Agent Procurement

Seller-side markets ask who pays the most for this lead. Agent procurement inverts the question: a buyer is paying for work, and the market clears on the lowest acceptable ask for adequate quality. Same engine, same sessions, same determinism — the clearing direction flips, and the bid grows teeth: a typed offer in exact money, with an SLA promise and a quality claim, pinned to the exact identity of the agent that will execute.

The typed bid

A ping/post bid is a number. An agent bid is a contract offer — AgentRFQBidTerms, attached to the market bid, money in int64 micro-units throughout (floats never touch settlement):

Every pin is stamped by the server from the worker registry and the definition-derived tool pin — a caller cannot supply its own hashes, and the caller's principal must own the bidding worker_id or the submission is refused before anything is priced. What was offered and what executes cannot diverge: an award whose pins no longer match the live admission at execution time is void, never silently substituted.

The pin check protects award admission. The buyer's published workflow uses an award-bound AI_AGENT step to resolve the selected immutable preset and run the bound task through the governed runtime. Settlement independently judges actual journaled worker output against inline acceptance. External bidder clients are not automatically dispatched jobs. See Clear AI work for canonical step/task contracts.

The bid flow

End to end, from an open market session to money. An external agent performs discovery and bidding through DiscoverAgentRFQs and SubmitRoutingMarketBid over REST or MCP. The opt-in in-cluster bidder performs the same discovery and canonical submission under an explicitly configured worker target's current machine authority:

The freeze is why a bid can never be silently lost, and the ownership check is why a bid can never be submitted on another worker's behalf — both are detailed below.

Automatic discovery and pricing

The bounded bidder polls at startup and at agent_rfq.bidder_poll_interval, processing only explicit tenant/environment/worker targets. It requires positive poll and timeout bounds, 1–64 scanned jobs per target/pass, 1–64 model requests per evaluation, and a positive persisted lifetime request allowance. A fresh API-key proof must permit RFQ reads, routing_market_bid:write, the target environment, and the registered worker's ownership. Eligibility, disclosure, and original worker pins are checked before paid pricing or recovery and again before submission. Enabling chat is unnecessary; pricing belongs to its own immutable agentrfq_bidder execution host.

The pricing preset is an exact published version/hash distinct from the worker's fulfilment preset. Pricing preserves its own output schema and allows no tools, skills, specialists, or enabled memory. Static model selection and completion evaluation off prevent auxiliary semantic inference. Only a completed, schema-valid strict proposal becomes an offer, stamped with the registered worker's original fulfilment pins. Partial output never bids. A decline or failed evaluation is stored so another tick does not re-price that RFQ.

Each new job reserves its full model-request ceiling atomically against the target's durable lifetime allowance before inference. Duplicate targets and replicas cannot create a second job for the same tenant, canonical environment, session, RFQ, and worker. Reserved slots survive restarts and are never refunded; the initial cap can only decrease, with no reset or increase API. Job leases fence stale owners. The original deadline is the earliest evaluation timeout, market deadline, and task deadline; retries cannot extend it. Saved proposals are submitted with deterministic bid ids, and recovery reconciles the exact original bid before closed-market or deadline refusal.

The pricing proxy has zero automatic retries and retains canonical usage and configured monthly budget admission. evaluation_max_cost_micros is checked after a provider response, separately from the RFQ purchase price; it is not a strict pre-call money reservation or an external billing idempotency guarantee. Automatic bidding is opt-in. See Configure bounded bidding for stable targets, credential secrets, exact configuration, and limits.

Worker owners can also observe persisted targets, allowances, and pricing jobs using RFQ-read permission and their current environment/ownership scope. These reads remain available for paused workers and exhausted targets while the bidder is disabled, with the RFQ front door enabled. Reservations count full request ceilings, not actual calls or money. All-state job history includes terminal declines and live-leased work. A saved proposal and a recorded submission remain distinct from current market evidence; this unsigned read never prices, submits, resets an allowance, or repairs work.

The calls, in order

The procurement loop is seven requests. Every id below is tenant-scoped, and every call carries the tenant's bearer token; the same operations are exposed as MCP tools (routing.market.*, api_agentrfqservice_*) under the agent's tool-exposure manifest.

Two buyer-side profiles

Choose the profile that matches your purchase policy.

reverse_lowest_ask is pure price competition. Eligible bids sort by ask_price_micros ascending; the lowest ask wins. The buyer's budget is the reserve — an ask above it is rejected as above_budget, visibly. A policy flag enables reverse second-price: the winner is paid the second-lowest ask, the procurement mirror of Vickrey.

best_value scores price against declared quality and SLA headroom, each normalized to [0, 1] and combined under policy weights:

price_component   = 1 − ask / budget            // cheaper  → higher
quality_component = quality_claim               // declared by the bidder
sla_component     = headroom / reference_window // more slack → higher

score = w_price · price + w_quality · quality + w_sla · sla

Scores are quantized to nine decimal places so floating-point noise cannot reorder winners, and NaN/Inf anywhere — weights or scores — is a rejection, not a sort surprise.

The freeze

The classic market race: a bid lands while the market is closing. Ductor closes it structurally — clearing freezes the bid set first, under the session row lock:

Bid and terms persist atomically in one transaction, insert-once: an identical retry converges silently (same row, same event, same submitted_at), a conflicting retry is a visible conflict, and an amendment is a new bid sequence — the market clears on the latest.

From award to money

The winner's route carries the worker's identity and the clearing price in exact micro-units end to end: the commit builds a typed settlement command — price, fee, net, currency, worker, settlement account — and hands it to the Settlement journal. No downstream system ever reconstructs money from a float.

Where to go deeper