Opens in a new tabSkip to content
Agent LighthouseAgent Lighthouse

    Searches the text of every published page. The evidence sources themselves are not in this index — search all of them on the trusted sources page.

    GitHub ↗
    Browse checks and page contents
    agentic-commerce/acp-policy-link-surface

    ACP link-surface completeness

    What it checks

    Verifies the merchant can populate the links array that every ACP CheckoutSession response is required to carry, by resolving each of the 8 enum link types to a stable, HTTPS, no-JS-required, non-soft-404 URL on the merchant’s own site.

    Why it matters

    Falsifiable claim: ACP spec 2026-04-17 makes links one of the 9 REQUIRED fields on every CheckoutSession response, with type enum {terms_of_use, privacy_policy, return_policy, shipping_policy, contact_us, about_us, faq, support}. Independently, the OpenAI product feed spec makes seller_privacy_policy and seller_tos HARD-REQUIRED whenever is_eligible_checkout=true. Therefore a merchant that cannot produce a resolvable HTTPS URL for terms_of_use and privacy_policy cannot set is_eligible_checkout=true and its catalogue is excluded from Instant Checkout no matter how good the feed is. Disproof condition: if a merchant with no reachable ToS URL is observed transacting via ACP Instant Checkout, the check is wrong.

    Evidence

    • openapi.agentic_checkout.yaml (spec version 2026-04-17) — Agentic Commerce Protocol (spec, URL verified 2026-08-20)
    • CheckoutSession carries nine REQUIRED fields and three enums.
    • Required fields: id, status, currency, line_items, totals, fulfillment_options, messages, links, capabilities.
    • links[].type, expanded to 8 values: terms_of_use, privacy_policy, return_policy, shipping_policy, contact_us, about_us, faq, support.
    • status, 11 values: incomplete, not_ready_for_payment, requires_escalation, authentication_required, ready_for_payment, pending_approval, complete_in_progress, completed, canceled, in_progress, expired.
    • totals[].type, 12 values: items_base_amount, items_discount, subtotal, discount, fulfillment, tax, fee, gift_wrap, tip, store_credit, total, amount_refunded. Message error codes extended with low_stock, quantity_exceeded, coupon_invalid, coupon_expired, minimum_not_met, maximum_exceeded, region_restricted, age_verification_required, approval_required, unsupported, not_found, conflict, rate_limited, expired, intervention_required. API-Version is YYYY-MM-DD, required on all requests. Response headers Idempotency-Key and Request-Id are required echoes.
    • OpenAI Product Feed Specification — OpenAI (vendor-doc, URL verified 2026-08-20)
    • Required feed fields: item_id (<=100 chars), title (<=150), description (<=5000), brand (<=70), url, image_url, price (number + ISO 4217), availability enum {in_stock,out_of_stock,pre_order,backorder,unknown}, is_eligible_search, is_eligible_checkout, target_countries. CONDITIONAL hard requirements: availability_date required if availability is pre_order/backorder; seller_privacy_policy and seller_tos required if is_eligible_checkout=true; gtin or mpn required unless identifier_exists=no. Recommended: group_id, listing_has_variations, variant_dict, size, size_system, color, item_group_title, review_count, star_rating, q_and_a, reviews, age_restriction. Optional fulfillment field shipping uses format country:region:service_class:price:handling_days:transit_days. Returns fields: accepts_returns, return_deadline_in_days (positive int), accepts_exchanges, return_policy (URL, HTTPS preferred). sale_price must be less than price. Formats: .txt/.tsv/.csv (+.gz), UTF-8, lowercase underscore header row. Parser auto-selects between OpenAI schema and a Google-compatible profile.
    • Agentic Checkout Specification — OpenAI / Stripe (Agentic Commerce Protocol) (spec, URL verified 2026-08-20)
    • Five merchant-hosted HTTPS+JSON endpoints: POST /checkout_sessions (201), POST /checkout_sessions/{checkout_session_id}, POST /checkout_sessions/{id}/complete, POST /checkout_sessions/{id}/cancel (405 if not cancelable), GET /checkout_sessions/{id} (404 if absent). Request headers: Authorization, Accept-Language, User-Agent, Idempotency-Key, Request-Id, Content-Type, Signature, Timestamp (RFC 3339), API-Version. Response MUST echo Idempotency-Key and Request-Id. Session object carries id, status, currency (lowercase ISO 4217), line_items, fulfillment_options, totals, messages, links, payment_provider. Error envelope: {type, code, message, param(JSONPath)}. Message error codes include missing, invalid, out_of_stock, payment_declined, requires_sign_in, requires_3ds. Link types include terms_of_use, privacy_policy, seller_shop_policies.
    • ACP Getting Started: Sellers — Agentic Commerce Protocol (spec, URL verified 2026-08-20)
    • Seller obligations: implement the five HTTPS/JSON checkout endpoints; calculate all amounts (item prices, discounts, taxes, shipping); manage inventory and availability; process payments through their PSP; fulfil orders. Sellers must declare capabilities in every checkout response, including payment handlers (handler id, name, version, PSP reference, configuration) and optional extensions. Sellers must validate payment handler IDs against declared capabilities and manage state transitions to ready_for_payment.

    How it scores

    Tier per evidence policy: scored — grade A meets the A/B bar required for scored audits.

    Example failure

    A Shopify store renders its refund policy at /policies/refund-policy but the PDP only links it from a JS-hydrated footer drawer, so raw HTML contains no href to it; return_policy resolves to nothing and the merchant’s CheckoutSession links array ships incomplete. Worse case: /terms 301-redirects cross-domain to a Zendesk help centre that returns 403 to non-browser clients — terms_of_use fails the hard gate and is_eligible_checkout cannot be set.

    Sources