Release notes, 29 October 2026

Summary

If you publish a Personal Agent Protocol file that declares version 0.2 or later, scan again. It is now checked against its own version's rules, so a file we failed may now pass, and a 0.2 file is held to the rules 0.2 added. One check that no version of the protocol states is gone.

A file that declares version 0.1 is judged as before, apart from that removed check.

Every scan now comes from one address, 32.192.148.204. If our scans were turned away by your firewall, allow it and scan again.

Fixed

• Personal Agent Protocol: each poppy.json is now judged by the protocol_version it declares. We judged every file by version 0.1 before, so a correct file of a later version could fail for lacking a field that version replaced. A file declaring a version we do not check yet, such as the 0.3 draft, is judged only by the rules both published versions share, and marked partly checked.
• We removed the check that a browser-session address sits on the site's own domain. No version of the protocol says so: the sentence we quoted is about the page an agent opens afterwards. We were stricter than the specification.

Changed in the standards

• Personal Agent Protocol 0.2 was published on 24 October 2026. It compares the organization's domain with the host that serves the file, where 0.1 compared it with the host asked for, and it makes every address it defines HTTPS. Version 0.2 files are now checked against those rules.

How we scan

• Every scan now comes from one address, 32.192.148.204. If your firewall or CDN turns away bots it does not know, allow that address and our scans get through. The scan settings show it, and a scan that a site turns away now names it too.