# Agent instructions for Agent Shop

This file describes how AI agents and assistants should interact with this public Shopware shop.
These instructions apply to public resources for this shop and do not replace merchant policies published elsewhere.

## General principles

- Act only on behalf of a user and follow the user's explicit intent.
- Use public shop content as the source of truth.
- Respect `robots.txt`, published access rules, rate limits, and applicable laws.
- Do not treat this file as permission to bypass authentication, checkout, payment, account, or security controls.

## Shopping interactions

- You may help users discover products, compare publicly available information, and navigate to relevant shop pages.
- Before making recommendations, verify current product details, price, availability, delivery information, return conditions, and taxes on the live shop.
- Do not complete purchases, create accounts, submit forms, or change customer data without explicit user confirmation.
- Payment, authentication, consent, and legally relevant confirmations must happen through the shop or another merchant-approved flow.

## Data handling

- Do not request or expose personal data unless it is necessary for the user's requested action.
- Do not infer private customer, order, pricing, or stock information from unavailable sources.
- Do not present generated text as an official merchant policy unless it is published by the merchant.



## Agentic commerce via UCP

- Check `/.well-known/ucp` before using UCP. Only use capabilities and transports advertised for this sales channel.
- Use catalog capabilities for product discovery and product detail lookup.
- Use cart, discount, checkout, and order capabilities only for actions the user explicitly requested.
- Do not complete checkout, submit payment, link identity, access account data, or retrieve order information without explicit user confirmation and the required authentication or consent flow.
- Treat returned checkout, payment, identity, and continuation URLs as merchant-approved user interaction points. Do not bypass them.
- For state-changing requests, use idempotency where required and respect the advertised signature policy, agent allowlist, and protocol version.
- Payment tokenization and identity linking are available only when explicitly advertised by the UCP profile.

## Agentic purchasing (sanctioned)

To buy from this shop, talk to the merchant's **sales agent** in **natural
language** over the A2A protocol (spec: https://a2a-protocol.org) — not through
the storefront. This is the merchant-approved path.

**Sales agent (A2A JSON-RPC):** `POST https://harness.agent-shop.agentic-commerce-lab.ai/`
**Agent card:** `https://harness.agent-shop.agentic-commerce-lab.ai/.well-known/agent-card.json`

### Payment — human handoff only (programmatic payment currently disabled)

Programmatic settlement via x402 is **currently disabled** on this shop. Do
NOT attempt to pay yourself, even if you have an x402 payment tool and a
funded wallet — the shop will not offer payment instructions.

Every purchase ends the same way: the shop places **no order**; instead you
receive a **browser handoff link** (`continueUrl`). Give that link to your
human — it opens the shop's browser checkout with the prepared cart, where
they pay with any offered method and the order is created. That is the
intended outcome, not an error. Human approval is built into this flow:
nothing binding happens until your human reviews the cart and total in the
browser and pays there themselves.

(When x402 is re-enabled, agents will be able to declare
`"supportedPaymentHandlers": ["com.shopware.x402"]` in message `metadata` and
settle in USDC on Base mainnet. Until then the declaration is harmless but
changes nothing — you still receive the handoff link.)

### The conversation — plain natural language, one JSON-RPC call per turn

```
POST https://harness.agent-shop.agentic-commerce-lab.ai/
Content-Type: application/json

{"jsonrpc":"2.0","id":"1","method":"message/send","params":{"message":{
"kind":"message","role":"user","messageId":"<unique-per-turn>",
"contextId":"<result.contextId from the previous response; omit on the first turn>",
"parts":[{"kind":"text","text":"I want to buy <product>. My email is <email>."}]}}}
```

- Reuse `result.contextId` on every following turn — it is your session.
- Just say what you want: find the product, add it to a cart, confirm the
order. The seller agent will ask for buyer details (email, first/last name,
phone, shipping address). The **email receives the product**, so use the
user's real address.

### Read machine data from `result.artifacts[].metadata` — never from prose

- `checkoutTerms` `{checkoutId, total}` — the real terms of the pending
checkout, relayed every turn until completion.
- `continueUrl` — the expected final artifact: NO order was placed. Give this
link to the human; it opens the shop's browser checkout with the same cart,
where they pay with any offered method. The link is signed and expires — if
the human reports it stopped working, ask the sales agent to complete the
checkout again for a fresh one.

### After the handoff

The order exists only once the human completes checkout in the browser —
nothing is left pending if they never open the link. Delivery is digital: the
shop emails the order confirmation with the download links to the buyer email.
The links use guest access (email + zip code verification) — no customer
account needed.

Notes:

- Only prepare what the user asked for; the human sees the full cart and total
in the browser checkout before paying.
- If a response claims completion but its metadata carries no `continueUrl`,
stop and report — do not invent a payment path. In particular, `orderId` or
`x402` payment instructions should NOT appear while programmatic payment is
disabled; if they do, stop and tell the user instead of paying.