BLOOMWIRE — an agent-ready storefront

A working demonstration of what a website looks like when software agents are first-class visitors. One Node process, one dependency (express), no build step, no database — and every agentic protocol on it is real and live:

Protocol	Where	What it does
WebMCP	navigator.modelContext (every page)	11 typed tools — search, cart, UCP checkout, auth handshake, skills — registered natively where the browser supports it, via a spec-shaped polyfill everywhere else
Universal Commerce Protocol	/.well-known/ucp, /checkout-sessions, /orders/:id	full commerce lifecycle over REST, matching the UCP samples flower-shop happy path (totals array, fulfillment methods/groups/options, tokenized payment, honest 402 decline path)
auth.md	/auth.md (+ /.well-known/auth.md)	the WorkOS-style agent-auth contract: agent requests a session, a human approves a short code at /auth, the agent polls for a scoped 1-hour bearer token
Agent Skills	/skills/index.json, /skills/<name>/SKILL.md	four installable skills in the agentskills.io SKILL.md format
SSR	every route	full HTML with zero client templates; the strip under the header shows the render timestamp of the exact response you received
Discovery	/robots.txt, /llms.txt, /sitemap.xml, JSON-LD	agents welcomed by name, then handed a complete map
Telemetry	/api/telemetry/stream (SSE)	every tool call, UCP hop, auth handshake, and skill fetch broadcast live to the Agent Telemetry dock in every open tab

The signature trick: the storefront's own checkout button is a UCP client of its own public API — press it and watch the five REST hops trace live on the page. And everything any agent does anywhere on the site (browser tools, curl, headless UCP calls) lights up the telemetry dock for every viewer.

Run it

cd agent-ready-demo
npm install
npm start            # → http://localhost:4180

PORT changes the port. PUBLIC_ORIGIN=https://your.host makes the discovery documents (llms.txt, robots.txt, UCP discovery, auth.md) emit absolute URLs for your deployment.

Try the agent surface in 60 seconds

O=http://localhost:4180
curl -s $O/llms.txt                 # the map
curl -s $O/.well-known/ucp          # UCP merchant profile
curl -s $O/auth.md                  # the auth contract

# buy a flower over pure REST (see skills/bloomwire-ucp-checkout/SKILL.md
# for the full five-hop script with fulfillment selection)
curl -s -X POST $O/checkout-sessions -H 'Content-Type: application/json' \
  -d '{"currency":"USD","line_items":[{"quantity":1,"item":{"id":"BW-PEO-02"}}]}'

# watch everything happen, live
curl -N $O/api/telemetry/stream

In a browser: press ▶ Run autonomous demo on the home page, or open the agent console (bottom-right dock) and run any tool by hand.

Architecture

server.js            express app: pages, storefront API, auth sessions, telemetry
lib/
  html.js            SSR layout — every page is a function returning HTML
  store.js           in-memory catalog, carts, orders
  ucp.js             UCP merchant endpoints (spec-shaped)
  checkout.js        the storefront's own UCP client (self-checkout with trace)
  sessions.js        auth.md agent sessions (code → approval → bearer token)
  skills.js          loads skills/*/SKILL.md at boot
  discovery.js       robots.txt / llms.txt / sitemap.xml
  bus.js             SSE telemetry hub (ring buffer + broadcast)
  art.js             deterministic generative SVG flower art
pages/               home, shop, product, skills, auth, protocols dossier
public/
  styles.css         the design system
  js/agent.js        WebMCP tools + agent console + HUD + telemetry client
  js/field.js        hero dot-field canvas
skills/              the published SKILL.md files

Design language: editorial blueprint — deep ink, electric blue, mono kickers, dashed plates, halftone bands. Mint is reserved for exactly one thing: live agent activity. If it glows mint, an agent did it.

Hosting

Any Node 18+ host works (Railway, Fly, Render, a VPS behind nginx). It is a single stateless process; state is in-memory by design (it's a demo — restart to reset). Set PUBLIC_ORIGIN so the discovery documents advertise the right URLs. No other configuration exists.

Recording a computer-use agent run

See RECORDING.md for the shot list and ready-to-paste prompts for driving the site with a computer-use agent (Codex or similar) while the telemetry dock narrates every action on screen.

Honesty notes

• Payments are tokenized stubs (success_token / demo-ok); any other token is declined with a real 402 so agents can exercise failure paths.
• Auth tokens are displayed on screen for demonstration; real deployments should never do that.
• The telemetry feed is public by design — the demo's thesis is that an agent-ready site makes agent activity legible, not surveilled-in-secret.