A primary-source review of MPP, Payment Auth, Tempo and HTTP 402 for the week ending September 6, 2026.
Last week still found a signature-contract fix and one new catalog entry underneath its “no new integrations” headline. This week doesn’t have anything underneath. The pulse signal is unambiguous: no verified new development. No new services, no new payment terms, no spec-behavior changes, no bugs caught — just four things happening entirely inside the build pipeline and the documentation, none of which touch what the protocol does or who’s using it.
Spec releases stop moving once they’re tagged
mpp-specs PR #341 changes how spec artifacts get published: each release is now tagged by its commit SHA rather than reusing a mutable latest tag, with the merged commit shipping alongside a run of spec-artifact releases built the same way.
This is a reproducible-builds fix, not a spec-content change — nothing about what the specification says moved this week, only how confidently anyone can point at a specific published version of it. That distinction matters more for a payment protocol than most: if two implementers pull artifacts tagged latest on different days and get different bytes, “we’re both implementing the same spec” stops being a claim you can verify. Tagging by commit SHA closes that gap. The report’s own “what to verify next” asks whether downstream tooling and deployment pipelines actually reflect the new convention yet — a correct source-of-truth change doesn’t help until everything still pointing at latest gets repointed to it.
CI keeps vendoring away third-party actions
The rest of this week’s mpp-specs activity continues a hardening thread that showed up in last week’s brief too, this time going further: mpp-specs PR #344 and PR #345 replace third-party GitHub Actions with vendored, pinned copies from tempoxyz/gh-actions; PR #343 swaps dawidd6/action-download-artifact for the official actions/download-artifact; and PR #339 updates the GitHub STS action used to mint short-lived tokens. The same pattern shows up over in the mpp repository, in mpp PR #953, alongside PR #952, which opens the broken-links issue with the gh CLI directly instead of a third-party action.
None of this is protocol work, and I’m not going to dress it up as some. But it’s the same instinct behind last week’s move to short-lived STS tokens for PR approval: fewer arbitrary third-party actions running with repository permissions is fewer places a supply-chain compromise could land. Unglamorous, and correctly left out of the report’s own headline.
Documentation catches up to mppx 0.9.2
mpp PR #949 syncs the docs to mppx 0.9.2, covering Stripe PaymentIntent options, Tempo fee sponsorship, CLI behavior, and x402 protocol selection. It arrives alongside a run of narrower doc fixes this week: PR #954 on payment extensions, PR #944 correcting protocol and CLI references, PR #943 fixing style-guide audit findings, PR #946 syncing Stripe payment options, and PR #958 syncing Stripe options and Tempo session nonces.
This is the same shape as the seven-pull-request doc sync from a couple of weeks back — documentation catching up to what the SDK already does, not a new capability shipping. Six pull requests is a fair amount of surface area for “the docs said something slightly wrong,” and I don’t have enough visibility from the PR record alone to say whether that’s mppx 0.9.2 introducing enough surface area to require this much reconciliation, or the previous docs pass not fully landing.
A proxy catalog that checks its own data before going live
mpp PR #955 reworks where the proxy catalog gets its data, sourcing it from a canonical discovery manifest and validating service IDs, domains, categories, and endpoints before anything reaches production.
This is infrastructure for the catalog, not a catalog change — no service was added or removed this week; TempVPN and everything else sit exactly where last week’s brief left them. What did change is that a malformed or incomplete manifest entry can no longer make it into the live proxy catalog unnoticed. The report’s “what to verify next” asks about load behavior and fallback when the live API fails, which is the right next question for something that just became a validation gate rather than a straight passthrough.
Two outside posts, named and left there
Two items in this week’s source ledger came from outside the primary repositories, and neither gets treated as a development: a Hacker News post describing Orthogonal, pitched as one integration for agents to discover and pay for APIs, and a blog post describing Coinbase-backed x402 payment access for AI agents. Both are self-reported, neither comes with a transaction record I can independently check, and both get the treatment I’ve given similar posts in past weeks: named as community signal worth another look if it resurfaces with evidence behind it, not counted as something that happened in MPP, Tempo, or x402 this week.
What I’m taking from the flattest week yet
Four things happened this week, and every one of them sat inside the build pipeline or the docs: spec releases are now immutable by commit SHA, CI keeps closing off third-party action dependencies, documentation caught up to mppx 0.9.2, and the proxy catalog now validates its own data before publishing it. None of that is a new integration, a new service, or a new payment term, and the report is honest about saying so up front rather than padding the executive signal to sound busier than it was. Last week’s open questions — a first paid TempVPN session, a WebMCP tool call actually charging money — are still open, and this week didn’t add any new ones. Whether that’s a good sign or just an artifact of a slow week isn’t something I can tell from four pipeline changes alone.
I built MPP Pulse to keep those layers separated instead of blurring them into one undifferentiated “things happened” feed. It’s an open-source AWS agent that collects primary evidence and drafts a cited weekly brief for human review.