Your agent can quote freely. It cannot spend freely.
The connector exposes two tools, and the separation between them is the whole design. One reads and prices, with no side effects, so the agent can call it as often as it likes. The other buys, and it cannot complete without a human typing y in a terminal.
Takes a URL and a selector, returns the recipe and the price of the code. No side effects, no charge, nothing written to disk. There is no reason for an agent to hesitate before calling it.
Buys the component and writes it into your workspace. The connector freezes the thread before it touches the network, and asks in your terminal:
⚠ MVOOM · The agent wants to buy 'HeroLineReveal' for $37.32 USD. Confirm the charge? [y/N]:
Answer anything but y and it returns USER_DENIED_TRANSACTION: no charge, no residual state, nothing half-done.
You can set a ceiling for autonomous purchases. Below it, the gate is skipped and the buy goes through without friction. Above it, the gate always fires.
The ceiling lives on the server, not only in the client. A patched client must not be able to walk past it — the client is a convenience, the validation is ours. And it is tested, not promised: there is a test proving a charge cannot happen without a signature.
Every quote carries a hash of the artefact it was calculated from. Nobody can be charged a price different from the one they were shown — not the customer, not the agent, and not a bug on our side.