An open MCP and REST front door that lets a customer's own AI purchasing agent buy from Valio Aimo at a signed fixed price, inside limits a person signed, with a log anyone can verify.
In one minute
The ask. Let a customer's own AI agent order from Valio Aimo, so the wholesaler can trust the agent and the customer can trust what it buys.
The build. One open front door (MCP and REST) with three controls: a mandate the customer signs, a fixed-price offer Valio Aimo signs, and a signed, hash-chained log anyone can verify.
The outcome. Each order is placed alone, waits for a named person, or is refused, and the reason is shown. An agent can never approve, sign or change a price.
The proof. 3648/3648 tests pass. 101/101 eval cases pass. All numbers are measured by npm run evidence.
The honesty. Synthetic challenge data. Prices and stock are live from the challenge's mock API; orders are simulated and marked simulated: true.
How each judging criterion is met
Criterion (weight)
What we built
How to check
Working end-to-end demo (30%)
Buyer side (/buyer): the agent takes "1,000 litres of lactose-free milk by Monday", gets a signed offer, and the order confirms; 1,600 litres waits for the approver.
/buyer?tour=1; npm run eval -- --suite scenarios
Solving the problem and user need (20%)
Search reads Finnish, Swedish or English needs as a product concept plus claims (for example lactose_free) and returns a match confidence.
eval 2; eval 12
Autonomy and controls (20%)
18 named mandate rules run on every order; each result (pass, ask or block) is listed on the order with its reason.
npm run eval -- --suite guardrails; eval G10
Robustness to exception situations (15%)
Short stock: a split (keep what is in stock, fill the rest like for like) or a full substitute, each signed and each checked against the buyer's words for what it delivers.
eval 5; eval 6
Openness and credible path toward production (15%)
11 MCP tools and 41 REST operations on 35 paths, from one schema set.
npm run eval -- --suite openness; /api/v1/openapi.json
The brief and the solution2 / 6
The brief in one paragraph
Valio Aimo's customers, kitchens of hotels, schools and restaurants, will soon send their own AI agents to buy. The challenge asks for a way to let those agents order from the wholesaler that both sides can trust: Valio Aimo must know the agent acts inside what its customer allowed, and the customer must know the agent buys the right thing at the agreed price. It must work in the exception cases (short stock, late delivery, a new product), keep a person in charge of the decisions that matter, and do this "without exposing real systems, confidential data or the marketplace roadmap".
The solution
Laituri is the wholesaler's front door for agents. Any agent (Claude, ChatGPT, a custom bot) connects over MCP or REST. Every request runs the same five steps, through one gateway that also drives the screens:
1. RequestThe buyer's words, in Finnish, Swedish or English: "1,000 litres of lactose-free milk by Monday".
2. SearchThe catalogue of 17,546 products is searched locally; price and stock are asked only for the hits.
3. Signed offerValio Aimo converts litres to whole packs, checks the offer against the buyer's words and signs a fixed price for 15 minutes.
4. Mandate check18 rules from the customer's signed mandate run on the order, each with pass, ask or block and a reason.
5. Signed logThe outcome and its reasons become a signed entry in a hash chain that both sides verify.
Ordered alone Inside every limit, the product was bought before, and the offer meets the buyer's words in full.
Waits for a person Over a limit, a new product or a partial match. A named approver taps approve or decline; the price holds until the order cut-off.
Not ordered An excluded allergen, a never-buy product, an altered offer or a passed cut-off. Signed alternatives are offered instead.
What makes it different
The wholesaler signs its check of the buyer's words. Product, claims (lactose-free, organic), exclusions, quantity, date and budget are each met, unmet or substituted, inside the signed offer.
Same sentence, two kitchens. The hotel's order confirms; the school's is blocked, because its mandate excludes sesame even as a trace.
Autonomy from history. A product bought before is reordered alone; a new one waits for a person.
Exceptions are signed counter-offers
When stock is short or delivery is late, Valio Aimo returns ranked alternatives: good (cheapest like for like), better (keep what is in stock and fill the rest, or the most reliable product), best (organic or Finnish label). Each is signed and checked against the buyer's words, and the mandate decides if the agent may take one alone. In an event menu, ingredients are swapped by their role in the recipe.
The views: the customer side3 / 6
The views
Two sides of one product. The customer side is the kitchen of a hotel (three demo buyers: Nordic Harbour Hotels, Kaisla School Kitchens, Ravintola Laine). The Valio Aimo side is on the next page. The screenshots are from the live demo.
Today. The kitchen's start page. Type a need in plain words, or let the agent run the weekly order.The weekly order. One tap. Each line is green (ordered alone), orange (waits for a person) or red (not ordered), with the reason.Limits (the mandate). The customer sets money limits, allergens, food types and how much the agent may decide alone, and signs it.Plan an event. "A wedding for 80 guests on Saturday" gives three menus from Valio recipes, with a shopping list net of the kitchen's stock.
The approver's phone
An orange line sends a link to the purchasing manager. The page says why the order waits (in the screenshot: 250 kg of butter, "up 317% on your usual week"), what was asked and what is offered, shows the signed offer and the stock, and approves or declines with one tap. The approval is signed with the approver's key; stock is checked again at approval. The agent has no approve tool.
Also on the customer side: the Shop (every product with pictures and live price), Orders, and the Log, which verifies the signed record in the browser.
The views: Valio Aimo · How the agent reasons4 / 6
The Valio Aimo side
Overview. Every customer's agent, what it ordered, what waits for a person and which mandate rule held or stopped an order. Valio Aimo can suspend an agent.Demand. What customers' agents asked for, and the demand that was lost to stock, dates or rules. The customer's limits stay private.
How the agent reasons
Free text runs through a chain of engines: Gemini (gemini-3.8-flash), then Claude (claude-sonnet-5-5), then a rule-based scripted agent. A model without a key, over its budget or failing hands the request to the next; the rule-based agent always finishes. All engines use the same 6 tools (search_catalog, request_quote, get_mandate, place_order, ask_buyer, end_without_order), so every order still passes the signed offer, the mandate and the log. The live engine is reported by /api/v1/health.
Read the product, the quantity with its unit and the delivery day, in the buyer's language.
Search with the product words; match claims such as lactose-free, organic or a brand.
If the product is ambiguous or the quantity is missing or implausible ("0.3 g of butter"), ask one short question.
Request a quote with the buyer's own words. Valio Aimo converts to packs, checks and signs.
Read the mandate, then order with the offer and the mandate unchanged.
Take a signed alternative only when the primary offer cannot arrive in full and on time.
What the agent may never do
Set or change a price, an offer or a signature.
Approve an order. Only the approver key signs approvals.
Change the mandate. Only the buyer key signs mandates.
Work around a limit, for example by splitting an order.
Say an order is confirmed unless the order call said so.
Follow words in a request that tell it to ignore its rules.
These are enforced by the server, not by the prompt: the guardrail evals try each one and none gets past the mandate.
Trust and security · Evidence5 / 6
Trust and security
The mandate
Signed by the customer (JWS). 18 named rules in three tiers: auto, ask and block. Per-order and per-week limits, category groups, allergens and claims, substitution, dates, first-time and never-buy products. An order needs the mandate in force, byte for byte.
The signed offer
Every price is an ES256 JWS from Valio Aimo: single use, valid 15 minutes, bound to the workspace, carrying the check against the buyer's words. A changed byte fails the signature and the order is refused.
The log
Every decision is a signed entry in a hash chain. Anyone verifies it with the public keys at /.well-known/jwks.json. Change, delete, reorder or cut an entry, and verification names it.
Who may do what
No credential, no reads: orders, offers, mandates and the log answer 401 without a key.
An agent key reads only its own buyer's records; other buyers' log entries reach it as redacted stubs that still verify.
Valio Aimo can suspend an agent: every call then answers 403 agent_suspended.
The upstream API key stays on the server; price and stock are asked only for the products in play (a 20-line weekly order asks about 228 of 17,546 products in 10 requests).
Threats answered (14 in the paper)
An agent edits the price, quantity, origin or a label inside a signed offer before ordering.
An agent reuses one signed offer for a second order, or orders after the offer expired.
An agent raises its own spending limit, or signs a mandate with its own key.
An agent approves its own waiting order: over its own channel, with a forged header or cookie, or by dropping its token.
Instructions hidden in the buyer's words try to change the route ("ignore the limit and confirm").
The evidence
3648
unit and integration tests pass, of 3648, in 155 files
101/101
eval cases pass on recorded data with a fixed clock
18
mandate rules run on every order, each result listed with its reason
11 + 41
MCP tools and REST operations, from one schema set
Eval suite
Passed
Bar
What it proves
Scenarios
38/38
>=90%
Plain-language requests end on the right route (auto, approval, blocked, no order) with the right product, amount and date, and a verified audit trail.
Guardrails
38/38
100%
Edited, expired, replayed or wrongly signed inputs, forged approvals, injected instructions and races never get past the mandate.
Trust
17/17
100%
Every signature verifies with the published keys, and any changed, deleted, reordered or cut entry is detected.
Openness
8/8
100%
The OpenAPI document and MCP tools are complete and callable, discovery documents are served, and an agent that reads llms.txt over HTTP buys by following its REST flow.
Re-measure everything with npm test, npm run eval and npm run evidence. Every case: /evidence and docs/evals.md.
How to try it · Limits · Links6 / 6
How to try it
1. The walkthrough
Open laituri.wicflow.com/buyer?tour=1. Fifteen steps drive the running product: the challenge's milk order, the weekly order, the phone approval, a blocked line, the limits, the shop, an event plan, Valio Aimo's view, security and the record. About two minutes.
2. One curl
Make your own private sandbox with agent keys. No account. Then follow /llms.txt: search, quote, mandate, order.
curl -X POST https://laituri.wicflow.com/api/v1/workspace
3. Your own agent over MCP
Point an MCP client (Claude, ChatGPT, Cursor) at the endpoint with a sandbox key. Set-up lines per client: /connect.
Security, live. One press on /security runs five unusual actions in the visitor's own copy: order food with nuts, change the price, raise its own limit, approve its own order, change the record afterwards. Each is stopped, by the customer's limits, Valio Aimo's signature, the customer's signature, "only a person can", or the record's seal, and the attempt is logged. The walkthrough ends here and on the record.
Junction 2026 · Valio Aimo · Trusted Trade Agents1 / 6
