Model eBay's Buy Browse scope beside the Sell Inventory modules

[gunbai-bot]

First of two PRs for the buyer-agent pipeline (buyer-agent-pipeline, gunbc-private strategy.year_end_plan). This one covers exit-criterion part 1: the marketplace as a cited upstream, with the sheet's columns derivable from the API's real response shape. The pipeline itself (ListingObservation, the three-valued attribute sheet, PurchaseIntent) lands in gunbc-private and consumes this PR.

What lands

• extdeps.ebay.browse: the Buy Browse scope of the existing eBay subject, added next to inventory.dag rather than as a second eBay module tree (DESIGN §3, external upstream decomposition).
  • Two operations: ebay.Browse.SearchItemSummaries and ebay.Browse.GetItem. Both are readonly and use application-token auth against the existing extdeps.ebay.oauth api_scope_root.
  • Response shapes come from eBay's published buy_browse_v1_oas3 contract (v1.20.4). Modeled fields are the ones a buyer adjudicates; the rest are listed per type in CoverageClosureEntry residuals, so nothing is dropped silently.
  • Condition IDs. The numeric condition-ID table is decoded onto the existing ConditionEnum: same concept, different wire. That makes it one table in both directions, not a second enum. Unlisted IDs decode to Absent, and MANUFACTURER_REFURBISHED has no ID, so encoding it refuses.
  • Search filters. The filter grammar is a typed coproduct.
    • price and priceCurrency render together, so a price without its currency can't be written.
    • An empty value set refuses.
    • A condition with no ID refuses the whole filter, because a dropped field would silently widen the search.
  • browse_contextual_location_header builds the X-EBAY-C-ENDUSERCTX header. Without it, calculated shipping isn't returned and a delivered price can't be formed.
  • browse_production_access records the upstream fact that production Buy access is an eBay Partner Network application with no guaranteed approval. The private pipeline consumes it as an intervention whose outcome can be a refusal.
• extdeps.ebay.rate_limits: adds ebay_buy_browse_rate_limit, 5,000/day. product.capacity.quota derives its pool unchanged, so the cadence is derivable, not asserted. capacity_quota_witness now counts 11 scopes, up from 10.
• extdeps.currency.currency: adds the ISO 4217 alphabetic code and its parse.
• Published mock cases for both operations, and browse.dag enrolled in scope_carrier_paths.
• test.claim.ebay_browse_witness: decode and round-trip controls, the full filter rendering, two filter refusals, the header against eBay's own example, and the rate-limit row.

Consumers of these declarations (DESIGN §3c)

• Executing consumers in this PR: the 12 witnesses in test.claim.ebay_browse_witness. They run:
  • the condition-ID decode and encode folds;
  • the whole filter renderer, including both refusals;
  • the search-page admission, including all three refusals;
  • the contextualLocation header;
  • the ISO 4217 alphabetic code.
    The rate-limit row is consumed by product.capacity.quota through capacity_quota_witness's identity join.
• Response types and browse_production_access: consumed by the private buyer pipeline in its companion change. It uses them for the Browse fold into listing evidence, the access standing, and the schedule's result-window check.
• The scheduled executor that calls these operations is deliberately not built yet. Its trigger is approved production access and observed response bodies. Until then the operations are reached only through those folds. This is a declared deferral, not an unconsumed model.

Findings that change the downstream shape

1. Search results carry no item aspects. ItemSummary has no localizedAspects, mpn or product. Rank, speed, capacity and MPN therefore cost one getItem per candidate, and the scan cadence has to be derived from candidate volume against 5,000/day.
2. Delivered price is price plus shippingOptions[].shippingCost, evaluated at the buyer's contextualLocation.
3. Production access is Limited Release, as described above. The scout pipeline refuses while the application is anything but approved. It never falls back to scraping.

Provenance and evidence standing

• How the facts were read. developer.ebay.com answers HTTP 403 to our fetches.
  • The contract was read from a GitHub mirror of eBay's published OpenAPI file (hendt/ebay-api specs/buy_browse_v1_oas3.json, info.version 1.20.4).
  • Call limits, production access, the condition-ID table and the filter grammar came from web.archive.org captures of the cited eBay pages, taken 2026-05 and 2026-06.
  • Each fact's citation is the canonical eBay URL.
• Not executed yet. This change has been checked by source inspection only. No session route executes .dag witnesses, so test.claim.ebay_browse_witness first runs in CI.

🤖 Generated with Claude Code

https://claude.ai/code/session_01X7jMc5D8JFmu8US1ZaZk6r

[gunbai-bot]

Addressed review 63298 in b06a8ca. All four findings were right.

• Price as a string. BrowsePriceAtMost.max is now a MoneyAmountMicro. It renders to the filter's decimal through std.decimal fixed_point_wire, only at the wire.
• Second amount shape. BrowseConvertedAmount.currency and convertedFromCurrency are now CurrencyCode, matching extdeps.ebay.inventory EbayAmount. The only Browse-specific addition left is the pre-conversion pair.
• Dangling parse. parse_currency_alphabetic_code is removed. With the fields typed it had no production consumer.
• Count literal. capacity_quota_witness no longer asserts length == 11. It joins the roster's keys against the published scope keys in both directions, and it keeps the key-uniqueness check.

The commit also fixes the parse errors CI reported at f29da9a: annotations in front of test fn attach to nothing, and a literal { inside a string began interpolation.

How this was checked. I ran it locally with a gunbc built today (/cargo-target/release/gunbc).

• All eleven Browse witnesses pass.
• Changing condition-table row 3000 to 3001 reds exactly the two witnesses that depend on that row.
• Removing ebay-buy_browse from the expected scope set reds the quota join.

Pre-existing, not from this PR. test.claim.external_model_scope_witness carriers_declare_scope_on_disk is red on main as well. dag/extdeps/standards/rfc_8118.dag is a rostered carrier whose scope is named rfc_8118_model_scope, not extdeps_model_scope. The new dag/extdeps/ebay/browse.dag carrier declares the expected name.

[gunbai-bot]

Addressed review 63312 in the commit after b06a8ca.

• browse_search_result_window / browse_search_limit_max. Both are now read by browse_search_page_admission. It refuses three cases, each as its own arm, before any request is formed: a limit outside 1..200, an offset that isn't a page boundary, and a page past the 10,000-item window. That turns the "offset must be a multiple of limit" comment into a wall. witness_browse_search_page_admission_holds_the_published_bounds covers the admitted case and all three refusals.
• browse_production_access / BrowseProductionAccess. The consumer is the buyer pipeline's access standing in the private overlay, which lands next. It derives "awaiting the Partner Network application" from this row and uses application_route as the intervention's subject. The public tree may not name private carriers (the private overlay's placement rule), so I can't cite the consuming module here. It is a declared frontier whose consumer arrives with the private change; it is not dangling. I've added a line to the row's annotation naming the consuming role.
• CoverageClosureFact import. Confirmed that it resolved: record-literal constructors bind by corpus-wide uniqueness, and the Browse witnesses executed against this module locally. I've added the import anyway, because every sibling writes it and the divergence was unstated.

I ran the Browse witness suite locally again: all twelve pass.

— sent from sunny-carp-475

[gunbai-bot]

Addressed review 63325 in 77c7198. I kept the row rather than dropping it: production access is an upstream fact about this subject, and deleting it would push the fact down into the consumer. What was missing is the declared frontier, so ebay_browse_frontier_rows now names browse_production_access and the two response types that no executing entry reads yet (BrowseItem, BrowseSearchPagedCollection). This follows the extdeps.backblaze.b2 precedent. Each row's dissolution names the capability that retires it: an executing entry that folds an observed response body with approved access. Approval alone, a fixture body, or a witness that the row exists does not retire it. witness_browse_frontier_rows_are_well_formed checks the rows. I ran the Browse suite again locally and all 13 pass.

[gunbai-bot]

On review 63332's non-blocking note: agreed that SearchItemSummaries still takes filter, limit and offset as wire inputs. That's deliberate for now. The operation block models the upstream request, and nothing in this change calls it. The frontier row for BrowseSearchPagedCollection states that its dissolution requires the search to be performed under browse_search_page_admission, so the first executing caller has to put the admission and the renderer on the request path. Raising them into the operation's input types is the structural version; it belongs with that caller, not ahead of it.

— sent from sunny-carp-475

[gunbai-bot]

Addressed review 63363 in 895484e. The finding was right: an omitted limit went out as 200, where the published default is 50. browse_search_limit_default = 50 is now the operation default, following the sibling default_inventory_items_limit pattern, and browse_search_limit_max stays the admission ceiling only. The page-size policy (the buyer schedule's 200-candidate pages) is set by the consumer. The witness now also admits the default page, and all 13 Browse witnesses pass locally.

[gunbai-bot]

Addressed review 63380 in 0fab94e. ebay_browse_frontier_rows is now concatenated into gunbc.census_closure_frontier next to backblaze_b2_frontier_rows, so gunbc.dissolution_census walks it. witness_browse_frontier_rows_are_well_formed_and_in_the_census asserts census membership for each of the three rows, the Cloudflare pattern.

Checked locally:

• All 13 Browse witnesses pass.
• test.claim.annotation_carrier census_closure_frontier_rows_well_formed still holds over the enlarged census.
• Deleting the enrollment line reds the membership check, so the witness discriminates.

[gunbai-bot]

CI at 650621d, attempt 1: none of the failures is in this change.

• build and heal: toolchain installation died on the runner (rustup: No such file or directory, exit 127/101). That's the shared-runner toolchain eviction, not code.
• floor: 9 blockers, all v2.test.parse / body_lowering where-refinement witnesses interrupted_before_verdict at the 500 ms ceiling. That's the main-wide cost defect whose repair is in flight. No eBay, currency or quota identity is among them.

The stage0 mirror drift that reddened 0fab94e is fixed in 650621d. I checked it locally with --required-regen, using a claim_executor built from this tree: extdeps_currency_currency.rs was the only drift across the candidate tree.

I cancelled the attempt-2 rerun rather than spend runner slots re-measuring the main defect. I'll merge main and push once the repair lands.

— sent from sunny-carp-475

[gunbai-bot]

Addressed review 63740 in d8b48c1. SearchItemSummaries and GetItem now take marketplace_id: MarketplaceEnum, the extdeps.ebay.ebay type the Sell scope already uses. It goes straight into the header map and marketplace_wire_contract encodes it, the same way the GitHub operations pass enum inputs. So upstream's silent EBAY_US substitution can no longer be reached through a missing or misspelled value. I rewrote the annotation to say this. No marketplace outside the enum is needed, so the enum is unchanged. All 13 Browse witnesses pass locally. They don't call the operations, so for the typed inputs this is a compile check, not an exercised one.

[gunbai-bot]

Addressed review 63756 in a2358c0. The count is gone. witness_browse_frontier_rows_are_well_formed_and_in_the_census now joins ebay_browse_frontier_rows against the three expected subjects by DeclSubject identity, in both directions: every expected subject appears exactly once, and every row is expected. That's the same shape as the quota witness's key join. Checked locally: it passes, and a mutant that points one row at BrowseItemSummary reds it.

[briansrls]

The modeled eBay Browse authority is the right prerequisite for private #58, and I have no content objection at this head. Please refresh this branch onto current public main and rerun witnesses before merging: the only green run is against base f078c59, while current main has advanced by 13 commits. Private #58 must then rebase on private #65's detached-worktree composition fix and consume the landed symbols.