Your agent buys the car. Your user reads the receipt.

An agent that can't show its work is the desk reborn inside your user's own tool — opacity ported to the instrument that was supposed to kill it. When the deal is disputed, the principal audits; "trust the agent" is the answer that ends the account.

verified listings only

The agent shops the 2.1M+ corpus — every Listing posted with venue, source, timestamp. Nothing off-record enters the deal.

the ceiling is enforced, not remembered

Every gate returns a typed OFFER carrying posted price and the hard Mandate ceiling; the agent settles by x402 under it or hands the human a signed Handoff URL. Overspend is a settle failure, not an apology.

the receipt is the record

Every act replays as evidence statements — value · source · timestamp · verification — with the settled price and a dispute/refund URL. The report the agent fetched is, byte for byte, the page the human reads.

one page, both readers

You've sat across the desk not knowing what the other side knows. Every fact here is posted — value, source, timestamp — and the dealer sees this exact page. Your user has sat there too — and the page their agent reads is the page they read. The agent reads the same record you do. One estate MCP at apis.vin/mcp whose tool results carry the door URL so the human twin travels with the machine result. The check digit certifies; it never sells.

posted

This page sells nothing and meters nothing — it is the wiring diagram. The rails are metered at apis.vin, every unit price posted on the page; deal flow lands at buy.vin and offers.vin. This door's own ledger entry: one x402 payment, settled and posted, like every live door in the family.

questions with posted answers

What stops the agent from overspending? The Mandate ceiling rides inside the typed OFFER and the x402 settle; above the ceiling the settlement fails. The limit is a wire format, not a prompt.

What does my user see afterward? The receipt: every fact the agent consulted (value · source · timestamp · verification), every action taken, the price settled under their ceiling, and a dispute/refund URL. Byte-identical to what the agent fetched.

What happens when a step needs the human? A typed NEEDS_HUMAN Handoff: url, signed expiring shortUrl, pollUrl, expiresAt. The human authorizes, the agent resumes. Never a dead end, a form, or "contact sales."

who this door serves

who: The consumer-agent builder: assistant platforms, fintech and concierge apps, agent startups — anyone who must delegate a car moment to an agent acting for a consumer without dispossessing their user.
arriving: The consumer-agent builder — assistant platforms, fintech and concierge apps, agent startups — who must delegate a car moment without dispossessing their user.
against: The desk — here in its delegation franchise: delegation that can't show its work. The desk reborn inside the user's own agent: opacity ported to the tool that was supposed to kill it.
the guide: You've sat across the desk not knowing what the other side knows. Every fact here is posted — value, source, timestamp — and the dealer sees this exact page. Your user has sat there too — and the page their agent reads is the page they read. 2.1M+ verified Listings, each posted with venue, source, timestamp; every gate a typed OFFER carrying posted price and a hard Mandate ceiling, settled by x402 or handed off via NEEDS_HUMAN; every field an evidence object, byte-identical across representations. The check digit certifies; it never sells.
the stakes: Ship delegation that dispossesses: an agent shopping unverified surfaces on a limit it merely remembers, returning logs nobody can read. The first disputed deal is the last — "trust the agent" is the answer that ends the account, and the builder becomes the desk.
done: An agent whose work is auditable by construction: verified Listings only, the ceiling enforced in the wire format, a receipt the principal reads line by line — delegation without dispossession. The human stays the hero; the agent stays the instrument. From mark to principal — the principal whose agent reads the record.

the plan

The Receipt Plan — read, act, return.

read — the agent reads the record: verified Listings, posted values, open recalls, each field value · source · timestamp · verification. The same record the principal can read — that is the point.
act — the agent acts under the ceiling: every gate a typed OFFER with the Mandate ceiling in the shape; x402 settle beneath it, NEEDS_HUMAN Handoff at the moments a human decision is legally or financially load-bearing.
return — the agent returns the receipt: evidence consulted, actions taken, price settled under the ceiling, dispute/refund URL. Done is a receipt the principal reads, not a log they take on faith.

You're 3 steps from done.

apis.vin/keys — issue your agent's key b2a2c.vin/{VIN} — the receipt, rendered live for any VIN: free, keyless, no account

for the agent you send

The agent reads the same record you do. Same two routes, three representations — the numbers never differ between them.

motions: B2A2C

B2A2C — an agent acting for a consumer — everything it does survives being shown to them afterward

curl https://b2a2c.vin/ -H 'accept: text/markdown'        → the markdown twin of this page
curl https://b2a2c.vin/{VIN} -H 'accept: application/json' → the record as typed evidence objects
curl https://b2a2c.vin/{VIN} -H 'accept: text/markdown'    → the record's markdown twin

Machine surfaces on this host: /llms.txt · /icp.json · /.well-known/agents.json · one estate MCP server — apis.vin/mcp (every door a lens; tool results carry the door URL).

Attribution: X-Client-Type: html | md | json | mcp — read for agent-led demand attribution; it never changes the record.

No gate on this door's two routes — keyless reads, no account. Gated actions elsewhere on the estate return a typed OFFER (posted price · hard ceiling) or a NEEDS_HUMAN handoff, never a dead end.

every door opens on the same record

where the motion transacts

buy.vinThe checklist this motion runs in production — B2A2C + B2H2A on any VIN
offers.vinOffer, payoff, net-to-you posted before the principal accepts
vhr.vinThe per-report OFFER an agent settles under ceiling

the transactor

apis.vinThe record as a response — every call priced on the page

every door

all.vinEvery door, one record: all.vin/any VIN