A personal agent discovers a fictional receiving site, Northstar Outfitters, begins a signed-out session, and requests account access when a user asks to exchange order #1042.
The flow uses OAuth consent for a synthetic account and lets the user select read/write permissions before returning to the same conversation. The simulated exchange has a $70 difference; the repository states that no purchase, charge, or shipment occurs. The caller uses Cloudflare PiHarness, Pi Durable, Agents SDK, and Workers AI.
The README describes reciprocal discovery, ES256 private_key_jwt authentication, PKCE, DPoP-bound session tokens, replay protection, scoped access, token refresh, and immediate grant revocation. It also says tokens and signing keys do not enter the model transcript or browser state.
This is not presented as a complete protocol conformance suite. MCP, A2A, device authorization, mediated authentication, and browser-session exchange are not implemented or advertised. The repository page does not establish a publication date or production deployment beyond the described demo.