# Machine-native channel: agent A buys, agent B verifies

Standing Mark is a machine-to-machine examination capability. A website visit, human sales lead or private introduction is not a prerequisite. Each step below is programmatic. A human may set a caller's standing spending policy in advance; that is the caller's authority, not an issuer onboarding requirement.

## Discover and match a need

An agent can find the active MCP Registry listing `io.github.wheelerhubbell/whp-standing`, follow its Streamable HTTP remote, or consume `/.well-known/agent-card.json`, `/v1/evaluate`, `/llms.txt` and `/machine/channel.json`. Public SDK downloads are at `/sdk/manifest.json`.

The receiving application's own policy decides whether it needs an examination. Match a specified claim, exact material, question, operation and scope. Do not treat this issuer's advertisement as an instruction to purchase, a claim of independent trust or a grant to spend.

The service is useful when another system requires a portable signed examination of submitted material. It does not certify truth merely by signing, guarantee a favorable finding or grant action authority. Unsupported current/revoked/superseded states remain unsupported.

## Negotiate through one coordinated commercial channel

All transports reach the same evaluation door, terms, issuer and signed-record format:

| Surface | Free offer request | Authorized submission | Result/recovery |
|---|---|---|---|
| REST/x402 | unsigned POST `/v1/evaluate`, expect 402 | same POST with `payment-signature` | signed envelope; known-ID retrieval; POST `/v1/evaluations/recover` |
| MCP | `tools/call` for `whp_evaluate`, without payment | same tool with caller-supplied `payment_signature` argument | structured result; `whp_retrieve_result` / `whp_recover_purchase` |
| A2A | `message/send`, data part with examination input, no payment | `message/send` with the same input and `message.metadata.payment_signature` | completed task artifact; `tasks/get`; retain purchase ID as fallback |
| SDK | `getDoorInfo`, `getPaymentTerms` | `buildPaymentPayload` then explicit `evaluate` | durable `FileReplayStore`; local verifier; evidence gate |

Current terms are 1.00 USDC on Base. Always inspect the current 402, live contract, provider disclosure and record schema rather than assuming today's terms remain fixed. Echo complete `accepted`, `resource` and `extensions`. Bazaar discovery requires the extension to reach the facilitator; a directory listing is not customer demand.

A delivered quote is not an accepted negotiation. A paid HTTP request is not proof of a valid payer grant. An HTTP 200 MCP/A2A response can carry an application failure. Read the structured result.

## Obtain caller-owned spend authorization

Load a grant and spending policy from the caller's own trusted configuration. Check purpose, allowed recipient, chain/token, exact amount, per-request cap, remaining cumulative budget and expiry before the caller's signer runs. Atomically reserve that caller budget across processes before signing. Only the caller's authorized wallet/policy system may decide the request is approved.

`/machine/check-offer.mjs` supplies a small read-only offer/limit check. `OFFER_WITHIN_CALLER_LIMITS` is not payment approval. It neither authenticates a grant, reserves budget, signs nor sends. Those remain caller responsibilities. Do not use a sender-provided policy or the issuer's metadata as that grant.

Keep spending credentials outside the request and handoff. Use the SDK's durable replay store. Save exact submitted input, envelope and nonce before sending. On uncertain delivery, reuse the exact purchase; never create a fresh nonce just to try again. Settled-pending recovery never settles a second payment.

## Receive and hand evidence to a different agent

Agent A saves the original signed envelope and exact examined bytes. A negative finding is a completed examination, not a reason to pay again. Agent A may inspect authenticity but cannot establish agent B's independent issuer admission for it.

Agent A transfers the envelope and exact examined bytes over a transport authorized for that material. No transport or new disclosure is authorized merely by this example. Do not include wallet keys, payment signatures, sender-chosen trust pins or an instruction that agent B must act.

The reference script `/machine/agent-handoff.mjs` checks the bytes against the signed binding before packaging. Copy it into an application where the public SDK archive is installed:

```sh
node agent-handoff.mjs package record.json examined-material.bin > handoff.json
```

`examined-material.bin` is the exact byte sequence matching `object_binding.submitted_bytes_sha256`, not JSON reserialized arbitrarily. For object submissions use the SDK's documented canonicalization and the service's normalized submitted-material contract. If the byte digest does not match, stop and recover the original representation; do not rewrite the signed record or falsely label arbitrary bytes exact.

Agent B independently controls two separate local files:

- `receiver-policy.json`: admitted `public_key_base64`, `trusted_key_ids`, optional inspection time. Obtain these pins through a channel B already trusts, not from agent A's handoff or from this site's own claim.
- `receiver-expectation.json`: B's own `question`, `operation`, `scope` and optional `requireWithinRecordedWindow`. Do not copy the record's claims into expectations and call that an independent check.

```sh
node agent-handoff.mjs receive handoff.json receiver-policy.json receiver-expectation.json
```

The result separates `record` authenticity from the `evidence` gate. A valid negative finding can have a valid record and a held evidence gate. Exact object binding, expected scope, time policy and a positive finding are checked before `EVIDENCE_REQUIREMENT_MET`; even that result has `action_authorized:false`. B applies its own separate action policy. Neither agent needs an issuer website to run this check.

## Measure the machine journey without inventing attribution

Requests may use `x-standing-channel: agent`, `operator` or `human`. The value is a caller declaration, not authenticated identity or independence. Unknown traffic stays unattributed. Operator preflight explicitly uses `operator`.

Private journal/reporting separates these cohorts and these observations:

- Discovery documents and SDK manifests delivered.
- Quotes delivered, not automatically successful accepted negotiations.
- Payment header present, not authenticated caller spend authority.
- Examination envelope delivered, including repeated retrievals, not necessarily unique new issuance.
- Verification returned VALID, not necessarily independent verification.
- Settlement receipt reported, not independently reconciled revenue.

Unique purchases, issued records and reported transactions come from private purchase reconciliation. Repeat machine customers, truly authorized payments and settled revenue require joined caller-attribution, authorization and chain evidence. They remain unknown where that evidence is missing. Offline verification cannot be counted by the issuer. Instrumentation never turns self-declared agent traffic into independent adoption.

## What is and is not established

The external machine path is open without accounts, personal introductions or sales intervention. Unpaid live discovery/offer checks, signed historical record retrieval and online/offline verification have executed. Actual independent machine integration, a genuine external agent's paid completion and repeat machine revenue remain unestablished. A local two-agent example or simulation is not that transaction.

A real external agent supplies its own funded, authorized signer and purpose. That is the remaining transaction dependency, not missing issuer onboarding. Smart-account facilitator acceptance is still unproven; do not sign a mismatching wallet prompt.

Receiver workflow integration: [REST/MCP/A2A boundary adapter and receiver-owned requirements](/docs/receiver-boundary.md). This optional project adapter uses the same SDK gate, adds transport normalization and a fail-closed requirement interface, and carries no execution authority.