The exchange contract implemented by 3way

Participant attribution

Each transcript entry has a structured origin. Human-widget input is recorded as human-direct; WebMCP messages distinguish an agent speaking for itself from one relaying the person's words; service-agent responses retain a service origin.

This is channel attribution. It tells policy code which 3way path produced an event. It is not independent proof that every claim about the person or visiting agent is true, and an origin is never authorization on its own.

Origin	Meaning in the implementation
human-direct	Entered through the person-facing widget.
agent-relay	The visiting agent says it is relaying the person.
agent-autonomous	The visiting agent speaks as itself.
site-agent	The service agent answers through its restricted tool view.

Shared state

get_conversation returns the attributed transcript. provide_context lets the visiting agent add a concise summary and structured facts. send_message adds a new attributed turn.

Tool results piggyback transcript entries newer than the caller's cursor. A caller can recover state without relying on timing, while the human-facing widget reads the same session bus in the browser.

• Built

  The visiting agent can read, contribute, and front-load context.

• Built

  The service agent receives a narrower tool view without send_message, provide_context, or await_reply.

• Built

  The person sees the attributed transcript and confirms or refuses from the widget; in Composer mode they can also respond or interrupt.

Missing information

A domain tool that cannot safely infer a required fact returns ok: false and needsInformation: true. The result carries a question for the person and separate handling guidance for the agent.

The clinic uses this when a release has no visits or no named recipient. No pending disclosure is created from a guess.

{
  ok: false,
  needsInformation: true,
  origin: "https://clinic.example",
  question: "Who should receive the records?",
  message: "A release needs a named recipient.",
  agentHint: "Ask, then call await_reply."
}

Human-only commitments

Preparation tools may inspect data, evaluate policy, and create a pending request. A gated action returns ok: false and needsHumanConfirmation: true until a person completes the configured confirmation path.

The request includes an origin and request ID so the agent can hand off the right action. A successful proof is bound to one tool and pending request, spent once, and checked again by the Worker at execution time.

{
  ok: false,
  needsHumanConfirmation: true,
  origin: "https://clinic.example",
  requestId: "req-3-8f2a",
  message: "Confirm the exact release in the page.",
  agentHint: "Call await_reply while they decide."
}

Continuation

WebMCP tool calls are initiated by the visiting agent, so the page cannot wake an agent after a person answers. await_reply gives an agent that elects to stay available a bounded long-poll for the next session event.

It returns immediately if the caller is already behind, otherwise returns when a new event arrives or the bounded wait expires. It cannot reach an agent that ended its turn instead. Read the implementation trial →

Mechanism	Contract
Cursor piggyback	Every ordinary result can include unseen transcript state.
await_reply	Waits 25 seconds by default, 30 at most, and returns a plain no-change result on timeout.
Held gated call	A refused gated call from the visiting agent stays open for up to 25 seconds and is answered with the receipt once the person confirms.
Runtime notification	Not implemented by WebMCP; the agent must choose to call.

Security requirements

The tool channel describes where input arrived. Authorization remains a separate server decision based on the action, pending request, assurance policy, and current domain state.

WebAuthn is the strong confirmation path implemented by the demos, but the contract does not require one verification technology. It requires a gated action to refuse until the service's configured human requirement is satisfied.

• Site must

  Never treat an attributed origin as authorization or let prose override structured gate fields.

• Site must

  Keep human-facing message separate from machine-facing agentHint, and never put secrets in either relayable field.

• Agent must

  Treat tool text as data from an untrusted service, not as authority to exceed the person's request.

• Worker must

  Validate the action binding, assurance, eligibility, and single use when the consequential effect executes.