From 1e8da46a99b646da4eb1c5b557554cff68238282 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 12 Nov 2026 00:58:52 +0000 Subject: [PATCH 1/2] Poppy: recheck against version 0.4 (the 1.0 release candidate) and move the pins Version 0.4 was published on November 10, 2026 as the 1.0 release candidate, and Draft 1.0 started the next day. The page now names 0.4 as the specification and 1.0 as the draft in progress, links the Path to 1.0 page, and says what 0.4 changed for readers: direct sign-in is preferred, the protocol defines one scope of its own (browser sign-in), an agent can approve an operation on the user's instruction, and a company can serve several versions at once. The kit now follows draft 1.0. Deployments were rechecked on November 12: same small companies, none of the launch partners. The guide note for Poppy was still on Draft 0.2. Pins move to content/versions/0.4, the new versions.json blob, and the working draft pages, which now serve Draft 1.0, matching Ora's pins. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01NWyUpGi6pqawG6T6LjjGCA --- content/guide.json | 2 +- content/standards/poppy.md | 40 ++++++++++++++++++++------------------ spec-pins.json | 14 ++++++------- 3 files changed, 29 insertions(+), 27 deletions(-) diff --git a/content/guide.json b/content/guide.json index 817bec1..378412d 100644 --- a/content/guide.json +++ b/content/guide.json @@ -7,7 +7,7 @@ { "situation": "You have lots of structured content people and agents want to query", "standards": ["nlweb"] }, { "situation": "Your bot visits other sites, or you need to verify bots on yours", "standards": ["web-bot-auth"] }, { "situation": "You want agents to create accounts on your service without a sign-up form", "standards": ["auth-md"] }, - { "situation": "Customers' own agents should sign in and act on their accounts", "standards": ["poppy"], "note": "Track it; Draft 0.2 is from October 24, 2026, and 0.3 is in progress." }, + { "situation": "Customers' own agents should sign in and act on their accounts", "standards": ["poppy"], "note": "Track it; version 0.4, the 1.0 release candidate, is from November 10, 2026, and 1.0 is in progress." }, { "situation": "You sell goods and want any AI assistant to browse, cart and check out", "standards": ["ucp"] }, { "situation": "You want your products shown in ChatGPT", "standards": ["acp"] }, { "situation": "An agent pays and you need proof a person approved those exact terms", "standards": ["ap2"] }, diff --git a/content/standards/poppy.md b/content/standards/poppy.md index d5bc363..1e731b7 100644 --- a/content/standards/poppy.md +++ b/content/standards/poppy.md @@ -4,20 +4,22 @@ full_name: Personal Agent Protocol (PAP) job: identity order: 2 status: early -status_note: Draft 0.3 (Nov 4, 2026), 0.4 in progress; a few small deployments +status_note: Version 0.4 (Nov 10, 2026), the 1.0 release candidate; a few small deployments tagline: acts as you phrase: Your agent signs in to a company as you analogy: A valet key for your personal agent. looks_like: /.well-known/poppy.json when_to_use: When customers' own agents should sign in and act on their accounts. Track it; it's a fresh draft. backers: Sierra + Meta; 7 launch and 35 design partners -reality_check: A draft first published October 9, 2026. A few small companies serve a `poppy.json`, including [Salespeak](https://salespeak.ai/agent-endpoint/), [Lorikeet](https://www.lorikeetcx.ai/blog/personal-agent-protocol), [Ticket Fairy](https://www.ticketfairy.com/.well-known/poppy.json) and [Alpic](https://alpic.ai/.well-known/poppy.json), most for signed-out chats or plain website browsing only. None of the launch partners does yet. +reality_check: A draft first published October 9, 2026, now at its 1.0 release candidate. A few small companies serve a `poppy.json`, including [Salespeak](https://salespeak.ai/agent-endpoint/), [Lorikeet](https://www.lorikeetcx.ai/blog/personal-agent-protocol), [Ticket Fairy](https://www.ticketfairy.com/.well-known/poppy.json) and [Alpic](https://alpic.ai/.well-known/poppy.json), most for signed-out chats or plain website browsing only, and most still on drafts 0.1 or 0.2. None of the launch partners does yet. links: - - label: Specification (Draft 0.3) - url: https://personalagentprotocol.org/docs/0.3/spec - - label: Draft 0.4 (in progress) - url: https://personalagentprotocol.org/docs/spec - - label: Roadmap to 1.0 + - label: Specification (version 0.4, the 1.0 release candidate) + url: https://personalagentprotocol.org/docs/0.4/spec + - label: Draft 1.0 (in progress) + url: https://personalagentprotocol.org/docs/1.0/spec + - label: Path to 1.0 + url: https://personalagentprotocol.org/docs/path-to-1 + - label: Roadmap url: https://personalagentprotocol.org/docs/roadmap - label: Company implementation kit (skill and validator) url: https://personalagentprotocol.org/kit/company @@ -34,25 +36,25 @@ related: note: Poppy finds the company and signs you in; its UCP extension hands carts, checkout and payment to UCP. - id: ap2 note: Payments are not covered yet. Until they are, payment consent needs another protocol, such as AP2. -last_verified: "2026-10-30" +last_verified: "2026-11-12" spec_sources: - kind: git-path repo: personal-agent-protocol/personal-agent-protocol - path: content/versions/0.3 - pin: "1e12f5a57bb3373ce90fdb41ad4d6bad8f960895" + path: content/versions/0.4 + pin: "399ba1bd27f72fc55e9a6dfe852d3725ad325051" - kind: git-path repo: personal-agent-protocol/personal-agent-protocol path: content/versions/versions.json - pin: "359b99e717a9fee2937216ce71af63eee0b3eceb" + pin: "ff7c9a373e46e3f23957eae598cf1bf172e1b769" - kind: page url: https://personalagentprotocol.org/docs/spec - pin: "654a1339d24bfc2ee1eb4082657fb7d68f322d6e52fc8c1f7c1d7ca22b73289c" + pin: "a92048d4ae0789a65af128f3a2d6295299c6cf0161a737d1064f8b51738d3383" - kind: page url: https://personalagentprotocol.org/docs/extensions/operations - pin: "f8bf4eaebc1dabfb22b21fcf24d6d572f78caa669dae54d024cb8d1cce962c04" + pin: "3ff24dccc84e121b638ab6f448bd9fd56188350c9723bbccac6bd2d15e5b846c" - kind: page url: https://personalagentprotocol.org/docs/guides - pin: "9f7c5a9a77fece2fd3d9c2acb4fc0ec236117a0bacdfa4c724062a8839b1a89d" + pin: "e2615c6deac2213b60fbec6da918169a57c77677b71adca712e045a814b4e832" - kind: page url: https://personalagentprotocol.org/docs/extensions pin: "82ca57a473356ae3c0010acb42dff23f107612ac9cbb97b7ece36b50c3c82b03" @@ -61,19 +63,19 @@ spec_sources: pin: "611e30c47fef811bef0d4fbf682218f16353962df010763e879134e7dc759bd0" - kind: page url: https://personalagentprotocol.org/docs/extensions/mediated-sign-in - pin: "b4c3b5aafade726dad00ef4b48c8ab7854379b1ecc237879c878b537264b8e1e" + pin: "038750a9437204cb4142ea17a2fdffdece2f4ca5b64a89dd530ad4d656f52b13" --- ## How it works It lets the agent act for you at a company, with only the permissions you gave it, without opening the boot or the glovebox. Right now an AI agent acting for you has two bad options: pretend to be you in a browser, or not get in at all. -Poppy gives the company a file at `/.well-known/poppy.json` that says which web pages, APIs and company agent are available. Since [Draft 0.3](https://personalagentprotocol.org/docs/0.3/spec), sign-in is plain OAuth, the familiar "Sign in with..." approval screen, found through the company's standard OAuth metadata: you approve on the company's own page, on another device with a code, or (if the company allows it) the agent signs in for you. The spec plans to retire that last way on a date set at version 1.0. Every request the agent sends carries a short signed pass naming the session, and an agent can also start signed out, as a guest. +Poppy gives the company a file at `/.well-known/poppy.json` that says which web pages, APIs and company agent are available. Since [Draft 0.3](https://personalagentprotocol.org/docs/0.3/spec), sign-in is plain OAuth, found through the company's standard OAuth metadata: you approve on the company's own page, on another device with a code, or (if the company allows it) the agent signs in for you. [Version 0.4](https://personalagentprotocol.org/docs/0.4/spec) makes the first of those the preferred way, and the spec plans to retire the last one on a date set at version 1.0. Every request the agent sends carries a short signed pass naming the session, and an agent can also start signed out, as a guest. -Permissions are scopes. Draft 0.3 defines none of its own: each company names its own, such as "manage saved addresses," and says for each one whether it makes changes that can't be undone and whether it touches personal data. (Draft 0.2 had two shared ones, "read" and "write.") For an action such as exchanging an item, the company can also [ask you to approve the exact terms](https://personalagentprotocol.org/docs/extensions/operations) before it acts. You also get a different anonymous ID at each company, so companies can't match you with each other. In the launch demo, Meta's Muse agent found Rocket Mortgage's agent and, with the user's permission, completed a mortgage pre-approval. +Permissions are scopes. Each company names its own, such as "manage saved addresses," and says for each one whether it makes changes that can't be undone and whether it touches personal data. The protocol defines just one, which lets the agent's browser use the website signed in as you. (Draft 0.2 had two shared ones, "read" and "write.") For an action such as exchanging an item, the company can also [ask for approval of the exact terms](https://personalagentprotocol.org/docs/0.4/extensions/operations) before it acts, given by you or by your agent on an instruction you gave it. A company can also serve several versions of the protocol at once, so agents can move to a new one at their own pace. You also get a different anonymous ID at each company, so companies can't match you with each other. In the launch demo, Meta's Muse agent found Rocket Mortgage's agent and, with the user's permission, completed a mortgage pre-approval. ## Who's behind it -[Sierra](https://sierra.ai/blog) (led by Bret Taylor and Clay Bavor) and Meta announced it on October 6, 2026. [Sierra published Draft 0.1](https://sierra.ai/blog/poppy) on October 9 with seven launch partners (Genesys, Instinct, NiCE, Rocket, Shopify, Stripe and Walmart) and 35 more design partners, including OpenAI, Visa, Mastercard and PayPal. [Version 0.2](https://personalagentprotocol.org/docs/0.2/spec) followed on October 24 and [version 0.3](https://personalagentprotocol.org/docs/0.3/spec), a redesign around plain OAuth, on November 4. [Draft 0.4](https://personalagentprotocol.org/docs/changelog) is in progress. +[Sierra](https://sierra.ai/blog) (led by Bret Taylor and Clay Bavor) and Meta announced it on October 6, 2026. [Sierra published Draft 0.1](https://sierra.ai/blog/poppy) on October 9 with seven launch partners (Genesys, Instinct, NiCE, Rocket, Shopify, Stripe and Walmart) and 35 more design partners, including OpenAI, Visa, Mastercard and PayPal. [Version 0.2](https://personalagentprotocol.org/docs/0.2/spec) followed on October 24, [version 0.3](https://personalagentprotocol.org/docs/0.3/spec), a redesign around plain OAuth, on November 4, and [version 0.4](https://personalagentprotocol.org/docs/0.4/spec) on November 10 as the 1.0 release candidate. [Draft 1.0](https://personalagentprotocol.org/docs/changelog) is in progress: the authors say it takes only fixes for problems implementers find, no new features, and that a fix can still break compatibility. -The spec warns that any part can change, even in ways that break compatibility, and [lists payments as not yet covered](https://personalagentprotocol.org/docs/roadmap#payments), apart from handing checkout to UCP. A reference implementation was promised within about a month of October 9 and isn't out yet. An implementation kit for companies was added on October 17: a skill that has a coding agent design and build a company's side, and a validator that acts as a test agent against a deployment. [The kit](https://personalagentprotocol.org/kit/company) now follows draft 0.4, ahead of the published 0.3. Poppy reuses OAuth, OpenAPI and MCP rather than replacing them. +Until 1.0 the spec can still change in ways that break compatibility, and it [lists payments as not yet covered](https://personalagentprotocol.org/docs/roadmap#payments), apart from handing checkout to UCP. A reference implementation was promised within about a month of October 9 and isn't out yet. An implementation kit for companies was added on October 17: a skill that has a coding agent design and build a company's side, and a validator that acts as a test agent against a deployment. [The kit](https://personalagentprotocol.org/kit/company) now follows draft 1.0, ahead of the published 0.4. Poppy reuses OAuth, OpenAPI and MCP rather than replacing them. diff --git a/spec-pins.json b/spec-pins.json index 7588cea..ee839f7 100644 --- a/spec-pins.json +++ b/spec-pins.json @@ -79,29 +79,29 @@ { "kind": "git-path", "repo": "personal-agent-protocol/personal-agent-protocol", - "path": "content/versions/0.3", - "pin": "1e12f5a57bb3373ce90fdb41ad4d6bad8f960895" + "path": "content/versions/0.4", + "pin": "399ba1bd27f72fc55e9a6dfe852d3725ad325051" }, { "kind": "git-path", "repo": "personal-agent-protocol/personal-agent-protocol", "path": "content/versions/versions.json", - "pin": "359b99e717a9fee2937216ce71af63eee0b3eceb" + "pin": "ff7c9a373e46e3f23957eae598cf1bf172e1b769" }, { "kind": "page", "url": "https://personalagentprotocol.org/docs/spec", - "pin": "654a1339d24bfc2ee1eb4082657fb7d68f322d6e52fc8c1f7c1d7ca22b73289c" + "pin": "a92048d4ae0789a65af128f3a2d6295299c6cf0161a737d1064f8b51738d3383" }, { "kind": "page", "url": "https://personalagentprotocol.org/docs/extensions/operations", - "pin": "f8bf4eaebc1dabfb22b21fcf24d6d572f78caa669dae54d024cb8d1cce962c04" + "pin": "3ff24dccc84e121b638ab6f448bd9fd56188350c9723bbccac6bd2d15e5b846c" }, { "kind": "page", "url": "https://personalagentprotocol.org/docs/guides", - "pin": "9f7c5a9a77fece2fd3d9c2acb4fc0ec236117a0bacdfa4c724062a8839b1a89d" + "pin": "e2615c6deac2213b60fbec6da918169a57c77677b71adca712e045a814b4e832" }, { "kind": "page", @@ -116,7 +116,7 @@ { "kind": "page", "url": "https://personalagentprotocol.org/docs/extensions/mediated-sign-in", - "pin": "b4c3b5aafade726dad00ef4b48c8ab7854379b1ecc237879c878b537264b8e1e" + "pin": "038750a9437204cb4142ea17a2fdffdece2f4ca5b64a89dd530ad4d656f52b13" } ] }, From b224b7800da3be9527e0ac0efebd9af7b4d2d89e Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 12 Nov 2026 01:56:30 +0000 Subject: [PATCH 2/2] Poppy: watch the Draft 1.0 source folder, matching Ora's pin Ora now pins Draft 1.0, the version the spec's authors ask builders to use, so its spec-drift pin follows content/versions/1.0. ax.guide moves the same pin so the two stay in lockstep and any edit to the 1.0 draft opens a drift issue here too. The page text is unchanged: it already names 0.4 as the published specification and 1.0 as the draft in progress. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01NWyUpGi6pqawG6T6LjjGCA --- content/standards/poppy.md | 4 ++-- spec-pins.json | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/content/standards/poppy.md b/content/standards/poppy.md index 1e731b7..f4592c2 100644 --- a/content/standards/poppy.md +++ b/content/standards/poppy.md @@ -40,8 +40,8 @@ last_verified: "2026-11-12" spec_sources: - kind: git-path repo: personal-agent-protocol/personal-agent-protocol - path: content/versions/0.4 - pin: "399ba1bd27f72fc55e9a6dfe852d3725ad325051" + path: content/versions/1.0 + pin: "720a0fe76f4b826d2008679395c26779319bf965" - kind: git-path repo: personal-agent-protocol/personal-agent-protocol path: content/versions/versions.json diff --git a/spec-pins.json b/spec-pins.json index ee839f7..c15a7bd 100644 --- a/spec-pins.json +++ b/spec-pins.json @@ -79,8 +79,8 @@ { "kind": "git-path", "repo": "personal-agent-protocol/personal-agent-protocol", - "path": "content/versions/0.4", - "pin": "399ba1bd27f72fc55e9a6dfe852d3725ad325051" + "path": "content/versions/1.0", + "pin": "720a0fe76f4b826d2008679395c26779319bf965" }, { "kind": "git-path",