[Agricola] AGR-2026-101: Challenge formatting emits non-Latin-1 text that cannot be used as an HTTP header

[mpp-agricola]

AGR-2026-101 — Challenge formatting emits non-Latin-1 text that cannot be used as an HTTP header

Last observed by the head-to-head audit at 2026-09-14T09:17:13.387847Z.

Audited heads

Target	Repository	Commit	Conformance	Semantic review
typescript	wevm/mppx	3c14a65a7ea5	Complete	Reference
rust	tempoxyz/mpp-rs	d859a13d74ef	Complete	Complete
go	tempoxyz/mpp-go	9fcf9a47c61b	Complete	Complete
java	stripe/mpp-java	ca57f0998545	Complete	Complete
python	tempoxyz/pympp	7988d1cda5c4	Complete	Complete
ruby	stripe/mpp-rb	3b9e2923c67b	Complete	Complete

Finding

• Fingerprint: semantic:challenge-formatting/http-safe-unicode-quoted-strings
• Source: semantic
• Affected SDKs: rust
• Clean SDKs: none
• Not reported by semantic review: go, java, python, ruby
• Canonical reference: draft-ietf-httpauth-payment §5.1; RFC 9110 §5.5
• Severity: low
• Confidence: high

Evidence

SDK	Canonical evidence	SDK evidence	Suggested test
rust	authParam — Escapes all characters above U+00FF into ASCII \uXXXX sequences after quoted-string escaping.	escape_quoted_value — Escapes only backslashes and quotes, leaving non-Latin-1 Unicode unchanged in the formatted header.	Format and parse a challenge whose description is Payment — ready; assert the serialized value is accepted by the HTTP header-value type and parsing restores the original description.

rust: Canonical mppx escapes characters above Latin-1 as \uXXXX sequences so a challenge with a Unicode description remains a legal HTTP header and round-trips through its parser. Rust only escapes backslashes and quotes, leaving characters such as an em dash or emoji raw. Header libraries that require HTTP HeaderValue bytes can therefore reject the formatted challenge instead of sending the 402 response.

Available /ag commands

Post a command as a new comment. Only configured maintainers can run these commands.

Target	Automation	Status	Pull request
rust	pr	Awaiting decision	—

Quick action

Use GitHub's copy button, then post this command as a comment:

/ag fix

Command	What it does
/ag fix	Opens or retries draft fixes for every affected PR-enabled SDK.
/ag fix rust	Opens or retries the draft fix for rust only.
/ag fix "instruction"	Applies the instruction to affected fixes; recorded PRs also incorporate unresolved review feedback and failed CI.
/ag status	Reports the current state of linked remediation pull requests.