A primary-source review of MPP, Payment Auth, Tempo and HTTP 402 for the week ending November 8, 2026.
Last week was zero verified developments — spec linting, documentation catching up to two mppx releases, and a Tempo-Moralis partner announcement with no payment term attached. This week doesn’t break that streak. The primary record for the seven days ending November 8 shows no new MPP integration, payment term, or protocol capability. What it shows instead is the project’s internal conventions getting more disciplined: a shared AGENTS.md shape across repos, a supervision schedule for session closes, a third-party SDK added to the extensions page, and the usual docs-and-dependency cleanup underneath.
SDK docs catch up to mppx 0.17.0, across three languages at once
mpp PR #1151 refreshed the Go, Python, and Rust SDK documentation to match current library releases, with its implementing commit emphasizing explicit spending policies, replay protection, and multi-currency challenge handling. Separately, PR #1146 synced identity and client documentation to mppx 0.17.0, via its commit — the same version-chasing pattern last week’s brief flagged for mppx 0.15.0 and 0.16.0, now one point release further on.
This is documentation narrating already-shipped behavior, not new behavior. The multi-currency challenge handling called out in PR #1151 is worth checking in practice: whether the three SDKs actually agree with each other, and with the server, on how a multi-currency challenge resolves — docs refreshed in the same PR across three languages can still drift from runtime behavior in ways a diff doesn’t catch.
A minute-by-minute watch schedule for session closes
mpp PR #1157 adds a “Close supervision” section recommending a minute-by-minute supervision schedule for handling on-chain close requests and idle channel cleanup, with its commit. The stated purpose is mitigating loss-of-funds risk from stale channels — a session left unsupervised during a close request is exactly the kind of gap that turns into a real loss rather than a theoretical one.
It’s guidance, not an automated guard: the PR documents a schedule operators should follow, it doesn’t appear to enforce one. Worth verifying next, per the source report, is whether the recommended schedule actually catches on-chain close events within the stated 900-second grace period when tested in staging — a supervision cadence that’s one beat too slow is worse than no documented cadence, because it reads as covered when it isn’t.
@getpitstop/sdk joins the extensions page
mpp PR #1153 added @getpitstop/sdk to the extensions listing, with its commit. The listing describes account keychain access for agents, cross-chain funding via LI.FI, and MCP server integration for limit checks.
Same caveat that’s applied to every catalog addition this brief has covered: being listed on the extensions page means it’s documented and reachable, not that anyone’s funding flows are running through it yet. What’s worth testing, per the source report, is whether the funding paths actually work with LI.FI across Base, Solana, and Ethereum in a sandbox — a cross-chain funding claim is one of the easier things to document and one of the harder things to get uniformly right.
AGENTS.md gets the same shape in both repos
mpp-specs PR #391 added an AGENTS.md file, via its commit, and mpp PR #1154 reorganized its own AGENTS.md into that same shared MPP shape, with its commit. Together they harmonize CI targets, layout rules, and PR workflow guidance across the two repositories that make up the project.
This is internal process hygiene aimed at whoever — human or agent — is contributing to either repo, not a change anyone integrating against MPP needs to act on. Worth noting: the mpp-specs commit behind PR #391 also triggered this week’s auto-published spec artifact release, the same byproduct pattern prior briefs have noted rather than a spec change in its own right.
Service directory adds OUSD and Sessions filters
mpp PR #1161 added OUSD and Sessions badges with filtering to the service directory, with its commit, reflecting session-currency support and asset holdings. It’s the next step after the October brief covering OUSD becoming the documented default — now the directory itself can be filtered on it, not just the quickstarts.
A filter is only as trustworthy as the data feeding it. Per the source report, what’s worth confirming next is whether the OUSD and Sessions badges correctly reflect each service’s tempo-api currency declarations after a redeploy — a badge that’s stale by one release is worse than no badge, for the same reason a stale directory listing is worse than an empty one.
Dependency patches and a round of CI throttling
mpp PR #1117 updated body-parser, fast-uri, and zod to patched versions addressing published security advisories, with its commit. Three CI changes rode alongside it: PR #1156 throttled the agents-sync workflow from hourly to once-daily execution, with a companion PR #1155 annotating the pin so the zizmor security linter accepts it; PR #1148 enabled automatic closure of pull requests inactive for 14 days; and PR #1149 removed the weekly llms-full.txt token-count workflow.
None of this touches what an agent can do against MPP — it’s the maintenance layer reducing attack surface and trimming CI load. The stale-PR closure is the one worth watching rather than just logging: per the source report, it’s worth auditing that the 14-day closure doesn’t sweep up pull requests that are inactive because they’re waiting on a design decision rather than because they’re abandoned.
Community signals, named and not folded in
Three items from this week’s source ledger are independent x402 commentary, not MPP or IETF spec developments, and none come with a transaction record to verify independently: Auria Chain, an SDK pitched for AI agents to pay AI agents over HTTP via x402; a smart-contract risk-report service that agents buy per call over x402; and X402 Music, an API to search, license, and stream pre-cleared music stems. All three stay signals to watch rather than verified developments.
What I’m taking from this week
Second straight week with zero verified MPP developments, but the texture is different from last week’s. Last week was specification precision and a partner’s data showing up elsewhere; this week is the project tightening its own operating conventions — a shared AGENTS.md shape, a documented (if unenforced) close-supervision schedule, a directory filter that only works if the underlying currency data stays fresh, and dependency and CI hygiene underneath all of it. None of it is adoption news, and none of it should be read as such. The honest open questions carry forward: whether the close-supervision schedule actually catches events inside its stated window, whether @getpitstop/sdk’s cross-chain funding holds up in sandbox testing, and whether the new OUSD and Sessions badges stay accurate past the next redeploy.
I built MPP Pulse to keep those layers separated instead of blurring them into one undifferentiated “things happened” feed. It’s an open-source AWS agent that collects primary evidence and drafts a cited weekly brief for human review.