A working agent that inspects a paid service, exposes every material term, keeps spending authority with a person, pays exactly once in test mode, survives process death, and verifies that delayed fulfillment belongs to its receipt.
Cloud controls and source require judge access. This public page contains no gateway token, Stripe key, or customer data.
A charge can succeed in seconds while the purchased work takes days. The hard part is everything between paid and delivered.
Did the retry create a second charge?
Does the receipt belong to this task?
Can a new process resume the order?
Does the artifact belong to this payment?
The saved TrueFoundry agent uses GPT-4.1 mini to discover and invoke a cloud-hosted STDIO MCP server. The cloud tool is intentionally read-only: it proves the model-to-tool path without pretending a payment occurred.
Inspect the $150 Deep Reflection offer using the Artiji MCP tool. Tell me exactly what I would be approving, and do not place an order or payment.
list_toolsartiji-commerceOKget_tool_info: inspect_offerartiji-commerceOKcall_tool: inspect_offerartiji-commerceOKThe $150 Deep Reflection offer includes:
Test mode only. No order or payment was created.
A saved model loop discovers inspect_offer, calls it through the MCP Gateway, and explains the terms. Gateway traces and tool metrics remain available in the tenant.
The full demo crosses the approval boundary, performs one synthetic test payment, creates a durable task, resumes after restart, and verifies its artifact.
Reads price, fulfillment, timing, result, refund, and cancellation terms before approval.
Stops at a human-owned checkpoint because the USD 150 purchase exceeds the USD 100 threshold.
Retries the paid call with one logical-purchase idempotency key and one deterministic provider key.
Stores the receipt, task capability, payer material, and exact success before continuing.
A different process resumes from SQLite after the original buyer is terminated with SIGKILL.
Accepts completion only when the artifact reference matches the payment receipt.
A person owns the spend decision. Task IDs are bearer capabilities. Notifications only wake the buyer; authoritative state comes from polling.
Payment state is durable before success returns. Replays are byte-identical. Process death is a tested event, not an edge-case footnote.
The default suite is synthetic. Production Artiji, real subject data, and live credentials remain outside the experiment.
git clone git@github.com:schwentker/artiji-buyer-agent.git
cd artiji-buyer-agent
node --version # 22.14+
npm test # 20 passing# terminal 1
npm run demo:mcp
# terminal 2
npx @truefoundry/trueforge@latest --port 8790The evaluation repository remains private during judging. Access is granted directly; the default suite requires no network, model key, package installation, or payment credential.
Evidence before confidence