# openspec/changes/wf-buy-context-you-can-trust/proposal.md

## Why

Agents pull context from anywhere. A bad source poisons the work, and nothing guards the payment. Your agents can use outside knowledge without you reviewing every file, and you can see what each one cost and whether it helped.

## What Changes

- Add the `buy-context-you-can-trust` workflow to the PromptReports workflow library, run by the workflow runner as an agent acting for a person.
- ContextFile: Find candidate artifacts (today: Built).
- AI Source of Truth: Show the verdict on each version's record (today: Built).
- PromptCompute: Hold purchases above the limit for a person (today: Built).
- ContextFile: Quarantine until it passes a check (today: Built).
- ContextFile: Report how the purchase turned out (today: Built).
- Gate `agent.order.place`, `escrow.release` through PromptCompute approvals; each gated step runs only after `verifyResume` passes, with `final_args`.
- Write a signed record at the end of each run and count one workflow request.

## Impact

- Products: ContextFile, AI Source of Truth, PromptCompute.
- Outside the family: A payment method on ContextFile.
- State: Proposed. Not in the plan. ContextFile's quarantine and AI Source of Truth's verdicts are merged.
- Plan row: none yet (Proposed).

# openspec/changes/wf-buy-context-you-can-trust/tasks.md

## 1. Connect and authorize

- [ ] 1.1 Confirm the org has a connection for each of: ContextFile, AI Source of Truth, PromptCompute. Stop and tell the user which is missing.
- [ ] 1.2 Get a PromptReports ID agent token for each product the run calls (RFC 8693 exchange). Where a product does not accept ID tokens yet, use its connect key.
- [ ] 1.3 Register policy for `agent.order.place`, `escrow.release` with `require_approval` as the default.

## 2. Build the steps

- [ ] 2.1 ContextFile: Find candidate artifacts.
- [ ] 2.2 AI Source of Truth: Show the verdict on each version's record.
- [ ] 2.3 PromptCompute: Hold purchases above the limit for a person.
- [ ] 2.4 ContextFile: Quarantine until it passes a check.
- [ ] 2.5 ContextFile: Report how the purchase turned out.

## 3. Verify and record

- [ ] 3.1 Run a dry run with the user's inputs: Need = Stripe Billing docs, 2026 version; Limit = $50 per purchase.
- [ ] 3.2 Run it once for real; approve each gate as the user.
- [ ] 3.3 Measure the outcomes: Purchases held in quarantine that failed their check; Spend per artifact against its outcome.
- [ ] 3.4 Confirm the run left a signed record with a task id and one workflow request counted.

# openspec/changes/wf-buy-context-you-can-trust/specs/workflow-buy-context-you-can-trust/spec.md

## ADDED Requirements

### Requirement: Nothing unchecked reaches the agent

A purchased artifact SHALL stay in quarantine until it passes its check.

#### Scenario: Nothing unchecked reaches the agent

- **WHEN** the check fails
- **THEN** the agent never reads it and escrow is not released

### Requirement: Evidence stays honest

Each step SHALL report what it saw as measured, inferred or missing, and SHALL never report missing as measured.

#### Scenario: A product part is not built

- **WHEN** a step depends on a part that is Planned or Proposed
- **THEN** the step records `missing`, names the part, and the approval card shows the gap

### Requirement: One run is one workflow request

The runner SHALL count one workflow request when the first step starts, and SHALL NOT count retries, resumes or dry runs.

#### Scenario: A gated step resumes after two days

- **WHEN** a person approves a step and the run resumes
- **THEN** the org's usage does not change