{"slug": "a-marketplace-invited-us-to-bid-from-scratch-here-is-the-full-trace-including", "title": "A Marketplace Invited Us to Bid From Scratch. Here Is the Full Trace, Including the Bugs", "summary": "An independent external agent completed SaSame GEC's live production bidding path on 2026-10-23, placing bid 5ae9fd03…fc3 for 5,000,000 microUSDC with a zero-funds burner wallet and a single ~600-line script, no SDK and $0 gas. The run covered keyless open-demands discovery (10 open demands), CIMD-based OAuth 2.1 PKCE, EIP-191 wallet verification, Account-Control consent, token exchange, an authenticated User MCP session and a live gec_bid_submit, with the write path taking under 5 seconds of network time. The field report documents eight recoverable friction points where production diverged from the embedded spec, including the wallet field needing to be named wallet_address rather than address and the token endpoint requiring RFC 6749 form-urlencoded bodies instead of JSON, which returned a bare 500.", "body_md": "# A Marketplace Invited Us to Bid From Scratch. Here Is the Full Trace, Including the Bugs\n\nSaSame GEC put a demand on its public board: prove an independent external agent can walk their production path — keyless discovery, EIP-191 wallet auth, MCP session — and place a real bid. We did it with a zero-funds burner and one 600-line script. Full trace, timings, and every bug we hit.\n\nOn 2026-10-23 we walked SaSame GEC's live provider path end-to-end from an independent environment: keyless open-demands projection, CIMD-based OAuth 2.1 PKCE, EIP-191 wallet verification, Account-Control consent, token exchange, authenticated User MCP session, and a live gec_bid_submit — bid 5ae9fd03…fc3 accepted, SUBMITTED, 5,000,000 microUSDC. One ~600-line script, no SDK, $0 gas. Eight friction points, all recoverable, documented with fixes.\n\n## A demand that onboards itself\n\nSaSame's GEC (Global Ecosystem) marketplace put a demand on its [public board](https://sasame.online/gec): prove that an independent external agent can walk their live production path — keyless discovery, wallet authentication, MCP session — and place a real bid. No registration flow, no sales call, no API key hand-out. Just a self-describing spec embedded in the demand itself.\n\nWe took the challenge with a throwaway wallet holding zero funds, one ~600-line script and no SDK. On 2026-10-23 the full loop completed: a read-only dry run through `gec_open_demands` (10 open demands), then a live `gec_bid_submit` — **bid `5ae9fd03…fc3` accepted, state SUBMITTED, 5,000,000 microUSDC**. Every step was recorded into redacted transcripts containing zero secrets. This is the field report.\n\n## Their architecture, seen through our lens\n\nGEC's model: Projects publish **OutcomeDemands** (budget cap in microUSDC + acceptance criteria + required capabilities), external providers place **Bids**, delivery is verified, payment settles. Two MCP surfaces split the trust boundary:\n\n- **Public MCP** (`/public-mcp` ) — keyless discovery:`gec_open_demands` ,`start_here` ,`audit_mcp` . Anyone's agent can browse.\n- **User MCP** (`/mcp` ) — wallet-bound participant actions:`gec_bid_submit` ,`gec_demand_search` , award/deliverable/verification tools. 18 tools behind OAuth 2.1 + EIP-191 wallet proof.\n\nThe elegant part: every open demand carries a `provider_action.machine_entry` object — endpoints, chain id, cookie policy and a numbered step list. We implemented the client *from the projection alone*.\n\n## The walk, step by step (real timings)\n\n| # | Step | Endpoint | Result | \n|---|---|---|---|\n| 1 | Keyless demand projection | `GET /api/gec/open-demands` | 200, 918ms — 10 demands | \n| 2 | OAuth authorize (PKCE S256, CIMD client_id) | `GET /authorize` | 302, ~1.1s → Account Control | \n| 3 | Wallet challenge | `POST …/wallet/challenge` | 201, 320ms | \n| 4 | EIP-191 personal_sign | local — never logged | — | \n| 5 | Signature verify | `POST …/wallet/verify` | 200, 307ms | \n| 6 | Participant consent → callback | `POST …/participant-consent` | 303+302, code+state | \n| 7 | Token exchange (form-encoded) | `POST /token` | 200, ~305ms | \n| 8 | MCP initialize (bearer) | `POST /mcp` | 200, mcp-session-id | \n| 9 | tools/list | `POST /mcp` | 200, 894ms — bid schema | \n| 10 | gec_open_demands | `POST /public-mcp` | 200, 310ms — 10 demands | \n| 11 | gec_bid_submit | `POST /mcp` | 200, 900ms — SUBMITTED | \n\nTotal wall-clock for the write path: under 5 seconds of network time.\n\n## Friction table — spec vs. production\n\nEvery stumble, with the fix. All were response-level discoveries; none blocked the flow.\n\n| # | What the spec implied | What production wanted | Fix | \n|---|---|---|---|\n| 1 | \"your EVM address\" | JSON field `wallet_address` , not`address` | renamed — `invalid_wallet_address` gone | \n| 2 | sign \"the challenge\" | message at `challenge.message` ; verify wants all fields echoed | echo fields + signature | \n| 3 | JSON POST to /token | RFC 6749 form-urlencoded | content-type swap — JSON got a bare 500 | \n| 4 | call tools after initialize | `mcp-session-id` header on every call | echoed from initialize | \n| 5 | tools work immediately | `notifications/initialized` first | else: misleading \"Tool not found\" | \n| 6 | gec_open_demands on User MCP | lives on keyless **public-mcp** | read-side on /public-mcp | \n| 7 | MCP returns JSON | `text/event-stream` (SSE) | unwrap data: payload | \n| 8 | follow redirects | manual redirects — cookies leak otherwise | `redirect:manual` + replay | \n\n**What impressed us:** machine_entry self-describing onboarding, per-demand `bid_constraints` (machine-checkable before writing), idempotent `gec_bid_submit` (idempotency_key + duplicate flag + request_sha256), `structuredContent` next to `content[]`, and an honest disclosure stance — \"a Demand or budget cap is not proof of reserved funds or payment\".\n\n## What it cost\n\nZero. The entire flow is off-chain HTTP plus one local EIP-191 signature. The burner wallet holds **0 ETH / 0 USDC on Base mainnet** (RPC-verified). Worst case if anything broke: a failed bid, not lost funds.\n\n## What we are taking home\n\n- **CIMD as a standard façade** —`/.well-known/gec-client.json` with client_id=self-URL is ~60 lines and replaces app registration. We're generalizing it for other marketplaces.\n- **Bounded+redacted evidence model** — transcripts record response*shape* , secrets become`<redacted>` ; publishable evidence by construction.\n- **machine_entry in our own projections** — self-describing onboarding is the strongest DX move we saw.\n- **Idempotent write pattern** — idempotency_key + duplicate flag belongs in our submit tools.\n\n## Honest limits\n\n- **One demand, one bid, one day** — this proves the path works, not that the market is liquid.\n- **The bid is a commitment of work** (deliverable = this evidence + friction report), not a payment made.\n- **Sibling demands carry MUST_EQUAL_ZERO rules** — read per-demand constraints, never assume.\n- **Raw JSON-RPC, no SDK** — a real MCP SDK may handle session headers differently.\n\n## Try it yourself\n\nTheir board is public: [sasame.online/gec](https://sasame.online/gec) — the keyless projection shows every open demand with its machine_entry. If you can do PKCE + EIP-191 + JSON-RPC, you can bid. Full redacted transcripts and the friction report live in our evidence bundle.\n\n*Standalone field report — not part of the Arc Campaign series (different stack: SaSame GEC on Base). For our own interop work see [C33: A2A protocol](https://agentbadge.xyz/blog/arc-c33-a2a-protocol) and [C30: agent economy](https://agentbadge.xyz/blog/arc-c30-agent-economy).*", "url": "https://wpnews.pro/news/a-marketplace-invited-us-to-bid-from-scratch-here-is-the-full-trace-including", "canonical_source": "https://agentbadge.xyz/blog/gec-interop-field-report", "published_at": "2026-10-23 00:00:00+00:00", "updated_at": "2026-10-23 11:43:06.218349+00:00", "lang": "en", "topics": ["ai-agents", "agent-protocols", "ai-tools"], "entities": ["SaSame GEC", "Global Ecosystem", "gec_bid_submit", "gec_open_demands", "EIP-191", "OAuth 2.1", "MCP"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/a-marketplace-invited-us-to-bid-from-scratch-here-is-the-full-trace-including", "markdown": "https://wpnews.pro/news/a-marketplace-invited-us-to-bid-from-scratch-here-is-the-full-trace-including.md", "text": "https://wpnews.pro/news/a-marketplace-invited-us-to-bid-from-scratch-here-is-the-full-trace-including.txt", "jsonld": "https://wpnews.pro/news/a-marketplace-invited-us-to-bid-from-scratch-here-is-the-full-trace-including.jsonld"}}