[liady]

What changed

The spec drift check found changes in ARD, ai-catalog, WebMCP, Web Bot Auth, Poppy and x402 since October 19. I rechecked each page against its live sources, moved its pins (npm run pins), and set last_verified to 2026-10-30. No status changed. I also fixed one blurred example on the MPP page that the quiz fact-check turned up.

• Poppy: Version 0.2 was published on October 24, and draft 0.3 is in progress. Draft 0.3 changes three things: each company defines its own scopes, sign-in by the agent becomes a "transitional" extension, and operations move to version 2. The content/guide.json note is updated to match.
• Web Bot Auth: WG draft -01 is dated October 29. A request now names the address of its key set directly, and a site can ask for a signature. The signers now link primary sources: OpenAI, Cloudflare Browser Run, and some Google-Agent traffic. I dropped DuckDuckGo, because no primary source shows it signing requests.
• WebMCP: The draft is now dated October 27. The page now mentions the draft W3C Agentic Web WG charter and that pages using the Chrome trial passed 0.5% of all page loads. Hydrogen stores now load the tools by default.
• ai-catalog: Trust Manifests can now come from several parties. The page adds Cloudflare's live catalog and the working group's list of 26.
• x402: The page now mentions the October 22 disclosure of library flaws, which were fixed in August. The CoinDesk figure is total volume, not real payments, and the wording now says so. I linked the source for the Foundation announcement and removed one claim that had no source.
• ARD: Upstream only added a non-normative observability section. Hugging Face, like GitHub, serves only ai-catalog.json.
• MPP: Pay-as-you-go sessions run on stablecoin rails such as Tempo; cards through Stripe cover one-off charges.

Closes #16, closes #17, closes #18, closes #19. The ai-catalog and Web Bot Auth changes landed after the last weekly run, so they have no issues yet.

Sources

• Poppy: https://personalagentprotocol.org/docs/0.2/spec, https://personalagentprotocol.org/docs/changelog
• Web Bot Auth: https://datatracker.ietf.org/doc/html/draft-ietf-webbotauth-httpsig-protocol-01
• WebMCP: https://webmachinelearning.github.io/webmcp/, https://w3c.github.io/charter-drafts/2026/agenticweb-wg.html, http://www.mail-archive.com/blink-dev@chromium.org/msg17895.html, https://shopify.dev/docs/api/web-mcp
• ai-catalog: https://ai-catalog.io/spec/, https://github.com/Agent-Card/awesome-ai-catalogs, https://developers.cloudflare.com/.well-known/ai-catalog.json
• x402: https://v12.sh/blog/x402, the Linux Foundation's announcement of the x402 Foundation,`` and the CoinDesk article already linked on the page
• ARD: https://huggingface.co/.well-known/ai-catalog.json
• MPP: https://mpp.dev/, https://datatracker.ietf.org/doc/draft-httpauth-payment/

Checklist

• Every new or changed claim links a primary source.
• If I changed a status, the evidence meets the rules in content/contribute.md. (No status changed.)
• I only changed last_verified on pages where I rechecked every claim.
• Plain words, no em dashes.

Two links to click once before merging. The sandbox got a 403 from both pages, so I confirmed them through search-engine copies:

• OpenAI's help article on signed requests, linked from the Web Bot Auth page.
• OpenAI's "site tools" article, linked from the WebMCP page.

The quiz in the stacked PR (#21) builds on this branch.

🤖 Generated with Claude Code

https://claude.ai/code/session_01NWyUpDcNT2Fd6FNzeuy2Bn

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
standards	Ready	Preview	Oct 30, 2026 7:56pm UTC