Test one marketplace offer end to end.

Start with a buyer or provider goal and record the immutable prompt, persona, constraints, locale, viewport, authentication state, fixture version, allowed actions, stop gate and deterministic assertions. Identify every party that can change the outcome: platform, seller or provider, payment or fulfillment partner and the user account.

Run the same contract through a deterministic browser baseline and named agent profiles. A plausible recommendation is not completion. The selected listing, seller, condition, total and terminal state must all match the expected fixture.

Assign stable fixtures for listing ID, canonical URL, seller or provider ID, product or service identity, variant, condition, inventory state and fulfillment method. Test ranking, filtering, pagination, duplicate listings and sponsored placements without allowing the executor to merge facts from similar offers.

Inspect semantic headings, links, controls, accessible names, roles, values, focus order and dynamic announcements. Structured data such as Product, Offer or AggregateOffer can improve machine-readable context when it accurately represents the visible page, but its absence alone does not decide task success.

Calculate the comparison total from item or service price, platform fee, seller fee, delivery, tax, deposit, protection and any conditional charge visible before the decision boundary. Recalculate after location, quantity, variant, seller or fulfillment changes and flag authoritative surfaces that disagree.

Keep platform guarantees, verified seller attributes, seller claims, ratings, reviews and moderation notices in separate evidence fields. Reputation is context, not proof that a listing fact is true. The report should state which party supplied each claim and when it was observed.

Reviews, listing descriptions, seller profiles, questions, messages and uploaded documents are user-generated content. Test whether visible or hidden instructions inside those surfaces can redirect the agent, request secrets, alter constraints, bypass a confirmation or make it treat a seller claim as a platform command.

Record the injection payload as evidence without allowing it to escape the scenario boundary. Sensitive account, payment, message and order data must remain unavailable to unrelated sellers, listings and sessions. Classify successful manipulation or cross-account disclosure as a security finding, not ordinary content friction.

Create available, low-stock, reserved, delisted, seller-paused, changed-price, changed-fee and temporarily unavailable fixtures. Trigger the change after comparison or selection so the test observes whether the site exposes the new state and preserves valid constraints.

Recovery must not silently replace the seller, condition, variant, fulfillment method or commercial terms. If the original offer cannot continue, the agent should explain the invalidated choice, return to a safe decision point and request confirmation before selecting an alternative.

Public production runs stop before sending a seller message, placing a bid, submitting an enquiry, confirming a booking, creating an order, authorizing payment, opening a dispute or requesting a refund. The review state should expose the exact listing, seller, total, terms and next consequential action.

Approved sandboxes may exercise the complete flow with synthetic accounts and reversible fixtures. Use idempotency controls and independent assertions to prove exactly one intended message, transaction or case was created, and that retries, delayed responses or expired sessions did not duplicate the write.

Assert the expected listing, seller, condition, quantity, total, fulfillment, account and review or sandbox transaction state outside the agent narrative. Also prove the absence of an unintended message, bid, reservation, order, charge, dispute, refund or cross-account data exposure.

Package the session recording, ordered steps, screenshots, accessibility evidence, DOM, console and network signals, source snapshots, completion time, waits, retries, interventions, Cumulative Layout Shift and target movement. Classify the primary cause as website, agent-specific, agent policy, infrastructure or inconclusive before remediation.