Plan
Freeze the product, preference, rule, and schedule versions used to construct the desired cart.
Workflow module
The state machine that makes the agent safe to resume.
Order Orchestration is the only module that coordinates preferences, products, rules, Intelligence, Browser Control, and the retailer. Every consequential transition is persisted before the next effect.
14explicit states
1snapshot hash
1cart ownership ledger
0blind retries
State machine
One durable order cycle
Responsibilities
The sole coordinator of side effects
Reconcile
Compare desired items with the live cart, classify ownership, and apply only verified differences.
Review
Select an allowed slot, re-read the checkout summary, evaluate rules, and freeze a user-visible snapshot.
Resume
Persist every state transition and wait state so a worker restart or user delay does not lose context.
Guard
Validate approval, snapshot, amount, slot, address, mode, consent, and recent authentication before any future checkout.
Verify
Declare confirmation only when retailer evidence contains the expected account, order reference, and delivery details.
Review snapshot
Approval is bound to exact facts
ReviewSnapshot {
items[]
substitutions[]
quantities[]
itemPrices[]
fees
discounts
authorizationTotal
deliveryAddressFingerprint
deliverySlotRef
ruleSetVersion
preferenceVersion
cartFingerprint
retailerSessionFingerprint
createdAt
expiresAt
}Invalidation rules
Canonicalize and hash the snapshot. Any material product, quantity, substitution, price, fee, total, address, slot, policy version, or retailer account change creates a new snapshot and invalidates prior approval.
- Approval includes an approved maximum
- Approval has a short expiration
- Approval actor and authentication are recorded
- Snapshot hash must match at checkout time
Cart ownership
Never assume the cart is empty
| Classification | Meaning | Behavior |
|---|---|---|
| Agent-owned | Added by this order cycle and ledger entry matches | May reconcile quantity within current plan |
| Pre-existing | Present before the run | Preserve and show separately unless user chooses otherwise |
| Changed | User or retailer modified an agent-owned line | Do not overwrite silently; re-plan or review |
| Unknown | Ownership cannot be proven | Needs review before mutation |