[Agricola] AGR-2026-023: Non-letter payment method identifiers are accepted

[github-actions]

AGR-2026-023 — Non-letter payment method identifiers are accepted

Last observed by the head-to-head audit at 2026-08-08T19:52:20.848585Z.

Audited heads

Target	Repository	Commit	Conformance	Semantic review
typescript	wevm/mppx	b7ab48e38e3d	Complete	Reference
rust	tempoxyz/mpp-rs	9808dede7ad8	Complete	Complete
go	tempoxyz/mpp-go	9cad840de723	Complete	Complete
java	stripe/mpp-java	8e403af5291e	Complete	Complete
python	tempoxyz/pympp	7f7164afa55c	Complete	Complete
ruby	stripe/mpp-rb	58a98bbf6820	Complete	Complete

Finding

• Fingerprint: semantic:challenge-parsing/enforce-method-identifier-grammar
• Source: semantic
• Affected SDKs: rust
• Clean SDKs: go, java, python, ruby
• Canonical reference: draft-httpauth-payment-00 §7.1
• Likely origin: likely SDK-local divergence
• Severity: low
• Confidence: high

Evidence

SDK	Canonical evidence	SDK evidence	Suggested test
rust	deserialize — Rejects method values that do not match ^[a-z][a-z0-9:_-]*$.	parse_www_authenticate — Rejects only empty values or characters for which is_ascii_lowercase is false, allowing digits and punctuation without the required leading letter.	Parse otherwise valid challenges with method values 123, *, and tempo!; assert that each is rejected.

rust: Canonical mppx requires a method identifier to begin with a lowercase ASCII letter and then contain only its permitted lowercase identifier characters. The target's all(is_ascii_lowercase) check treats non-alphabetic characters as lowercase, so values such as 123, *, or tempo! pass. Such challenges can enter method selection despite not naming a valid payment method.

Available /ag commands

Post a command as a new comment. Only configured maintainers can run these commands.

Target	Automation	Status	Pull request
rust	pr	Recorded	tempoxyz/mpp-rs#379

Quick action

Use GitHub's copy button, then post this command as a comment:

/ag fix

Command	What it does
/ag fix	Opens or retries draft fixes for every affected PR-enabled SDK.
/ag fix rust	Opens or retries the draft fix for rust only.
/ag fix "instruction"	Applies the instruction to affected fixes; recorded PRs also incorporate unresolved review feedback and failed CI.
/ag status	Reports the current state of linked remediation pull requests.

[brendanjryan]

/ag fix

[mpp-agricola]

Queued remediation for rust.

View fix run

[mpp-agricola]

Opened draft PR for rust: tempoxyz/mpp-rs#379.

View fix run