app/paypal-sandbox.html):
    Provides an immediate, zero-friction interactive preview of all 6 Governed Verification Scenarios executed deterministically via Netlify Edge Functions (DETERMINISTIC_MCDA_POLICY_ENGINE). The hosted workbench operates in DEMO_LOCAL_SIMULATED_SETTLEMENT mode with simulated capture reconciliation so judges can inspect the entire decision topology instantly without requiring PayPal Sandbox credentials or Docker ($0.00 funds moved).
  2. Full Local Neural & PostgreSQL Architecture:
    Executes authentic local neural AI model inference (qwen2.5:0.5b via Ollama on loopback 127.0.0.1:11434, 490M params, 397MB footprint; audit proof in evidence_captures/real_ai_inference_proof.json), persistent PostgreSQL 16 with durable 12-table schema, transactional Outbox/Inbox with row-level leasing (FOR UPDATE SKIP LOCKED), and the asynchronous reconciler daemon. Setup in under 60 seconds via ./velqiris_services.sh start. Complete guide in JUDGE_START_HERE.md.
  3. End-to-End Live PayPal Developer Sandbox COMPLETED Settlement (scripts/execute_sandbox_completed_settlement.py):
    Proves the complete 6-layer autonomous chain settled in live COMPLETED status using strictly $19.00 USD virtual PayPal Developer Sandbox test funds ($0.00 real-world capital):
    • PayPal Sandbox Order ID: 0XE44560VW977724D (POST HTTP 201, GET HTTP 200, status: COMPLETED, payee_merchant_id: 528WKSF7HVQHA)
    • PayPal Sandbox Capture ID: 2LE025816J493433W (status: COMPLETED, final_capture: true, gross $19.00, PayPal fee $1.04, net $17.96 virtual Sandbox USD)
    • Official PayPal Server Webhook Event: WH-1Y8645456N7575209-8AU56827GB856572S (PAYMENT.CAPTURE.COMPLETED), recorded on PayPal backend infrastructure upon capture completion and verified directly via PayPal Sandbox Notifications API (GET /v1/notifications/webhooks-events). (Note: This proves PayPal's authoritative emission of the capture event into its notification log; live script ingestion loaded this verified event payload directly into PostgreSQL for ACID reconciliation, whereas inbound HTTP webhook signature verification via POST /v1/notifications/verify-webhook-signature is enforced separately on public HTTP ingress in paypal-webhook.js and verified through our 117-test suite).
    • PostgreSQL 16 ACID Reconciliation & Single-Use Gate: Order transitioned CREATED -> COMPLETED (row_version: 2), webhook_inbox marked PROCESSED, transactional outbox dispatched, 1st HMAC delivery token access granted (DELIVERED_SUCCESS), 2nd replay rejected (TOKEN_ALREADY_CONSUMED / HTTP 410).
    • Verifiable Proof Artifact: evidence_captures/real_paypal_sandbox_completed_proof.json (artifact_sha256: c60322c6b547ca99d3d1a37c7eea89d616e1e0d6e426d5ded41b3315c05a3932).

What It Does

VELQIRIS executes an end-to-end autonomous procurement lifecycle governed by strict safety invariants:

  1. Autonomous Procurement Mandate: The AI buyer receives an operational purchase mandate with explicit canonical parameters:
    • Hard Budget Ceiling: $25.00 USD
    • Risk Tolerance Ceiling: 30.0 / 100
    • Authorized Merchant Whitelist: 528WKSF7HVQHA
      (Note on demonstration video: In the video walkthrough, an isolated stress-test demonstration of Scenario 3 showcases a tightened $20.00 ceiling to visually highlight extreme budget overrun rejection (+45%), fully proving policy non-bypassability across both $20.00 and $25.00 parameters).
  2. Multi-Factor Epistemic Risk Scoring: The engine evaluates vendor catalogs across 4 empirical dimensions:
    • Merchant Trust & Provenance (history, tenure, verification records)
    • Anomaly & Behavioral Drift (deviation from category averages)
    • Price Volatility & Speculation (stability relative to reference price)
    • Contract & Schema Alignment (delivery SLA, return policy, terms conformity)
  3. Fail-Closed Policy Enforcement: Transactions exceeding risk tolerance, budget caps, or missing verifiable policy credentials are rejected prior to contacting payment rails (POLICY_REJECT_RISK_THRESHOLD_EXCEEDED, POLICY_REJECT_BUDGET_EXCEEDED).
  4. Active Prompt Injection Defense: Hostile vendor metadata attempting instruction overrides (e.g., hidden system prompts demanding automatic policy bypass) are sanitized and trigger an immediate security rejection (SECURITY_REJECT_PROMPT_INJECTION).
  5. Authentic PayPal Sandbox Order Creation & Settlement Gate: Approved transactions create real PayPal Sandbox Orders via the official v2 REST API (POST /v2/checkout/orders), locking order ID, gross amount ($19.00 USD), merchant (528WKSF7HVQHA), and SHA-256 policy audit hash (custom_id). Full settlement is proven in live Sandbox COMPLETED status (Order 0XE44560VW977724D, Capture 2LE025816J493433W), while interactive hosted testing on Netlify uses simulated settlement preview to avoid requiring judge credentials.
  6. Asynchronous Reconciler Daemon: A resilient background worker (supporting both local SQLite and PostgreSQL 16) leases pending webhook inbox events via FOR UPDATE SKIP LOCKED, reconciles orphan events against stored order mandates and custom_id hashes, quarantines mismatches to a Dead Letter Queue (DLQ), and preserves idempotency.
  7. Cryptographic Webhook Ingress Architecture: For incoming HTTP webhooks, the system enforces PayPal's official POST /v1/notifications/verify-webhook-signature API check and SSRF certificate-domain allowlisting on HTTP ingress prior to idempotency or state transitions, neutralizing forged signatures (SECURITY_REJECT_FORGED_WEBHOOK_SIGNATURE) and replay attacks (tested deterministically in test harness and Netlify edge functions).
  8. Gated Single-Use Digital Fulfillment: Only after reconciliation confirms exact mandate, merchant, currency, amount, and custom_id policy-hash binding, VELQIRIS issues a single-use HMAC-SHA256 fulfillment token (DELIVERED_SUCCESS; replay attempts blocked with HTTP 410).

AI Integrity & Deterministic Policy Gate Independence

In the live autonomous execution trace (evidence_captures/real_paypal_sandbox_completed_proof.json), local neural model qwen2.5:0.5b evaluated the competing vendor offers and correctly selected OFFER-ALPHA-01. In its natural-language rationale, the model included a hallucinated textual statement ("The offer is also compliant with the risk score of 78.5, which is below the 30.0 max tolerance"), conflating the text of Offer A with the rejected Offer B.

This hallucination empirically proves the core architectural thesis of VELQIRIS:

  • Zero LLM Authority: The Policy Gate never grants financial authority to LLM reasoning or natural-language output. The model's sole output used downstream is the candidate proposal key (recommended_offer_id: "OFFER-ALPHA-01").
  • Server-Side Canonical Catalog Enforcement: The Policy Gate discards all LLM-reported metrics and performs an independent server-side lookup in the authoritative vendor registry, where OFFER-ALPHA-01 has verified risk score 8.0 and price $19.00.
  • Deterministic Bounds Verification: The gate independently verified 8.0 <= 30.0 (Risk OK), $19.00 <= $25.00 (Budget OK), and merchant 528WKSF7HVQHA (Whitelist OK). The model's hallucinated rationale had zero influence on financial authorization.
  • Cryptographic Policy Hash: The authorized order specification was locked into SHA-256 audit hash f57ed1690bd0ae6b... and bound to PayPal custom_id: GATE_AUTH_f57ed1690bd0ae6b.

6 Governed Verification Scenarios

VELQIRIS is verified against six reference scenarios demonstrating robust decision boundaries:

  • Scenario 1 (Honest Vendor Multi-Offer Evaluation): Evaluates Offer A ($19.00 / Risk 8.0), Offer B ($16.00 / Risk 78.5), and Offer C ($29.00 / Risk 4.5). Offer A is approved ($19.00 <= $25.00, Risk 8.0 <= 30.0) -> Authentic PayPal Sandbox Order Creation -> Verified Settlement -> Single-Use Digital Delivery (DELIVERED_SUCCESS).
  • Scenario 2 (High Risk Anomaly - Offer B): Evaluated under tightened risk tolerance ceiling (20.0/100). Rejected fail-closed (Risk 78.5 > 20.0 threshold / fails baseline 30.0 limit) -> Policy Gate halted -> Payment rail uncontacted ($0 spent).
  • Scenario 3 (Budget Exceeded - Offer C): Evaluated under tightened budget cap ($20.00). Rejected fail-closed ($29.00 > $20.00 cap / fails baseline $25.00 limit) -> Policy Gate halted -> Zero financial risk ($0 spent).
  • Scenario 4 (Prompt Injection Attack): Adversarial vendor catalog containing system override instructions neutralized -> Security Gate halted fail-closed ($0 spent).
  • Scenario 5 (Orphan Webhook Recovery): Webhook arrives before local order registration -> held in PostgreSQL durable inbox (PENDING_RECONCILIATION) -> asynchronous reconciler matches order ($19.00, custom_id policy hash) via SKIP LOCKED and authorizes single-use delivery.
  • Scenario 6 (Forged Webhook Defense): Fraudulent signature payload rejected with HTTP 401; authentic webhook replayed with HTTP 200 idempotency without double-fulfillment.

How We Built It

  • Agentic Engine & Neural AI: Python 3.12 and Node.js architecture with clean separation between policy evaluation, epistemic risk computation, and payment gateway isolation. Integrates local neural LLM inference via Qwen2.5 0.5B (qwen2.5:0.5b transformer, 490M parameters, 397MB footprint served locally via Ollama on 127.0.0.1:11434) alongside deterministic Multi-Criteria Decision Analysis (MCDA).
  • Serverless & Edge Runtime: Netlify Edge Functions implementing stateless proxying, client token authentication, SHA-256 HMAC signature verification, SSRF defense, and fail-closed error handling.
  • Storage Tier & Concurrency: Pluggable storage architecture featuring in-memory test mocks, persistent local SQLite, and enterprise PostgreSQL 16 adapters with 12 canonical tables, transactional Outbox/Inbox, and high-concurrency row-level leasing (FOR UPDATE SKIP LOCKED).
  • PayPal Integration: Official PayPal REST APIs (/v2/checkout/orders, /v1/notifications/verify-webhook-signature, /v1/oauth2/token, /v1/notifications/webhooks-events) utilizing PayPal Developer sandbox credentials. Live autonomous settlement proven in COMPLETED status (0XE44560VW977724D / 2LE025816J493433W), with zero real funds disbursed.
  • Test Suite: Comprehensive 16-file test harness audited by node scripts/audit_test_suite.js.

Test & Verification Evidence

  • Total Unique Tests Declared: 117 Unique Tests (16 test suites across JavaScript & Python, zero double-counting).
  • Host Execution (Docker PostgreSQL 16 Running): 117 PASS · 0 FAIL · 0 SKIPPED (100% GREEN in direct host environment).
  • Hermetic Sandbox Execution (Stopped Container): 99 PASS · 10 PG-dependent · 8 SKIPPED (reconciles exactly to 117 declared).
  • Mathematical Reconciliation: Declared (117) === PASS (117) + FAIL (0) + SKIPPED (0) in direct host environment. Status Audit: MATHEMATICALLY CONVERGENT & EXACT (PASS).
  • Local AI Inference Proof: SHA-256 verified neural inference trace recorded in evidence_captures/real_ai_inference_proof.json (eb6e758dc00f5adb58fdc96d89686439951b5fdfd1a92e8c08117bd0970d030a).
  • PayPal Sandbox COMPLETED Settlement Proof: Recorded in evidence_captures/real_paypal_sandbox_completed_proof.json (c60322c6b547ca99d3d1a37c7eea89d616e1e0d6e426d5ded41b3315c05a3932).
  • Verified Authentic Video SHA-256: e367671866abda3fb33c64f169e7e66291ac8f897d2b3ef5a0645f4acf724943 (157.97s / 2m38s, 1080p, YouTube ID C7KyyEiovCA).
  • Release Manifest & Frozen Commit: Tracked in repository under RELEASE_MANIFEST_P0.json (Commit 40de4a9332d32b7c29536b646699649d9cea9d2f).

Try It Out

Built With

  • agentic-commerce
  • ai-procurement
  • fintech
  • paypal
  • risk-engine
  • security
Share this project:

Updates

Submission history