Forward Deployed Engineer – Identity, UCP & Wallets (TypeScript)

This role carries a verified loyalty identity through the agent handshake on Google's Universal Commerce Protocol (UCP) and on a protocol-agnostic rail, and builds a wallet-held Verifiable Credential proof of concept.

First 90 days

• Implement the UCP side. This means a namespaced agent_trust signal with a loyalty block on a platform agent, and a mock UCP merchant that verifies it, resolves eligibility server-to-server, applies member pricing and reserved-inventory holds in the Checkout object, and records pending earn on the Order. It steps up to OAuth (PKCE) identity linking only for redeem/transfer.
• Build the protocol-agnostic rail: an X-Agent-Trust header contract, a Cloudflare Worker edge verifier with JWKS caching and spoof-header stripping, and Node/TypeScript merchant middleware exposing a loyalty context to handlers.
  Build the VC POC.
• Issue an Agent Trust credential over OID4VCI to a holder wallet (Credo or equivalent), present it via OID4VP with selective disclosure (SD-JWT first, BBS+ predicate as a stretch goal), verify it at the merchant, and prove no PII reaches the agent.
• Implement and run the loyalty-fraud test suite on both rails, covering replay across merchants, token reuse, enumeration, ATO-pattern redeem, and scalper hold-and-abandon.
• Write the merchant integration guides for the rail and the UCP path, and build the demo storefront beats.

Deliverables
UCP signal schema + platform-agent reference · Mock UCP merchant with loyalty tiers · Header contract + edge verifier + middleware SDK · VC issuer/wallet/verifier POC · Fraud test suite · Integration guides · Demo beats