
First pourInside the AI Shopping Assistant
The model knows the world.
The system knows your store.
How the orchestrator routes catalog, orders and human handoff in one session. World knowledge can answer a product question. Commerce requires catalog, inventory, fitment, policy and order data, with the right context carried across every change in intent.
A shopper asks for a red jacket in size medium. A general-purpose LLM gives them a fluent answer in seconds. It can summarize reviews, compare common features and explain what a technical fabric rating means.
Then the shopper reaches the store.
“Do you carry it in a medium?”“Is it in stock?”“Can it ship to Nevada?”“Where's my order from last week?”“Can I talk to someone?”
That's one shopping session. It contains several jobs.
The first question can draw on broad knowledge. The next questions require catalog truth, variant-level inventory, shipping policy, account access, order data and a support workflow. A model can produce fluent language for any of these. What decides whether the language is reliable is the layer of systems the model is answering from.
That's the difference between a chat layer and commerce AI built for a merchant's workload.
Webscale's AI Shopping Assistant works across the merchant's catalog, inventory, fitment rules, policies, order data and support workflows. An orchestrator routes each turn to the right specialist while the shopper's context stays with the session. General knowledge can fill a gap. Merchant data remains authoritative when the two conflict.
The work is in the routing
The assistant is a team of specialized agents behind an orchestrator. Product discovery reads from the catalog and inventory. Order history and shipping status are handled by a separate agent. Returns, account questions and the path to a human support agent belong to a third. And when the merchant's own data doesn't reach a question, a fourth agent fills in with general world knowledge.
The orchestrator decides which specialist should handle each turn. It also carries the session forward when the shopper changes subjects.
That matters because shoppers don't follow the boundaries in a system diagram. They can move from compatibility to stock to an existing order in three messages. If each change starts a new conversation, the experience becomes a collection of disconnected bots. If one model receives every tool and every policy in one prompt, the model has to sort through unrelated contexts and may use the wrong source.
Giving each agent a narrower job with its own data boundary is what makes the specialization work. The orchestration on top of it is what makes the whole thing feel like one conversation to the shopper.
World knowledge is the easy part
General-purpose LLMs already know a great deal about the world. They can explain what an industry term means and how a brand's reputation has shifted over time. When a category standard needs interpreting, they can do that too. That's useful context, and the AI Shopping Assistant can use it.
The harder part is bringing that context into a response that also respects what the merchant knows.
Suppose outside information says a product is commonly available in a shopper's state. The merchant's shipping rules say that SKU can't go there. The merchant's rule controls the response. Suppose reviewers say an accessory usually works with a product family, while the merchant's fitment matrix excludes the exact variant in the shopper's cart. The fitment matrix controls the recommendation.
General knowledge helps the assistant read what the shopper is asking. But what the store can promise depends on the merchant's own data.
The data changes the answer
Store-aware assistance works at the level where commerce decisions happen.
Catalog data keeps recommendations inside the assortment and ties claims to the right product or variant. Inventory prevents the assistant from steering a shopper toward an unavailable SKU. Fitment and compatibility rules resolve details a general model may never have seen. Policy data governs restrictions, disclaimers and shipping eligibility. Order and account data make post-purchase questions answerable. Session context keeps all of those turns connected.
For a low-consideration purchase, a plausible answer may lead to a return. In auto parts, archery, age-gated categories, supplements or other regulated and high-consideration commerce, it can create a safety or compliance problem. Fluency alone will not catch either failure mode. What catches it is the data layer sitting underneath the model.
When a person needs to take over
Human handoff is part of the architecture, not an escape hatch at the edge of it.
When a shopper asks for help from a person, the session can move with them. The support agent receives the conversation context instead of asking the shopper to explain the problem again. The handoff preserves the path that led there, including the products considered, the questions asked and the point where the AI stopped.
For developers, this turns handoff into a state problem. A conversation has to have a durable identity so it can survive a change of handler. The context attached to it has to travel with the shopper, without the receiving system inheriting data it should never see. When any part of that fails, the shopper is the first to notice, because they end up having to start over.
That engineering is part of the product experience. The shopper only notices when it's missing.
How to test the difference
Product discovery is the easy demo. Use a sequence that forces the system to cross boundaries.
01Ask for a product using a specific fitment, compatibility or variant constraint. Check whether the answer resolves against merchant data.
02Change the subject to an existing order. Check whether the assistant routes the turn and keeps the session intact.
03Ask a relevant question that requires broad industry knowledge. Check whether the answer adds context without overruling merchant policy.
04Ask for a human. Check whether the conversation arrives with the history attached.
05Create a conflict between outside information and a merchant rule. Check which source wins.
A good first answer is easy. What matters is what the system does with every turn after it, once the conversation has changed shape into something the model on its own can't handle.
A storefront conversation that can query merchant systems, use general knowledge, switch specialists and hand the session to a person without dropping context.
Order up
Ship log
Magento 1 EOL patches 119 through 123 published July 15. Below is what each patch covers and what to test after applying it.
Patch 119
Enable/disable control and URL allow list
Remote HTTP-CURL access in Dataflow gets an enable/disable control and a URL allow list. The patch narrows which remote destinations a configured process can reach.
Developer note
Treat the allow list as a trust boundary. Test accepted destinations, rejected destinations and redirects. Keep the list as narrow as the integration permits.
Treat the allow list as a trust boundary. Test accepted destinations, rejected destinations and redirects. Keep the list as narrow as the integration permits.
Patch 120
Field labels escaped before rendering
System configuration field labels are escaped before rendering. Inline on* event handlers are blocked at the same layer.
Developer note
Test labels containing encoded characters and handler-like input. Verify the rendered admin page and the saved configuration path.
Test labels containing encoded characters and handler-like input. Verify the rendered admin page and the saved configuration path.
Patch 121
Exception output escaped before page render
Exception output on the Dataflow process view is escaped before it reaches the page.
Developer note
Exercise failure paths with payload-shaped exception text. Security fixes in error rendering need tests that reach the error branch.
Exercise failure paths with payload-shaped exception text. Security fixes in error rendering need tests that reach the error branch.
Patch 122
Cryptographically secure random values
API session IDs replace
md5(time() . uniqid()) with a cryptographically secure random value provided through phpseclib. A database migration extends the sessid column to 64 characters.Developer note
The generator and schema change belong in the same deployment check. Verify the column width and inspect newly created API sessions after patching.
The generator and schema change belong in the same deployment check. Verify the column width and inspect newly created API sessions after patching.
Patch 123
escapeJsInHtml() across affected admin templates
escapeJsInHtml() JSON-encodes values and escapes closing-script sequences across the admin templates that render user-supplied content into JavaScript.Developer note
Cover quotes, angle brackets, encoded characters and script-closing input in affected admin screens. This patch protects a JavaScript-in-HTML context, which needs different tests from ordinary HTML escaping.
Cover quotes, angle brackets, encoded characters and script-closing input in affected admin screens. This patch protects a JavaScript-in-HTML context, which needs different tests from ordinary HTML escaping.
Under the hood
Patch boundaries worth testing
An allow list is executable policy
Patch 119 turns remote Dataflow access into a configured policy decision. Test the exact destination formats the application evaluates, including redirects and host variants. An allow list set too broadly weakens the boundary the patch is meant to enforce. Set it too narrowly and the integration itself stops working. Both failure modes look fine in a superficial smoke test.
XSS protection depends on the output context
Patches 120, 121 and 123 all address cross-site scripting, but each one covers a different rendering context. Patch 120 handles labels rendered into the admin configuration screen. In patch 121, the sink is exception output on the Dataflow process view. Patch 123 protects JavaScript that has been embedded inside an HTML page. A single generic XSS test won't cover the set. Build fixtures that match the sink each patch protects.
Session entropy needs schema support
Patch 122 changes both how API session IDs are generated and how much space the database gives them. A secure value truncated at persistence is still a broken implementation. Verify both sides of the change in the same deploy.
From the blog
Why your personalization tool is working with stale data
Personalization quality depends on the data path underneath it. This article follows what happens when storefront behavior, customer records and decisioning systems update on different clocks.
The same lesson applies to AI assistance. The response can only be as current as the systems supplying catalog, inventory, shopper and order context.
Adrian Luna · July 14, 2026 · ~4 min read
The grind
M1 EOL patch 119 to 123 runbook
Ship it without the surprises.
01Back up the database and record the deployed code revision.
02
Apply patches 119 through 123 in staging with
patch -p1 --ignore-whitespace
.
03Configure the remote Dataflow toggle and URL allow list.
04Test approved and rejected Dataflow destinations, including redirects.
05Exercise affected admin screens with encoded characters and script-closing sequences.
06Confirm the sessid column supports 64 characters and inspect new API sessions.
07Record the rollback point and smoke tests required for production approval.
Every two weeks
Get the next issue in your inbox
The Brew Ha Ha lands every two weeks.
Written for the developers keeping commerce running.
Written for the developers keeping commerce running.
