liady · Oct 19, 2026 · Oct 19, 2026
diff --git a/.github/assets/map.png b/.github/assets/map.png
diff --git a/README.md b/README.md
@@ -22,7 +22,7 @@ Agents are the new browsers. Since mid-2025 a dozen open standards have appeared
 
 Read it left to right as an agent's visit: find what's offered, use the site, prove who it is, shop, then pay. Orange means real traffic today, plain means early use, and hatched means a draft.
 
-<a href="https://ax.guide/#map"><img src=".github/assets/map.png" alt="The map: twelve standards in five columns (Find, Act, Identity, Shop, Pay). Web Bot Auth, UCP, ACP and x402 are orange for real traffic; Poppy is hatched as a draft; the rest are early use." width="100%"></a>
+<a href="https://ax.guide/#map"><img src=".github/assets/map.png" alt="The map: twelve standards in five columns (Find, Act, Identity, Shop, Pay). Web Bot Auth, UCP, ACP and x402 are orange for real traffic; the rest are early use." width="100%"></a>
 
 ## The standards
 

diff --git a/content/guide.json b/content/guide.json
@@ -7,7 +7,7 @@
     { "situation": "You have lots of structured content people and agents want to query", "standards": ["nlweb"] },
     { "situation": "Your bot visits other sites, or you need to verify bots on yours", "standards": ["web-bot-auth"] },
     { "situation": "You want agents to create accounts on your service without a sign-up form", "standards": ["auth-md"] },
-    { "situation": "Customers' own agents should sign in and act on their accounts", "standards": ["poppy"], "note": "Track it; Draft 0.1 is from October 9, 2026." },
+    { "situation": "Customers' own agents should sign in and act on their accounts", "standards": ["poppy"], "note": "Track it; Draft 0.1 is from October 9, 2026, and 0.2 is in progress." },
     { "situation": "You sell goods and want any AI assistant to browse, cart and check out", "standards": ["ucp"] },
     { "situation": "You want your products shown in ChatGPT", "standards": ["acp"] },
     { "situation": "An agent pays and you need proof a person approved those exact terms", "standards": ["ap2"] },

diff --git a/content/home.json b/content/home.json
@@ -16,7 +16,7 @@
   "patterns": [
     {
       "title": "Platforms move faster than standards bodies.",
-      "body": "The standards with real traffic are the ones a big platform switched on: Shopify accounts for most of UCP's 15,000+ verified storefronts and puts WebMCP tools on every standard storefront; Visa and Mastercard build on Web Bot Auth; OpenAI pipes ACP feeds into ChatGPT. The drafts with the most impressive partner lists are often the ones with no known deployments."
+      "body": "The standards with real traffic are the ones a big platform switched on: Shopify accounts for most of the roughly 17,800 stores an independent tracker verified for UCP and puts WebMCP tools on every Liquid storefront; Visa and Mastercard build on Web Bot Auth; OpenAI pipes ACP feeds into ChatGPT. The drafts with the most impressive partner lists are often the ones with the fewest deployments."
     },
     {
       "title": "Partner lists aren't adoption, and transaction counts aren't commerce.",

diff --git a/content/standards/acp.md b/content/standards/acp.md
@@ -10,7 +10,7 @@ phrase: Products (and checkout) into ChatGPT
 analogy: A catalogue mailed straight to your personal shopper, with an optional order form attached.
 looks_like: Product feeds + checkout endpoints
 when_to_use: When you want your products shown in ChatGPT, especially if you already use Stripe.
-backers: OpenAI + Stripe
+backers: OpenAI + Stripe, with Meta on the steering committee
 reality_check: In production for discovery. The headline feature that launched ACP, buying inside ChatGPT, is exactly the part that was scaled back.
 links:
   - label: Specification (GitHub)
@@ -24,7 +24,7 @@ related:
     note: A payment layer that can sit underneath.
   - id: x402
     note: Payment rails like MPP and x402 can sit underneath.
-last_verified: "2026-10-11"
+last_verified: "2026-10-19"
 ---
 
 ## How it works
@@ -35,6 +35,6 @@ Today its main job is discovery: merchants push feeds and promotions so ChatGPT
 
 ## Who's behind it
 
-OpenAI and Stripe launched it on September 29, 2025, alongside "Instant Checkout" in ChatGPT. [The spec is still labeled beta](https://github.com/agentic-commerce-protocol/agentic-commerce-protocol); its latest stable version is dated April 17, 2026.
+OpenAI and Stripe launched it on September 29, 2025, alongside "Instant Checkout" in ChatGPT. [The spec is still labeled beta](https://github.com/agentic-commerce-protocol/agentic-commerce-protocol); its latest stable version is dated April 17, 2026. [Meta joined its steering committee](https://github.com/agentic-commerce-protocol/agentic-commerce-protocol/blob/main/docs/governance.md) on April 24, 2026; OpenAI and Stripe remain the founding maintainers.
 
 On March 24, 2026 OpenAI said it was [expanding ACP to support product discovery](https://openai.com/index/powering-product-discovery-in-chatgpt/), naming Target, Sephora, Nordstrom, Lowe's, Best Buy, The Home Depot and Wayfair as integrated, while checkout moved back to the merchant's side.
diff --git a/content/standards/ai-catalog.md b/content/standards/ai-catalog.md
@@ -4,27 +4,27 @@ full_name: AI Catalog
 job: find
 order: 2
 status: early
-status_note: Draft; MCP Server Cards point to it; small real use
+status_note: Draft; MCP Server Cards (final) point to it; small real use
 tagline: site's AI list
 phrase: A site's list of its AI offerings
 analogy: Your site's table of contents for AI.
 looks_like: /.well-known/ai-catalog.json
 when_to_use: When you publish that same list for MCP Server Cards and older tools. Serve one file at both addresses.
 backers: Linux Foundation working group (MCP and A2A communities)
-reality_check: Early, with experimental catalogs at GitHub, Buildkite and Hugging Face. The fix is easy, serve the same file at both `ai-catalog.json` and `ard.json`.
+reality_check: Early, with live catalogs at GitHub, Buildkite and Hugging Face. ARD tools look for `ard.json` first and may skip the old address, so serve the same file at both `ai-catalog.json` and `ard.json`.
 links:
   - label: ai-catalog.io
     url: https://ai-catalog.io/
   - label: Working repository
     url: https://github.com/Agent-Card/ai-catalog
-  - label: MCP Server Cards proposal
+  - label: MCP Server Cards (final)
     url: https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2127
 related:
   - id: ard
     note: ARD calls ai-catalog its predecessor. ai-catalog sees itself as the lightweight publishing format; it was split off, not retired.
   - id: nlweb
     note: A catalog can list an NLWeb endpoint.
-last_verified: "2026-10-11"
+last_verified: "2026-10-19"
 ---
 
 ## How it works
@@ -37,4 +37,4 @@ A restaurant that works with a booking provider and a jobs provider can list bot
 
 It's developed in a [Linux Foundation working repository](https://github.com/Agent-Card/ai-catalog) (started October 2025) with members from the MCP and A2A communities, and published at [ai-catalog.io](https://ai-catalog.io/). Even the group's name is inconsistent: ai-catalog.io calls it the "Agent Card Working Group," while Google thanks the "AI Catalog Working Group."
 
-Its biggest recent boost: [MCP's "Server Cards" proposal](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2127) points discovery at `ai-catalog.json` (reported as finalized October 6, 2026, though one implementer still saw it in review). ARD calls ai-catalog its predecessor, but ai-catalog sees itself as a lightweight publishing format that stays separate: it was split off, not retired.
+Its biggest recent boost: [MCP's "Server Cards" proposal](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2127) points discovery at `ai-catalog.json`; it was [marked final](https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/seps/2127-mcp-server-cards.md) on October 6, 2026. ARD calls ai-catalog its predecessor, but ai-catalog sees itself as a lightweight publishing format that stays separate, loosely linked to ARD for now: it was split off, not retired.
diff --git a/content/standards/ap2.md b/content/standards/ap2.md
@@ -26,21 +26,20 @@ related:
     note: AP2 authorizes a payment; it can settle through x402.
   - id: mpp
     note: Another way to actually move the money.
-last_verified: "2026-10-11"
+last_verified: "2026-10-19"
 ---
 
 ## How it works
 
-When an agent pays, the bank and merchant need answers to "did a real person agree to this?" and "who's liable if it goes wrong?" AP2 answers with *mandates*, tamper-proof signed records of your instructions:
+When an agent pays, the bank and merchant need answers to "did a real person agree to this?" and "who's liable if it goes wrong?" AP2 answers with *mandates*, tamper-proof signed records of your instructions. [Version 0.2](https://ap2-protocol.org/) has two kinds:
 
-- An **intent mandate** captures what you asked for ("concert tickets, under $200, this week").
-- A **cart mandate** locks the exact items and price.
-- A **payment mandate** tells the card network an agent was involved.
+- A **checkout mandate** covers what you buy. While it is *open*, it holds your limits ("concert tickets, under $200, this week"). Once *closed*, it locks the exact items and price the merchant signed.
+- A **payment mandate** covers how you pay: first your budget and card, then the exact amount. It goes to the card network and bank, which are also told an agent was involved.
 
-Version 0.2 adds "Human Not Present" purchases: you pre-sign the rules, and the agent buys later when conditions are met, say when tickets go on sale at 3 a.m. It works with cards, bank transfers and stablecoins. AP2 authorizes payments; it doesn't process them.
+Version 0.2 adds "Human Not Present" purchases: you pre-sign the rules, and the agent buys later when conditions are met, say when tickets go on sale at 3 a.m. Today it supports cards. Bank transfers and digital currencies are on the roadmap, and a sample shows payment through x402. AP2 authorizes payments; it doesn't process them.
 
 ## Who's behind it
 
 Google announced it on September 16, 2025 with more than 60 organizations, including American Express, Coinbase, Mastercard, PayPal and Salesforce. On April 28, 2026 Google [released v0.2](https://github.com/google-agentic-commerce/AP2) and [handed AP2 to the FIDO Alliance](https://blog.google/products-and-platforms/platforms/google-pay/agent-payments-protocol-fido-alliance/) (the group behind passkeys), which [formed working groups](https://fidoalliance.org/fido-alliance-to-develop-standards-for-trusted-ai-agent-interactions/) chaired by members from Google, OpenAI, CVS Health, Visa and Mastercard.
 
-Mastercard's Verifiable Intent, a similar auditable record of what a user approved, co-developed with Google, went to FIDO at the same time. FIDO's work is only months old, so v0.2 isn't yet a FIDO-approved standard.
+Mastercard's Verifiable Intent, a similar auditable record of what a user approved, co-developed with Google, went to FIDO at the same time. In September 2026 FIDO put the AP2 and Verifiable Intent specs in a public repository for review, and [aims to merge them](https://www.w3.org/2026/09/ecommerce-agents/slides/Jean_Luc_Di_Manno_FIDO.pdf) and publish a first FIDO version in mid-2027. Until then, v0.2 isn't a FIDO-approved standard.
diff --git a/content/standards/ard.md b/content/standards/ard.md
@@ -11,18 +11,18 @@ analogy: A search engine for agent tools.
 looks_like: /.well-known/ard.json
 when_to_use: When you offer APIs, MCP servers or agents and want agent search registries to find them.
 backers: Google-led authors (Google, Hugging Face, R.V. Guha)
-reality_check: Early. [Hugging Face runs a public registry](https://huggingface.co/blog/agentic-resource-discovery-launch), but one independent check in June found that none of the named contributor companies served a catalog yet.
+reality_check: Early. [Hugging Face runs a public registry](https://huggingface.co/blog/agentic-resource-discovery-launch), and Hugging Face and GitHub now publish catalogs, though GitHub's is only at the older `ai-catalog.json` address. According to [an independent sweep in September 2026](https://github.com/Agent-Card/ai-catalog/issues/115), only 24 of 102 publishers could be found at `ard.json`; the other 78 used only `ai-catalog.json`.
 links:
   - label: Specification (v0.91)
     url: https://agenticresourcediscovery.org/spec/
   - label: Google's announcement
     url: https://developers.googleblog.com/announcing-the-agentic-resource-discovery-specification/
-  - label: Hugging Face registry
+  - label: Hugging Face registry launch
     url: https://huggingface.co/blog/agentic-resource-discovery-launch
 related:
   - id: ai-catalog
     note: Its predecessor, now the publishing format. ARD is the discovery format. Serve the same file at both addresses.
-last_verified: "2026-10-11"
+last_verified: "2026-10-19"
 ---
 
 ## How it works
@@ -33,6 +33,6 @@ Separate "registries" collect these files and answer plain-language searches. Sa
 
 ## Who's behind it
 
-[Google announced ARD](https://developers.googleblog.com/announcing-the-agentic-resource-discovery-specification/) on June 17, 2026. The [current version is v0.91](https://agenticresourcediscovery.org/spec/), a "Proposal" dated August 26, 2026, from authors at Google and Hugging Face plus R.V. Guha (the creator of RSS and Schema.org).
+[Google announced ARD](https://developers.googleblog.com/announcing-the-agentic-resource-discovery-specification/) on June 17, 2026. The [current version is v0.91](https://agenticresourcediscovery.org/spec/), a "Proposal" dated August 26, 2026, from authors at Google and Hugging Face plus R.V. Guha (who helped create RSS and Schema.org).
 
-It tells agents to look for `ard.json` first and treats the older `ai-catalog.json` address as its predecessor. On July 9, 2026 the two formally split into a *publishing* format (ai-catalog) and a *discovery* format (ARD). The file name changed within a few months, so early tutorials already show the old address.
+It tells agents to look for `ard.json` first and treats the older `ai-catalog.json` address as its predecessor. At a meeting on July 9, 2026 the two groups agreed to keep them [loosely linked, at least for now](https://github.com/ards-project/ard-spec/blob/main/adr/0010-ard-and-ai-catalog-loose-coupling.md): ai-catalog is the *publishing* format and ARD is the *discovery* format. The ARD project recorded this as a formal decision on October 11, 2026. The file name changed within a few months, so early tutorials already show the old address.
diff --git a/content/standards/auth-md.md b/content/standards/auth-md.md
@@ -23,7 +23,7 @@ related:
     note: Poppy signs in existing customers. auth.md signs up new ones.
   - id: web-bot-auth
     note: Web Bot Auth proves which bot is asking. auth.md creates the account it acts for.
-last_verified: "2026-10-11"
+last_verified: "2026-10-19"
 ---
 
 ## How it works
@@ -33,14 +33,14 @@ When your agent needs a service you've never used, it hits a wall built to keep
 Ask a coding agent to add web scraping to your app, and it calls the scraping service, gets "401: who are you?" plus a pointer to the service's login details and auth.md file, then signs you up one of three ways:
 
 - **Vouched for:** the company running the agent signs a short-lived pass saying "this is a verified user" and registration finishes on its own.
-- **By email:** you type a 6-digit code on the service's own page.
+- **By email:** the agent gives you a short code and a link. You sign in on the service's own page and type the code.
 - **Anonymously:** the agent starts with limited access and you "claim" the account later.
 
 Either way, it ends with a normal, short-lived, revocable OAuth token tied to you.
 
 ## Who's behind it
 
-[WorkOS](https://workos.com/auth-md), an identity company, published it as an [open, MIT-licensed spec](https://github.com/workos/auth.md) on May 21, 2026 and shipped [six versions in three weeks](https://github.com/workos/auth.md/blob/main/CHANGELOG.md), reaching v0.6.0 on June 10. It isn't with any standards body; [WorkOS's own recap](https://workos.com/blog/agent-registration-with-auth-md) calls it "a spec, not an IETF-ratified standard." It's built from existing parts: OAuth's login-discovery files, and a vouching token ("ID-JAG") that is itself a draft in the IETF's OAuth working group.
+[WorkOS](https://workos.com/auth-md), an identity company, published it as an [open, MIT-licensed spec](https://github.com/workos/auth.md) on May 21, 2026 and shipped [six versions in three weeks](https://github.com/workos/auth.md/blob/main/CHANGELOG.md), reaching v0.6.0 on June 10. It isn't with any standards body; [WorkOS's own recap](https://workos.com/blog/mcp-night-4-recap-auth-md-agentic-registration) calls it "a spec, not an IETF-ratified standard." It's built from existing parts: OAuth's login-discovery files, and a vouching token ("ID-JAG") that is itself a draft in the IETF's OAuth working group. On August 4, 2026 WorkOS [built it into AuthKit](https://workos.com/changelog/agent-registration), its sign-in product, so AuthKit customers can turn it on from the dashboard.
 
 WorkOS lists 15 adopters, and implementations vary a lot: [Neon](https://neon.com/auth.md) lets an agent spin up a temporary database the person claims within 72 hours; [Cloudinary](https://cloudinary.com/auth.md) does the same with a temporary media cloud claimable within 24 hours; [monday.com](https://monday.com/auth.md) has the agent solve a captcha and then creates the account; [Firecrawl](https://www.firecrawl.dev/auth.md) only accepts identities vouched for by WorkOS; Cloudflare and Resend said "not yet" at last check. Several follow the idea more than the exact spec.
 

diff --git a/content/standards/mpp.md b/content/standards/mpp.md
@@ -13,26 +13,26 @@ when_to_use: When agents pay per call or by the minute and you want cards and st
 backers: Stripe + Tempo
 reality_check: Early use, live on Tempo. Unlike x402, no neutral foundation owns it; it's written and maintained by two companies with a commercial stake.
 links:
-  - label: mpp.dev
-    url: https://mpp.dev/
   - label: IETF draft (-01)
     url: https://datatracker.ietf.org/doc/draft-httpauth-payment/01/
+  - label: mpp.dev
+    url: https://mpp.dev/
 related:
   - id: x402
     note: MPP now accepts x402's simplest payment flow, so the two are more compatible than competing.
   - id: ap2
     note: AP2 records what a person approved; MPP moves the money.
-last_verified: "2026-10-11"
+last_verified: "2026-10-19"
 ---
 
 ## How it works
 
 Paying for an online service usually means signing up, getting a key and setting up billing, which an autonomous agent can't easily do. MPP uses the web's long-unused "402 Payment Required" code: the server replies "this costs 2 cents, here's how to pay," the client pays, and the server returns the result plus a receipt.
 
-It supports one-off charges, subscriptions and streaming pay-as-you-go "sessions," with stablecoins on Stripe's Tempo blockchain or ordinary cards through Stripe. Picture a research agent paying a fraction of a cent per article from a paywalled archive and settling the total when it finishes.
+It supports one-off charges, subscriptions and streaming pay-as-you-go "sessions," with stablecoins on the Tempo blockchain or ordinary cards through Stripe. Picture a research agent paying a fraction of a cent per article from a paywalled archive and settling the total when it finishes.
 
 ## Who's behind it
 
 [Stripe and Tempo launched it](https://mpp.dev/) on March 18, 2026, the same day Tempo's payments blockchain went live. Its core spec is an IETF Internet-Draft ([draft-httpauth-payment-01](https://datatracker.ietf.org/doc/draft-httpauth-payment/01/), September 9, 2026), but an *individual* one: the IETF lists it as having no formal standing, and no working group has taken it on.
 
-The ecosystem is growing (Circle drafted a USDC payment method), and MPP now accepts x402's simplest payment flow from the same toolkit.
+The ecosystem is growing: Circle drafted a [USDC payment method](https://paymentauth.org/draft-usdc-charge-00.html) and Visa drafted a [card method](https://paymentauth.org/draft-card-charge-00.html). MPP now accepts x402's simplest payment flow from the same toolkit.