Visual marketplace + capture: fixes, safety hardening, verification

[Soundcreates]

Summary

Most of the Cascade Visual Marketplace + Visual Capture feature (frontend product grid/capture UI, backend capture API/storage/vision job/MCP tool, DB migrations) landed on main directly during this session via this repo's auto-commit pipeline. This PR is the remainder: a multi-agent orchestrated build-out (repo mapping → frontend → backend → commerce integration → adversarial safety review → verification), captured as a clean branch with the fixes that pass came out of that pipeline.

• Mission orchestration fix: captured missions never called kernel.recordTopologyDecision, so mission.search silently no-op'd — every capture-created mission was permanently stuck with zero offers. Fixed, with 9 new Postgres-backed integration tests proving capture → mission → quote → BUY → checkout works end to end through the same pipeline every other mission uses (no capture-specific quote/payment/checkout code).
• Adversarial safety review (Opus, read-only) found one confirmed defect: a shopper's explicit budget ceiling stated in free text was ignored for every capture preset except custom, so the compiled contract could authorize more than the shopper asked for. Fixed — the stated ceiling now caps the grounded budget for every preset, with 2 new regression tests.
• Full verification pass: 13/13 packages typecheck, 13/13 build, lint clean, all test suites pass aside from 3 pre-existing failures confirmed unrelated (checked out at the commit before this feature and reproduced identically there).
• Docs: added a "Visual marketplace + capture" section to build.md, plus the two new env vars to .env.example.

What's already true (verified, not assumed)

• Marketplace and mission search share one registry (MOCK_INDIA_LISTINGS) — no duplicate catalogue.
• Client-submitted price/vendor/stock is never trusted; the server reloads the product/vendor/variant from the registry on every capture.
• Vision output can only block mission creation on identity conflict, never override registry identity.
• Sandbox mode never invokes Prava MCP shopping for capture-sourced offers (structural guarantee — the capture pipeline's dependency type has no Prava/MCP field).
• One capture creates at most one mission, enforced by a DB unique constraint plus idempotent kernel commands.
• Screenshots are private, never exposed via signed URL, and deleted after a configurable retention window (default 24h) regardless of mission outcome.
• Nothing uploads until the shopper explicitly confirms in the review dialog; Cancel makes no network call.

Test plan

pnpm typecheck && pnpm lint && pnpm build
pnpm --filter @cascade/server exec vitest run src/marketplace-capture.test.ts
pnpm --filter @cascade/server exec vitest run src/marketplace-capture.integration.test.ts
pnpm --filter @cascade/web test
pnpm --filter @cascade/db test:integration

• Typecheck: 13/13 packages
• Lint: clean (2 pre-existing warnings, unrelated file)
• Build: 13/13 tasks
• Unit tests: server 24/24 (incl. 2 new budget-ceiling regressions), web 32/32, contracts 3/3, merchants 16/16, agents 8/8
• Integration tests: marketplace-capture 9/9 (new), db 40/41 (1 pre-existing unrelated failure), server 27/28 (1 pre-existing unrelated failure)
• Migrations 0016/0017 applied and verified idempotent against live Postgres
• Manual demo: browse /marketplace → capture a product → review dialog → create mission → confirm mission reaches searching/offers appear → BUY → Prava sandbox → simulated order

No real payment or live checkout was performed anywhere in this work.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
cascade-web	Skipped		Aug 2, 2026 11:59pm