Support external buyer identity and payment signer in the machine purchase path

[norgejbb-byte]

Expected

An external agent with its own DACS identity can, machine-to-machine, (a) resolve
a listing's reachable surface, (b) obtain an x402 quote, and (c) present its own
buyer identity / EIP-3009 signer to transact — without a human using the demo UI.

Observed (bytes)

For the endpoint-bearing listing, oracle-data-x402 v2
(stor-a119786d3a1832165cedbf86f03938a30d1c05ef):

1. seller.publicEndpoint = "https://agents.dacs.directory/try" → NXDOMAIN.
   curl (6) Could not resolve host: agents.dacs.directory; nslookup → NXDOMAIN.
2. acceptedRails[0].parameters.resourceBase = "https://butler.agentcommerce.network/demo/x402"
   is intent-scoped. Unpaid GET /demo/x402 → 404 {"error":{"code":"not_found", "message":"no route for GET /demo/x402"}}; GET /demo/x402/crypto-price?id=bitcoin
   → 404 {"error":"x402 procurement intent not found"}. There is no
   unauthenticated 402 challenge — an intent must first be minted via a session.
3. Neither procurement lane accepts an external buyer identity. Both post to
   butler.agentcommerce.network/demo/procurement and connect the gateway's own
   "Butler buyer wallet":
   • butler-lab (/demo/app.js): body {goal, budgetDem, files}.
   • directory /try (page-0155398d5b9f5da3.js): body
     {profileId, ...input, paymentRail} (flat).
     Neither body has a field for a buyer DID, public key, or EIP-3009 signer; the
     session party primaryClaim is the gateway's own did:demos:agent:…, and our
     DID is never referenced (ourDidUsed:false).

Net: the live terms (payTo 0xc0FD4427E059c5649C488729aeE2c56756a75c99, x402:default,
scheme exact, protocolVersion 2, 0.01 USDC per-datum) exist only in the on-chain
listing bytes; there is no reachable, unauthenticated, externally-signable path to
act on them.

Repro

nslookup agents.dacs.directory                                   # → NXDOMAIN
curl -s https://butler.agentcommerce.network/demo/x402           # → 404 no route
curl -s "https://butler.agentcommerce.network/demo/x402/crypto-price?id=bitcoin"  # → 404 intent not found
# /try body schema: page-0155398d5b9f5da3.js → t={profileId:eQ.id,...i,paymentRail:Y}; no signer field

Cross-links

• Declared-but-absent gate on the same lanes: Options declare confirmationGates ["commit-agreement","pay-dem"] but no gate state, confirm endpoint, or client action exists #47.
• Discovery of the endpoint-bearing listing is itself broken: Catalog indexes only the superseded agent-card generation; current DACS-1 listings are absent #43.
• Spec-side reachability discussion: [discussion] Reachability gap: a listing can be cryptographically valid yet commercially unreachable DACS-Standard#294.

[randomblocker]

Split into what can be fixed now versus the remaining product work. Gateway PR https://github.com/randomblocker/dacs-agents/pull/5 derives same-origin live publicEndpoint values and makes the intent-scoped x402 base return machine discovery rather than a dead 404. Directory PR #50 clearly states that the public lab uses a gateway-custodied demo buyer. External DACS identity and payment signer input is still not implemented and remains the substantive open enhancement, so this issue should stay open after those disclosure/discovery fixes merge.

[norgejbb-byte]

Expected

/.well-known/dacs-directory.json states its verification limitation ("client verification proves internal consistency, not independent chain inclusion") and ships anchor locators in every ListingSummary. For a client to close that gap — read StorageProgram.getByAddress(node, locator) and re-verify the contentHash itself — it must know which Demos node to read from. That endpoint is on no public directory surface.

Observed (bytes)

GET /.well-known/dacs-directory.json enumerates humanUrl, agentCard, api, catalog, openapi, schemas, status, inspectService, artifactProfiles, maturity, verification, filters — no substrate/RPC field. /api/dacs/status exposes syncedToTx/chainLatestTx but not the node URL. Row anchor is { "kind":"storage-program","locator":"stor-…" } with no resolver hint. Our own external walks (externalProof.ts, dealWalk.ts) succeeded end-to-end only by hardcoding https://demosnode.discus.sh/ — network-membership knowledge, not something the catalog told us.

Repro

curl -s ".../.well-known/dacs-directory.json" | jq 'keys'   # → no rpc/substrate/node key
curl -s ".../api/dacs/status" | jq 'keys'                    # → no node URL

Suggested direction (one line): add a substrate block to dacs-directory.json (e.g. { "kind":"demos", "rpc":"https://…", "network":"testnet" }) so the "resolve the anchor yourself" path is fully public-derivable.

Cross-links: the chain-read facet of the machine-buyer gap in #48 (no machine path for an external buyer) and the reachability discussion #294; the engage-surface mechanism is proposed as a comment on #294.

[randomblocker]

Current status after re-checking Community main and the live services:

Resolved:

• the live same-origin procurement options endpoint is reachable;
• GET https://butler.agentcommerce.network/demo/x402 returns machine-readable intent-scoped x402 discovery;
• Community PR feat(directory): publish substrate resolver metadata #66 added the public Demos substrate/RPC resolver contract to the Directory manifest: feat(directory): publish substrate resolver metadata #66
• Community PR Describe hosted procurement controls honestly #50 makes custody explicit in the buyer UI contract: Describe hosted procurement controls honestly #50

Still open:

• buyerControl truthfully reports gateway-custodied-demo;
• acceptsExternalDacsIdentity is false;
• acceptsExternalPaymentSigner is false;
• there is no request contract through which an independent buyer supplies its DACS identity/proof and authorizes payment with its own signer.

I have narrowed the title to that remaining capability. This needs a gateway/SDK execution contract first; the Community Directory UI can expose it only after the service accepts and verifies it. The issue should remain open as the end-to-end consumer requirement, with discovery and resolver work no longer treated as blockers.

[randomblocker]

The remaining producer-side work is now tracked concretely in randomblocker/dacs-agents issue #10:
https://github.com/randomblocker/dacs-agents/issues/10

That issue defines the fail-closed external-buyer contract: nonce/listing/request-bound DACS proof of control, verified DACS-to-Base account binding, client-side EIP-3009 authorization with no private-key handoff, seller-side verification, replay-safe recovery, and an independent-process testnet E2E. It also links the reusable SDK seams rather than inventing an incompatible gateway-only signing protocol.

Community #48 remains open as the end-to-end consumer requirement. Once gateway #10 is live and truthful buyerControl metadata advertises the new mode, the Directory UI/API integration can be added and independently tested here.