# ACP implementation findings

## Interoperability

1. **A transport adapter is enough.** ACP products can enter an existing
   canonical funnel and ACP checkout can leave it without contaminating ranking
   or duplicating commerce entities.
2. **Discovery is a security boundary.** Version negotiation is inseparable
   from DNS, redirects, private-network refusal, response caps and a seller
   allowlist.
3. **Checkout truth arrives late.** Product-card prices are estimates. The
   seller’s checkout response is authoritative for availability, fulfillment,
   tax and total.
4. **Idempotency must be durable before egress.** A retry key is scoped to the
   seller, operation and logical request. The body hash prevents a changed
   request from reusing an old key.
5. **REST/MCP parity is a domain property.** Both bindings dispatch the same
   operation model and deterministic seller engine; parity is tested from
   recorded request through parsed result.
6. **Order events belong in the project ledger.** Signed, replay-safe seller
   events map to closed event vocabularies and deterministic budget/task
   changes rather than raw seller blobs or model-authored state.

## Security and privacy

- Every ACP surface is default-off. Disabled inbound and sandbox routes return
  404 so they do not advertise an inactive capability.
- Seller discovery rejects non-HTTPS, credentials in URLs, redirects to unsafe
  hosts, loopback, link-local and private address space.
- Checkout approval is SHA-256-bound to the seller, session, currency, line
  quantities and seller totals. A changed total requires a new approval.
- GovCodex never logs or returns seller credentials, payment instruments,
  delivery addresses or buyer details. UI projections contain presence flags,
  not sensitive values.
- Webhook signatures are seller-specific and receipts are replay-protected.
- The showcase accepts no project, product, address, credential or payment
  input. It uses a fixed `.test` seller, fake handler and fresh memory store.
- GovCodex does not hold card data, mint a Shared Payment Token or act as
  merchant of record.

## Known limits

- This is a tested subset of ACP `2026-04-17`, not certification.
- Live payment is deliberately unsupported and refused by configuration.
- The appointment proof is experimental and its in-memory slot contention is
  process-local, not a distributed booking lock.
- Cross-seller checkout remains multiple seller sessions; no synthetic merged
  settlement object is invented.