All issues

Search results

Process: what is the path for an independently implemented extension to become normative UCP text, and which body ratifies it?

Status: Open.

#701 In Universal-Commerce-Protocol/ucp;

· lucaslubi opened on Aug 9, 2026

[Proposal]: Bind signed REST responses to their request (RFC 9421 §2.4)

Status: Open.

#698 In Universal-Commerce-Protocol/ucp;

· sakinaroufid opened on Aug 8, 2026

## Announcement

Status: Open.

#693 In Universal-Commerce-Protocol/ucp;

· mdazizulislamdukhu-cyber opened on Aug 6, 2026

Domain Working Group (DWG) Charter: Bulk Product Discovery

gov:needs-gc-review

Status: Open.

#682 In Universal-Commerce-Protocol/ucp;

· jamesandersen opened on Aug 4, 2026

Buyer consent at complete_checkout: the extension overlay reopens the full buyer object that core locks, and the MCP binding omits the extension on complete

Status: Open.

#678 In Universal-Commerce-Protocol/ucp;

· vishkaty opened on Aug 3, 2026

keys[] rename removes signing_keys[] with no migration window: mixed-version parties cannot verify request or webhook signatures

Status: Open.

#676 In Universal-Commerce-Protocol/ucp;

· vishkaty opened on Aug 3, 2026

[Proposal]: Add seller.logo to the catalog variant schema

Status: Open.

#674 In Universal-Commerce-Protocol/ucp;

· XiaolongZhang-TT opened on Aug 3, 2026

[Bug]: Incorrect usage of "Authorization" header in OpenAPI 3.1.0

bugSomething isn't workingSomething isn't working

Status: Open.

#668 In Universal-Commerce-Protocol/ucp;

· jingyli opened on Aug 1, 2026

Delegated-IdP accelerated flow: two trust-chain gaps (unauthenticated platform at the token endpoint, and no trust anchor for auth_url)

Status: Open.

#667 In Universal-Commerce-Protocol/ucp;

· vishkaty opened on Jul 31, 2026

Permalink can attach state changes to an authenticated buyer session on an unauthenticated GET: what protects against CSRF?

Status: Open.

#666 In Universal-Commerce-Protocol/ucp;

· vishkaty opened on Jul 31, 2026

Extension-defined Actions: empty actions map passes schema despite the MUST-omit rule; A2A binding missing the complete_in_progress freeze

Status: Open.

#665 In Universal-Commerce-Protocol/ucp;

· vishkaty opened on Jul 31, 2026

Idempotency payload-matching by raw-body SHA-256 is unworkable over MCP (JSON-RPC envelope varies per request)

Status: Open.

#664 In Universal-Commerce-Protocol/ucp;

· vishkaty opened on Jul 31, 2026