# Release notes, 20 October 2026

We re-read every specification we check and fixed seven places where our results were wrong.

![A release tag dated 20 October 2026 listing one new check and seven fixes, starting with unit prices, beside the Lumar mark.](https://agentic-readiness.lumar.io/assets/hero-release-2026-10-20.webp)

## Summary

We re-read the specification behind every technology we check. Seven checks were stricter than their source or misread what a site sent, and they are fixed. If your results showed a missing product price, a robots.txt rule before the first group, an empty RSL licence, a missing Vary header or an unregistered RSA key name, scan again. The command-line tool has the fixes from version 0.3.8.

One new check reports a robots.txt `Sitemap:` line written as a path. We also corrected which source some checks cite: a few we had attributed to a vendor are our own recommendation, and two MCP checks now cite the MCP specification itself. We ran the new rules over our own site before release. It came back with no faults.

## New checks

-   robots.txt: a `Sitemap:` line written as a path, such as `Sitemap: /sitemap.xml`, is now reported. [The sitemaps protocol](https://www.sitemaps.org/protocol.html) asks for "the full URL" and [Google](https://developers.google.com/crawling/docs/robots-txt/robots-txt-spec) says it "must be a fully qualified URL". We still read the sitemap behind it, so its own faults are reported too. Before, we treated that line as an address we refuse to fetch and stopped the scan, which was wrong.

## Fixed

-   Product data: a price given in a `UnitPriceSpecification` now counts as the price. [Google's merchant-listing guide](https://developers.google.com/search/docs/appearance/structured-data/merchant-listing) puts the active price there in two of its own examples, and we reported those as having no price and no currency.
-   robots.txt: `Crawl-delay` and similar lines above the first `User-agent` are no longer a fault. [RFC 9309](https://www.rfc-editor.org/rfc/rfc9309.html) defines only Allow and Disallow as rules, so we were stricter than the specification. Allow and Disallow outside a group are still reported.
-   RSL: a licence made only of extension elements is no longer reported as empty, and elements from another namespace are no longer judged as RSL ones. [RSL 1.0](https://rslstandard.org/rsl) allows both.
-   Markdown for agents: a missing `Vary: Accept` is no longer reported when the response is marked `no-store` or `private`. [RFC 9110](https://www.rfc-editor.org/rfc/rfc9110.html#section-12.5.5) asks for Vary "on a cacheable response", and those are not.
-   Web Bot Auth: RSA keys labelled RS384, RS512, PS256 or PS384 are no longer reported. [RFC 7518](https://www.rfc-editor.org/rfc/rfc7518.html#section-3.1) registers all of them for RSA keys.
-   MCP: a server that answers with only the empty priming event [MCP 2025-11-25](https://modelcontextprotocol.io/specification/2025-11-25/basic/transports) describes is no longer at risk of being called "not MCP". We now treat that answer as inconclusive.
-   Page checks: a page that moves on as soon as it loads is now checked. The browser dropped the page we were sent, so we reported that we could not read it. We now read it again directly.

## Changed in the standards

-   Personal Agent Protocol: [version 0.1](https://github.com/personal-agent-protocol/personal-agent-protocol/blob/main/content/versions/0.1/spec.mdx) was frozen on 18 October and 0.2 is in draft. Every published file we have seen says 0.1, so we keep checking files by the version they declare.

[Run a scan](https://agentic-readiness.lumar.io/)[Build an agent-ready file](https://agentic-readiness.lumar.io/build)[Read the reference](https://agentic-readiness.lumar.io/docs)