A primary-source review of MPP, Payment Auth, Tempo and HTTP 402 for the week ending November 1, 2026.
Last week was three security patches landing quietly and a discovery-wide relabeling of 19 services to MACH support. This week doesn’t add anything to that list either — the primary record shows no new MPP integration, payment term, or protocol capability for the seven days ending November 1. What it shows is the specification getting more precise about what it already says, the SDK docs catching up to two mppx releases, and Tempo’s data showing up somewhere other than Tempo.
Problem-type URIs get published, and the examples that cite them get linted
Three merged mpp-specs PRs did double duty this week: PR #384 publishes the problem-type URIs that the specs cite and lints for coverage, with its implementing commit; PR #385 fixes the spec’s JSON examples so they actually parse, and lints them too, via its commit; and PR #386 extends CI to run every script test and lint encoded examples, with its commit. A fourth, smaller change, PR #382, pointed SDK contributions to GitHub issues and added issue forms, with its commit.
None of these change what the spec permits — they change how confidently you can trust what it says. A problem type cited in prose but never published as a resolvable URI, or a JSON example that doesn’t actually parse, is the kind of gap that looks cosmetic until an implementer copies it. Worth verifying next is whether a problem type like session/transaction-reverted now resolves correctly under paymentauth.org/problems/ and returns the HTTP status the spec claims — linting for coverage isn’t the same as confirming the endpoint behind it works.
The three merged commits also triggered this week’s usual auto-published spec artifact releases — one, two, three, giving HTML, TXT, XML, and PDF renderings of the IETF Payment Auth specification. As in prior weeks, I’m noting them as the byproduct of the commits above rather than a spec change in their own right.
SDK docs catch up to mppx 0.15.0 and 0.16.0
mpp PR #1124 synced the docs with mppx 0.15.0’s APIs and behavior, with its commit, and PR #1135 bumped mppx to 0.16.0, via its commit. Separately, PR #1136 added documentation showing how to pay with an existing Stripe SPT, with its commit, and PR #1125 named Tempo and Stripe as MPP co-authors on the project overview, via its commit.
This is the same genre of change recent briefs have flagged repeatedly: documentation making an already-shipped release legible, not a new capability. The Stripe SPT doc is the one worth watching, since it’s addressing a specific point of confusion — secret key usage in agent scenarios — rather than just narrating an API diff. Worth verifying next is whether mppx 0.16.0’s keyAuthorization handling is now fully reflected in client and server codebases, not just in the docs describing it.
Dependency bumps and the usual tooling cleanup
mpp PR #1127 upgraded vocs to 2.12.0 and PR #1131 upgraded a batch of other dependencies, with matching and matching commits. A smaller cluster of internal fixes rode along underneath: PR #1133 rejects proxy health-check fixtures for routes the proxy doesn’t actually serve, PR #1132 generates MPP proxy services from the proxy’s own discovery manifest instead of hand-maintained ones, and PR #1137 regenerates the site’s generated pages file to match. None of it changes what an agent can do against MPP — it’s the maintenance that keeps the pipelines shipping the next thing that does.
Tempo’s data shows up in someone else’s API, not a new MPP capability
Tempo’s own blog announced that Moralis is bringing Tempo data to its APIs this week. That’s Tempo extending where its chain data is queryable, not an MPP payment-flow change — the same category distinction prior briefs have drawn for Tempo-only announcements. It’s worth flagging because Moralis widening access to Tempo data is a plausible precursor to more integrations building on that rail, but nothing in the primary record ties it to a payment term or protocol capability yet.
Community signals, named and not folded in
Three Hacker News posts are worth naming rather than treating as development. The x402 merchant-of-record and budget-attenuation project this brief flagged in late July resurfaced in this week’s primary record without a new transaction to verify. Two others are new: x402 integrations for an AI-agent data API, checked in a clean room, and Statebase, pitched as a backend for agents and builders who don’t need one yet. None of the three come with a transaction record I can verify independently, so all three stay signals to watch rather than verified developments.
What I’m taking from this week
Zero verified developments, and this time there isn’t even a security patch or a discovery-wide relabeling to make the quiet week interesting — it’s specification precision, documentation catch-up, and one partner’s data showing up in another company’s API. That’s a legitimate maintenance week for a protocol between adoption waves, but it’s worth saying plainly rather than dressing it up. Next week’s honest questions carry over directly from this one: whether the newly-published problem-type URIs actually resolve and return the right HTTP status, whether mppx 0.16.0’s keyAuthorization handling is fully reflected outside the docs, and whether the Tempo-Moralis data link turns into anything payment-shaped.
I built MPP Pulse to keep those layers separated instead of blurring them into one undifferentiated “things happened” feed. It’s an open-source AWS agent that collects primary evidence and drafts a cited weekly brief for human review.