Poppy: recheck against the Draft 1.0 fixes of November 13 and move the pins

content/standards/poppy.md

@@ -4,14 +4,14 @@ full_name: Personal Agent Protocol (PAP)
 job: identity
 order: 2
 status: early
-status_note: Version 0.4 (Nov 10, 2026), the 1.0 release candidate; a few small deployments
+status_note: Version 0.4 (Nov 10, 2026), the 1.0 release candidate; a few deployments, mostly signed out only
 tagline: acts as you
 phrase: Your agent signs in to a company as you
 analogy: A valet key for your personal agent.
 looks_like: /.well-known/poppy.json
 when_to_use: When customers' own agents should sign in and act on their accounts. Track it; it's a fresh draft.
 backers: Sierra + Meta; 7 launch and 35 design partners
-reality_check: A draft first published October 9, 2026, now at its 1.0 release candidate. A few small companies serve a `poppy.json`, including [Salespeak](https://salespeak.ai/agent-endpoint/), [Lorikeet](https://www.lorikeetcx.ai/blog/personal-agent-protocol), [Ticket Fairy](https://www.ticketfairy.com/.well-known/poppy.json) and [Alpic](https://alpic.ai/.well-known/poppy.json), most for signed-out chats or plain website browsing only, and most still on drafts 0.1 or 0.2. None of the launch partners does yet.
+reality_check: A draft first published October 9, 2026, now at its 1.0 release candidate. A few companies serve a `poppy.json`, almost all for signed-out chats or plain website browsing only, and most still on drafts 0.1 to 0.3. Small ones include [Salespeak](https://salespeak.ai/agent-endpoint/), [Lorikeet](https://www.lorikeetcx.ai/blog/personal-agent-protocol), [Ticket Fairy](https://www.ticketfairy.com/.well-known/poppy.json) and [Alpic](https://alpic.ai/.well-known/poppy.json). The first launch partner is now live. [Rocket Mortgage](https://www.rocketmortgage.com/.well-known/poppy.json) serves a Draft 0.3 file with a signed-out MCP server for mortgage education and sample rates, and no sign-in yet. No other launch partner does.
 links:
   - label: Specification (version 0.4, the 1.0 release candidate)
     url: https://personalagentprotocol.org/docs/0.4/spec
@@ -36,25 +36,25 @@ related:
     note: Poppy finds the company and signs you in; its UCP extension hands carts, checkout and payment to UCP.
   - id: ap2
     note: Payments are not covered yet. Until they are, payment consent needs another protocol, such as AP2.
-last_verified: "2026-11-12"
+last_verified: "2026-11-13"
 spec_sources:
   - kind: git-path
     repo: personal-agent-protocol/personal-agent-protocol
     path: content/versions/1.0
-    pin: "720a0fe76f4b826d2008679395c26779319bf965"
+    pin: "0800017f4ba402b8f5616b20eacf32ae8b103f0a"
   - kind: git-path
     repo: personal-agent-protocol/personal-agent-protocol
     path: content/versions/versions.json
     pin: "ff7c9a373e46e3f23957eae598cf1bf172e1b769"
   - kind: page
     url: https://personalagentprotocol.org/docs/spec
-    pin: "a92048d4ae0789a65af128f3a2d6295299c6cf0161a737d1064f8b51738d3383"
+    pin: "396c448f352fddc00a4ec3c9659142381d4a058f69873c8024fcafebc4443d33"
   - kind: page
     url: https://personalagentprotocol.org/docs/extensions/operations
     pin: "3ff24dccc84e121b638ab6f448bd9fd56188350c9723bbccac6bd2d15e5b846c"
   - kind: page
     url: https://personalagentprotocol.org/docs/guides
-    pin: "e2615c6deac2213b60fbec6da918169a57c77677b71adca712e045a814b4e832"
+    pin: "fc46a65967b779f7e1e8e3cf338803a9d2c26b51e5d0b480682d961b8d3946fe"
   - kind: page
     url: https://personalagentprotocol.org/docs/extensions
     pin: "82ca57a473356ae3c0010acb42dff23f107612ac9cbb97b7ece36b50c3c82b03"
@@ -76,6 +76,6 @@ Permissions are scopes. Each company names its own, such as "manage saved addres
 
 ## Who's behind it
 
-[Sierra](https://sierra.ai/blog) (led by Bret Taylor and Clay Bavor) and Meta announced it on October 6, 2026. [Sierra published Draft 0.1](https://sierra.ai/blog/poppy) on October 9 with seven launch partners (Genesys, Instinct, NiCE, Rocket, Shopify, Stripe and Walmart) and 35 more design partners, including OpenAI, Visa, Mastercard and PayPal. [Version 0.2](https://personalagentprotocol.org/docs/0.2/spec) followed on October 24, [version 0.3](https://personalagentprotocol.org/docs/0.3/spec), a redesign around plain OAuth, on November 4, and [version 0.4](https://personalagentprotocol.org/docs/0.4/spec) on November 10 as the 1.0 release candidate. [Draft 1.0](https://personalagentprotocol.org/docs/changelog) is in progress: the authors say it takes only fixes for problems implementers find, no new features, and that a fix can still break compatibility.
+[Sierra](https://sierra.ai/blog) (led by Bret Taylor and Clay Bavor) and Meta announced it on October 6, 2026. [Sierra published Draft 0.1](https://sierra.ai/blog/poppy) on October 9 with seven launch partners (Genesys, Instinct, NiCE, Rocket, Shopify, Stripe and Walmart) and 35 more design partners, including OpenAI, Visa, Mastercard and PayPal. [Version 0.2](https://personalagentprotocol.org/docs/0.2/spec) followed on October 24, [version 0.3](https://personalagentprotocol.org/docs/0.3/spec), a redesign around plain OAuth, on November 4, and [version 0.4](https://personalagentprotocol.org/docs/0.4/spec) on November 10 as the 1.0 release candidate. [Draft 1.0](https://personalagentprotocol.org/docs/changelog) is in progress: the authors say it takes only fixes for problems implementers find, no new features, and that a fix can still break compatibility. The fixes so far mostly tighten sign-in: the company's approval page must list every permission it will grant, including ones the person approved before; a company may require the agent to send its sign-in request ahead, server to server (Pushed Authorization Requests); and a company's own agent must say in `poppy.json` what it can help with.
 
 Until 1.0 the spec can still change in ways that break compatibility, and it [lists payments as not yet covered](https://personalagentprotocol.org/docs/roadmap#payments), apart from handing checkout to UCP. A reference implementation was promised within about a month of October 9 and isn't out yet. An implementation kit for companies was added on October 17: a skill that has a coding agent design and build a company's side, and a validator that acts as a test agent against a deployment. [The kit](https://personalagentprotocol.org/kit/company) now follows draft 1.0, ahead of the published 0.4. Poppy reuses OAuth, OpenAPI and MCP rather than replacing them.

spec-pins.json

@@ -80,7 +80,7 @@
           "kind": "git-path",
           "repo": "personal-agent-protocol/personal-agent-protocol",
           "path": "content/versions/1.0",
-          "pin": "720a0fe76f4b826d2008679395c26779319bf965"
+          "pin": "0800017f4ba402b8f5616b20eacf32ae8b103f0a"
         },
         {
           "kind": "git-path",
@@ -91,7 +91,7 @@
         {
           "kind": "page",
           "url": "https://personalagentprotocol.org/docs/spec",
-          "pin": "a92048d4ae0789a65af128f3a2d6295299c6cf0161a737d1064f8b51738d3383"
+          "pin": "396c448f352fddc00a4ec3c9659142381d4a058f69873c8024fcafebc4443d33"
         },
         {
           "kind": "page",
@@ -101,7 +101,7 @@
         {
           "kind": "page",
           "url": "https://personalagentprotocol.org/docs/guides",
-          "pin": "e2615c6deac2213b60fbec6da918169a57c77677b71adca712e045a814b4e832"
+          "pin": "fc46a65967b779f7e1e8e3cf338803a9d2c26b51e5d0b480682d961b8d3946fe"
         },
         {
           "kind": "page",