# Code-to-Cart: 90-second demo

## Script

| Time | Show | Say |
| --- | --- | --- |
| 0–15s | Synthetic sauna selected after code/parcel fit | “The purchase starts with project evidence, not a shopping prompt.” |
| 15–30s | Buy list and ACP discovery | “GovCodex negotiates the pinned ACP version with a seller-scoped sandbox.” |
| 30–45s | Fulfillment and authoritative total | “The seller—not the estimate—owns freight, tax, availability and total.” |
| 45–60s | Stale-checkout guard | “The runner calls the real completion guard with a deliberately changed current hash and proves it refuses. This is programmatic enforcement; no human approval occurs in this demo.” |
| 60–75s | Synthetic completion and delivered order | “No money moves. The resulting order still exercises the real lifecycle mapping into budget and tasks.” |
| 75–90s | 240V dependency and electrician experiment | “Stable ACP cannot express this service booking, so the appointment is visibly experimental rather than silently faked.” |

## Run without production data

The public page is static. The optional POST runner requires all of:

```text
ACP_SHOWCASE_DEMO_ENABLED=1
ACP_ENABLED=1
ACP_CHECKOUT_ENABLED=1
ACP_SANDBOX_ENABLED=1
ACP_PAYMENT_MODE=test
ACP_LIVE_PURCHASE=0
```

Then open `/acp` and choose **Run synthetic demo**. The request accepts no body
and constructs a fresh in-memory store. It constructs or consults no Supabase
client, performs no network fetch, emits no webhook and discards the world after
returning the sanitized trace.

The runner exercises the production completion function's current-checkout-hash
guard with a deliberately stale value. That proves the programmatic refusal,
not a person clicking an approval control. Human review and approval are covered
separately by the production `AcpCheckoutReview` component and checkout-flow
tests before any non-synthetic completion can proceed.

The route rejects request bodies and clearly cross-site browser requests before
its abuse limiter. The limiter retains at most 1,024 raw client IPs for a
60-second fixed window in the current Node process only. It is non-distributed,
resets on cold start, performs no hashing, database writes or network calls, and
is a best-effort guardrail for a zero-cost synthetic endpoint rather than a
spend quota. It trusts Vercel's overwritten `X-Vercel-Forwarded-For` only when
the runtime also declares `VERCEL=1`; generic forwarding and CDN headers are
ignored. If no trusted IP is present, the request is not recorded instead of
joining a shared `no_ip` bucket.

For repeatable desktop and 390px browser QA:

```bash
npm run test:e2e:acp
```

The dedicated Playwright configuration starts a local server with dummy public
auth values and test-only ACP flags. It blocks unexpected external requests and
does not require a user, project UUID, service-role credential or production DB.