[Agricola] AGR-2026-105: Automatic client silently returns an unhandleable initial 402

[mpp-agricola]

AGR-2026-105 — Automatic client silently returns an unhandleable initial 402

Last observed by the head-to-head audit at 2026-09-14T09:17:13.387847Z.

Audited heads

Target	Repository	Commit	Conformance	Semantic review
typescript	wevm/mppx	3c14a65a7ea5	Complete	Reference
python	tempoxyz/pympp	7988d1cda5c4	Complete	Complete
go	tempoxyz/mpp-go	9fcf9a47c61b	Complete	Complete
java	stripe/mpp-java	ca57f0998545	Complete	Complete
ruby	stripe/mpp-rb	3b9e2923c67b	Complete	Complete
rust	tempoxyz/mpp-rs	d859a13d74ef	Complete	Complete

Finding

• Fingerprint: semantic:client-errors/surface-unhandleable-initial-payment-challenge
• Source: semantic
• Affected SDKs: python
• Clean SDKs: none
• Not reported by semantic review: go, java, ruby, rust
• Canonical reference: src/client/internal/Fetch.ts:253
• Severity: medium
• Confidence: high

Evidence

SDK	Canonical evidence	SDK evidence	Suggested test
python	from.request — For the initial challenge round, absence of a compatible method raises an error; only an unhandleable post-payment 402 is returned as the server's final answer.	PaymentTransport.handle_async_request — On any challenge-matching failure, including the initial 402, emits payment.failed and returns the response.	Configure the automatic client with only a Tempo method, return an initial valid Stripe challenge, and assert that the request rejects after one payment.failed event instead of resolving to the 402 response.

python: When the initial 402 contains parsed challenges but none matches an installed method, canonical mppx throws after emitting payment.failed. The target emits the event but returns the raw 402 response. Applications using the automatic client therefore observe different control flow and may fail to distinguish payment-handler failure from an ordinary HTTP response.

Available /ag commands

Post a command as a new comment. Only configured maintainers can run these commands.

Target	Automation	Status	Pull request
python	pr	Queued	—

Quick action

Use GitHub's copy button, then post this command as a comment:

/ag fix

Command	What it does
/ag fix	Opens or retries draft fixes for every affected PR-enabled SDK.
/ag fix python	Opens or retries the draft fix for python only.
/ag fix "instruction"	Applies the instruction to affected fixes; recorded PRs also incorporate unresolved review feedback and failed CI.
/ag status	Reports the current state of linked remediation pull requests.

[brendanjryan]

/ag fix

[mpp-agricola]

Queued remediation for python.

View fix run