Methodology: how every claim in the atlas is sourced and verified

Sources policy

Every factual claim on the site is a record with at least one source and a confidence. A source record names the URL, title, publisher, type, whether it is a primary source, the publication date when the publisher states one, and the date it was read (accessed). Claims are short sentences kept per protocol and cited from the page text; numbers carry an “as of” date.

Verified: a primary source was read during the build (spec text, schemas, the repository, official documentation or announcement, a standards-body record).
Reported: only reputable secondary sources support it. The claim is shown with a “reported” badge.
Unverified: shown only with a visible badge, or left out.

The order of preference is spec repositories, official documentation, official announcements, standards-body records, then reputable secondary sources. Field names, endpoints, headers and enums come from the cloned specification repositories, never from memory or blog posts. What a spec says is kept apart from what is deployed, and announced, pilot, beta and generally available are kept apart too. When sources disagree, both are kept, the primary one is named and the conflict is logged (see source conflicts). Spec text is linked, not copied; at most one short quotation per source appears across the site.

Verification method

A research pass per protocol builds the source registry and the claim pool from primary sources, then a writer drafts the page from those claims only.
An independent reviewer that did not write the page checks claims against sources, field names against the cloned schemas, dates, numbers and diagrams.
Scripts check the rest on every build: every claim points to existing sources, every source has an accessed date, the coverage thresholds per protocol, the style rules, the ASD-STE100 limits for the STE sections, every external link, and every publication against DataCite, Crossref, DOI resolution, arXiv or the publisher page.

Claims by confidence

1857

claims

94.1%

verified (1748)

reported

unverified

1008

sources (917 primary)

171

verified publications

224

full glossary terms (10 stubs not counted)

Claims per protocol by confidence, with freshness and coverage status
Protocol	Verified	Reported	Unverified	Total	Last verified	Coverage
ERC-8004	200	22	3	225	Verified 2026-10-11(verified under 30 days ago)	Pass
x402	227	17	6	250	Verified 2026-10-11(verified under 30 days ago)	Pass
Visa TAP	223	14	0	237	Verified 2026-10-11(verified under 30 days ago)	Pass
OpenAI ACP	238	5	5	248	Verified 2026-10-11(verified under 30 days ago)	Pass
UCP	225	5	5	235	Verified 2026-10-11(verified under 30 days ago)	Pass
Stripe MPP	205	3	3	211	Verified 2026-10-11(verified under 30 days ago)	Pass
AP2	202	4	2	208	Verified 2026-10-11(verified under 30 days ago)	Pass
Mastercard Agent Pay	228	14	1	243	Verified 2026-10-11(verified under 30 days ago)	Pass

Bar: solid for verified, striped for reported, the third segment for unverified. Freshness: a filled dot under 30 days since the last verification, a half dot from 30 to 90 days, a hollow dot over 90 days. Coverage report generated 2026-10-14.

What is still unverified

25 claims are unverified and 84 rest on secondary sources only. They appear on the pages with their badge. The unverified ones are listed here in full.

ERC-8004: 3 unverified

A self-described agent account reported in a GitHub issue on 2026-04-02 that about 50 of 119,675 agents had sustained activity. clm-erc-8004-158 (as of 2026-04-02)
No ERC3643 Association or Tokeny statement about AI agents or ERC-8004 was found in the pages searched. clm-erc-8004-182 (as of 2026-10-11)
No source was found for an October 2025 announcement that the spec was finalized; a community call agenda of 2025-10-22 speaks of a finalized spec while the ERC was in Review. clm-erc-8004-186 (as of 2026-10-11)

x402: 6 unverified

The Coinbase launch page for x402 could not be read (HTTP 403), so the launch partner list has no primary confirmation. clm-x402-007 (as of 2026-10-10)
The claim that all 15 tested facilitators violated at least one rule in arXiv:2607.19545 is not visible in the paper's abstract. clm-x402-140 (as of 2026-10-10)
The claim that the x402.org counter has been static since March 2026 could not be verified. clm-x402-196 (as of 2026-10-10)
Figures of about $1.59M in three days and 74,000 buyers by 2025-10-26 during the October 2025 memecoin spike could not be re-located in a source. clm-x402-208 (as of 2025-10-26)
The seed estimate that 25 to 30 percent of x402 activity is leaderboard farming has no located source. clm-x402-209 (as of 2026-10-10)
A browsingIOU object linking Visa TAP to HTTP 402 was not found in the cloned Visa TAP repository. clm-x402-216 (as of 2026-10-10)

OpenAI ACP: 5 unverified

No source read says the general ChatGPT payment sheet token is an allowance-scoped delegated token. clm-openai-acp-188 (as of 2026-10-11)
OpenAI has not published a fee rate for ChatGPT checkout. clm-openai-acp-193 (as of 2026-10-11)
No SPT price appears on the Stripe agentic commerce and SPT pages read on 2026-10-11. clm-openai-acp-197 (as of 2026-10-11)
No official ACP transaction volume, GMV or merchant count has been published by OpenAI, Stripe or the ACP project. clm-openai-acp-199 (as of 2026-10-11)
The 2026 SoK on agentic commerce security lists an Agent Commerce Protocol next to ERC-8183, which likely refers to Virtuals' protocol rather than OpenAI and Stripe's ACP. clm-openai-acp-231

UCP: 5 unverified

No public registry, indexer or explorer of UCP businesses was found as of 2026-10-11. clm-ucp-156 (as of 2026-10-11)
Google and the UCP project publish no merchant counts or transaction volumes for UCP as of 2026-10-11. clm-ucp-186 (as of 2026-10-11)
Google publishes no fee schedule for UCP checkout; because the merchant stays merchant of record and uses its own PSP, its normal processing fees presumably apply. This is an inference, not a published statement. clm-ucp-190 (as of 2026-10-11)
Production use of AP2 mandates inside UCP, or anywhere else, is unverified as of 2026-10-11. clm-ucp-197 (as of 2026-10-11)
Which card network's agentic token, if any, flows inside a Google Pay handler in UCP is not published. clm-ucp-204 (as of 2026-10-11)

Stripe MPP: 3 unverified

Whether Stripe charges a percentage fee on MPP stablecoin payments received through deposit addresses is unverified. clm-stripe-mpp-166 (as of 2026-10-11)
No public fee schedule for Stripe Shared Payment Tokens was found. clm-stripe-mpp-168 (as of 2026-10-11)
No Tempo or Mastercard page confirming that Agent Pay for Machines is MPP-compatible could be found, so that claim is unverified. clm-stripe-mpp-190 (as of 2026-10-11)

AP2: 2 unverified

No FIDO specification or public draft based on AP2 was found as of 2026-10-11. clm-ap2-021 (as of 2026-10-11)
Production use of AP2 mandates is unverified anywhere, including inside UCP. clm-ap2-139 (as of 2026-10-11)

Mastercard Agent Pay: 1 unverified

An unattributed inline answer in Verifiable Intent issue 15 says liability shift work for the Agent Pay Acceptance Framework is ongoing. clm-mastercard-agent-pay-180 (as of 2026-03-27)

Link and citation checks

Link check of 2026-10-14: 1162 external URLs, 1120 answered, 42 warnings (bot blocking or server errors from hosts known to block scripts) and 0 failures.

Links that did not answer cleanly
Outcome	Host	Reason	Used by
Warning	slack.x402.org	HTTP 403 from a known bot-blocking host	`res-x402-slack`
Warning	bscscan.com	HTTP 403 (Cloudflare challenge)	`src-erc-8004-chain-probe-verifier`
Warning	doi.org	HTTP 403 (Cloudflare challenge)	`pub-pass-2015-decentralized`
Warning	doi.org	HTTP 403 (Cloudflare challenge)	`pub-resnick-2000-reputation, src-pub-resnick-2000`
Warning	doi.org	HTTP 403 (Cloudflare challenge)	`pub-sun-2024-zkllm`
Warning	doi.org	HTTP 403 (Cloudflare challenge)	`pub-venugopalan-2025-fpinconsistent`
Warning	doi.org	HTTP 403 (Cloudflare challenge)	`pub-kamvar-2003-eigentrust, src-pub-eigentrust-2003`
Warning	doi.org	HTTP 403 (Cloudflare challenge)	`pub-rochet-2003-platform, src-ucp-doi-rochet-tirole`
Warning	doi.org	HTTP 403 (Cloudflare challenge)	`pub-rochet-2002-cooperation, src-mcap-doi-rochet`
Warning	fidoalliance.org	HTTP 504 (server error)	`res-mcap-podcast`
Warning	finance.yahoo.com	network error or timeout: fetch failed: Headers Overflow Error	`src-market-ms-yahoo`
Warning	finance.yahoo.com	network error or timeout: fetch failed: Headers Overflow Error	`src-stripe-mpp-yahoo-fee`
Warning	jamesbachini.com	HTTP 522 (server error)	`src-x402-learn-bachini`
Warning	medium.com	HTTP 403 (Cloudflare challenge)	`res-ap2-mysore`
Warning	openai.com	HTTP 403 (Cloudflare challenge)	`res-openai-acp-buy-it, src-openai-buy-it`
Warning	openai.com	HTTP 403 (Cloudflare challenge)	`res-openai-acp-discovery, src-openai-product-discovery`
Warning	openbankingtracker.com	HTTP 429 from a known bot-blocking host	`src-policy-obt-psd3`
Warning	paymentexpert.com	HTTP 403 (Cloudflare challenge)	`src-policy-paymentexpert-injunction`
Warning	research.4pillars.io	HTTP 429 from a known bot-blocking host	`res-x402-4pillars, src-x402-4pillars`
Warning	venturebeat.com	HTTP 429 from a known bot-blocking host	`res-venturebeat-tap`
Warning	www.americanexpress.com	network error or timeout: fetch failed: Headers Overflow Error	`src-orbit-amex-agentic-page`
Warning	www.dlapiper.com	HTTP 429 from a known bot-blocking host	`src-policy-dlapiper-c15`
Warning	www.fintechfutures.com	HTTP 403 (Cloudflare challenge)	`src-prehistory-emvco-token-news`
Warning	www.npmjs.com	HTTP 403 (Cloudflare challenge)	`src-npm-chaoschain`
Warning	www.npmjs.com	HTTP 403 (Cloudflare challenge)	`src-orbit-interledger-op-npm`
Warning	www.npmjs.com	HTTP 403 (Cloudflare challenge)	`src-npm-lucid-agents`
Warning	www.npmjs.com	HTTP 403 (Cloudflare challenge)	`src-ucp-npm`
Warning	www.npmjs.com	HTTP 403 (Cloudflare challenge)	`res-x402-npm-core, src-x402-npm-core`
Warning	www.npmjs.com	HTTP 403 (Cloudflare challenge)	`src-npm-agent0-sdk`
Warning	www.npmjs.com	HTTP 403 (Cloudflare challenge)	`res-openai-acp-svix, src-svix-acp-types`
Warning	www.npmjs.com	HTTP 403 (Cloudflare challenge)	`src-npm-create-8004-agent`
Warning	www.npmjs.com	HTTP 403 (Cloudflare challenge)	`src-npm-mpp-card, src-stripe-mpp-sdk-registries`
Warning	www.npmjs.com	HTTP 403 from a known bot-blocking host	`src-stripe-mpp-mpp-card-pkg`
Warning	www.npmjs.com	HTTP 403 (Cloudflare challenge)	`res-stripe-mpp-npm-mppx, src-stripe-mpp-npm-mppx`
Warning	www.npmjs.com	HTTP 403 (Cloudflare challenge)	`src-x402-npm-legacy`
Warning	www.retailtouchpoints.com	HTTP 403 from a known bot-blocking host	`res-retailtouchpoints-visa`
Warning	www.theblock.co	HTTP 403 (Cloudflare challenge)	`src-orbit-circle-arc-theblock`
Warning	www.theblock.co	HTTP 403 (Cloudflare challenge)	`src-orbit-tempo-testnet-theblock`
Warning	www.theblock.co	HTTP 403 (Cloudflare challenge)	`src-x402-stripe-coverage`
Warning	www.theblock.co	HTTP 403 (Cloudflare challenge)	`src-x402-agentic-wallets-coverage`
Warning	www.theblock.co	HTTP 403 (Cloudflare challenge)	`res-mcap-theblock`
Warning	www.theblock.co	HTTP 403 (Cloudflare challenge)	`src-orbit-kite-launch`

Citation check of 2026-10-14: 171 publications re-verified by title and first author, 170 ok, 1 unreachable.

pub-schumacher-2025-mckinsey: unreachable

Known gaps

10 glossary terms are stubs without sourced definitions (list).
The controls map has no hand-written notes on the independent controls layer yet; the annotations there are derived from the cells and labeled as derived.
Radar scores are editorial judgments made from cited sources, not measurements.

Blocked sources

Pages that refused automated reads (49 entries), with the alternative used for each.

2026-10-10, publications part b (commerce and benchmarks; security; reputation and Sybil)

dblp.org search API: anti-bot challenge page returned instead of JSON for every query, some requests timed out. Alternative used: OpenReview, proceedings.neurips.cc, doi.org content negotiation, Semantic Scholar (secondary only).
dl.acm.org: HTTP 403 for 10.1145/355112.355122 (Resnick 2000) and 10.1145/775152.775242 (Kamvar 2003). Alternative used: doi.org CSL JSON for metadata, OpenAlex for abstracts.
sciencedirect.com: HTTP 403 for 10.1016/j.dss.2005.05.019 (Josang 2007). Alternative used: authors’ preprint PDF at folk.universitetetioslo.no.
link.springer.com: served no abstract for 10.1007/3-540-45748-8_24 (Douceur 2002). Alternative used: Microsoft Research publication page.
api2.openreview.net: 403 “Challenge verification required” after about ten requests; WebArena, tau-bench and WASP records captured before the block.
proceedings.neurips.cc 2025 listing incomplete (64 entries) on the access date; WASP venue confirmed via OpenReview instead.
escience-conference.org/2026/papers: reachable; accepted list does not include arXiv:2609.19502 despite the arXiv comment. Venue left unconfirmed.
2026-10-11, ap2: https://fidoalliance.org/fido-alliance-to-develop-standards-for-trusted-ai-agent-interactions/: curl returned HTTP 403; alternative used: WebFetch of the same URL (succeeded).
2026-10-11, ucp: https://www.warren.senate.gov/?p=31789 and /newsroom/news-coverage/…: HTTP 403; alternative used: eWeek 2026-02-05 coverage (letter marked reported)
2026-10-11, ucp: https://www.searchenginejournal.com/ (UCP March update article): HTTP 403; alternative used: techwyse.com coverage (reported)
2026-10-11, ucp: https://searchengineland.com/google-opens-native-ai-checkout-to-eligible-shopify-merchants-490407: HTTP 403; alternative used: ppc.land 2026-09-23 (reported)
2026-10-11, openai-acp: https://openai.com/index/buy-it-in-chatgpt/ and https://openai.com/index/powering-product-discovery-in-chatgpt/: HTTP 403 to curl and WebFetch; alternative used: Wayback Machine snapshots 20261007012440 and 20260929220135 (text read from the archived HTML).
2026-10-11, ucp: https://fidoalliance.org/google-donates-agent-payments-protocol-to-fido-alliance/: HTTP 403; alternative used: Google blog 2026-04-28 post
2026-10-11, erc-8004: https://www.fireblocks.com/blog/agentic-payment-protocols-compared: HTTP 403 to curl; alternative used: none needed (cross-cutting resource left out of the ERC-8004 list)
2026-10-11, erc-8004: https://docs.polygon.technology/payment-services/agentic-payments/erc8004: HTTP 404; alternative used: agentic-docs.polygon.technology page (200), not cited
2026-10-11, erc-8004: eth_getLogs over 10,000-block ranges on mainnet.base.org and base-rpc.publicnode.com: errors or empty responses; alternative used: eth_estimateGas through cast for gas figures
2026-10-11, erc-8004: https://agentscan.info: counts render client-side, no numbers in HTML; alternative used: 8004scan.io and the CSOAI census for metrics
2026-10-11, visa-tap: https://investor.visa.com/news/news-details/2025/Akamai-and-Visa-Collaborate-to-Build-Trust-in-Agentic-Commerce/default.aspx: curl HTTP 403; alternative used: Akamai press release (WebFetch) and Visa 2025-12-18 release.
2026-10-11, visa-tap: https://www.businesswire.com/news/home/20260703072567/en (eDreams ODIGEO): curl HTTP/2 stream error and WebFetch HTTP 403; alternative used: secondary coverage found by search (marked reported).
2026-10-11, visa-tap: https://merchantcostconsulting.com/?p=8876: curl and WebFetch HTTP 403; alternative used: the follow-up research brief Appendix B summary (claim marked reported).
2026-10-11, visa-tap: https://www.mastercard.com/us/en/news-and-trends/stories/2025/agentic-commerce-framework.html: curl HTTP 403 (developer.mastercard.com Agent Pay page renders client-side, no text); alternative used: search excerpts of Mastercard pages (claims marked reported).
2026-10-11, stripe-mpp: https://www.theblock.co/post/394131/tempo-mainnet-goes-live-with-machine-payments-protocol-for-agents: HTTP 403 to curl; alternative used: tempo.xyz/blog/mainnet (primary)
2026-10-11, stripe-mpp: thedefiant.io and fireblocks.com resource pages: HTTP 403 to curl HEAD (bot blocking); alternative used: kept Appendix A entries (opened 2026-10-10) with a note
2026-10-11, stripe-mpp: mastercard.com AP4M press release and businesswire.com copy: HTTP 403 to curl and WebFetch; alternative used: ecommercenews.co.nz, electronicpaymentsinternational.com and thepaypers.com coverage (secondary)
2026-10-11, mastercard-agent-pay: www.mastercard.com (Agent Pay product page, agentic-commerce-framework story, verifiable-intent story, press pages): HTTP 403 to curl and WebFetch; alternative used: Mastercard Investor Relations PDFs on s25.q4cdn.com, newsroom.mastercard.com copies, and developer.mastercard.com markdown sources.
2026-10-11, mastercard-agent-pay: investor.mastercard.com: HTTP 403; alternative used: s25.q4cdn.com PDF copies of the same releases.
2026-10-11, mastercard-agent-pay: www.businesswire.com: HTTP/2 stream error; alternative used: Investor Relations PDFs (Business Wire text).
2026-10-11, mastercard-agent-pay: developer.mastercard.com/mastercard-checkout-solutions/documentation/use-cases/agent-pay/ (markdown source returns 404; the HTML is a JavaScript shell); alternative used: release-history page and Merchant Cloud tutorial pages.
2026-10-11, mastercard-agent-pay: agentpay-key-directory.mastercard.com: NXDOMAIN (host shown in a Mastercard developer guide example does not resolve); no alternative.
2026-10-11, mastercard-agent-pay: merchantcostconsulting.com/?p=8876, theblock.co/post/404288, fireblocks.com blog, digitalcommerce360.com, fidoalliance.org podcast page: HTTP 403 to curl (and WebFetch for Merchant Cost Consulting); alternative used: Appendix B and Appendix A entries of the follow-up research brief (opened 2026-10-10), marked reported.
2026-10-11, openai-acp: https://www.digitalcommerce360.com/2026/03/06/openai-shifts-checkout-plans-agentic-commerce-strategy/ (and /amp/, and the 2026-03-24 article): HTTP 403; alternative used: retail-systems.com article dated 2026-03-10 (reported).
2026-10-11, openai-acp: https://docs.paypal.ai/growth/agentic-commerce/agent-ready: HTTP 404; no alternative needed.
2026-10-11, openai-acp: https://4pillars.io/en/issues/acp-the-future-of-agentic-division-of-labour: HTTP 429; alternative used: https://whitepaper.virtuals.io/.
2026-10-11, orbit-b: https://www.courtlistener.com/docket/71874820/amazoncom-services-llc-v-perplexity-ai-inc/ (district docket page): HTTP 403; CourtListener REST API v4 docket endpoints require authentication. Alternative used: CourtListener search API (case numbers and filing dates), the Ninth Circuit opinion PDF (cdn.ca9.uscourts.gov, read with a local text extractor), and GeekWire and Decrypt coverage for the 2026-03-09 order date (reported).
2026-10-11, orbit-b: https://www.nasdaq.com/press-release/american-express-debuts-agentic-commerce-experiences-acetm-developer-kit-and: WebFetch timed out; alternative used: search summaries of the release and the americanexpress.com agentic commerce page (facts limited to those summaries).
2026-10-11, orbit-b: https://lightning.engineering/posts/ (Lightning Labs blog index): HTTP 404, and guessed post URLs return empty shells; alternative used: lightninglabs/L402 commit history for the LSAT to L402 rename date.
2026-10-11, policy: https://www.warner.senate.gov/?p=36442: HTTP 403 (Akamai) to curl and WebFetch; alternative used: the letter PDF hosted by Punchbowl News (text layer not extractable locally) plus press summaries (marked reported).
2026-10-11, policy: https://sso.agc.gov.sg (Payment Services Act 2019, PDPA 2012): HTTP 403 to curl; statements kept at reported or instrument level.
2026-10-11, policy: https://eur-lex.europa.eu consolidated MiCA HTML (CELEX 02023R1114): HTTP 202 with an empty body (bot check); alternative used: AMF page relaying ESMA (2026-06-23). The OJ HTML for Regulation (EU) 2026/1744 did load.
2026-10-11, market: https://www.mckinsey.com (agentic commerce report): curl HTTP/2 stream error and WebFetch timeout; alternative used: search extracts of the McKinsey page and PDF link (date kept at month precision).
2026-10-11, market: https://www.digitalcommerce360.com (Morgan Stanley and Bain coverage): HTTP 403; alternative used: search extracts; Bain figures from bain.com (page date read).
2026-10-11, fees: https://docs.stripe.com/agentic-commerce/concepts: HTTP 404; alternative used: https://docs.stripe.com/agentic-commerce/concepts/shared-payment-tokens.
2026-10-11, fees: https://payai.network/pricing: HTTP 404; alternative used: https://docs.payai.network/x402/facilitators/pricing and https://facilitator.payai.network/.
2026-10-11, pubs-c: https://www.imf.org/en/publications/imf-notes/issues/2026/04/22/how-agentic-ai-will-reshape-payments-575560: HTTP 403 to curl; alternative used: DOI 10.5089/9781513533308.068 (Crossref search, DOI content negotiation) and the bookstore.imf.org redirect to elibrary.imf.org.
2026-10-11, pubs-c: https://www.mckinsey.com (agentic commerce report page and PDF): curl timeout and WebFetch timeout; alternative used: the McKinsey-owned mirror karriere.mckinsey.de (title, date, authors, figures).
2026-10-11, pubs-c: https://www.bain.com (press release and 2030 forecast Snap Chart): HTTP 403 to curl; alternative used: WebFetch of the same bain.com pages, which succeeded.
2026-10-11, pubs-c: https://www.mastercard.com/us/en/news-and-trends/Insights/2026/mastercard-agentic-commerce-trust-white-paper.html (and the /am/en and /global/en variants): HTTP 403 to curl and WebFetch; alternative tried: the 2026-09-30 Investor Relations release PDF on s25.q4cdn.com (names the Trust Framework, links no white paper). Seed entry left unverified.
2026-10-11, pubs-c: https://export.arxiv.org/api/query: HTTP 429 after about 25 search requests at 0.5 s spacing; resumed after a pause with 3 s spacing.
2026-10-11, pubs-c: https://datatracker.ietf.org/api/v1/doc/documentauthor/?document=: returned no object list for the filter used; alternative used: author lines in the draft text at ietf.org/archive/id.

Source conflicts

75 conflicts between sources, with the source treated as primary.

Source conflicts found while building. Both sources are kept on the site; the primary one is named.

2026-10-10, x402scan operator: one research note marked the operator unverified; the repository Merit-Systems/x402scan (Apache-2.0) names Merit Systems. Kept “Merit Systems” with the repository as the primary source (the follow-up research brief 2.1.15).
2026-10-10, x402 license: the seed said docs are CC-BY-4.0 with DCO sign-off; the repository has only an Apache-2.0 LICENSE and CONTRIBUTING.md requires GPG-signed commits. The repository is primary; the seed claim is dropped.
2026-10-11, x402 V1 legacy packages: the follow-up research brief 2.1.13 says only npm x402 and x402-express are V1 legacy; the x402 repository at f8f8330 keeps six V1 packages in typescript/packages/legacy/ (x402, x402-axios, x402-express, x402-fetch, x402-hono, x402-next) and the migration guide maps x402-axios and x402-fetch to @x402/* too. The repository is primary. Kept the correction’s real point (PyPI x402 2.x is V2, not legacy) and listed all six npm legacy packages (claim clm-x402-039).
2026-10-11, x402 PayAI fee: the follow-up research brief Appendix B says PayAI charges $0.001 per settlement “after the first 1,000”; the cited Wavect comparison (2026-07-12) says 1,000 settlements free in total, not per month. Secondary only; verify on PayAI’s own page.
2026-10-11, ap2 step-up: the v0.2 normative documents (docs/ap2/*.md at e1ea56d) define no step-up and route failures through unresolved_constraint; the non-normative Executive Summary (docs/overview.md, same commit) still says any party may challenge with 3DS2. The normative spec is primary; correction 2.1.10 stands, with the Executive Summary text noted as legacy wording.
2026-10-11, ap2 FIDO payments group name: FIDO’s 2025-04-29 release launched a “Payments Working Group (PWG)” co-chaired by Visa and Mastercard; the 2026-04-28 release says “Payments Technical Working Group”, chaired by Mastercard and Visa. No source says whether this is a rename. Both kept; the group is treated as pre-existing (correction 2.1.11).
2026-10-11, ap2 Checkout JWT signature rule: specification.md forbids deterministic signatures (for example Ed25519) for the Checkout JWT; security_and_privacy_considerations.md allows them with a salt of sufficient entropy. Both are AP2 v0.2 text; issue 268 (open) tracks the fix. Show both.
2026-10-11, ap2 receipt field: agent_authorization.md defines the Mandate Receipt field result with values success and error; payment_receipt.json and checkout_receipt.json use status with Success and Error (issue 374). Field tables follow the schemas.
2026-10-11, ap2 reference constraint key: security_and_privacy_considerations.md writes mandate.payment.reference; open_payment_mandate.json defines payment.reference. The schema is primary.
2026-10-11, ap2 amount units: open_payment_mandate.json types payment.amount_range max and min as integers in minor units, but the payment_mandate.md example uses 100.50 and 10.00; payment.budget max is a number with no unit and an example of 1000.00. The schema is primary for amount_range; budget’s unit is unresolved.
2026-10-11, ap2 launch partner name: the Google Cloud launch post (2025-09-16) names “Ant International”; docs/partners.md at the launch commit e66fc0b lists “Ant Group”. Keep the launch post wording for the launch list.
2026-10-11, ap2 SD-JWT date: AP2’s normative reference dates SD-JWT (RFC 9901) “February 2025”; rfc-editor.org gives November 2025. The RFC Editor is primary.
2026-10-11, ucp Shopping TC roster: the UCP announcement of 2026-04-24 names “Greg Smith (Amazon)”; MAINTAINERS.md at 95b77fd lists Greg Smith (Google) and Jordan Williams (Amazon). MAINTAINERS.md is the current roster; both shown.
2026-10-11, ucp AP2 naming: the ucp.dev “UCP and AP2” page describes a checkoutSignature and a CheckoutMandate holding a checkout hash; the v2026-08-25 schema uses ap2.merchant_authorization and a checkout_mandate that contains the full checkout. The schema is primary.
2026-10-11, ucp release notes: v2026-08-25 notes say ap2_mandates; the schema name is dev.ucp.common.payment.ap2_mandate. The schema is primary.
2026-10-11, ucp Microsoft tense: Microsoft’s agentic commerce page says “MMC will support” UCP; trade press reports UCP feeds generally available in the US from April 2026. Microsoft’s page is primary; its tense is used.
2026-10-11, ucp Scenario 3: the follow-up research brief suggests “a Google Pay handler that returns a network token”; Google’s UCP FAQ says only PAN_ONLY is used for allowed_auth_methods on Google AI surfaces. The FAQ is primary.
2026-10-11, ucp capability versioning: the v2026-08-25 release notes say “independent capability versioning”; the normative overview pins dev.ucp.* capability versions to the release date and lets only third-party extensions version independently. The spec is primary.
2026-10-11, erc-8004 contracts license: Solidity files in erc-8004-contracts carry SPDX-License-Identifier: MIT (SingletonFactory.sol is CC0-1.0); the README “License” section says “CC0 - Public Domain”; GitHub detects no license file. Use “MIT per file headers; README says CC0”.
2026-10-11, erc-8004 tradingYield example: the spec (ERCS/erc-8004.md) encodes -3.2% as value -32, valueDecimals 1; the best-practices Reputation.md table “copied from the spec” shows 32. The spec is primary.
2026-10-11, erc-8004 Validation Registry deployment: the contracts README lists no Validation Registry address and calls that part of the spec under discussion; eth_call on 2026-10-11 shows a proxy at 0x8004Cc8439f36fd5F9F049D9fF86523Df6dAAB58 (the mainnet address in scripts/addresses.ts) on Ethereum and Base returning getVersion 2.0.0 and the Identity Registry address. Wording: “specified, not officially deployed”.
2026-10-11, erc-8004 network count: 8004scan.io shows 30 networks; the official README lists 25 mainnets (Ethereum plus 24). 8004scan’s count may include testnets or community deployments.
2026-10-11, erc-8004 registration cost: QuickNode (2026) “costs dollars” on mainnet and Cobo (2026-04-28) $1 to $5; eth_estimateGas on 2026-10-11 gives about 203,412 gas, which at 0.067 gwei is cents. Not a contradiction once dated; always show the date.
2026-10-11, erc-8004 agent id start: contracts commit of 2025-10-11 moved to 1-indexed agent ids; the current IdentityRegistryUpgradeable mints id 0 first and ownerOf(0) resolves on Ethereum. The deployed code is primary.
2026-10-11, erc-8004 testnet Validation address removal date: the initial research brief says 2026-01-08; README history shows the address list replaced by “TBC” on 2026-01-06 (f111c84) and the 2026-01-08 list without Validation addresses. Use 2026-01-06.
2026-10-11, erc-3643 latest tag: the ERC-3643/ERC-3643 repo marks 4.1.3 (2025-06-12) as latest; the archived TokenySolutions/T-REX repo has 4.1.6 (2024-10-18) plus later betas. Cite both with their repositories.
2026-10-11, visa-tap license: sample source files carry “(c) 2025 Visa” plus MIT-style permission text, while LICENSE.md binds users to the Visa Developer Center Terms and the TAP Product Terms (2025-10-10). Primary: LICENSE.md and the Product Terms.
2026-10-11, visa-tap “TAP headers optional”: the follow-up research brief 2.1.12 dates draft-card-charge-00 to 2026-10-05; the draft has no date field and the GitHub history of tempoxyz/mpp-specs shows the sentence in every version since the file’s first commit on 2026-01-05. Primary: the GitHub file history; 2026-10-05 is the snapshot date.
2026-10-11, visa-tap Cloudflare example: the 2025-10-24 Cloudflare post’s checks require agent-browser-auth or agent-payer-auth, but its example request uses tag="web-bot-auth". Primary: the Visa specification.
2026-10-11, visa-tap directory name: Visa’s 2026-06-10 release says “Agentic Directory” in the body and “Agentic Registry” in the subheadline; the 2026-07-02 release says “Agent Directory”. Primary: the 2026-06-10 body text.
2026-10-11, visa-tap key store: the spec’s examples use an Ed25519 keyid and point to https://mcp.visa.com/.well-known/jwks; the live JWKS holds one RSA key (sandbox CA, CN vic-oauth-jwe.visa.com). Both recorded.
2026-10-11, visa-tap liability: stellagent.ai (2026-04) says TAP-approved transactions can shift chargeback liability to Visa; Worldpay (2026-07-30) says no liability shift exists. No Visa source states a shift; Worldpay kept.
2026-10-11, openai-acp create request items: RFC-AC 4.1 and the 2026-04-17 OpenAPI request examples send items: [{id, quantity}] (one schema-level example uses product_id); the 2026-01-30 and 2026-04-17 JSON Schema and OpenAPI schema require line_items of Item (id, name, unit_amount, no quantity, additionalProperties: false). The schema is primary; the repository’s own examples file uses line_items: [{id}]. Seed drift note confirmed and widened.
2026-10-11, openai-acp completion status: ACP OpenAPI returns 200 on POST /checkout_sessions/{id}/complete; OpenAI’s production checklist says 201 Created. Spec primary for ACP; OpenAI docs primary for ChatGPT.
2026-10-11, openai-acp idempotency conflict: ACP RFC 6.4 uses 422 idempotency_conflict and 409 idempotency_in_flight; OpenAI’s checklist says idempotency_conflict with 409.
2026-10-11, openai-acp TLS: RFC-AC section 7 says TLS 1.3 MUST; OpenAI’s production guide says TLS 1.2 or later on port 443.
2026-10-11, openai-acp webhook names: ACP spec order_create and order_update; OpenAI docs say order_created, order_updated and ORDER_UPDATE.
2026-10-11, openai-acp feed paths: ACP 2026-04-17 Feed API uses /feeds...; OpenAI’s docs use /product_feeds... and add a promotions API that ACP deferred.
2026-10-11, openai-acp Delegate Payment signing: RFC-DP 2.2 says the client MUST sign and send Timestamp; the same RFC’s header list says RECOMMENDED and the OpenAPI marks both optional. Seed “signing is mandatory” kept only as “the RFC text says MUST in one section”.
2026-10-11, openai-acp order status: the 2026-04-17 changelog lists delivered; the 2026-04-17 schema (edited after release by PR #232 on 2026-05-01) lists completed. Schema primary; post-release edit noted.
2026-10-11, openai-acp decimal quantity: the 2026-04-17 changelog says Item.quantity became number; only spec/2025-09-29 has that type.
2026-10-11, openai-acp MCP idempotency: docs/mcp-binding.md keeps meta.idempotency_key optional and the request_not_idempotent type, which REST 2026-04-17 replaced with a required header and removed.
2026-10-11, openai-acp misc: checkout OpenAPI describes Signature as “HMAC signature for webhook verification” (RFC: detached signature over canonical JSON); RFC-DP marks virtual REQUIRED (schema: optional); the 2026-01-30 changelog deprecates a nonexistent 2026-01-22; its discount example uses namespace: dev.acp.discount while schemas use name: discount.
2026-10-11, openai-acp CLA “nekuda”: the seed lists nekuda as a corporate CLA signatory; legal/cla/SIGNATORIES.md names OpenCommerce Network Inc., with a dean-harel-nekuda-ai GitHub user. The file is primary.
2026-10-11, openai-acp authentication_required: the seed dates it to 2026-01-30; the JSON Schema has it from 2025-12-12. Schema primary.
2026-10-11, stripe-mpp IETF status wording: mpp.dev governance says the core is “submitted to the IETF standards track”; the Datatracker lists draft-httpauth-payment as an individual submission with no stream and no intended status (front matter says category: std). The Datatracker is primary; describe it as an individual Internet-Draft.
2026-10-11, stripe-mpp session intent status: the mpp.dev blog (2026-06-17) says sessions “are now a formal MPP intent” and links mpp-specs PR #280; PR #280 closed unmerged on 2026-09-28 and specs/intents/ holds only charge and subscription. The repository is primary; session stays a per-method (experimental per CONTRIBUTING) intent.
2026-10-11, stripe-mpp Tempo chain id defaults: draft-tempo-charge-00 defaults chainId to 42431, draft-tempo-session-00 to 4217, and draft-tempo-subscription-00 says “42431 (Tempo mainnet)”. Tempo’s connection-details page gives 4217 mainnet and 42431 Moderato testnet. Tempo docs are primary for the ids; the subscription spec label is an error.
2026-10-11, stripe-mpp MPPScan figure date: the seed dates “about 4M transactions, about $435K” to Merit Systems on 2026-06-24; the Merit glossary’s “Updated June 24, 2026” is the article date while its stats widget is live (hourly) and matches the 2026-10-11 all-time API values. Use 2026-10-11 as the as-of date; the June value is unconfirmed (a search summary suggested about 2.3M and $314.4K).
2026-10-11, stripe-mpp Visa card method and TAP (correction 2.1.12): the follow-up says “TAP headers optional” comes from draft-card-charge-00 dated 2026-10-05. The optional-TAP sentence is present in the file at the public init commit (2026-03-18) and unchanged since; 2026-10-05 is only the date of the mpp-specs head commit read. Visa’s 2026-03-18 post says the spec and SDK are built on Visa Intelligent Commerce and TAP, and the mpp-card 0.1.8 package has no TAP code. Keep both facts with their own sources: the spec (primary for protocol behavior) makes TAP headers optional from the start; Visa’s announcement frames the offering as built on VIC and TAP.
2026-10-11, stripe-mpp launch partners: the seed calls Anthropic, DoorDash, Mastercard, Nubank, OpenAI, Ramp, Revolut, Shopify, Standard Chartered and Visa MPP design partners; Tempo’s mainnet post names them as Tempo partners for stablecoin workloads and calls only Visa an MPP design partner. Tempo’s post is primary.
2026-10-11, orbit-b Amazon v. Perplexity appeal date: the initial research brief Section 6 says the Ninth Circuit vacatur was “reported 2026-08-05”; the opinion in No. 26-1444 (cdn.ca9.uscourts.gov/datastore/opinions/2026/08/04/26-1444.pdf) is dated 2026-08-04 (argued and submitted 2026-06-11). The opinion is primary; use 2026-08-04.
2026-10-11, orbit-b L402 status: bLIP-0026 front matter says “Status: Active”, but lightning/blips PR #26 is still open and unmerged (gh api 2026-10-11), and its 2026-02-25 rewrite (token-agnostic, token=, version="0") differs from the lightninglabs/L402 master text, which reverted to macaroon= on 2026-03-20. Show both; neither is a ratified standard.
2026-10-11, orbit-b NPCI ChatGPT pilot date: Razorpay’s newsroom page carries datePublished 2025-10-30, while news coverage and the joint announcement are dated 2025-10-09. Use 2025-10-09 for the announcement; the page timestamp is a web publication date.
2026-10-11, orbit-b MPP expansion: Nevermined’s Payments Facilitator docs expand MPP as “Merchant Payment Protocol”; the MPP specs repository (primary) names it the Machine Payments Protocol.
2026-10-11, mastercard-agent-pay Web Bot Auth tag: Cloudflare’s 2025-10-24 post says TAP and Agent Pay tags signal browsing or paying (agent-browser-auth, agent-payer-auth); Mastercard’s Level 1 developer guide says Mastercard uses Agent-pay-auth and the browse and pay values are Visa’s; Mastercard’s testing glossary spells it agent-pay-auth. Mastercard’s guide is primary for Mastercard; letter case unresolved.
2026-10-11, mastercard-agent-pay DTVC: Mastercard’s MVCT overview says “Dynamic Token Validation Code”; its MVCT test cases say “Dynamic Token Verification Code”. Both primary; same artifact.
2026-10-11, mastercard-agent-pay VI versions: CHANGELOG 0.1.0 dated 2026-02-19, tag v0.1.0 on a 2026-03-05 commit, breaking renames on main 2026-04-20 (PR #23) without a version bump; CHANGELOG says five constraint types, spec registers eight. The AP2 dossier’s “same vct values as AP2 v0.2” holds for main, not for tag v0.1.0.
2026-10-11, mastercard-agent-pay AP4M and MPP (follow-up 2.1.2): the MPP compatibility statement is Tempo’s quote inside Mastercard’s 2026-06-10 AP4M release; Mastercard’s own text makes no MPP claim; no Tempo page listing AP4M found.
2026-10-11, mastercard-agent-pay Acceptance Framework date: seed 2025-10-14; Mastercard (2025-12-03 release) says “launched in October 2025”; Cloudflare’s post is 2025-10-24. Day unknown.
2026-10-11, mastercard-agent-pay VI supporters: PYMNTS (2026-03-05) lists Google, Fiserv, IBM, Checkout.com, Basis Theory, Getnet; Mastercard developer guides list Google, IBM, Fiserv, Checkout.com, Worldpay, Adyen.
2026-10-11, mastercard-agent-pay key directory: the Mastercard guide’s example host agentpay-key-directory.mastercard.com returns NXDOMAIN; Cloudflare names no Mastercard directory URL.
2026-10-11, mastercard-agent-pay MDES: Eco’s explainer says agentic tokens come from MDES; Mastercard pages read say “tokenization” only (follow-up 2.2). Mastercard primary.
2026-10-11, mastercard-agent-pay VI duplicate digests: VI spec examples list each L2 mandate digest in both _sd and delegate_payload; RFC 9901 says a digest MUST NOT appear more than once and verifiers MUST reject (issue #29, open). RFC 9901 primary for SD-JWT.
2026-10-11, x402 who pays gas: the follow-up research brief 3.3 suggests “payer pays gas (x402 EVM default)” for the compare row; specs/schemes/exact/scheme_exact_evm.md and docs/core-concepts/facilitator.md (f8f8330) have the facilitator broadcast the EIP-3009 or Permit2 settlement and pay the gas, and on Solana the facilitator (or a sponsoring merchant) is fee payer. The spec is primary; the x402 who-pays cell reads “Facilitator pays gas; seller pays the facilitator fee”.
2026-10-11, x402 facilitator timeout: the dossier says the TypeScript facilitator client times out after 30 seconds; typescript/packages/core/src/http/httpFacilitatorClient.ts at f8f8330 sets DEFAULT_TIMEOUT_MS = 90_000. The code is primary (claim clm-x402-246).
2026-10-11, x402 error code names: the spec (section 9) lists codes such as insufficient_funds and invalid_exact_evm_payload_recipient_mismatch; the TypeScript exact EVM facilitator emits invalid_exact_evm_insufficient_balance, invalid_exact_evm_recipient_mismatch and invalid_exact_evm_nonce_already_used. Both shown (claims clm-x402-243, clm-x402-244).
2026-10-11, fees PayAI (errata R7): the follow-up research brief Appendix B says “$0.001 per settlement after the first 1,000” (read as monthly). PayAI’s pricing docs (primary, read 2026-10-11) say cost-plus pricing since 2026-09-21: gas plus 30 percent in $0.001 credits, with 1,000 free credits per receiving wallet for life (not monthly). PayAI’s facilitator home page still shows the older plan cards (1,000 settlements total free, then $0.001 per settlement). Docs treated as current; both recorded in fees.json.
2026-10-11, fees Stripe SPT: Appendix B says private preview; the Stripe SPT docs page is labeled “Public preview” on 2026-10-11. Stripe docs primary.
2026-10-11, market Keyrock window: seed says “year to May 2026”; ForkLog gives May 2025 to April 2026; Cryptoast gives April 2025 to May 2026. Keyrock report not read; ForkLog window used, marked reported.
2026-10-11, market Morgan Stanley date: seed 2025-12-08; earliest press report found is Digital Commerce 360 on 2025-12-09. The report itself was not reached; 2025-12-09 used with a caveat.
2026-10-11, market McKinsey date: seed 2025-10-17; McKinsey dates the report October 2025 and no source checked gave the day. Month precision used.
2026-10-11, policy GENIUS Act and AI: seed says the Act “says nothing about AI agents”. True for agents, but Section 9 lists artificial intelligence among AML detection methods for Treasury to study. Statute primary.
2026-10-11, prehistory L402 rename: Lightning Labs’ 2023-07-06 blog post uses L402 without giving a rename date; the spec repository commit d31479c (2023-04-20) is the rename. Commit history primary.
2026-10-11, MPP card draft date (resolved): draft-card-charge-00 first commit b3bc1ab was authored 2026-01-05 and committed in the public init on 2026-03-18; the “may include TAP headers” sentence is in it from the start. Reconciles the visa-tap (2026-01-05) and stripe-mpp (2026-03-18) dossiers; both dates are right for different events.

Errata

Corrections to the seed facts the research started from (the initial and follow-up research briefs), and where the corrected statement now lives.

Corrections to the seed facts in the initial research brief, from the follow-up research brief Section 2 and docs/factcheck-of-the initial research brief. Because the site content did not exist when the follow-up arrived (see AUDIT.md), every item below was applied at authoring time: the research and writer briefs carried the corrected wording. Columns: what the initial brief said, what is correct, source, files that carry the corrected statement (filled in during verification).

#	Initial brief said	Correct	Source	Files
2.1.1	MPP IETF draft renamed 2026-09-09	`draft-ryan-httpauth-payment-01` expired 2026-09-18; `draft-httpauth-payment-00` published 2026-06-19; `-01` on 2026-09-09	IETF datatracker	stripe-mpp timeline, facts
2.1.2	Mastercard AP4M “cites MPP compatibility”	Tempo lists AP4M as MPP-compatible; Mastercard does not	Tempo pages (or removed)	mastercard-agent-pay, stripe-mpp relations, compare
2.1.3	Web Bot Auth WG draft is “the basis” of TAP	TAP (2025-10-14) uses RFC 9421 and is aligned with the Web Bot Auth direction but does not conform to the 2026-09-01 WG draft	Visa spec, IETF draft, Cloudflare blog	visa-tap, orbit/web-bot-auth
2.1.4	Scenario 8 combines Monetization Gateway with `cloudflare:402` batch settlement	Monetization Gateway beta settles USDC on Base through the Coinbase facilitator; `cloudflare:402` is a separate credit-backed scheme variant	Cloudflare blog 2026-09-30, x402 spec	scenarios/crawler-pays-per-page
2.1.5	L402 is “macaroon plus invoice”, “the ancestor of x402”	bLIP-0026 is token-agnostic, macaroons optional; original Lightning Labs spec used macaroon plus BOLT11 invoice; no source states x402 lineage	bLIP-0026, lightninglabs/L402	x402, orbit/l402
2.1.6	PayWord and MicroMint 1996	LNCS volume dated 1997 (workshop 1996)	DOI 10.1007/3-540-62494-5_6	publications, timeline prehistory
2.1.7	ERC-8004 testnets November 2025	October to November 2025	erc-8004 repo	erc-8004 timeline
2.1.8	“about 25 more mainnets”	about 25 mainnets by August 2026 including Ethereum; dated table from README	erc-8004-contracts README	erc-8004 ecosystem
2.1.9	AP2 production use unverified “outside UCP”	unverified anywhere, including inside UCP	AP2 and UCP repos	ap2, ucp, compare adoption
2.1.10	AP2 v0.2 leaves step-up to networks	v0.2 specifies no step-up; failures fall back through `unresolved_constraint`; only liability left to networks	AP2 v0.2 docs	ap2 security
2.1.11	FIDO formed two working groups on 2026-04-28	only the Agentic Authentication TWG was new; the Payments TWG already existed	FIDO announcement	ap2, mastercard-agent-pay, orbit/fido
2.1.12	Visa MPP card spec 2026-03-18 “TAP headers optional”	March spec uses VIC tokens and TAP; “optional” is from `draft-card-charge-00` dated 2026-10-05	mpp-specs	stripe-mpp, visa-tap
2.1.13	PyPI `x402` legacy	only npm `x402` and `x402-express` are V1; PyPI `x402` 2.x is V2	PyPI, repo	x402 ecosystem
2.1.14	“Microsoft says it supports UCP”	“MMC will support UCP” (future); Copilot Checkout requires a UCP-compliant feed (current)	Microsoft announcement	ucp ecosystem
2.1.15	x402scan operator unverified in one note	Merit Systems (Apache-2.0 repository)	Merit-Systems/x402scan	x402; research/conflicts.md
2.1.16	STE rule 2.2 “then simplify”	“then make it clear”	research/ste.md	STE guide
2.2	13 unsupported items	verified, tagged reported, or removed per item	see follow-up	per item
2.3	7 internal inconsistencies	fixed per item (proofOfPayment off-chain; a2a-x402 targets AP2 v0.1; constraint key prefixes; closed Payment Mandate fields from schema; orbit links; MPP mention agreement)	see follow-up	per item

Found during research (session 2), beyond the follow-up

#	Earlier text said	Correct	Source	Files
R1	Scenario 3 (follow-up wording): “a Google Pay handler that returns a network token”	Google’s UCP FAQ says UCP checkout on Google surfaces uses only `PAN_ONLY` for Google Pay `allowed_auth_methods`; a network-token path through that handler is not documented for Google surfaces	developers.google.com/merchant/ucp/faq	scenarios/shopper-in-gemini, ucp
R2	UCP capabilities versioned independently since 2026-08-25	core `dev.ucp.*` capabilities carry the release date; only third-party extensions version independently	UCP v2026-08-25 schemas	ucp
R3	UCP ES256 “mandatory”	verifiers must support ES256; ES384 and EdDSA optional	UCP spec	ucp
R4	“No paper names UCP”; “no UCP conference talk”	arXiv 2606.05043 models UCP checkout and 2602.06345 names UCP in its abstract; UCP sessions at the W3C and GS1 workshop on 2026-09-08	arXiv; workshop page	ucp section G and F
R5	UCP “converging with ACP”	no source supports convergence; only “no bridge” is supported	ucp dossier	ucp, openai-acp
R6	Follow-up 2.1.13: only npm `x402` and `x402-express` are V1 legacy	six npm legacy packages are V1 (`x402`, `x402-axios`, `x402-express`, `x402-fetch`, `x402-hono`, `x402-next`); PyPI `x402` 2.x is V2	x402 repo `typescript/packages/legacy/`	x402
R7	Follow-up Appendix B: PayAI 1,000 free settlements per month	the cited secondary source says 1,000 free in total; unverified on PayAI’s page	Wavect 2026-07-12	x402 costs
R8	“No AP2 podcast found”	The Agent Factory Podcast episode on agent payments (Google Cloud Tech, 2025-09) linked from the AP2 README	AP2 README	ap2 resources
R9	Follow-up 2.1.8: Billions “has no dated entry”	the contracts README added Billions on 2026-04-08; 25 mainnets including Ethereum are listed (24 others); dates are README listing dates, not deployment dates	erc-8004-contracts README history	erc-8004 ecosystem
R10	Testnet Validation addresses removed 2026-01-08	removed from the README on 2026-01-06	erc-8004-contracts commits	erc-8004 timeline
R11	Upgrade key holder “[verify]”	on Ethereum and Base all three proxies are owned by one externally owned account (no contract code, so not a multisig); the holder is not published	eth_call on public RPC, 2026-10-11	erc-8004 security, compare
R12	No published `giveFeedback` gas; registration “$1 to $5” on mainnet	measured with `eth_estimateGas` on 2026-10-11: about 155k to 179k gas for a first feedback, about 203k for `register`; at the gas price observed that day this is cents on mainnet; method labeled, figures dated	read-only RPC estimate	erc-8004 costs
R13	ERC-8126 Final “[verify, unusually fast]”	Final confirmed on 2026-06-02 (Last Call 2026-05-12) while it requires ERC-8004, still Draft	ERCs repo	erc-8004, orbit
R14	T-REX 4.1.6 year unverified	published 2024-10-18	GitHub release	orbit/erc-3643
R15	Follow-up 2.1.12: “TAP headers optional” comes from `draft-card-charge-00` dated 2026-10-05	the sentence has been in the draft since its first commit on 2026-01-05; 2026-10-05 was only the snapshot date and the draft carries no date. Visa’s 2026-03-18 post says the card spec and `mpp-card` 0.1.8 are built on VIC and TAP	mpp-specs history; Visa newsroom	visa-tap, stripe-mpp
R16	TAP key directory `mcp.visa.com/.well-known/jwks` “[verify contents]”; examples use Ed25519	the directory holds one 2048-bit RSA key whose certificate names `vic-oauth-jwe.visa.com` (Visa Sandbox Issuing CA); no Ed25519 key, so the spec’s example keyid cannot be resolved there	fetched 2026-10-11	visa-tap observability, security
R17	TAP spec examples	the example keyid, nonce, timestamps and signature reuse Web Bot Auth draft test vector E.2.2; browsing and checkout examples show the same signature, and the example window is 3,600 seconds against TAP’s own 8-minute limit	TAP spec, IETF draft	visa-tap section B, H
R18	“No paper names TAP”	RAILS (arXiv 2606.08790) names TAP	arXiv	visa-tap section G
R19	`visa/mcp` repository	now resolves to `visa/ai` (MIT, created 2025-11-05)	GitHub API	visa-tap resources
R20	ACP `authentication_required` added 2026-01-30	first appears in the 2025-12-12 schema	acp repo	openai-acp
R21	ACP CLA signatories include “nekuda”	the signatory is OpenCommerce Network Inc. (a nekuda GitHub user is listed); Agentic Commerce Inc. (Catalog) also signed	acp repo CLA files	openai-acp
R22	ACP request signing “mandatory for Delegate Payment”	mandatory only in RFC section 2.2; the same RFC’s header list says RECOMMENDED and the OpenAPI marks `Signature` optional	acp RFC and OpenAPI	openai-acp
R23	ACP extensions: discount, affiliate attribution, marketing consent	only discount uses the extensions framework; affiliate attribution and marketing consent are fields defined by their own RFCs	acp repo	openai-acp
R24	ACP versions as releases; npm `@agentic-commerce-protocol/specification` [verify]	0 GitHub releases and 0 tags; versions are dated spec folders (latest 2026-04-17); the npm package is not published (404); PyPI `acp-sdk` is IBM’s Agent Communication Protocol	GitHub API, npm, PyPI	openai-acp
R25	ACP spec drift `items[{id, quantity}]`	confirmed and wider: schema requires `line_items`, `Item` has no `quantity`, one example uses `product_id`; released snapshots were edited after release (2026-04-17 edited 2026-05-01)	acp repo history	openai-acp
R26	Follow-up 2.1.1 draft dates	confirmed from the Datatracker: `draft-ryan-httpauth-payment-00` 2026-02-16, `-01` 2026-03-18, expired 2026-09-18 (record shows 2026-09-19 02:45 UTC); `draft-httpauth-payment-00` 2026-06-19, `-01` 2026-09-09, expires 2027-03-13; both individual submissions, no recorded “replaces” link	IETF Datatracker API	stripe-mpp
R27	Follow-up 2.1.2: “Tempo lists AP4M as MPP-compatible”	no Tempo or Mastercard page found that says so; claim dropped (unverified); only Tempo and Stripe being in AP4M’s initial partner group is supported (secondary)	searched 2026-10-11	stripe-mpp, mastercard-agent-pay
R28	MPP design partners Anthropic, DoorDash, Mastercard, OpenAI and others	those are named as Tempo partners for stablecoin work; only Visa is named an MPP design partner	Tempo launch post	stripe-mpp
R29	Tempo “about 500 ms finality”	blocks about every 600 ms (500 ms build loop plus network delay) with deterministic Simplex BFT finality	Tempo docs	stripe-mpp
R30	MPP seed dates (subscriptions 2026-05-12, x402 support 2026-06-08, session v2 2026-06-17, identity 2026-08-12, CVEs 2026-03-31)	blog or SDK dates; spec or code dates: subscriptions spec merged 2026-07-29; mppx 0.6.29 shipped x402 on 2026-06-02; session v2 spec merged 2026-06-25; identity code merged 2026-08-04 (npm 0.8.17 on 2026-08-10); advisories and fix 0.4.11 on 2026-03-26 (NVD 2026-03-31)	mpp-specs, mppx, GitHub advisories	stripe-mpp timeline
R31	MPP `session` as an intent	no generic session intent is standardized: PR #280 closed unmerged 2026-09-28; only `charge` and `subscription` are in `specs/intents/`; session is defined by the Tempo method	mpp-specs	stripe-mpp
R32	Session v2 “cuts costs by up to 72%”	best case for one operation; settling to a new payee balance costs 79.4% more gas	mpp-specs session v2	stripe-mpp
R33	MPPScan “about 4M transactions, $435K (2026-06-24)”	those are the all-time values read on 2026-10-11 (4,072,426 transactions, $435,476); the June article shows live values	mppscan API	stripe-mpp ecosystem
R34	Rivest lottery tickets DOI	10.1007/3-540-63594-7_87 (a nearby DOI resolves to a different paper)	doi.org	publications
R35	Amazon v. Perplexity: injunction vacated, reported 2026-08-05	Ninth Circuit opinion (No. 26-1444) dated 2026-08-04, read from the court PDF: vacated and remanded; the district court’s 2026-03-09 order date rests on press reports only (reported)	Ninth Circuit opinion PDF	orbit, timeline Policy lane
R36	Follow-up 2.1.5: “the current specification (bLIP-0026) is token-agnostic”	bLIP-0026 is still an open, unmerged PR (#26) whose header says Active; its 2026-02-25 rewrite is token-agnostic (macaroons RECOMMENDED); the Lightning Labs repo adopted that text on 2026-03-10 and returned to `macaroon=` on 2026-03-20; LSAT first commit 2020-02-06, renamed L402 on 2023-04-20	lightning/blips PR #26; lightninglabs/L402 commits	orbit/l402, x402
R37	Cloudflare Radar “needs a free token”	Radar API needs an API token; data licensed CC BY-NC 4.0 (Cloudflare docs)	Cloudflare Radar docs	orbit/cloudflare, methodology
R38	Cloudflare NET Dollar	announced 2025-09-25; no evidence of launch found	Cloudflare	orbit
R39	R27 (AP4M and MPP claim dropped)	refined: Mastercard’s 2026-06-10 AP4M release quotes Tempo as “working with Mastercard on Machine Payments Protocol compatibility”; Mastercard makes no MPP claim in its own words; no Tempo page lists AP4M. Write it as Tempo’s statement, sourced to that release	Mastercard newsroom 2026-06-10	mastercard-agent-pay, stripe-mpp, compare
R40	Verifiable Intent constraint keys `mandate.payment.amount_range`, types with `.1`	those strings exist only on VI `main` (2026-04-20, PR #23, a breaking rename without a version bump); at tag v0.1.0 the names were `payment.amount`, `payment.allowed_payee` and types without `.1`	verifiable-intent repo	mastercard-agent-pay, ap2
R41	DTVC as “an agentic token formatted for card fields”	DTVC is a one-time security code issued with a Mastercard Virtual Card Token; Mastercard expands it both as “Validation Code” and “Verification Code”	Mastercard developer docs	mastercard-agent-pay, glossary
R42	Mastercard agent identity “as a browse or pay `tag`”	Mastercard’s developer guide gives one tag, `Agent-pay-auth` (glossary writes `agent-pay-auth`); `agent-browser-auth` and `agent-payer-auth` are Visa’s	Mastercard developer guide	mastercard-agent-pay, visa-tap compare
R43	Mastercard key directory “[verify URL]”	unknown: the only host in the docs, `agentpay-key-directory.mastercard.com`, does not resolve; Cloudflare’s post names none	DNS check 2026-10-11	mastercard-agent-pay observability
R44	Acceptance Framework 2025-10-14; Trust Framework white paper 2026-09-30	Mastercard says only “October 2025”; no Trust Framework white paper found (the 2026-09-30 release names the framework, the US probability score test and Skyfire as KYA partner)	Mastercard newsroom	mastercard-agent-pay timeline, publications grey list
R45	VI v0.1.0 dated 2026-02-19	CHANGELOG date 2026-02-19; the git tag sits on a 2026-03-05 commit	verifiable-intent	mastercard-agent-pay timeline
R46	R7 / Appendix B PayAI fee	PayAI’s own docs: 1,000 free credits per receiving wallet for life, not per month; since 2026-09-21 each settlement costs gas plus 30 percent, paid in $0.001 credits; the facilitator home page still shows the older plan (both recorded)	PayAI docs	x402 costs
R47	Stripe SPT “private preview, no pricing”	Stripe docs now say “Public preview”; no pricing published	Stripe docs	openai-acp, stripe-mpp
R48	Keyrock “$73M in the year to May 2026”	window May 2025 to April 2026, covering 176M on-chain transactions	ForkLog report of Keyrock	market
R49	McKinsey 2025-10-17; Morgan Stanley 2025-12-08	McKinsey report dated October 2025 (day unconfirmed); Morgan Stanley earliest report 2025-12-09	publisher pages, press	market
R50	Prehistory: EMVCo tokenisation framework 2014; LSAT around 2020	EMVCo v1.0 2014-03-11 (trade press, reported); LSAT launch post 2020-03-30; renamed L402 2023-04-20 (repository commit); HTTP 402 reserved in RFC 2068 (1997-01), RFC 2616 (1999-06), RFC 9110 (2022-06); RFC 9421 and 9530 February 2024	rfc-editor.org, Lightning Labs, Crossref	timeline Prehistory lane
R51	“GENIUS Act says nothing about AI agents”	it does not cover agents as payers, but Section 9 mentions artificial intelligence as an AML detection method for Treasury to study	GENIUS Act text	compliance rows
R52	“Card-network live agent transactions are controlled pilots”	no source says this directly; closest is Mastercard’s “first agentic transaction” remark on its Q3 2025 call (reported); write “named transactions are pilots or first transactions” with sources	earnings call coverage	visa-tap, mastercard-agent-pay, market
R53	x402 dossier: TypeScript facilitator client timeout 30 seconds	`DEFAULT_TIMEOUT_MS = 90_000` in `httpFacilitatorClient.ts` (90 seconds); the flow file and playground use 90	x402 SDK source	x402 flows, playground
R54	Follow-up 2.2: say “built on Mastercard tokenization” unless a Mastercard page names MDES; the site said no Mastercard page names MDES	Mastercard developer pages (release history, Virtual Card Token tests) do name MDES for Token Connect and Virtual Card Tokens; the agentic-token pages do not. Wording: agentic tokens are “built on Mastercard tokenization”; MDES is named only where Mastercard names it	developer.mastercard.com release history and mvct tests	mastercard-agent-pay (claims 007, facts, FAQ, flashcard, resources)
R55	Mastercard: “the network adds an agent flag to the authorization message”	Stripe says only that additional information is included in the authorization message; no data element is named	Stripe docs	mastercard-agent-pay body, open questions
R56	Verifiable Intent L1 “about 1 year”, L2 Immediate “about 15 minutes” as limits	the spec states these lifetimes as recommendations, not hard limits	verifiable-intent spec	mastercard-agent-pay