Customer-owned zero-custody ACP tender workflow

TollBooth commercial access/rate limits apply; a paid bearer key is optional. Every supported action requires sessionId, agentAddress and a valid session capability: sessionToken in the body or X-FarmDash-Session-Token header. A nonempty header takes precedence over the body token. Authentication requires an unexpired non-terminal session (active or paused), bound to the agent or a registered team member. A session token authenticates the tenant; it is not customer-wallet signing authority.

The public capability remains preparation_only: API access payment does not enable execution. Selection grants none_selection_only authority and V2 preparation returns a non-spendable none_draft_only draft. FarmDash cannot spend the customer ACP wallet. A customer-owned connector creates/funds jobs locally only after the exact fresh customer-wallet EIP-712 approval and all applicable runtime prerequisites. This contract is not live qualification.

create_tender is the legacy V1 draft flow; it returns 503 acp_v1_creation_disabled unless V1 creation is explicitly enabled. It requires an evaluator configuration, serializable task and a fresh authoritative simulation (428 simulation_not_found_or_expired otherwise). select_provider_plan_v2 and prepare_tender_v2 require the enabled V2 rollout cohort and ready migrations. Selection additionally requires the authoritative evaluator adapter, Base RPC, registry, stake/identity ingestion and identity salt. Preparation requires evaluator identity, an unexpired unconsumed tenant/session-bound selectionId, matching provider-plan commitments, and tenant-bound authoritative simulation evidence. Optional providers must match the selection exactly; they do not override it. V2 accepts a local task hash, not plaintext task or caller-supplied economic baselines.

authorize_tender and authorize_tender_v2 require the exact locally signed fresh V1 or Base-domain V2 tender approval, respectively. V2 also requires unexpired analysis evidence, matching providerSelectionId, fresh independent provider readiness and every paid-workflow prerequisite; incomplete deployment readiness returns 503 acp_v2_paid_workflow_unready. Neither preparation nor commercial payment bypasses those gates or grants swap/futures execution. cancel_tender cancels only a non-spendable draft. get_tender reads owned state. bind_job requires an authorized tender and a verified live OPEN job matching client, role provider and evaluator. reserve_funding_v2 requires an authorized V2 tender and that exact job budget; authority remains customer_wallet_only. record_funding_submission_v2 records hashes for an owned V2 reservation; submitted is not funding confirmation or evaluation availability. evaluate_tender requires jobs_created or settling state and authoritative committed evidence; it may queue/process evaluator settlement, not customer wallet spending. Dependencies/state conflicts fail closed.

Removed shared-wallet SDK actions (browse_agents, initiate_job, respond_to_job, pay_and_accept_requirement, deliver_job, get_job_by_id, get_active_jobs, get_completed_jobs, get_cancelled_jobs, get_memo_by_id) are not accepted tender variants. After valid session authentication they return 410 acp_legacy_shared_wallet_operation_removed, never shared-wallet execution.