APIs coverage

OpenAPI with DPoP and MCP with a resource-bound Bearer (§6). Upstream: personalagentprotocol.org/docs/spec.

6 entries: 6 implemented. Each row is one atomic statement of the upstream text, with the SDK symbols that implement it (Python; TypeScript mirrors them), the tests and shared conformance cases that show it, and its status.

ID	Section	Level	Role	Requirement	SDK symbol	Tests	Status
PAP-6-01	§6	MUST	company	Each API's type MUST be one of these: openapi, mcp.	CompanyService.discovery_document	test_direct_and_api.py::test_signed_out_then_direct_sign_in_then_a_read_and_a_proposed_exchange	implemented
PAP-6-02	§6	SHOULD	personal-agent	Personal Agents SHOULD skip API types they don't recognize, so later versions can add types.	known_apis	test_fixtures.py::test_local_fixture_case protocol.unknown-api-type	implemented
PAP-6-03	§6	MUST	company	Every listed API MUST accept Session Tokens as described in 4.3: DPoP for OpenAPI, and Bearer for MCP.	CompanyService._api_call CompanyService._mcp_route	test_direct_and_api.py::test_signed_out_then_direct_sign_in_then_a_read_and_a_proposed_exchange test_mcp_and_web.py::test_a_signed_in_bearer_reads_and_proposes_through_mcp_the_same_operation lifecycle.mcp-protected-resource-metadata	implemented
PAP-6-04	§6	MUST	company	A listed MCP server MUST accept Session Tokens as its access tokens and enforce their scopes.	CompanyService._mcp_route CompanyService._mcp_tool ToolResult	test_mcp_and_web.py::test_a_bearer_is_issued_only_for_the_mcp_url_and_an_existing_session test_mcp_and_web.py::test_signing_out_reaches_the_mcp_server_at_once test_conformance.py::test_python_agent_python_company_over_tls lifecycle.mcp-bearer-for-its-url lifecycle.mcp-sign-out-takes-effect	implemented
PAP-6-05	§6	MUST	company	It MUST accept only tokens issued for its url (4.3).	CompanyService._bearer_caller	test_mcp_and_web.py::test_a_bearer_token_is_refused_everywhere_but_its_mcp_server test_conformance.py::test_python_agent_python_company_over_tls lifecycle.mcp-bearer-only-at-mcp	implemented
PAP-6-06	§6	MUST	company	MCP clients find where to get a token from the server's protected resource metadata (RFC 9728), and its authorization_servers MUST include auth.issuer.	CompanyService.protected_resource_metadata CompanyService._bearer_refusal	test_mcp_and_web.py::test_the_company_advertises_its_mcp_server_and_its_issuer test_conformance.py::test_python_agent_python_company_over_tls lifecycle.mcp-protected-resource-metadata	implemented

Conformance case IDs name protocol/fixtures/conformance cases; see the conformance report for their outcome in every language pairing.