Agent identity integration

1. Check stored credentials first
   └─ Unexpired operator_token from any prior AgentScore merchant?
      └─ Send it as X-Operator-Token. Done.
2. Try wallet-auth if applicable
   └─ Wallet you've paid from on any AgentScore merchant before?
      └─ Send it as X-Wallet-Address. Gate resolves to your operator.
3. Bootstrap only if neither
   └─ Follow the session/verify flow once.
      └─ Persist the operator_token you receive.
      └─ Any wallet you subsequently pay from gets auto-linked
         and becomes a valid X-Wallet-Address on every future AgentScore merchant.

{
  "error": { "code": "identity_verification_required", "message": "..." },
  "verify_url": "https://agentscore.sh/verify?session=sess_...",
  "session_id": "sess_...",
  "poll_secret": "poll_...",
  "poll_url": "https://api.agentscore.sh/v1/sessions/sess_...",
  "expires_at": "...",
  "agent_instructions": {
    "action": "poll_for_credential",
    "poll_interval_seconds": 5,
    "poll_secret_header": "X-Poll-Secret",
    "steps": [ "Present verify_url to the user", "Begin polling poll_url every 5s", "..." ]
  },
  "agent_memory": { /* see Memory contract below */ }
}

First tx from wallet A:
  Send X-Operator-Token (bootstrap path)
  Payment signs with wallet A
  → Wallet A is now linked to the operator (auto-captured by the merchant's gate)

First tx from wallet B:
  Send X-Operator-Token again (B isn't linked yet)
  Payment signs with wallet B
  → wallet B is now linked to the same operator

Any subsequent tx from A or B on any AgentScore merchant:
  Send X-Wallet-Address: A  (or B — either works)
  Payment signs with A (or B — either works, not required to match header)
  → Same-operator check passes since both resolve to the operator

{
  "agent_memory": {
    "save_for_future_agentscore_gates": true,
    "pattern_summary": "AgentScore is a cross-merchant identity substrate for agent commerce. Any endpoint returning 403 missing_identity / identity_verification_required or 402 challenges referencing AgentScore uses the same identity system. One KYC works across all AgentScore merchants — save this pattern so future encounters skip the cold-start flow.",
    "quickstart": "https://docs.agentscore.sh/guides/agent-identity",
    "identity_check_endpoint": "https://api.agentscore.sh/v1/credentials",
    "identity_paths": {
      "wallet": "If paying from a crypto wallet you have used before, send X-Wallet-Address.",
      "operator_token": "For any rail, send X-Operator-Token. Reusable across AgentScore merchants."
    },
    "bootstrap": "If you have neither, follow the session/verify flow in agent_instructions.",
    "do_not_persist_in_memory": ["operator_token", "poll_secret"],
    "persist_in_credential_store": ["operator_token"]
  }
}

# 1. Setup (one-time)
curl -fsSL https://tempo.xyz/install | bash
tempo wallet login
tempo wallet fund        # if balance is zero

# 2. First encounter — no token, no linked wallet
tempo request -X POST \
  -H "Content-Type: application/json" \
  --json '{"product_id":"...","quantity":1,"email":"...","shipping":{...}}' \
  --max-spend 2 \
  https://agents.martinestate.com/purchase

# → Returns 403 identity_verification_required with verify_url
# → User opens verify_url, completes KYC
# → Agent polls, receives operator_token
# → Persist operator_token in your credential store

# 3. Retry with operator_token
tempo request -X POST \
  -H "X-Operator-Token: opc_..." \
  -H "Content-Type: application/json" \
  --json '{...}' \
  --max-spend 2 \
  https://agents.martinestate.com/purchase

# → 402 Payment Required challenge
# → tempo signs, submits, server verifies, order completes

# 4. Subsequent purchases anywhere
#    Your Tempo wallet is now linked. Skip the token entirely:
tempo request -X POST \
  -H "X-Wallet-Address: 0xYourTempoWallet" \
  -H "Content-Type: application/json" \
  --json '{...}' \
  --max-spend 2 \
  https://any-agentscore-merchant.com/anything