[liady]

What changed

Every page was rechecked against primary sources on October 19, 2026. Poppy moves from Draft to Early use. Stale or wrong claims are fixed on nine other pages; ACP and MPP mostly gain new facts. The README map screenshot is updated to match.

Covers the same Poppy lines as #6, which can be closed if this merges. One correction to #6: Salespeak isn't the only public deployment.

Sources

Poppy (status draft to early)

• Public poppy.json files are live at salespeak.ai, lorikeetcx.ai, ticketfairy.com (with direct and device sign-in plus APIs), emorahealth.com and docs.celestia.org. All are on 0.1, and most are signed-out only. No launch partner serves one yet. This meets "some real, public deployments, but small".
• Draft 0.1 is still the published version, and 0.2 is "in progress, no publication date yet": https://personalagentprotocol.org/docs/changelog. /docs/spec now shows the 0.2 working draft, so the spec link points to https://personalagentprotocol.org/docs/0.1/spec.
• There are 7 launch partners, not 6 (NiCE), and the design partners include OpenAI, Visa, Mastercard and PayPal: https://sierra.ai/blog/poppy and https://personalagentprotocol.org/docs/path-to-1. Open topics moved to Path to 1.0.

WebMCP

• The draft is now dated October 16, 2026: https://webmachinelearning.github.io/webmcp/
• The declarative form attributes were removed from the draft on October 8, 2026 (commit #338).
• Shopify puts WebMCP tools on every Liquid storefront, and Hydrogen stores can opt in. The checkout tool needs the buyer's approval, but that rule is on the agent, not enforced by the tool: https://shopify.dev/docs/api/web-mcp and https://shopify.dev/docs/agents/carts-and-checkout/checkout-webmcp
• "Ready for testing" now links to the Edge blog post. Removed "since Edge 150", which had no primary source.

AP2

• v0.2 has two mandates, checkout and payment, each open then closed. It supports cards only today; other methods are on the roadmap: https://ap2-protocol.org/
• FIDO plans a first combined version in mid-2027: https://www.w3.org/2026/09/ecommerce-agents/slides/Jean_Luc_Di_Manno_FIDO.pdf

auth.md

• The email flow changed in v0.4.0: https://github.com/workos/auth.md/blob/main/CHANGELOG.md
• The "not an IETF-ratified standard" quote now links to its real source: https://workos.com/blog/mcp-night-4-recap-auth-md-agentic-registration
• auth.md is now built into AuthKit: https://workos.com/changelog/agent-registration

Web Bot Auth

• The key-directory change already landed in -00: https://www.ietf.org/archive/id/draft-ietf-webbotauth-httpsig-protocol-00.html
• Cloudflare's checker still expects the older format: https://developers.cloudflare.com/bots/reference/bot-verification/web-bot-auth/
• Cloudflare only plans to use Web Bot Auth and x402 together for pay-per-crawl: https://blog.cloudflare.com/x402/

ARD and ai-catalog

• The two are loosely coupled "at least for now", not formally split: https://github.com/ards-project/ard-spec/blob/main/adr/0010-ard-and-ai-catalog-loose-coupling.md
• GitHub and Hugging Face now publish catalogs. The September sweep is labelled as a secondary source: Discovery path and link relation now differ from ARD v0.91 — 78 of 102 publishers are reachable on only one Agent-Card/ai-catalog#115
• MCP Server Cards is Final: https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/seps/2127-mcp-server-cards.md

UCP

• About 17,800 verified stores, now attributed to the independent tracker: https://ucpchecker.com/blog/state-of-agentic-commerce-september-2026
• The release notes list 11 groups of breaking changes, and the description of what v2026-08-25 changed is corrected: https://github.com/Universal-Commerce-Protocol/ucp/releases/tag/v2026-08-25
• The launch link now points to Google's post.

x402

• New volume figures from TRM Labs: https://www.trmlabs.com/trm-tech-blog/whos-actually-paying-measuring-ai-agent-payments-onchain
• The foundation now lists 57 members, 19 of them premier: https://www.x402.org/members
• Added a spec link.

ACP

• Meta joined the steering committee: https://github.com/agentic-commerce-protocol/agentic-commerce-protocol/blob/main/docs/governance.md

MPP

• Visa drafted a card method: https://paymentauth.org/draft-card-charge-00.html
• The spec is now first in links.

NLWeb

• Added a spec link: https://nlweb.ai/docs/specification
• Cloudflare's setup is a public preview, not one-click: https://developers.cloudflare.com/ai-search/how-to/nlweb

The statuses of NLWeb (borderline Draft) and WebMCP (arguably In production) were reviewed and left unchanged on purpose.

Checklist

• Every new or changed claim links a primary source. (The UCP Checker and apis.io figures are labelled as secondary in the text.)
• If I changed a status, the evidence meets the rules in content/contribute.md.
• I only changed last_verified on pages where I rechecked every claim. Exceptions where only secondary sources were found: the UCP hiking-boots example, the ai-catalog restaurant example, and the openai.com post behind the ACP claims, which returned 403 and was confirmed through coverage that quotes it.
• Plain words, no em dashes.

npm test, npm run lint and npm run typecheck pass.

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
standards	Ready	Preview	Oct 19, 2026 4:30am UTC