Signatures that do not verify
Request signing under RFC 9421 implemented against the wrong covered components, and order webhooks delivered unsigned and without retry.
Practice
Payments and protocol
Agentic checkout fails on protocol, not on prose. We find those defects in the reference implementations, send the fix upstream, and keep a public checker that catches each one on the way back.
The failures that matter
None of these are model problems. Every one of them has shipped in a reference implementation.
Idempotency that breaks under retry
Keys scoped too widely, and a lost race answered with a 500 instead of the result the winner already committed.
Errors a client cannot act on
Validation failures answered with a framework default shape instead of the error envelope the specification requires.
Constraints that only appear to bind
Code generation silently dropping value constraints, conditional rules and dependent requirements, so a schema check passes what the specification forbids.
Server truth taken from the client
Currency, totals, identifiers and omit marked members copied from the request into the response.
Conformance mistaken for reliability
Roughly 99% of stores pass conformance while real agent checkouts still fail. The agent lane grades behaviour, not shape.
The instrument
spck.dev/check points at any Universal Commerce Protocol server and returns a capability scoped report, in the browser with no install, or from PyPI in your CI.
- 250 kill-rate-validated merchant checks
- 44 agent checks covering 45 modelled defects
- OAuth mix-up and PKCE, request signing, refusing mismatched totals, phishing defence, revoke on unlink
Independent and unofficial. It reports only the checks it runs and never claims certified.
The record behind it
65 pull requests merged across the specification, both official SDKs, the reference samples and the official conformance suite, plus 53 defect reports filed.
Every check in the suite exists because the defect it catches was found, reported and fixed upstream first.