[liady]

What changed

Seven pages are rechecked against the live specs and their pins moved, one commit per standard. This closes the open drift issues #22 (WebMCP) and #23 (Poppy), and keeps ax.guide's pins in lockstep with Ora's. Ora's spec-drift.mjs lockstep reports "pins agree", and both copies of scripts/spec-drift.mjs are identical.

• WebMCP:
  • The draft is now dated November 2, 2026, and it adds outputSchema, so a tool can describe what it returns.
  • Pin ce87954 moves to 847677e.
• Poppy:
  • Draft 0.3 was published on November 4, 2026, and 0.4 is in progress.
  • The text now says:
    • sign-in is plain OAuth, found through the company's metadata;
    • scopes are the company's own, with hints for changes and personal data;
    • a UCP extension hands checkout to UCP;
    • the kit now follows 0.4.
  • The links move to the frozen /docs/0.3/spec and the Roadmap page.
  • The pins move to the frozen content/versions/0.3 source tree and versions.json, which don't churn when a new draft starts, plus the working-draft pages.
• NLWeb:
  • The spec link now goes to the source on GitHub, because nlweb.ai serves a certificate that doesn't match its name.
  • "Every NLWeb site is also an MCP server" is corrected: the spec makes the MCP tool optional.
  • The participant count is 13.
• x402: pin 11f02ce moves to e54f095. The two spec commits after the old pin change no claim on the page.
• MPP: the "accepts x402's simplest flow" claim is now attributed to the mppx toolkit, with its source.
• ACP: looks_like names the /.well-known/acp.json discovery file.
• auth.md: two nuances:
  • registration finishes on its own only for a new account;
  • the token is tied to you once the account is claimed.
• last_verified is unchanged on every page.

Superseded by this PR: #24 (Poppy pins to the 2026-11-02 working-draft digests, which are now stale).

Sources

• WebMCP: https://webmachinelearning.github.io/webmcp/ (index.bs commit 6cd745a, #254)
• Poppy: https://personalagentprotocol.org/docs/0.3/spec, https://personalagentprotocol.org/docs/changelog, https://personalagentprotocol.org/docs/roadmap, https://personalagentprotocol.org/docs/0.3/extensions/ucp
• NLWeb: https://github.com/nlweb-ai/website/blob/main/NLWEBSPEC.md (Appendix A), https://www.w3.org/community/nlweb
• x402: https://github.com/x402-foundation/x402/commits/main/specs
• MPP: https://mpp.dev/guides/use-mpp-with-x402
• ACP: https://github.com/agentic-commerce-protocol/agentic-commerce-protocol/tree/main/spec/2026-04-17 (rfcs/rfc.discovery.md)
• auth.md: https://github.com/workos/auth.md/blob/main/AUTH.md

Checklist

• Every new or changed claim links a primary source.
• If I changed a status, the evidence meets the rules in content/contribute.md (no status changed).
• I only changed last_verified on pages where I rechecked every claim (none changed).
• Plain words, no em dashes.

npm run pins regenerated spec-pins.json, the tests pass, and node scripts/spec-drift.mjs check spec-pins.json --only poppy reports all five sources ok.

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
standards	Ready	Preview	Nov 9, 2026 12:17pm UTC