{"title":"UCP Sandbox changelog","home_page_url":"https:\/\/flowers-a2a.ucpsandbox.com\/changelog","entries":[{"id":"2026-10-30-embedded-checkout","version":"0.10.0","date":"2026-10-30","kind":"New","title":"Embedded checkout","detail":"flowers-embedded.ucpsandbox.com adds UCP's Embedded transport (Embedded Checkout Protocol, 2026-08-25) to Northlight Flowers: its profile lists the embedded transport, every checkout carries an embedded binding with the delegations it allows, and its continue_url opened in an iframe with ec_version speaks ECP to the host page. A host can take over the payment credential, address changes, payment method changes and links. White Orchid is redirect-only, and test switches cover an unsupported version and a refused host.","area":"Protocol"},{"id":"2026-10-30-docs-embedded-checkout","version":"0.10.0","date":"2026-10-30","kind":"New","title":"Docs: embedded checkout","detail":"The quickstart shows how to frame a checkout, what each delegation sends and how to test the error paths.","area":"Docs and site"},{"id":"2026-10-30-checkout-over-a2a","version":"0.9.0","date":"2026-10-30","kind":"New","title":"Checkout over A2A","detail":"flowers-a2a.ucpsandbox.com adds UCP's A2A transport to Northlight Flowers: its profile lists an A2A service whose agent card is at \/.well-known\/agent-card.json, and checkout runs at \/ucp\/a2a over A2A 0.3 (message\/send) or A2A 1.0 (SendMessage), with the UCP extension activated. Each reply carries the checkout in a2a.ucp.checkout. The action names (create_checkout, update_checkout, get_checkout, cancel_checkout, complete_checkout) are our interpretation: UCP's A2A binding shows add_to_checkout and complete_checkout only as examples and defines no list. Catalogue search stays on REST and MCP.","area":"Protocol"},{"id":"2026-10-30-docs-checkout-over-a2a","version":"0.9.0","date":"2026-10-30","kind":"New","title":"Docs: checkout over A2A","detail":"The quickstart shows the agent card, the headers for each A2A version and every checkout action.","area":"Docs and site"},{"id":"2026-10-29-a-missing-idempotency-key-over-mcp-is-invalid-params","version":"0.8.3","date":"2026-10-29","kind":"Fixed","title":"A missing idempotency key over MCP is invalid params","detail":"A complete_checkout or cancel_checkout call without meta[\"idempotency-key\"] now answers JSON-RPC -32602 with code idempotency_key_required; -32000 stays for a key reused with a different payload, as the MCP binding's error table has it.","area":"Protocol"},{"id":"2026-10-29-harbour-row-bookings-are-read-and-cancelled-by-their-id","version":"0.8.2","date":"2026-10-29","kind":"Fixed","title":"Harbour Row bookings are read and cancelled by their id","detail":"Confirmation numbers are random, and get_booking and cancel_booking take the booking id from confirmation.booking_id; a confirmation number alone answers not_found.","area":"Stores"},{"id":"2026-10-29-stays-warns-totals-changed-and-waits-for-the-new-price","version":"0.8.2","date":"2026-10-29","kind":"Fixed","title":"Stays warns totals_changed and waits for the new price","detail":"When a rate changes, the booking session warns totals_changed at $.totals as a disclosure, and complete is refused until the platform updates the session to the new totals, as the lodging draft requires.","area":"Protocol"},{"id":"2026-10-29-room-capacity-is-the-real-maximum-occupancy","version":"0.8.2","date":"2026-10-29","kind":"Fixed","title":"Room capacity is the real maximum occupancy","detail":"capacity.total is the most a room sleeps, and a party that does not fit is refused with occupancy_exceeded_capacity.","area":"Stores"},{"id":"2026-10-29-order-webhooks-are-signed-with-es256","version":"0.8.2","date":"2026-10-29","kind":"Improved","title":"Order webhooks are signed with ES256","detail":"Webhooks are signed with a P-256 key, the algorithm every UCP verifier supports; each store's profile publishes it alongside the existing Ed25519 key.","area":"Protocol"},{"id":"2026-10-29-kettle-streets-alcohol-warning-uses-the-policy-type-as-its-code","version":"0.8.2","date":"2026-10-29","kind":"Fixed","title":"Kettle Street's alcohol warning uses the policy type as its code","detail":"The age disclosure's code is com.ucpsandbox.policy.age_restricted, as UCP 2026-08-25 requires of a warning that refers to a policy.","area":"Protocol"},{"id":"2026-10-29-add-ons-point-to-their-dish","version":"0.8.2","date":"2026-10-29","kind":"Improved","title":"Add-ons point to their dish","detail":"At Kettle Street an add-on line carries line_item.parent_id for the dish it belongs to, on the checkout and on the order. A dish with no allergen recorded no longer reads as free of allergens.","area":"Stores"},{"id":"2026-10-26-location-search-refuses-a-filter-it-doesnt-support","version":"0.7.7","date":"2026-10-26","kind":"Fixed","title":"Location search refuses a filter it doesn't support","detail":"A location search or lookup with a filter other than hours, amenities or items is now refused with invalid_request, as the spec requires, instead of the filter being ignored and every shop returned.","area":"Protocol"},{"id":"2026-10-26-return-terms-an-agent-can-read","version":"0.7.6","date":"2026-10-26","kind":"New","title":"Return terms an agent can read","detail":"Every store has a -returns host, such as flowers-returns.ucpsandbox.com, on the draft Return Policy Extension (dev.ucp.shopping.policy.return, merged to the spec's main branch on 23 October, not yet in a release). Catalogue, cart, checkout and order responses carry the return window, refund types, return channels and fees; final-sale items come with a disclosure, and a delivered order states each return deadline. Responses in 2026-04-08 leave it out.","area":"Protocol"},{"id":"2026-10-26-clearer-returns-at-northlight-flowers","version":"0.7.6","date":"2026-10-26","kind":"Improved","title":"Clearer returns at Northlight Flowers","detail":"Fresh flowers and plants: tell us within 48 hours of delivery if they arrive damaged. Vases, accessories and dried flowers: 30 days unused, free in store or $4.95 by mail. Wedding and event pieces are final sale.","area":"Stores"},{"id":"2026-10-26-the-flowers-sign-in-servers-read-the-resource-parameter","version":"0.7.5","date":"2026-10-26","kind":"Improved","title":"The Flowers sign-in servers read the resource parameter","detail":"An authorization or token request may name the store as its resource (RFC 8707). The store's own resource identifier, as its protected resource metadata gives it, is accepted; any other value is refused with invalid_target.","area":"Protocol"},{"id":"2026-10-23-account-linking-with-no-client-registration","version":"0.7.4","date":"2026-10-23","kind":"New","title":"Account linking with no client registration","detail":"flowers-account-noreg.ucpsandbox.com offers identity linking with no registration endpoint, as many sign-in servers do. Use the public client ucpsandbox-test with PKCE S256 and no secret; redirect to https:\/\/ucpplayground.com\/oauth\/callback or a 127.0.0.1 or localhost address.","area":"Protocol"},{"id":"2026-10-23-link-a-buyer-account-at-northlight-flowers","version":"0.7.3","date":"2026-10-23","kind":"New","title":"Link a buyer account at Northlight Flowers","detail":"The store offers UCP identity linking (dev.ucp.common.identity_linking, 2026-08-25): OAuth 2.0 with PKCE, authorization server and protected resource metadata, client registration, a consent page with test buyers, and token revocation. It offers dev.ucp.shopping.order:manage; order reads stay open.","area":"Protocol"},{"id":"2026-10-23-a-store-where-reading-an-order-needs-a-linked-account","version":"0.7.3","date":"2026-10-23","kind":"New","title":"A store where reading an order needs a linked account","detail":"flowers-account.ucpsandbox.com offers dev.ucp.shopping.order:read and dev.ucp.shopping.order:manage: get_order without a linked buyer answers identity_required, and a token without the scope answers insufficient_scope.","area":"Protocol"},{"id":"2026-10-21-a-new-look-for-the-site","version":"0.6.2","date":"2026-10-21","kind":"Improved","title":"A new look for the site","detail":"The home page, docs, changelog, contact and legal pages have a new design. Nothing about the stores changed.","area":"Docs and site"},{"id":"2026-10-08-northlight-flowers-also-speaks-ucp-2026-04-08","version":"0.5.0","date":"2026-10-08","kind":"New","title":"Northlight Flowers also speaks UCP 2026-04-08","detail":"Agents built to the 2026-04-08 release get replies in that release. The store's profile lists it under supported_versions.","area":"Protocol"},{"id":"2026-10-08-carts-say-when-they-expire-and-orders-carry-their-number","version":"0.5.0","date":"2026-10-08","kind":"Improved","title":"Carts say when they expire, and orders carry their number","detail":"Carts include expires_at, and a completed checkout's order includes its label.","area":"Protocol"},{"id":"2026-10-05-sign-in-with-google","version":"0.4.0","date":"2026-10-05","kind":"New","title":"Sign in with Google","detail":"Use your Google account to sign in to the console, alongside GitHub and an emailed link.","area":"Console"},{"id":"2026-10-05-harbour-row-stays-and-kettle-street-noodles-are-previews","version":"0.4.0","date":"2026-10-05","kind":"Improved","title":"Harbour Row Stays and Kettle Street Noodles are previews","detail":"The UCP spec for lodging and food is still settling, so these two stores will change.","area":"Stores"},{"id":"2026-10-03-stores-check-request-signatures","version":"0.3.0","date":"2026-10-03","kind":"New","title":"Stores check request signatures","detail":"Web Bot Auth and UCP request signatures are checked against the keys the agent publishes. Unsigned agents are still answered.","area":"Protocol"},{"id":"2026-10-03-who-shops-here","version":"0.3.0","date":"2026-10-03","kind":"New","title":"Who shops here","detail":"Each store's analytics page shows which agents shop it and how many proved who they are. Only verified agents are named.","area":"Stores"},{"id":"2026-10-02-northlight-flowers-has-five-shops","version":"0.2.0","date":"2026-10-02","kind":"New","title":"Northlight Flowers has five shops","detail":"Find a shop by distance, delivery area, opening hours or stock, and collect an order from it.","area":"Stores"},{"id":"2026-10-02-location-search-and-lookup","version":"0.2.0","date":"2026-10-02","kind":"New","title":"Location search and lookup","detail":"The flowers store answers the UCP location calls over REST, MCP and WebMCP.","area":"Protocol"},{"id":"2026-10-02-analytics-for-your-stores","version":"0.2.0","date":"2026-10-02","kind":"New","title":"Analytics for your stores","detail":"How far agents got, what they searched for, which result they picked and where calls failed.","area":"Console"},{"id":"2026-10-02-each-reference-store-shows-how-agents-use-it","version":"0.2.0","date":"2026-10-02","kind":"New","title":"Each reference store shows how agents use it","detail":"Shares and timings at \/analytics on the store. No agent is named.","area":"Stores"},{"id":"2026-10-02-store-versions","version":"0.2.0","date":"2026-10-02","kind":"New","title":"Store versions","detail":"A reference store gets a version number when it changes, and an experiment records the version it ran on.","area":"Stores"},{"id":"2026-10-02-sign-in-with-github-or-an-emailed-link","version":"0.2.0","date":"2026-10-02","kind":"New","title":"Sign in with GitHub or an emailed link","detail":"No password. Your email is your account.","area":"Console"},{"id":"2026-10-02-account-page","version":"0.2.0","date":"2026-10-02","kind":"New","title":"Account page","detail":"See your details, download your data, sign out, or delete your account and everything in it.","area":"Console"},{"id":"2026-10-02-contact-page","version":"0.2.0","date":"2026-10-02","kind":"New","title":"Contact page","detail":"One form for questions, bugs in a test store and data requests.","area":"Docs and site"},{"id":"2026-10-02-stays-store-is-clearer-about-dates-and-prices","version":"0.2.0","date":"2026-10-02","kind":"Improved","title":"Stays store is clearer about dates and prices","detail":"Stay dates are spelled out, the booking window is stated, and prices can be shown in the traveller's currency as a guide.","area":"Stores"},{"id":"2026-10-02-idle-stores-are-archived","version":"0.2.0","date":"2026-10-02","kind":"Improved","title":"Idle stores are archived","detail":"A store copy nothing has used for 90 days stops answering; you can restore or delete it.","area":"Console"},{"id":"2026-10-01-ucp-sandbox-is-live","version":"0.1.0","date":"2026-10-01","kind":"New","title":"UCP Sandbox is live","detail":"Test stores any agent can shop, and experiments on your own copy of one.","area":"Docs and site"},{"id":"2026-10-01-three-reference-stores","version":"0.1.0","date":"2026-10-01","kind":"New","title":"Three reference stores","detail":"Northlight Flowers (retail), Harbour Row Stays (lodging) and Kettle Street Noodles (takeout).","area":"Stores"},{"id":"2026-10-01-experiments-a-against-b-one-change","version":"0.1.0","date":"2026-10-01","kind":"New","title":"Experiments: A against B, one change","detail":"Pick a change, point agents at both stores, read the result from the stores' own records.","area":"Console"},{"id":"2026-10-01-stores-speak-ucp-release-2026-08-25","version":"0.1.0","date":"2026-10-01","kind":"New","title":"Stores speak UCP release 2026-08-25","detail":"Over REST and MCP, with WebMCP tools in the storefront pages.","area":"Protocol"}]}