Amana

AI can understand a shopping request or diagnose a merchant API, but neither ability makes its answer financially authoritative. Amana separates those responsibilities in a deterministic trust layer for agentic commerce.

The Merchant Agentization Agent turns merchant-approved interfaces into tested, evidence-backed capabilities. The Safe AI Buyer interprets multimodal intent, discovers eligible products, and prepares a transaction without giving the model independent authority over money.

The backend is a Java 25 / Spring Boot 4.1.1 modular monolith. PostgreSQL is the system of record. Authority-critical rules stay inside explicit module and transaction boundaries rather than introducing unnecessary distributed-system failure modes.

Gemini handles interpretation, multilingual and visual understanding, interface reasoning, diagnosis, and bounded planning. The application owns readiness, identity, authoritative quotes, policy evidence, proposals, authorization, exact money, execution, payment truth, and refund accounting.

The frontend uses Next.js, React, TypeScript, Tailwind CSS, and Razorpay Blade. Retrieval combines PostgreSQL full-text search, pg_trgm, pgvector, and Gemini embeddings. The deployed stack uses Vercel, Render, and Supabase; P0 requires no Kafka, BullMQ, or Redis service.

Merchant catalogues and APIs differ in money units, inventory semantics, fulfilment behaviour, policies, authentication, and response shapes. Amana starts with merchant-approved structured sources, not arbitrary website crawling.

The agentization lifecycle moves through inspection, discovery, mapping, contract testing, observation, diagnosis, bounded repair, and retest. AI may propose a mapping or diagnose a failure. Only deterministic evidence reduction can mark a capability READY.

The demo exposes a concrete mismatch: an API returns 2999 for a ₹2,999 product, while the canonical money contract expects 299900 minor units. A rupees-to-paise repair must create a new mapping version, receive merchant approval, pass deterministic contract tests, and satisfy the readiness reducer.

The Buyer can interpret typed, spoken, visual, multilingual, and conversational requests. Its execution path is stricter: eligible READY merchants, grounded catalogue records, an authoritative quote, stock and serviceability evidence, an immutable proposal, explicit authorization, and the execution gate.

A canonical proposal hash binds authorization to the exact transaction. If execution attempts a modified amount, product, variant, merchant, currency, or provider account, the authorization no longer binds. Safety-critical missing evidence fails closed.

Browser callbacks and provider webhooks are observations, not unquestioned financial truth. The backend binds and reduces Razorpay evidence, reconciles ambiguous outcomes, and models proposal, authorization, execution, order, payment, fulfilment, and refunds separately.

Stable identities, constraints, and transactional locking make retries and concurrent callers converge. Durable work after commit uses a PostgreSQL transactional outbox. An uncertain provider outcome moves toward reconciliation rather than an invented success.

The verification suites measure distinct boundaries, so their results are kept separate. These figures come from the repository’s committed evidence and README.

The intent and retrieval fixtures report 92.41% buyer intent field accuracy, 83.58% hybrid-v3 discovery Recall@5, and 76.12% valid-product Recall@5. Valid-product recall improved by 20.90 percentage points over hybrid-v2. Exact-identity precision and valid no-match accuracy were both 100% on those fixtures.

The safety harness covers proposal integrity, money integrity, callback truth, payment and refund idempotency, capability readiness, evidence, and policy enforcement. The core pnpm proof:verify path runs offline without Gemini, Razorpay, or deployment services.

Explore the committed proof artifacts ↗

The public demo includes Buyer, Merchant, Proof, Security, Failure Lab, Architecture, and Performance surfaces. It uses synthetic merchants and products, Razorpay Test Mode, and explicit on-screen authorization for current purchases.

The fastest reviewer path is a Buyer request for Auralink Buds under ₹3,000, followed by the merchant money-unit repair and retest. The proof and security surfaces expose the evidence behind the authority boundaries.

Unattended scheduled AutoBuy is not presented as complete. Native Buyer applications remain a future direction. The current system makes no production revenue, security certification, or compliance certification claim.

The backend uses Render’s free tier and can sleep after inactivity. If the live demo is unavailable, open its health endpoint ↗, wait for an UP response, then reload the product.