{"profile":"pap-0.1@2026-10-09","spec_version":"0.1","draft":true,"spec_url":"https://personalagentprotocol.org/docs/spec","generated_from":"ora","tier1_policy":"Tier 1 requests are sent only on a scan that asks for active probes, at most once per target domain every 6 hours, and never to a domain whose verified owner turned active probes off.","rows":[{"id":"T0-01","tier":0,"level":"0","severity":"P0","title":"Document exists","spec_ref":"§3","spec_url":"https://personalagentprotocol.org/docs/spec#discovery","profile":"pap-0.1@2026-10-09","implemented":true,"provisional":false,"request":{"method":"GET","target":"https://{domain}/.well-known/poppy.json","condition":"on every scanned domain"},"pass_when":"https://{domain}/.well-known/poppy.json (or its www or apex sibling, see T0-SIB) answers 2xx, after at most 5 redirects, with a JSON object naming protocol_version or organization. A body sent as JSON that does not parse, is not an object or is over 100 KB also counts as found (and fails T0-03); a JSON object with neither key, an HTML page or any other body reads as no file","replaces":null},{"id":"T0-02","tier":0,"level":"0","severity":"P0","title":"Redirects safe","spec_ref":"§3","spec_url":"https://personalagentprotocol.org/docs/spec#discovery","profile":"pap-0.1@2026-10-09","implemented":true,"provisional":false,"request":null,"pass_when":"Every redirect hop on the way to poppy.json is HTTPS","replaces":null},{"id":"T0-03","tier":0,"level":"0","severity":"P0","title":"Valid JSON object","spec_ref":"§3","spec_url":"https://personalagentprotocol.org/docs/spec#discovery","profile":"pap-0.1@2026-10-09","implemented":true,"provisional":false,"request":null,"pass_when":"The body parses as a JSON object of at most 100 KB","replaces":null},{"id":"T0-04","tier":0,"level":"0","severity":"P0","title":"Supported protocol_version","spec_ref":"§3.1","spec_url":"https://personalagentprotocol.org/docs/spec#fields","profile":"pap-0.1@2026-10-09","implemented":true,"provisional":false,"request":null,"pass_when":"protocol_version is a \"major.minor\" string whose major is 0","replaces":null},{"id":"T0-05","tier":0,"level":"0","severity":"P0","title":"Organization matches the requested host","spec_ref":"§3.1","spec_url":"https://personalagentprotocol.org/docs/spec#fields","profile":"pap-0.1@2026-10-09","implemented":true,"provisional":false,"request":null,"pass_when":"organization has a name and a domain, and organization.domain equals the host the agent requested, case folded and ignoring a leading www. (never the host a redirect served the file from)","replaces":null},{"id":"T0-06","tier":0,"level":"0","severity":"P0","title":"Has an interface","spec_ref":"§3.1","spec_url":"https://personalagentprotocol.org/docs/spec#fields","profile":"pap-0.1@2026-10-09","implemented":true,"provisional":false,"request":null,"pass_when":"The file has at least one interface: an agent object, a non-empty apis array or a web object","replaces":null},{"id":"T0-07","tier":0,"level":"0","severity":"P0","title":"auth.issuer when needed","spec_ref":"§3.1","spec_url":"https://personalagentprotocol.org/docs/spec#fields","profile":"pap-0.1@2026-10-09","implemented":true,"provisional":false,"request":null,"pass_when":"auth.issuer is set whenever agent, apis or web.browser_session_endpoint is present; N/A when no interface needs sign-in","replaces":null},{"id":"T0-08","tier":0,"level":"0","severity":"P0","title":"All URLs HTTPS","spec_ref":"§3","spec_url":"https://personalagentprotocol.org/docs/spec#discovery","profile":"pap-0.1@2026-10-09","implemented":true,"provisional":false,"request":null,"pass_when":"Every URL field the spec defines, and every string in the file that carries a URL scheme, is an absolute https URL","replaces":null},{"id":"T0-SIB","tier":0,"level":"0","severity":"P2","title":"Published on the requested host","spec_ref":"§3.1","spec_url":"https://personalagentprotocol.org/docs/spec#fields","profile":"pap-0.1@2026-10-09","implemented":true,"provisional":false,"request":{"method":"GET","target":"https://{www or apex sibling}/.well-known/poppy.json","condition":"when the requested host has no file and its homepage resolved to the sibling"},"pass_when":"Ora's lookup, not defined by the spec: poppy.json is served on the requested host itself, not only on its www or apex sibling","replaces":null},{"id":"T0-09","tier":0,"level":"0","severity":"P0","title":"Issuer metadata reachable","spec_ref":"§3.2","spec_url":"https://personalagentprotocol.org/docs/spec#oauth-server","profile":"pap-0.1@2026-10-09","implemented":true,"provisional":false,"request":{"method":"GET","target":"the issuer's RFC 8414 metadata URL","condition":"when the file names an issuer"},"pass_when":"The issuer's RFC 8414 metadata (/.well-known/oauth-authorization-server for auth.issuer, following redirects only within the issuer's registrable domain) answers 200 with a JSON object","replaces":null},{"id":"T0-10","tier":0,"level":"0","severity":"P0","title":"Issuer match","spec_ref":"§3.2","spec_url":"https://personalagentprotocol.org/docs/spec#oauth-server","profile":"pap-0.1@2026-10-09","implemented":true,"provisional":false,"request":null,"pass_when":"The metadata's issuer is exactly auth.issuer","replaces":null},{"id":"T0-11","tier":0,"level":"0","severity":"P0","title":"Domain binding","spec_ref":"§3.2","spec_url":"https://personalagentprotocol.org/docs/spec#oauth-server","profile":"pap-0.1@2026-10-09","implemented":true,"provisional":false,"request":null,"pass_when":"The metadata's poppy_domains lists organization.domain, case insensitive","replaces":null},{"id":"T0-12","tier":0,"level":"0","severity":"P0","title":"Required endpoints","spec_ref":"§3.2","spec_url":"https://personalagentprotocol.org/docs/spec#oauth-server","profile":"pap-0.1@2026-10-09","implemented":true,"provisional":false,"request":null,"pass_when":"The metadata has https token_endpoint and revocation_endpoint, plus authorization_endpoint when auth.direct is set and device_authorization_endpoint when auth.device is set","replaces":null},{"id":"T0-21","tier":0,"level":"0","severity":"P2","title":"Cache headers","spec_ref":"§3.2","spec_url":"https://personalagentprotocol.org/docs/spec#oauth-server","profile":"pap-0.1@2026-10-09","implemented":true,"provisional":false,"request":null,"pass_when":"Ora inference, graded P2: the issuer metadata response sends Cache-Control or Expires. The spec's caching SHOULD binds agents, not the Company","replaces":null},{"id":"ADV-PKCE","tier":0,"level":"0","severity":"Adv","title":"No plain PKCE","spec_ref":"guides","spec_url":"https://personalagentprotocol.org/docs/guides","profile":"pap-0.1@2026-10-09","implemented":true,"provisional":false,"request":null,"pass_when":"code_challenge_methods_supported, when the metadata lists it, does not include plain","replaces":null},{"id":"T0-13","tier":0,"level":"0","severity":"P1","title":"Scopes defined","spec_ref":"§3.1","spec_url":"https://personalagentprotocol.org/docs/spec#fields","profile":"pap-0.1@2026-10-09","implemented":true,"provisional":false,"request":null,"pass_when":"Each sign-in type in auth (direct, device, mediated) lists scopes, each poppy:read, poppy:write or a key of auth.custom_scopes; every custom scope has a description and no poppy: prefix","replaces":null},{"id":"T0-14","tier":0,"level":"0","severity":"P1","title":"Mediated sign-in well formed","spec_ref":"§4.7","spec_url":"https://personalagentprotocol.org/docs/spec#mediated-sign-in","profile":"pap-0.1@2026-10-09","implemented":true,"provisional":false,"request":null,"pass_when":"auth.mediated has an https endpoint, a non-empty fields list (each with a name, a label and a boolean secret) and scopes","replaces":null},{"id":"T0-19","tier":0,"level":"0","severity":"P1","title":"Extensions named correctly","spec_ref":"§3.3","spec_url":"https://personalagentprotocol.org/docs/spec#extensions","profile":"pap-0.1@2026-10-09","implemented":true,"provisional":false,"request":null,"pass_when":"Every extension name is either one the protocol defines (operations) or prefixed with a domain (example.com/name), and every extension has a version","replaces":null},{"id":"T0-20","tier":0,"level":"0","severity":"P1","title":"Operations advertised fully","spec_ref":"Ops §2","spec_url":"https://personalagentprotocol.org/docs/extensions/operations#support","profile":"pap-0.1@2026-10-09","implemented":true,"provisional":false,"request":null,"pass_when":"extensions.operations has version \"1\" and an https endpoint","replaces":null},{"id":"T0-15","tier":0,"level":"0","severity":"P1","title":"Conversation entries","spec_ref":"§3.1","spec_url":"https://personalagentprotocol.org/docs/spec#fields","profile":"pap-0.1@2026-10-09","implemented":true,"provisional":false,"request":null,"pass_when":"agent.protocols is a non-empty list, each entry with a type and an https endpoint","replaces":null},{"id":"T0-16","tier":0,"level":"0","severity":"P1","title":"API entries","spec_ref":"§3.1","spec_url":"https://personalagentprotocol.org/docs/spec#fields","profile":"pap-0.1@2026-10-09","implemented":true,"provisional":false,"request":null,"pass_when":"apis is a non-empty list, each entry with type openapi or mcp, an https url and a description","replaces":null},{"id":"T0-17","tier":0,"level":"0","severity":"P1","title":"OpenAPI parses","spec_ref":"§6","spec_url":"https://personalagentprotocol.org/docs/spec#apis","profile":"pap-0.1@2026-10-09","implemented":true,"provisional":false,"request":{"method":"GET","target":"each listed OpenAPI document","condition":"when the file lists OpenAPI documents, at most 3"},"pass_when":"Each listed OpenAPI document (the first 3) is OpenAPI 3.0 or 3.1","replaces":null},{"id":"T0-18","tier":0,"level":"0","severity":"P1","title":"MCP resource metadata","spec_ref":"§6","spec_url":"https://personalagentprotocol.org/docs/spec#apis","profile":"pap-0.1@2026-10-09","implemented":true,"provisional":false,"request":{"method":"GET","target":"each MCP server's RFC 9728 metadata","condition":"when the file lists MCP servers, at most 3"},"pass_when":"The RFC 9728 protected resource metadata of each listed MCP server (the first 3) lists auth.issuer in authorization_servers","replaces":null},{"id":"X-01","tier":0,"level":"0","severity":"P2","title":"Same MCP server everywhere","spec_ref":"§6","spec_url":"https://personalagentprotocol.org/docs/spec#apis","profile":"pap-0.1@2026-10-09","implemented":true,"provisional":false,"request":null,"pass_when":"Ora consistency check, not a spec requirement: every MCP server poppy.json lists has a server card in the site's ARD catalog","replaces":null},{"id":"X-02","tier":0,"level":"0","severity":"P2","title":"Same organization","spec_ref":"§3.1","spec_url":"https://personalagentprotocol.org/docs/spec#fields","profile":"pap-0.1@2026-10-09","implemented":true,"provisional":false,"request":null,"pass_when":"Ora consistency check, not a spec requirement: the site's ARD catalog host names the same organization as poppy.json (display name, and the did:web domain)","replaces":null},{"id":"X-04","tier":0,"level":"0","severity":"P2","title":"Domains covered","spec_ref":"§3.2","spec_url":"https://personalagentprotocol.org/docs/spec#oauth-server","profile":"pap-0.1@2026-10-09","implemented":true,"provisional":false,"request":{"method":"GET","target":"each other domain in poppy_domains: /.well-known/poppy.json","condition":"when the issuer binding holds and the issuer lists other domains, at most 3"},"pass_when":"Ora consistency check, not a spec requirement: each other domain in the issuer's poppy_domains (the first 3) serves a poppy.json naming the same issuer","replaces":null},{"id":"X-07","tier":0,"level":"0","severity":"P2","title":"One issuer","spec_ref":"§3.2","spec_url":"https://personalagentprotocol.org/docs/spec#oauth-server","profile":"pap-0.1@2026-10-09","implemented":true,"provisional":false,"request":null,"pass_when":"Ora consistency check, not a spec requirement: the site's protected resource metadata (auth.md) lists the PAP issuer in authorization_servers","replaces":null},{"id":"X-08","tier":0,"level":"0","severity":"Adv","title":"One metadata document","spec_ref":"§3.2","spec_url":"https://personalagentprotocol.org/docs/spec#oauth-server","profile":"pap-0.1@2026-10-09","implemented":true,"provisional":false,"request":null,"pass_when":"Ora consistency check, not a spec requirement: the site serves one authorization server metadata document, the PAP issuer's","replaces":null},{"id":"X-10","tier":0,"level":"0","severity":"P2","title":"Shared token endpoint lists both protocols' grants","spec_ref":"§3.2","spec_url":"https://personalagentprotocol.org/docs/spec#oauth-server","profile":"pap-0.1@2026-10-09","implemented":true,"provisional":false,"request":null,"pass_when":"Ora consistency check, not a spec requirement: where the PAP issuer also serves auth.md's agent_auth, grant_types_supported lists every grant both protocols send to its token endpoint","replaces":null},{"id":"X-12","tier":0,"level":"0","severity":"P2","title":"Consistent 401s","spec_ref":"§6","spec_url":"https://personalagentprotocol.org/docs/spec#apis","profile":"pap-0.1@2026-10-09","implemented":true,"provisional":false,"request":null,"pass_when":"Ora consistency check, not a spec requirement: a recorded 401 challenge from a PAP MCP server points at the same resource metadata as T0-18","replaces":null},{"id":"T1-01","tier":1,"level":"1","severity":"P1","title":"Token endpoint rejects a junk JWT bearer request","spec_ref":"§4.2","spec_url":"https://personalagentprotocol.org/docs/spec#starting-sessions","profile":"pap-0.1@2026-10-09","implemented":true,"provisional":false,"request":{"method":"POST","target":"the token endpoint in the issuer's metadata","condition":"when the file names an issuer whose metadata has a token endpoint"},"pass_when":"Answers invalid_client (401), invalid_grant (400) or a DPoP proof error (400). Ora also passes invalid_request at any 4xx status (outside the spec 4.2 table) and any of these codes at a status other than the one listed, each with an advisory note","replaces":null},{"id":"T1-02","tier":1,"level":"1","severity":"Adv","title":"Error bodies leak nothing","spec_ref":"guides","spec_url":"https://personalagentprotocol.org/docs/guides","profile":"pap-0.1@2026-10-09","implemented":true,"provisional":false,"request":null,"pass_when":"No error body a probe got back carries a stack trace","replaces":null},{"id":"T1-03","tier":1,"level":"1","severity":"P0","title":"Conversation endpoint requires DPoP","spec_ref":"§4.3","spec_url":"https://personalagentprotocol.org/docs/spec#sending-tokens","profile":"pap-0.1@2026-10-09","implemented":true,"provisional":false,"request":{"method":"POST","target":"one conversation endpoint that poppy.json lists for the poppy protocol (the first in alphabetical order)","condition":"when the file lists one"},"pass_when":"Answers 401 with a DPoP challenge, and offers no Bearer challenge (one offered next to DPoP still fails)","replaces":null},{"id":"T1-05","tier":1,"level":"1","severity":"P1","title":"MCP server challenges unauthenticated initialize","spec_ref":"§6","spec_url":"https://personalagentprotocol.org/docs/spec#apis","profile":"pap-0.1@2026-10-09","implemented":true,"provisional":false,"request":{"method":"POST","target":"one MCP server that poppy.json lists (the first in alphabetical order)","condition":"when the file lists one"},"pass_when":"Answers 401 with a WWW-Authenticate challenge that points at the server's RFC 9728 metadata, or a 401 when that metadata is published at the well-known URI","replaces":null},{"id":"T1-07","tier":1,"level":"1","severity":"P0","title":"Browser endpoint rejects a junk assertion","spec_ref":"§5","spec_url":"https://personalagentprotocol.org/docs/spec#web-browsing","profile":"pap-0.1@2026-10-09","implemented":true,"provisional":false,"request":{"method":"POST","target":"web.browser_session_endpoint in poppy.json","condition":"when the file lists one"},"pass_when":"Answers 400 and no cookie (a CDN or load balancer cookie, or one the response clears, does not count)","replaces":null},{"id":"T1-09","tier":1,"level":"1","severity":"P2","title":"Operations endpoint requires a token","spec_ref":"Ops §2","spec_url":"https://personalagentprotocol.org/docs/extensions/operations#support","profile":"pap-0.1@2026-10-09","implemented":true,"provisional":false,"request":{"method":"GET","target":"the operations endpoint, with a made up operation id","condition":"when the file advertises the operations extension"},"pass_when":"Answers 401, and offers no Bearer challenge (one offered next to DPoP still fails)","replaces":null},{"id":"ADV-REDIRECT","tier":1,"level":"1","severity":"Adv","title":"Endpoint answers without a redirect","spec_ref":"guides","spec_url":"https://personalagentprotocol.org/docs/guides","profile":"pap-0.1@2026-10-09","implemented":true,"provisional":false,"request":null,"pass_when":"Every probed endpoint answers without a redirect: an agent needs a fresh DPoP proof for each hop","replaces":null},{"id":"T2-M1","tier":2,"level":"2a","severity":"P1","title":"Call each read-only OpenAPI GET with no token, then with a valid signed-out token","spec_ref":"§6","spec_url":"https://personalagentprotocol.org/docs/spec#apis","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"Protected operations return 401 invalid_token without one; public ones behave the same either way","replaces":"T1-04"},{"id":"T2-M5","tier":2,"level":"2a","severity":"Adv","title":"Load the consent page for Ora's real client_id from a valid S256 request and inspect headers; never sign in","spec_ref":"guides","spec_url":"https://personalagentprotocol.org/docs/guides","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"frame-ancestors CSP present","replaces":"T1-11"},{"id":"T2-01","tier":2,"level":"2a","severity":"P0","title":"Start a Session for U1","spec_ref":"§4.2","spec_url":"https://personalagentprotocol.org/docs/spec#starting-sessions","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"200 with access_token, token_type: DPoP, expires_in > 0, session_id, signed_in: false, empty scope; Cache-Control: no-store","replaces":null},{"id":"T2-02","tier":2,"level":"2a","severity":"P2","title":"Token lifetime","spec_ref":"§4.2","spec_url":"https://personalagentprotocol.org/docs/spec#starting-sessions","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"expires_in is hours, not days (≤ 24 h)","replaces":null},{"id":"T2-05","tier":2,"level":"2a","severity":"P1","title":"Renew with session_id","spec_ref":"§4.2","spec_url":"https://personalagentprotocol.org/docs/spec#starting-sessions","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"New token, same session_id","replaces":null},{"id":"T2-14","tier":2,"level":"2a","severity":"P1","title":"Nonce challenge","spec_ref":"§4.3","spec_url":"https://personalagentprotocol.org/docs/spec#sending-tokens","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"If use_dpop_nonce is returned, a retry with the DPoP-Nonce value succeeds","replaces":null},{"id":"T2-16","tier":2,"level":"2a","severity":"P1","title":"Bearer token request for an MCP server (no DPoP, resource = MCP url)","spec_ref":"§4.3, §6","spec_url":"https://personalagentprotocol.org/docs/spec#sending-tokens","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"token_type: Bearer, accepted at that MCP server","replaces":null},{"id":"T2-18","tier":2,"level":"2a","severity":"P1","title":"Token accepted without cookies","spec_ref":"§4.3","spec_url":"https://personalagentprotocol.org/docs/spec#sending-tokens","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"Requests with only Authorization + DPoP succeed","replaces":null},{"id":"T2-19","tier":2,"level":"2a","severity":"P0","title":"Valid browser assertion, form POST","spec_ref":"§5","spec_url":"https://personalagentprotocol.org/docs/spec#web-browsing","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"303 to return_to; cookie Secure, HttpOnly, SameSite Lax or None","replaces":null},{"id":"T2-25","tier":2,"level":"2a","severity":"Adv","title":"Cookie scope","spec_ref":"guides","spec_url":"https://personalagentprotocol.org/docs/guides","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"Cookie limited to needed hosts, not the whole domain","replaces":null},{"id":"T2-M2","tier":2,"level":"2b","severity":"P0","title":"Send a valid Session Token in ?access_token= instead of the header","spec_ref":"§4.3","spec_url":"https://personalagentprotocol.org/docs/spec#sending-tokens","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"Rejected; the same token in the header succeeds","replaces":"T1-06"},{"id":"T2-M3","tier":2,"level":"2b","severity":"P1","title":"Send a valid browser assertion in the URL instead of the form body","spec_ref":"§5","spec_url":"https://personalagentprotocol.org/docs/spec#web-browsing","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"Rejected with no cookie; the body form succeeds (T2-19)","replaces":"T1-08"},{"id":"T2-M4","tier":2,"level":"2b","severity":"Adv","title":"Start Direct Sign-In with code_challenge_method=plain and Ora's real client_id; stop at the authorization endpoint","spec_ref":"guides","spec_url":"https://personalagentprotocol.org/docs/guides","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"Rejected at the authorization endpoint","replaces":"T1-10"},{"id":"T1-12","tier":2,"level":"2b","severity":"P1","title":"Mediated endpoint, only if the company opts in: two bad-credential attempts","spec_ref":"§4.7, guides","spec_url":"https://personalagentprotocol.org/docs/spec#mediated-sign-in","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"Same failed response for unknown account and wrong password; eventually 429 with Retry-After","replaces":null},{"id":"T2-03","tier":2,"level":"2b","severity":"P0","title":"Replay the same assertion jti","spec_ref":"§4.2","spec_url":"https://personalagentprotocol.org/docs/spec#starting-sessions","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"invalid_grant 400","replaces":null},{"id":"T2-04","tier":2,"level":"2b","severity":"P1","title":"Assertion with aud as an array or another endpoint","spec_ref":"§4.2","spec_url":"https://personalagentprotocol.org/docs/spec#starting-sessions","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"Rejected","replaces":null},{"id":"T2-06","tier":2,"level":"2b","severity":"P0","title":"Renew U1's Session with a U2 assertion","spec_ref":"§4.2","spec_url":"https://personalagentprotocol.org/docs/spec#starting-sessions","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"invalid_session 400","replaces":null},{"id":"T2-07","tier":2,"level":"2b","severity":"P0","title":"Assertion signed with a key not in Ora's JWKS","spec_ref":"§4.1","spec_url":"https://personalagentprotocol.org/docs/spec#agent-identity","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"invalid_client 401","replaces":null},{"id":"T2-08","tier":2,"level":"2b","severity":"Adv","title":"alg: none or HS256 assertion","spec_ref":"guides","spec_url":"https://personalagentprotocol.org/docs/guides","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"Rejected","replaces":null},{"id":"T2-09","tier":2,"level":"2b","severity":"P0","title":"Valid token, reused proof jti","spec_ref":"§4.3","spec_url":"https://personalagentprotocol.org/docs/spec#sending-tokens","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"Rejected invalid_dpop_proof","replaces":null},{"id":"T2-10","tier":2,"level":"2b","severity":"P0","title":"Proof with wrong htu or htm","spec_ref":"§4.3","spec_url":"https://personalagentprotocol.org/docs/spec#sending-tokens","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"Rejected","replaces":null},{"id":"T2-11","tier":2,"level":"2b","severity":"P0","title":"Proof with wrong ath","spec_ref":"§4.3","spec_url":"https://personalagentprotocol.org/docs/spec#sending-tokens","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"Rejected","replaces":null},{"id":"T2-12","tier":2,"level":"2b","severity":"P0","title":"Proof signed by a different key than the token's binding","spec_ref":"§4.3","spec_url":"https://personalagentprotocol.org/docs/spec#sending-tokens","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"Rejected","replaces":null},{"id":"T2-13","tier":2,"level":"2b","severity":"P1","title":"Stale iat (beyond ~1 min)","spec_ref":"§4.3","spec_url":"https://personalagentprotocol.org/docs/spec#sending-tokens","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"Rejected","replaces":null},{"id":"T2-15","tier":2,"level":"2b","severity":"P0","title":"Token sent as Authorization: Bearer to a non-MCP endpoint","spec_ref":"§4.3","spec_url":"https://personalagentprotocol.org/docs/spec#sending-tokens","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"Rejected","replaces":null},{"id":"T2-17","tier":2,"level":"2b","severity":"P0","title":"That Bearer token at another MCP server or an OpenAPI endpoint","spec_ref":"§4.3","spec_url":"https://personalagentprotocol.org/docs/spec#sending-tokens","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"Rejected","replaces":null},{"id":"T2-20","tier":2,"level":"2b","severity":"P0","title":"Replay the same browser assertion","spec_ref":"§5","spec_url":"https://personalagentprotocol.org/docs/spec#web-browsing","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"400, no cookie","replaces":null},{"id":"T2-21","tier":2,"level":"2b","severity":"P1","title":"exp more than 60 s after iat","spec_ref":"§5","spec_url":"https://personalagentprotocol.org/docs/spec#web-browsing","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"400","replaces":null},{"id":"T2-22","tier":2,"level":"2b","severity":"P0","title":"return_to on a foreign domain","spec_ref":"§5","spec_url":"https://personalagentprotocol.org/docs/spec#web-browsing","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"400","replaces":null},{"id":"T2-23","tier":2,"level":"2b","severity":"P1","title":"Session assertion (wrong typ) at the browser endpoint","spec_ref":"§5","spec_url":"https://personalagentprotocol.org/docs/spec#web-browsing","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"400","replaces":null},{"id":"T2-24","tier":2,"level":"2b","severity":"P1","title":"Browser assertion at the token endpoint","spec_ref":"§5","spec_url":"https://personalagentprotocol.org/docs/spec#web-browsing","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"Rejected","replaces":null},{"id":"T2-26","tier":2,"level":"2b","severity":"P0","title":"Start with a general question","spec_ref":"§7.3","spec_url":"https://personalagentprotocol.org/docs/spec#sending-messages","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"201 with conversation_id, status, responder","replaces":null},{"id":"T2-27","tier":2,"level":"2b","severity":"P1","title":"Retry the same message id and content","spec_ref":"§7.3","spec_url":"https://personalagentprotocol.org/docs/spec#sending-messages","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"Same response, no duplicate message","replaces":null},{"id":"T2-28","tier":2,"level":"2b","severity":"P1","title":"Same id, different content","spec_ref":"§7.3","spec_url":"https://personalagentprotocol.org/docs/spec#sending-messages","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"message_id_conflict 409","replaces":null},{"id":"T2-29","tier":2,"level":"2b","severity":"P1","title":"Read events with and without wait","spec_ref":"§7.5, §7.7","spec_url":"https://personalagentprotocol.org/docs/spec#reading-events","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"Every read has cursor, has_more, status, responder; messages carry role and sender","replaces":null},{"id":"T2-30","tier":2,"level":"2b","severity":"P2","title":"POST …/messages?wait=10","spec_ref":"§7.3","spec_url":"https://personalagentprotocol.org/docs/spec#sending-messages","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"Events returned in the POST response","replaces":null},{"id":"T2-31","tier":2,"level":"2b","severity":"P1","title":"Junk cursor","spec_ref":"§7.13","spec_url":"https://personalagentprotocol.org/docs/spec#conversation-errors","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"invalid_cursor 400","replaces":null},{"id":"T2-32","tier":2,"level":"2b","severity":"P0","title":"U2 reads U1's conversation","spec_ref":"§7.2","spec_url":"https://personalagentprotocol.org/docs/spec#conversation-requests","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"conversation_not_found 404, same as a nonexistent ID","replaces":null},{"id":"T2-33","tier":2,"level":"2b","severity":"P2","title":"Stream with Accept: text/event-stream","spec_ref":"§7.6","spec_url":"https://personalagentprotocol.org/docs/spec#streaming","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"SSE with event ids, or plain JSON if unsupported; reconnect via Last-Event-ID works","replaces":null},{"id":"T2-34","tier":2,"level":"2b","severity":"P1","title":"Ask about the account while signed out","spec_ref":"§7.11","spec_url":"https://personalagentprotocol.org/docs/spec#conversation-sign-in","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"authorization event with sign_in_required, plus a message (P2)","replaces":null},{"id":"T2-35","tier":2,"level":"2b","severity":"P2","title":"Message with only context","spec_ref":"§7.4","spec_url":"https://personalagentprotocol.org/docs/spec#message-fields","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"Accepted; no reply required","replaces":null},{"id":"T2-36","tier":2,"level":"2b","severity":"P1","title":"Close, then send a message","spec_ref":"§7.12","spec_url":"https://personalagentprotocol.org/docs/spec#closing","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"Close returns 200; then conversation_closed 409","replaces":null},{"id":"T2-37","tier":2,"level":"2b","severity":"P2","title":"Handoff (opt-in only; may page staff)","spec_ref":"§7.9","spec_url":"https://personalagentprotocol.org/docs/spec#handoff","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"202 with status: queued, then responder: human or back to idle with an explanation","replaces":null},{"id":"T2-38","tier":2,"level":"2b","severity":"P1","title":"Ora client metadata without extensions.operations, trigger a proposing endpoint","spec_ref":"Ops §2","spec_url":"https://personalagentprotocol.org/docs/extensions/operations#support","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"No operation returned; either acts normally or extension_required 403 with extension","replaces":null},{"id":"T2-39","tier":2,"level":"2b","severity":"P0","title":"U2 reads U1's signed-out operation","spec_ref":"Ops §3.2","spec_url":"https://personalagentprotocol.org/docs/extensions/operations#ownership","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"operation_not_found 404","replaces":null},{"id":"T2-40","tier":2,"level":"2b","severity":"P1","title":"Confirm an old revision (if revisions can be triggered)","spec_ref":"Ops §5.2","spec_url":"https://personalagentprotocol.org/docs/extensions/operations#confirm","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"terms_changed 409 with current operation","replaces":null},{"id":"T3-01","tier":3,"level":"3","severity":"P0","title":"Direct sign-in","spec_ref":"§4.5","spec_url":"https://personalagentprotocol.org/docs/spec#direct-sign-in","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"Consent page shows agent name, logo, client_id domain, scopes; redirect carries code, state, iss; code exchange with session_id returns Account Token + signed-in Session Token","replaces":null},{"id":"T3-02","tier":3,"level":"3","severity":"P0","title":"Redirect URI not in Ora's redirect_uris","spec_ref":"§4.5","spec_url":"https://personalagentprotocol.org/docs/spec#direct-sign-in","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"Rejected","replaces":null},{"id":"T3-03","tier":3,"level":"3","severity":"P1","title":"User declines","spec_ref":"§4.5","spec_url":"https://personalagentprotocol.org/docs/spec#direct-sign-in","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"Redirect with error=access_denied and iss","replaces":null},{"id":"T3-04","tier":3,"level":"3","severity":"P1","title":"Device sign-in","spec_ref":"§4.6","spec_url":"https://personalagentprotocol.org/docs/spec#device-sign-in","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"Opening the link alone doesn't approve; authorization_pending then tokens; slow_down when polling too fast","replaces":null},{"id":"T3-05","tier":3,"level":"3","severity":"P1","title":"Mediated sign-in (if offered)","spec_ref":"§4.7","spec_url":"https://personalagentprotocol.org/docs/spec#mediated-sign-in","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"complete or code_required flow works; code submitted alone; credentials never echoed","replaces":null},{"id":"T3-06","tier":3,"level":"3","severity":"P1","title":"Partial scope approval","spec_ref":"§4.4","spec_url":"https://personalagentprotocol.org/docs/spec#sign-in","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"Response scope reflects what was approved","replaces":null},{"id":"T3-07","tier":3,"level":"3","severity":"P1","title":"Request an unlisted scope","spec_ref":"§4.4","spec_url":"https://personalagentprotocol.org/docs/spec#sign-in","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"invalid_scope","replaces":null},{"id":"T3-08","tier":3,"level":"3","severity":"P0","title":"Scope enforcement across channels","spec_ref":"§4.4, guides","spec_url":"https://personalagentprotocol.org/docs/spec#sign-in","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"poppy:read-only token: write via API, conversation and website all refused (insufficient_scope); write-only token can't read","replaces":null},{"id":"T3-09","tier":3,"level":"3","severity":"P0","title":"Account Token from another client_id or at an API","spec_ref":"§4.8","spec_url":"https://personalagentprotocol.org/docs/spec#account-tokens","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"Rejected","replaces":null},{"id":"T3-10","tier":3,"level":"3","severity":"P1","title":"Account Token with narrower and wider scope","spec_ref":"§4.8","spec_url":"https://personalagentprotocol.org/docs/spec#account-tokens","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"Narrower works; wider rejected","replaces":null},{"id":"T3-11","tier":3,"level":"3","severity":"P1","title":"Sign a Session into account B after account A","spec_ref":"§4.4","spec_url":"https://personalagentprotocol.org/docs/spec#sign-in","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"account_mismatch","replaces":null},{"id":"T3-12","tier":3,"level":"3","severity":"P0","title":"Revoke the Account Token","spec_ref":"§4.9","spec_url":"https://personalagentprotocol.org/docs/spec#sign-out","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"Later refresh_token use → invalid_grant; existing Session Tokens stop working for account actions promptly, or tokens are only minutes long","replaces":null},{"id":"T3-13","tier":3,"level":"3","severity":"P1","title":"Signed-out token on an account-using conversation","spec_ref":"§7.11","spec_url":"https://personalagentprotocol.org/docs/spec#conversation-sign-in","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"sign_in_required","replaces":null},{"id":"T3-14","tier":3,"level":"3","severity":"P1","title":"Direct Conversation","spec_ref":"§7.10","spec_url":"https://personalagentprotocol.org/docs/spec#direct-conversations","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"Opens with parent_conversation_id; parent rejects messages with direct_conversation_open; direct_opened/direct_closed events appear","replaces":null},{"id":"T3-15","tier":3,"level":"3","severity":"P0","title":"Operation end to end (sandbox action)","spec_ref":"Ops §3, Ops §6","spec_url":"https://personalagentprotocol.org/docs/extensions/operations#operations","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"Proposed without side effects; confirm executes once; repeated confirm returns same result; result.summary describes every change","replaces":null},{"id":"T3-16","tier":3,"level":"3","severity":"P1","title":"standing_permission on a user_approval_required operation","spec_ref":"Ops §5.2","spec_url":"https://personalagentprotocol.org/docs/extensions/operations#confirm","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"user_approval_required 403","replaces":null},{"id":"T3-17","tier":3,"level":"3","severity":"Adv","title":"Account settings","spec_ref":"guides","spec_url":"https://personalagentprotocol.org/docs/guides","profile":"pap-0.1@2026-10-09","implemented":false,"provisional":true,"request":null,"pass_when":"Connected agents listed with name, domain, scopes, last use; disconnect works","replaces":null}]}