agentic-payments 0.1.0

Autonomous multi-agent Ed25519 signature verification with Byzantine fault tolerance
Documentation
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
# Gap Analysis: AP2 vs Agentic Commerce Protocol (ACP)

## Overview

This document provides a detailed gap analysis comparing the current AP2 implementation in the agentic-payments crate with the requirements of the Agentic Commerce Protocol (ACP). The analysis identifies what exists, what's missing, and what needs modification.

## Executive Summary

| Category | AP2 Status | ACP Requirements | Gap Level |
|----------|-----------|------------------|-----------|
| Core Cryptography | ✅ Complete | Mostly Compatible | Low |
| Payment Authorization | ✅ Complete (Mandates) | Different Model (Checkout) | Medium |
| API Architecture | ⚠️ Library-only | RESTful HTTP API Required | High |
| Payment Tokens | ⚠️ Credentials | Shared Payment Tokens (SPT) | Medium |
| Merchant Integration | ❌ Not Implemented | Product Feed + Checkout API | High |
| Webhooks | ❌ Not Implemented | Order Event Webhooks Required | High |
| OpenAPI Compliance | ❌ Not Implemented | OpenAPI Spec Required | High |
| Agent Identity | ✅ Complete (DID) | Compatible | Low |
| Multi-Agent Consensus | ✅ Complete (BFT) | Not Required (But Valuable) | None |
| WASM Support | ✅ Complete | Compatible | Low |

**Overall Assessment**: The current AP2 implementation provides a solid cryptographic and agent infrastructure foundation, but significant new components are needed to support ACP's merchant-focused checkout API model.

## Detailed Gap Analysis

### 1. Cryptographic Infrastructure

#### Current AP2 Implementation ✅
- **Ed25519 Signatures**: Full RFC 8032 compliance
- **Key Management**: Agent key generation, storage, rotation
- **Signature Verification**: Fast batch verification (<100μs per signature)
- **Zero-Knowledge Support**: Zeroize integration for secure memory
- **WASM Compatibility**: Browser-compatible crypto via wasm-bindgen

**Files**:
- `src/crypto/mod.rs`
- `src/crypto/signatures.rs`
- `src/crypto/keys.rs`

#### ACP Requirements
- Ed25519 or similar for SPT signing
- Credential delegation support
- Time-bound token signatures
- Merchant verification keys

#### Gap Analysis
**Status**: ✅ **No Significant Gaps**

The existing Ed25519 infrastructure is fully compatible with ACP's SPT requirements. Minor additions needed:
- [ ] SPT-specific signing contexts
- [ ] Time-bound signature validation
- [ ] Merchant key registry integration

**Effort**: 1-2 days
**Priority**: Low (can reuse existing infrastructure)

---

### 2. Payment Authorization Model

#### Current AP2 Implementation ✅
- **Three-Tier Mandates**: Intent → Cart → Payment
- **Authorization Chains**: Complete payment authorization flows
- **Permission System**: Granular agent permissions
- **Lifecycle Management**: Mandate states (pending/active/completed/cancelled)
- **Calculations**: Tax, shipping, discounts, totals

**Files**:
- `src/ap2/mandates.rs` (409 lines)
- `src/ap2/mod.rs` (authorization chains)

#### ACP Requirements
- **Checkout API**: RESTful checkout flow
- **Order Management**: Create, retrieve, update orders
- **Payment Intent**: Different from AP2 Intent Mandate
- **Checkout State**: Rich state returned on every response
- **Guest Checkout**: Support for non-authenticated buyers

#### Gap Analysis
**Status**: ⚠️ **Significant Conceptual Differences**

AP2's mandate model is comprehensive but different from ACP's checkout model:

| Feature | AP2 | ACP | Gap |
|---------|-----|-----|-----|
| Authorization Model | Three mandates with signatures | Single checkout with SPT | Medium |
| Agent Permission | Explicit permission grants | Implicit via SPT scope | Low |
| State Management | Mandate lifecycle | Order state machine | Medium |
| Item Tracking | Cart mandate items | Order line items | Low |
| Payment Completion | Payment mandate execution | Checkout completion webhook | High |

**Missing ACP Components**:
- [ ] Checkout session management
- [ ] Order state machine (different from mandate states)
- [ ] Guest checkout support
- [ ] Checkout abandonment tracking
- [ ] Order modification after creation
- [ ] Shipping method selection
- [ ] Promo code application

**Effort**: 2-3 weeks
**Priority**: High (core ACP functionality)

---

### 3. API Architecture

#### Current AP2 Implementation ⚠️
- **Library-Only**: Rust library with async functions
- **No HTTP Layer**: Direct function calls only
- **In-Process**: Single-process multi-agent architecture
- **Type-Safe**: Strong Rust type system

**Files**:
- All current implementation is library-based
- No HTTP server infrastructure

#### ACP Requirements
- **RESTful HTTP API**: Required checkout endpoints:
  - `POST /checkout/create` - Initiate checkout
  - `GET /checkout/{id}` - Retrieve checkout state
  - `POST /checkout/{id}/complete` - Complete checkout
  - `POST /checkout/{id}/cancel` - Cancel checkout
- **Webhook Endpoints**: Receive order events from AI agents
- **Product Feed**: Expose product catalog
- **OpenAPI Specification**: Machine-readable API spec
- **Authentication**: Merchant authentication (API keys, OAuth)
- **Rate Limiting**: Request throttling
- **Versioning**: API version management

#### Gap Analysis
**Status**: ❌ **Major Gap - No HTTP Infrastructure**

Current implementation has no HTTP server or API layer.

**Required Components**:
- [ ] HTTP server framework (axum, actix-web, or warp)
- [ ] RESTful endpoint implementations
- [ ] Request/response serialization
- [ ] Authentication middleware
- [ ] Rate limiting middleware
- [ ] CORS support for browser agents
- [ ] API versioning strategy
- [ ] Error response standardization
- [ ] Health check endpoints
- [ ] Metrics collection (Prometheus)

**Architecture Decision Required**:
- **Option 1**: Embedded HTTP server (e.g., axum)
- **Option 2**: Separate HTTP wrapper crate
- **Option 3**: gRPC + HTTP gateway

**Recommendation**: Option 1 (embedded axum) with feature flag

**Effort**: 3-4 weeks
**Priority**: Critical (ACP cannot function without HTTP API)

---

### 4. Shared Payment Tokens (SPT)

#### Current AP2 Implementation ⚠️
- **Verifiable Credentials**: W3C VC standard implementation
- **Proof Structure**: Ed25519 signatures on credentials
- **Expiration Handling**: Timestamp-based validity
- **No Token Delegation**: Credentials are not delegatable

**Files**:
- `src/ap2/credentials.rs` (309 lines)

#### ACP Requirements
- **SPT Structure**: Stripe-compatible Shared Payment Token
  ```json
  {
    "token_id": "spt_xxx",
    "payment_method": "pm_xxx",
    "merchant_id": "mer_xxx",
    "amount_limit": 10000,
    "currency": "USD",
    "expires_at": 1234567890,
    "scope": ["charge", "refund"],
    "metadata": {}
  }
  ```
- **Delegation Semantics**: SPT delegates payment authority
- **Scoping**: Time, amount, merchant, and operation constraints
- **Revocation**: Token invalidation before expiry
- **PSP Integration**: Stripe SPT API or custom implementation

#### Gap Analysis
**Status**: ⚠️ **Partial - Need SPT-Specific Implementation**

Existing Verifiable Credentials are similar but not compatible with SPT format:

| Feature | AP2 VC | ACP SPT | Gap |
|---------|--------|---------|-----|
| Format | W3C VC (JSON-LD) | JSON (PSP-specific) | High |
| Delegation | No | Yes | High |
| Scoping | Permission-based | Amount/time/merchant | Medium |
| Revocation | No | Yes | High |
| PSP Integration | No | Stripe API | High |
| Expiration | Timestamp | Timestamp | None |

**Required Components**:
- [ ] SPT data structure
- [ ] SPT generation from credentials
- [ ] Token scoping logic
- [ ] Revocation list/system
- [ ] Stripe SPT API client
- [ ] Non-Stripe PSP abstraction
- [ ] Token → payment authorization mapping

**Effort**: 2-3 weeks
**Priority**: High (core ACP security primitive)

---

### 5. Merchant Integration

#### Current AP2 Implementation ❌
- **No Merchant Concepts**: AP2 is agent-to-agent focused
- **No Product Catalog**: No product feed or inventory
- **No Merchant Authentication**: No merchant-specific logic
- **No Order Management**: Focus on payment authorization only

#### ACP Requirements
- **Product Feed**: Expose product catalog to AI agents
  - Product IDs, names, descriptions
  - Pricing, images, variants
  - Availability, stock levels
  - Categories and taxonomy
- **Merchant Dashboard**: Merchant configuration UI (optional)
- **Merchant Authentication**: API key or OAuth for merchants
- **Merchant Settings**: Webhook URLs, payment preferences
- **Order Management**: Track orders, fulfillment, returns

#### Gap Analysis
**Status**: ❌ **Complete Gap - No Merchant Infrastructure**

This is entirely new functionality:

**Required Components**:
- [ ] Product feed data structures
- [ ] Product feed API endpoints
- [ ] Product search and filtering
- [ ] Merchant profile management
- [ ] Merchant authentication system
- [ ] Merchant API key generation
- [ ] Order tracking system
- [ ] Fulfillment status updates
- [ ] Return/refund handling

**Design Decisions**:
- **Storage**: Database required (PostgreSQL, SQLite)
- **Product Feed Format**: Follow ACP product feed spec
- **Merchant Portal**: Separate UI or API-only?

**Effort**: 4-5 weeks
**Priority**: High (required for merchant adoption)

---

### 6. Webhook System

#### Current AP2 Implementation ❌
- **No Webhooks**: Event-driven architecture not implemented
- **Callback Support**: Limited to in-process async callbacks

#### ACP Requirements
- **Order Event Webhooks**: Notify AI agents of order events
  - `order.created`
  - `order.updated`
  - `order.completed`
  - `order.cancelled`
  - `order.refunded`
- **Webhook Delivery**: Reliable HTTP POST to agent endpoints
- **Retry Logic**: Exponential backoff for failed deliveries
- **Signature Verification**: HMAC or Ed25519 signatures
- **Event Ordering**: Handle out-of-order events
- **Webhook Management**: Subscribe/unsubscribe endpoints

#### Gap Analysis
**Status**: ❌ **Complete Gap - No Webhook Infrastructure**

**Required Components**:
- [ ] Webhook event data structures
- [ ] Event queue (in-memory or external like Redis)
- [ ] Webhook delivery worker
- [ ] Retry logic with exponential backoff
- [ ] Signature generation for webhook payloads
- [ ] Webhook subscription management
- [ ] Event log for debugging
- [ ] Dead letter queue for failed deliveries
- [ ] Webhook testing tools

**Architecture Decision**:
- **Option 1**: Simple in-memory queue (for small scale)
- **Option 2**: Redis queue (for production scale)
- **Option 3**: Message broker (RabbitMQ, Kafka)

**Recommendation**: Option 1 initially, Option 2 for production

**Effort**: 2-3 weeks
**Priority**: High (critical for asynchronous order flow)

---

### 7. OpenAPI Compliance

#### Current AP2 Implementation ❌
- **No OpenAPI Spec**: Library-only, no API documentation
- **Rust Documentation**: rustdoc comments only

#### ACP Requirements
- **OpenAPI 3.x Specification**: Complete YAML spec for all endpoints
- **Request/Response Schemas**: JSON Schema for all payloads
- **Authentication Schemes**: Documented in OpenAPI
- **Example Requests**: Included in spec
- **Code Generation**: Enable client generation from spec
- **Conformance Testing**: Validate against spec

#### Gap Analysis
**Status**: ❌ **Complete Gap - Need OpenAPI Infrastructure**

**Required Components**:
- [ ] OpenAPI YAML specification file
- [ ] Schema generation from Rust types (utoipa)
- [ ] Schema validation middleware
- [ ] OpenAPI UI (Swagger UI, ReDoc)
- [ ] Example generation
- [ ] Conformance test suite
- [ ] Documentation generation pipeline

**Tools**:
- `utoipa`: Generate OpenAPI from Rust code
- `utoipa-swagger-ui`: Embed Swagger UI
- `schemars`: JSON Schema generation
- `validator`: Request validation

**Effort**: 2-3 weeks
**Priority**: High (required for ACP certification)

---

### 8. Agent Identity and DID

#### Current AP2 Implementation ✅
- **DID Documents**: Complete W3C DID implementation
- **DID Method**: Custom `did:ap2:` method
- **DID Resolution**: Caching resolver
- **Service Endpoints**: Configurable services
- **Verification Methods**: Ed25519 key support

**Files**:
- `src/ap2/did.rs` (387 lines)

#### ACP Requirements
- **Agent Identity**: Identify AI agents in checkout
- **Merchant Identity**: DID or similar for merchants
- **Service Discovery**: Find merchant checkout endpoints

#### Gap Analysis
**Status**: ✅ **No Significant Gaps**

Existing DID infrastructure is compatible with ACP:
- [ ] Extend `did:ap2:` to support merchant identities
- [ ] Add ACP-specific service types
- [ ] Merchant DID registry

**Effort**: 1 week
**Priority**: Low (existing DID system works)

---

### 9. Multi-Agent Consensus

#### Current AP2 Implementation ✅
- **Byzantine Fault Tolerance**: 2f+1 quorum with ⅔+ consensus
- **Verification Pool**: 3-100 agents per verification
- **Weighted Voting**: Reputation-based weights
- **Parallel Verification**: Concurrent agent execution
- **Self-Healing**: Automatic agent recovery (<2s)
- **Verification Policies**: Configurable thresholds

**Files**:
- `src/ap2/verification.rs` (477 lines)
- `src/consensus/` (Byzantine consensus algorithms)
- `src/agents/pool.rs` (agent pool management)

#### ACP Requirements
- **No Consensus Required**: ACP relies on PSP for verification
- **Optional Enhancement**: Could use for merchant reputation

#### Gap Analysis
**Status**: ✅ **Bonus Feature - Not Required but Valuable**

ACP doesn't require multi-agent consensus, but it's a differentiating feature:

**Potential Use Cases in ACP**:
- [ ] Merchant reputation scoring via multi-agent analysis
- [ ] Fraud detection with consensus-based alerts
- [ ] Disputed transaction arbitration
- [ ] Decentralized SPT verification (non-Stripe PSPs)

**Effort**: None (already implemented)
**Priority**: N/A (optional enhancement)

---

### 10. WASM Compatibility

#### Current AP2 Implementation ✅
- **Full WASM Support**: Browser and Node.js compatible
- **wasm-bindgen**: JavaScript interop
- **Async Support**: wasm-bindgen-futures
- **No Tokio**: Uses browser-compatible async
- **Crypto**: wasm-compatible ed25519-dalek

**Files**:
- `src/wasm/` (complete WASM bindings)

#### ACP Requirements
- **Browser Agents**: Support browser-based AI agents
- **WASM-Compatible**: HTTP client, crypto, async

#### Gap Analysis
**Status**: ✅ **No Significant Gaps**

Existing WASM infrastructure is solid. Minor additions:
- [ ] HTTP client for WASM (reqwest with wasm feature)
- [ ] localStorage for token caching
- [ ] Browser-compatible webhook receiver (via postMessage)

**Effort**: 1 week
**Priority**: Medium (enables browser agents)

---

## Summary of Gaps

### Critical Gaps (Block ACP Adoption)
1. **HTTP API Infrastructure** (3-4 weeks)
   - No RESTful server implementation
   - Required for all ACP interactions

2. **Merchant Integration** (4-5 weeks)
   - No product feed or merchant management
   - Essential for merchant adoption

3. **Webhook System** (2-3 weeks)
   - No event notification infrastructure
   - Critical for async order flow

### High Priority Gaps (Significantly Limit Functionality)
4. **Shared Payment Tokens** (2-3 weeks)
   - Need SPT-specific implementation
   - Core security primitive

5. **Checkout API Model** (2-3 weeks)
   - Different authorization model from mandates
   - Core payment flow

6. **OpenAPI Compliance** (2-3 weeks)
   - Required for certification
   - Enables client generation

### Medium Priority Gaps (Nice to Have)
7. **Protocol Abstraction** (1-2 weeks)
   - Support both AP2 and ACP
   - Enable gradual migration

8. **WASM HTTP Client** (1 week)
   - Browser-based agent support
   - Expands deployment options

### Low Priority Gaps (Minor Enhancements)
9. **SPT Signing Context** (1-2 days)
   - Adapt existing crypto for SPT
   - Minor adaptation

10. **Merchant DID Extension** (1 week)
    - Extend existing DID system
    - Minor addition

---

## Total Effort Estimate

**Critical Path**: HTTP API + Merchant Integration + Webhooks + SPT + Checkout Model + OpenAPI
**Total Effort**: 18-24 weeks of development time

**Parallelizable Work**:
- HTTP API + OpenAPI (can develop together)
- Merchant Integration (can be parallel to checkout model)
- Webhooks + SPT (some overlap)

**Realistic Timeline**: 12-16 weeks with 2-3 developers working in parallel

---

## Risk Assessment

### High Risk
- **OpenAPI Spec Changes**: ACP spec is new and may evolve
  - **Mitigation**: Pin to spec version, automated testing against spec

### Medium Risk
- **Stripe SPT API Changes**: Dependency on Stripe's implementation
  - **Mitigation**: Abstract PSP layer, support multiple PSPs
- **Performance Degradation**: HTTP layer adds latency
  - **Mitigation**: Benchmarking, async optimization

### Low Risk
- **WASM Compatibility**: Well-understood technology
  - **Mitigation**: Early testing, feature flags
- **Backward Compatibility**: AP2 implementation is stable
  - **Mitigation**: Separate modules, no changes to AP2

---

## Recommendations

### Immediate Actions (Week 1-2)
1. ✅ Complete this gap analysis
2. Create detailed implementation roadmap
3. Prototype HTTP API with axum
4. Design protocol abstraction layer
5. Set up OpenAPI tooling

### Phase 1: Foundation (Week 3-6)
1. Implement HTTP API infrastructure
2. Build OpenAPI spec and generation
3. Create protocol abstraction layer
4. Design SPT data structures

### Phase 2: Core ACP (Week 7-12)
1. Implement checkout API endpoints
2. Build SPT generation and validation
3. Create webhook system
4. Merchant integration basics

### Phase 3: Complete Integration (Week 13-16)
1. Full merchant integration
2. Product feed implementation
3. Conformance testing
4. Documentation and examples

---

## Next Steps

1. **Review and Approve**: Stakeholder sign-off on gap analysis
2. **Prioritize Gaps**: Confirm priority and sequencing
3. **Create Roadmap**: Detailed implementation roadmap with milestones
4. **Prototype**: Build HTTP API + OpenAPI proof of concept
5. **Iterate**: Begin Phase 1 development

---

**Document Version**: 1.0
**Last Updated**: 2025-09-29
**Status**: Draft - Pending Review