Establish the working surface
- Native embedding: application-owned accessors against SQLite or the configured backend.
- Governed commands: operator-owned identity/policy with typed payload and durable receipt.
- MCP: the actual discovered profile and its strict/read-only filters.
- Rust HTTP: the deployed
/api/v1DTO, auth, tenant and retry-receipt contract. - Messaging gateway: channel/session endpoints, not an alias for commerce REST or MCP HTTP.
- Sync/protocol/payment services: separate identity, credentials, state and settlement evidence.
Operate with retained evidence
- Identify the intended store, principal, tenant, business record and actual installed features.
- Read current state; keep IDs and uncertainty. Do not interpret missing observations as success.
- Test the hypothesis through preview or native simulation.
- Load authority outside model arguments. Check required capabilities, approvals, versions, scope, budget and deadline through governed execution.
- Persist original key and exact request before dispatch. Read receipt status and retry rules.
- Verify resulting native records and external outcomes separately; retain original receipts.
Important boundaries
Keep exact decimal strings, installed-version method signatures and original identity.
Use bindings,
recovery, and
Sandbox execution as needed.