liady · Nov 9, 2026 · Nov 9, 2026 · Nov 9, 2026 · Nov 9, 2026 · Nov 9, 2026
diff --git a/content/standards/acp.md b/content/standards/acp.md
@@ -8,7 +8,7 @@ status_note: Beta, stable 2026-04-17; live for discovery
 tagline: into ChatGPT
 phrase: Products (and checkout) into ChatGPT
 analogy: A catalogue mailed straight to your personal shopper, with an optional order form attached.
-looks_like: Product feeds + checkout endpoints
+looks_like: /.well-known/acp.json + product feeds + checkout endpoints
 when_to_use: When you want your products shown in ChatGPT, especially if you already use Stripe.
 backers: OpenAI + Stripe, with Meta on the steering committee
 reality_check: In production for discovery. The headline feature that launched ACP, buying inside ChatGPT, is exactly the part that was scaled back.

diff --git a/content/standards/auth-md.md b/content/standards/auth-md.md
@@ -36,11 +36,11 @@ When your agent needs a service you've never used, it hits a wall built to keep
 
 Ask a coding agent to add web scraping to your app, and it calls the scraping service, gets "401: who are you?" plus a pointer to the service's login details and auth.md file, then signs you up one of three ways:
 
-- **Vouched for:** the company running the agent signs a short-lived pass saying "this is a verified user" and registration finishes on its own.
+- **Vouched for:** the company running the agent signs a short-lived pass saying "this is a verified user" and registration finishes on its own for a new account (an existing account still asks you to confirm with a code).
 - **By email:** the agent gives you a short code and a link. You sign in on the service's own page and type the code.
 - **Anonymously:** the agent starts with limited access and you "claim" the account later.
 
-Either way, it ends with a normal, short-lived, revocable OAuth token tied to you.
+Either way, it ends with a normal, short-lived, revocable OAuth token, tied to you once the account is claimed.
 
 ## Who's behind it
 

diff --git a/content/standards/mpp.md b/content/standards/mpp.md
@@ -19,7 +19,7 @@ links:
     url: https://mpp.dev/
 related:
   - id: x402
-    note: MPP now accepts x402's simplest payment flow, so the two are more compatible than competing.
+    note: MPP's own toolkit can also take x402's simplest payment flow on the same route, so the two are more compatible than competing.
   - id: ap2
     note: AP2 records what a person approved; MPP moves the money.
 last_verified: "2026-10-19"
@@ -39,4 +39,4 @@ It supports one-off charges, subscriptions and streaming pay-as-you-go "sessions
 
 [Stripe and Tempo launched it](https://mpp.dev/) on March 18, 2026, the same day Tempo's payments blockchain went live. Its core spec is an IETF Internet-Draft ([draft-httpauth-payment-01](https://datatracker.ietf.org/doc/draft-httpauth-payment/01/), September 9, 2026), but an *individual* one: the IETF lists it as having no formal standing, and no working group has taken it on.
 
-The ecosystem is growing: Circle drafted a [USDC payment method](https://paymentauth.org/draft-usdc-charge-00.html) and Visa drafted a [card method](https://paymentauth.org/draft-card-charge-00.html). MPP now accepts x402's simplest payment flow from the same toolkit.
+The ecosystem is growing: Circle drafted a [USDC payment method](https://paymentauth.org/draft-usdc-charge-00.html) and Visa drafted a [card method](https://paymentauth.org/draft-card-charge-00.html). Its toolkit, mppx, can also [take x402's simplest payment flow](https://mpp.dev/guides/use-mpp-with-x402) on the same route; that is a feature of the toolkit, not of the protocol draft.
diff --git a/content/standards/nlweb.md b/content/standards/nlweb.md
@@ -13,7 +13,7 @@ backers: Microsoft (R.V. Guha)
 reality_check: Early. Nobody publishes a deployment count, partly because NLWeb has no fixed address to crawl.
 links:
   - label: Specification (v0.55)
-    url: https://nlweb.ai/docs/specification
+    url: https://github.com/nlweb-ai/website/blob/main/NLWEBSPEC.md
   - label: Source code
     url: https://github.com/nlweb-ai/NLWeb
   - label: Microsoft's announcement
@@ -39,10 +39,10 @@ spec_sources:
 
 Most websites already describe their content in structured ways (Schema.org tags, RSS feeds), yet you can still only search them with keywords. NLWeb indexes that structured data and adds an "ask" endpoint: type "vegetarian recipes under 30 minutes without nuts" and get answers drawn only from that site.
 
-Every NLWeb site is also an MCP server, so AI agents can ask the same questions through a standard plug. [Cloudflare offers an "NLWeb Website" option](https://developers.cloudflare.com/ai-search/how-to/nlweb), in public preview, that crawls your site and sets up an `/ask` page for people and an `/mcp` endpoint for agents.
+An NLWeb site can also offer `ask` as an MCP tool (the reference code and Cloudflare's setup both do), so AI agents can ask the same questions through a standard plug. The spec makes that optional. [Cloudflare offers an "NLWeb Website" option](https://developers.cloudflare.com/ai-search/how-to/nlweb), in public preview, that crawls your site and sets up an `/ask` page for people and an `/mcp` endpoint for agents.
 
 ## Who's behind it
 
 [Microsoft introduced it](https://news.microsoft.com/source/features/company-news/introducing-nlweb-bringing-conversational-interfaces-directly-to-the-web/) at its Build conference on May 19, 2025; R.V. Guha conceived it. [The code is open source](https://github.com/nlweb-ai/NLWeb) and the current spec is v0.55.
 
-A [W3C community group](https://www.w3.org/community/nlweb) launched in October 2025 but still has no chairs, 15 participants and no published reports, and community groups aren't a standards track, so NLWeb is not a W3C standard. Launch partners included Allrecipes, Eventbrite, Tripadvisor, O'Reilly and Shopify. A security bug that let attackers read server files was reported and fixed in mid-2025.
+A [W3C community group](https://www.w3.org/community/nlweb) launched in October 2025 but still has no chairs, 13 participants and no published reports, and community groups aren't a standards track, so NLWeb is not a W3C standard. Launch partners included Allrecipes, Eventbrite, Tripadvisor, O'Reilly and Shopify. A security bug that let attackers read server files was reported and fixed in mid-2025.
diff --git a/content/standards/poppy.md b/content/standards/poppy.md
@@ -4,7 +4,7 @@ full_name: Personal Agent Protocol (PAP)
 job: identity
 order: 2
 status: early
-status_note: Draft 0.2 (Oct 24, 2026), 0.3 in progress; a few small deployments
+status_note: Draft 0.3 (Nov 4, 2026), 0.4 in progress; a few small deployments
 tagline: acts as you
 phrase: Your agent signs in to a company as you
 analogy: A valet key for your personal agent.
@@ -13,12 +13,12 @@ when_to_use: When customers' own agents should sign in and act on their accounts
 backers: Sierra + Meta; 7 launch and 35 design partners
 reality_check: A draft first published October 9, 2026. A few small companies serve a `poppy.json`, including [Salespeak](https://salespeak.ai/agent-endpoint/), [Lorikeet](https://www.lorikeetcx.ai/blog/personal-agent-protocol), [Ticket Fairy](https://www.ticketfairy.com/.well-known/poppy.json) and [Alpic](https://alpic.ai/.well-known/poppy.json), most for signed-out chats or plain website browsing only. None of the launch partners does yet.
 links:
-  - label: Specification (Draft 0.2)
-    url: https://personalagentprotocol.org/docs/0.2/spec
-  - label: Draft 0.3 (in progress)
+  - label: Specification (Draft 0.3)
+    url: https://personalagentprotocol.org/docs/0.3/spec
+  - label: Draft 0.4 (in progress)
     url: https://personalagentprotocol.org/docs/spec
-  - label: Path to 1.0 (open topics)
-    url: https://personalagentprotocol.org/docs/path-to-1
+  - label: Roadmap to 1.0
+    url: https://personalagentprotocol.org/docs/roadmap
   - label: Company implementation kit (skill and validator)
     url: https://personalagentprotocol.org/kit/company
   - label: Sierra's Draft 0.1 post
@@ -31,32 +31,40 @@ related:
   - id: auth-md
     note: Poppy signs in existing customers. auth.md signs up new ones.
   - id: ucp
-    note: Poppy leaves shopping to UCP and ACP, and may overlap with UCP on sign-in.
+    note: Poppy finds the company and signs you in; its UCP extension hands carts, checkout and payment to UCP.
   - id: ap2
     note: Payments are not covered yet. Until they are, payment consent needs another protocol, such as AP2.
 last_verified: "2026-10-30"
 spec_sources:
+  - kind: git-path
+    repo: personal-agent-protocol/personal-agent-protocol
+    path: content/versions/0.3
+    pin: "1e12f5a57bb3373ce90fdb41ad4d6bad8f960895"
+  - kind: git-path
+    repo: personal-agent-protocol/personal-agent-protocol
+    path: content/versions/versions.json
+    pin: "b2ffb3afe546a2334d63052b0e97e3921e31117a"
   - kind: page
     url: https://personalagentprotocol.org/docs/spec
-    pin: "24d8da14fd16c944adeb9969221e6d6a6d9ba089f7299ce8c6a8df8a860001f3"
+    pin: "2e6063f39dac6f2bf8eb541e2f28e7cc6c85345c2f726216285ab55738c1b185"
   - kind: page
     url: https://personalagentprotocol.org/docs/extensions/operations
-    pin: "ec14d1af5ac4a65e0f691e49fbdf57ede32f32552d86ed88865e85bf8eedb169"
+    pin: "e5a42cb211e68ffff1cc4072456ce326fec4de2cc8b83cff37a63c522fbc2b57"
   - kind: page
     url: https://personalagentprotocol.org/docs/guides
-    pin: "708fc192545d0a65b596c8dbee038338fe559f21f4d3c203023304a1168420d0"
+    pin: "be0a953dd371f028369bb1a307e6614ecda1e67f02564c552c3a656b25782e75"
 ---
 
 ## How it works
 
 It lets the agent act for you at a company, with only the permissions you gave it, without opening the boot or the glovebox. Right now an AI agent acting for you has two bad options: pretend to be you in a browser, or not get in at all.
 
-Poppy gives the company a file at `/.well-known/poppy.json` that says how agents can start a session, how you sign in, and which web pages, APIs and company agent are available. Sign-in uses OAuth, the familiar "Sign in with..." approval screen: you approve on the company's own page, on another device with a code, or (if the company allows it) the agent signs in for you. [Draft 0.3](https://personalagentprotocol.org/docs/guides) calls that last way temporary, with an end date to be set at version 1.0. An agent can also start signed out, as a guest.
+Poppy gives the company a file at `/.well-known/poppy.json` that says which web pages, APIs and company agent are available. Since [Draft 0.3](https://personalagentprotocol.org/docs/0.3/spec), sign-in is plain OAuth, the familiar "Sign in with..." approval screen, found through the company's standard OAuth metadata: you approve on the company's own page, on another device with a code, or (if the company allows it) the agent signs in for you. The spec plans to retire that last way on a date set at version 1.0. Every request the agent sends carries a short signed pass naming the session, and an agent can also start signed out, as a guest.
 
-Permissions are scopes. Version 0.2 has two shared ones, "read" and "write," and companies can add their own, such as "manage saved addresses." [Draft 0.3](https://personalagentprotocol.org/docs/changelog) drops the shared ones: each company names its own and says which make changes that can't be undone. For an action such as exchanging an item, the company can also [ask you to approve the exact terms](https://personalagentprotocol.org/docs/extensions/operations) before it acts. You also get a different anonymous ID at each company, so companies can't match you with each other. In the launch demo, Meta's Muse agent found Rocket Mortgage's agent and, with the user's permission, completed a mortgage pre-approval.
+Permissions are scopes. Draft 0.3 defines none of its own: each company names its own, such as "manage saved addresses," and says for each one whether it makes changes that can't be undone and whether it touches personal data. (Draft 0.2 had two shared ones, "read" and "write.") For an action such as exchanging an item, the company can also [ask you to approve the exact terms](https://personalagentprotocol.org/docs/extensions/operations) before it acts. You also get a different anonymous ID at each company, so companies can't match you with each other. In the launch demo, Meta's Muse agent found Rocket Mortgage's agent and, with the user's permission, completed a mortgage pre-approval.
 
 ## Who's behind it
 
-[Sierra](https://sierra.ai/blog) (led by Bret Taylor and Clay Bavor) and Meta announced it on October 6, 2026. [Sierra published Draft 0.1](https://sierra.ai/blog/poppy) on October 9 with seven launch partners (Genesys, Instinct, NiCE, Rocket, Shopify, Stripe and Walmart) and 35 more design partners, including OpenAI, Visa, Mastercard and PayPal. [Version 0.2](https://personalagentprotocol.org/docs/0.2/spec) followed on October 24, and [draft 0.3](https://personalagentprotocol.org/docs/changelog) is in progress.
+[Sierra](https://sierra.ai/blog) (led by Bret Taylor and Clay Bavor) and Meta announced it on October 6, 2026. [Sierra published Draft 0.1](https://sierra.ai/blog/poppy) on October 9 with seven launch partners (Genesys, Instinct, NiCE, Rocket, Shopify, Stripe and Walmart) and 35 more design partners, including OpenAI, Visa, Mastercard and PayPal. [Version 0.2](https://personalagentprotocol.org/docs/0.2/spec) followed on October 24 and [version 0.3](https://personalagentprotocol.org/docs/0.3/spec), a redesign around plain OAuth, on November 4. [Draft 0.4](https://personalagentprotocol.org/docs/changelog) is in progress.
 
-The spec warns that any part can change, even in ways that break compatibility, and [lists payments as not yet covered](https://personalagentprotocol.org/docs/path-to-1). A reference implementation was promised within about a month of October 9 and isn't out yet. An implementation kit for companies was added on October 17: a skill that has a coding agent design and build a company's side, and a validator that acts as a test agent against a deployment. [The kit](https://personalagentprotocol.org/kit/company) now follows draft 0.3, not the published 0.2. Poppy reuses OAuth, OpenAPI and MCP rather than replacing them.
+The spec warns that any part can change, even in ways that break compatibility, and [lists payments as not yet covered](https://personalagentprotocol.org/docs/roadmap#payments), apart from handing checkout to UCP. A reference implementation was promised within about a month of October 9 and isn't out yet. An implementation kit for companies was added on October 17: a skill that has a coding agent design and build a company's side, and a validator that acts as a test agent against a deployment. [The kit](https://personalagentprotocol.org/kit/company) now follows draft 0.4, ahead of the published 0.3. Poppy reuses OAuth, OpenAPI and MCP rather than replacing them.
diff --git a/content/standards/webmcp.md b/content/standards/webmcp.md
@@ -3,7 +3,7 @@ name: WebMCP
 job: act
 order: 1
 status: early
-status_note: Draft (Oct 27, 2026); Chrome and Edge trials; live in ChatGPT desktop and Shopify
+status_note: Draft (Nov 2, 2026); Chrome and Edge trials; live in ChatGPT desktop and Shopify
 tagline: page tools
 phrase: A page hands typed tools to the agent in your browser
 analogy: A labeled menu of actions for the agent in your browser.
@@ -12,7 +12,7 @@ when_to_use: When agents use your site in people's browsers. Add tools to your k
 backers: W3C Web ML community group; Microsoft and Google editors
 reality_check: Early use with two big real-world users, ChatGPT's desktop browser and Shopify, while Chrome and Edge are still in trials.
 links:
-  - label: Draft (Oct 27, 2026)
+  - label: Draft (Nov 2, 2026)
     url: https://webmachinelearning.github.io/webmcp/
   - label: Chrome docs
     url: https://developer.chrome.com/docs/ai/webmcp
@@ -28,20 +28,20 @@ spec_sources:
   - kind: git-path
     repo: webmachinelearning/webmcp
     path: index.bs
-    pin: "ce879543a9013dae3effe292e6deda0b4323a07d"
+    pin: "847677e03d3e61aaddf65ad328147129083168c0"
 ---
 
 ## How it works
 
 More and more AI assistants work inside your browser, clicking and typing on the page for you. Today they mostly do it by looking: reading the page's code or a screenshot, guessing which box is "departure date," and hoping the "Book" button didn't move in last week's redesign.
 
-WebMCP lets the site say it plainly. A page registers "tools" in JavaScript (`document.modelContext.registerTool()`) with a name, a plain-English description, the fields it expects and the function that does the work. Chrome also lets a site tag an existing form with two attributes, `toolname` and `tooldescription`, but the draft dropped that form option on October 8, 2026, so JavaScript tools are the safer choice. On a hair-salon site, the agent stops hunting for the calendar widget and calls `book_appointment` with a date, time and service. It all happens in your own tab and signed-in session, so you can watch and step in.
+WebMCP lets the site say it plainly. A page registers "tools" in JavaScript (`document.modelContext.registerTool()`) with a name, a plain-English description, the fields it expects and the function that does the work. Since November 2, 2026 a tool can also describe what it returns, and agents may reject a result that doesn't match. Chrome also lets a site tag an existing form with two attributes, `toolname` and `tooldescription`, but the draft dropped that form option on October 8, 2026, so JavaScript tools are the safer choice. On a hair-salon site, the agent stops hunting for the calendar widget and calls `book_appointment` with a date, time and service. It all happens in your own tab and signed-in session, so you can watch and step in.
 
 One caveat: a page's tool descriptions are text the AI reads, so a malicious site can try to trick the agent. [Chrome says agents must defend against this](https://developer.chrome.com/docs/agents/security), and [gives sites hints to flag untrusted text](https://developer.chrome.com/docs/ai/webmcp/secure-tools).
 
 ## Who's behind it
 
-Microsoft and Google proposed it together in August 2025; the W3C's Web Machine Learning community group took it up that September, with editors from both companies. The current text is a [draft dated October 27, 2026](https://webmachinelearning.github.io/webmcp/) that says plainly it is "not a W3C Standard." A [draft W3C charter](https://w3c.github.io/charter-drafts/2026/agenticweb-wg.html) for a new Agentic Web Working Group would take WebMCP as its starting text, but that group does not exist yet.
+Microsoft and Google proposed it together in August 2025; the W3C's Web Machine Learning community group took it up that September, with editors from both companies. The current text is a [draft dated November 2, 2026](https://webmachinelearning.github.io/webmcp/) that says plainly it is "not a W3C Standard." A [draft W3C charter](https://w3c.github.io/charter-drafts/2026/agenticweb-wg.html) for a new Agentic Web Working Group would take WebMCP as its starting text, but that group does not exist yet.
 
 [Chrome has been testing it](https://developer.chrome.com/docs/ai/webmcp) in a time-limited "origin trial" (Chrome 149-156) since May 2026; on September 28 [Google asked to extend the trial](http://www.mail-archive.com/blink-dev@chromium.org/msg17568.html) to Chrome 162 because feedback is still changing the API, so there's no ship date. On October 28, Google said [pages using the trial had passed 0.5% of all Chrome page loads](http://www.mail-archive.com/blink-dev@chromium.org/msg17895.html), though agents call the tools far less often. [Edge runs its own trial](https://developer.microsoft.com/en-us/microsoft-edge/origin-trials/trials/0b76fe60-b266-458e-a285-04e375c0c31a) (through March 30, 2027) and [calls it "ready for testing."](https://blogs.windows.com/msedgedev/2026/09/21/new-in-edge-for-developers-create-better-components-and-make-your-site-agent-ready/)
 

diff --git a/content/standards/x402.md b/content/standards/x402.md
@@ -30,7 +30,7 @@ spec_sources:
   - kind: git-path
     repo: x402-foundation/x402
     path: specs
-    pin: "11f02ce95e15d78e246efcbd5253ecbeefc2718d"
+    pin: "e54f095315cfc0e936a130840c44a9c6d73bdb3f"
 ---
 
 ## How it works