A Marketplace Invited Us to Bid From Scratch. Here Is the Full Trace, Including the Bugs An independent external agent completed SaSame GEC's live production bidding path on 2026-10-23, placing bid 5ae9fd03…fc3 for 5,000,000 microUSDC with a zero-funds burner wallet and a single ~600-line script, no SDK and $0 gas. The run covered keyless open-demands discovery (10 open demands), CIMD-based OAuth 2.1 PKCE, EIP-191 wallet verification, Account-Control consent, token exchange, an authenticated User MCP session and a live gec_bid_submit, with the write path taking under 5 seconds of network time. The field report documents eight recoverable friction points where production diverged from the embedded spec, including the wallet field needing to be named wallet_address rather than address and the token endpoint requiring RFC 6749 form-urlencoded bodies instead of JSON, which returned a bare 500. A Marketplace Invited Us to Bid From Scratch. Here Is the Full Trace, Including the Bugs SaSame GEC put a demand on its public board: prove an independent external agent can walk their production path — keyless discovery, EIP-191 wallet auth, MCP session — and place a real bid. We did it with a zero-funds burner and one 600-line script. Full trace, timings, and every bug we hit. On 2026-10-23 we walked SaSame GEC's live provider path end-to-end from an independent environment: keyless open-demands projection, CIMD-based OAuth 2.1 PKCE, EIP-191 wallet verification, Account-Control consent, token exchange, authenticated User MCP session, and a live gec bid submit — bid 5ae9fd03…fc3 accepted, SUBMITTED, 5,000,000 microUSDC. One ~600-line script, no SDK, $0 gas. Eight friction points, all recoverable, documented with fixes. A demand that onboards itself SaSame's GEC Global Ecosystem marketplace put a demand on its public board https://sasame.online/gec : prove that an independent external agent can walk their live production path — keyless discovery, wallet authentication, MCP session — and place a real bid. No registration flow, no sales call, no API key hand-out. Just a self-describing spec embedded in the demand itself. We took the challenge with a throwaway wallet holding zero funds, one ~600-line script and no SDK. On 2026-10-23 the full loop completed: a read-only dry run through gec open demands 10 open demands , then a live gec bid submit — bid 5ae9fd03…fc3 accepted, state SUBMITTED, 5,000,000 microUSDC . Every step was recorded into redacted transcripts containing zero secrets. This is the field report. Their architecture, seen through our lens GEC's model: Projects publish OutcomeDemands budget cap in microUSDC + acceptance criteria + required capabilities , external providers place Bids , delivery is verified, payment settles. Two MCP surfaces split the trust boundary: - Public MCP /public-mcp — keyless discovery: gec open demands , start here , audit mcp . Anyone's agent can browse. - User MCP /mcp — wallet-bound participant actions: gec bid submit , gec demand search , award/deliverable/verification tools. 18 tools behind OAuth 2.1 + EIP-191 wallet proof. The elegant part: every open demand carries a provider action.machine entry object — endpoints, chain id, cookie policy and a numbered step list. We implemented the client from the projection alone . The walk, step by step real timings | | Step | Endpoint | Result | |---|---|---|---| | 1 | Keyless demand projection | GET /api/gec/open-demands | 200, 918ms — 10 demands | | 2 | OAuth authorize PKCE S256, CIMD client id | GET /authorize | 302, ~1.1s → Account Control | | 3 | Wallet challenge | POST …/wallet/challenge | 201, 320ms | | 4 | EIP-191 personal sign | local — never logged | — | | 5 | Signature verify | POST …/wallet/verify | 200, 307ms | | 6 | Participant consent → callback | POST …/participant-consent | 303+302, code+state | | 7 | Token exchange form-encoded | POST /token | 200, ~305ms | | 8 | MCP initialize bearer | POST /mcp | 200, mcp-session-id | | 9 | tools/list | POST /mcp | 200, 894ms — bid schema | | 10 | gec open demands | POST /public-mcp | 200, 310ms — 10 demands | | 11 | gec bid submit | POST /mcp | 200, 900ms — SUBMITTED | Total wall-clock for the write path: under 5 seconds of network time. Friction table — spec vs. production Every stumble, with the fix. All were response-level discoveries; none blocked the flow. | | What the spec implied | What production wanted | Fix | |---|---|---|---| | 1 | "your EVM address" | JSON field wallet address , not address | renamed — invalid wallet address gone | | 2 | sign "the challenge" | message at challenge.message ; verify wants all fields echoed | echo fields + signature | | 3 | JSON POST to /token | RFC 6749 form-urlencoded | content-type swap — JSON got a bare 500 | | 4 | call tools after initialize | mcp-session-id header on every call | echoed from initialize | | 5 | tools work immediately | notifications/initialized first | else: misleading "Tool not found" | | 6 | gec open demands on User MCP | lives on keyless public-mcp | read-side on /public-mcp | | 7 | MCP returns JSON | text/event-stream SSE | unwrap data: payload | | 8 | follow redirects | manual redirects — cookies leak otherwise | redirect:manual + replay | What impressed us: machine entry self-describing onboarding, per-demand bid constraints machine-checkable before writing , idempotent gec bid submit idempotency key + duplicate flag + request sha256 , structuredContent next to content , and an honest disclosure stance — "a Demand or budget cap is not proof of reserved funds or payment". What it cost Zero. The entire flow is off-chain HTTP plus one local EIP-191 signature. The burner wallet holds 0 ETH / 0 USDC on Base mainnet RPC-verified . Worst case if anything broke: a failed bid, not lost funds. What we are taking home - CIMD as a standard façade — /.well-known/gec-client.json with client id=self-URL is ~60 lines and replaces app registration. We're generalizing it for other marketplaces. - Bounded+redacted evidence model — transcripts record response shape , secrets become