[liady]

What changed

Poppy's version 0.4 was published on November 10, 2026 as the 1.0 release candidate, and Draft 1.0 started the next day. The Poppy page now names 0.4 as the specification and 1.0 as the draft in progress, links the Path to 1.0 page, says what 0.4 changed for readers, and moves the spec pins to 0.4 and the 1.0 working draft pages, matching Ora's pins in https://github.com/eralabs-ai/ora/pull/1674.

Details:

• status_note, reality_check, links and both prose sections updated. Status stays early: the live recheck on November 12 found the same small deployments, most still on drafts 0.1 or 0.2, and no launch partner serving a poppy.json.
• New in the prose: direct sign-in is the preferred way (0.4 spec 4); the protocol defines one scope of its own, for signing the agent's browser in (0.4 spec 4.7, 6); an operation can be approved by the agent on the user's instruction (Operations version 3); a company can serve several protocol versions at once (0.4 spec 3.4). The "Sign in with..." wording is gone, since the 0.4 guides advise consent pages to say "wants to connect" instead.
• The implementation kit now follows draft 1.0 (PROTOCOL_VERSION = "1.0" in kit/company/validate/catalog.ts).
• content/guide.json: the Poppy note still said "Draft 0.2 is from October 24, 2026, and 0.3 is in progress"; it now names 0.4 and 1.0.
• last_verified moves to 2026-11-12: every claim on the page was rechecked.
• Pins: content/versions/0.4 tree 399ba1b, versions.json blob ff7c9a3, and the six working draft page digests, which now hash the 1.0 pages. spec-pins.json regenerated with npm run pins.

Sources

• Version 0.4: https://personalagentprotocol.org/docs/0.4/spec (published date in content/versions/versions.json, https://github.com/personal-agent-protocol/personal-agent-protocol/blob/main/content/versions/versions.json)
• Draft 1.0 and the changelog: https://personalagentprotocol.org/docs/1.0/spec, https://personalagentprotocol.org/docs/changelog
• Path to 1.0: https://personalagentprotocol.org/docs/path-to-1
• Operations version 3: https://personalagentprotocol.org/docs/0.4/extensions/operations
• Mediated Sign-In retirement at 1.0: https://personalagentprotocol.org/docs/0.4/extensions/mediated-sign-in
• Demos page (first-party demos still in development): https://personalagentprotocol.org/docs/demos
• Kit: https://personalagentprotocol.org/kit/company
• Deployments: each listed /.well-known/poppy.json fetched on 2026-11-12; walmart.com, shopify.com, stripe.com, rocketmortgage.com, genesys.com and nice.com answer 404.

Checklist

• Every new or changed claim links a primary source.
• If I changed a status, the evidence meets the rules in content/contribute.md. (Status unchanged.)
• I only changed last_verified on pages where I rechecked every claim.
• Plain words, no em dashes.

npm test, npm run lint and npm run typecheck pass.

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
standards	Ready	Preview	Nov 12, 2026 1:17am UTC