Discovery coverage

Company discovery, OAuth metadata, versions, and extensions (§3). Upstream: personalagentprotocol.org/docs/spec.

16 entries: 15 implemented, 1 partial. Each row is one atomic statement of the upstream text, with the SDK symbols that implement it (Python; TypeScript mirrors them), the tests and shared conformance cases that show it, and its status.

ID	Section	Level	Role	Requirement	SDK symbol	Tests	Status
PAP-3-01	§3	MUST	company	A Company MUST publish its poppy.json document at https://{domain}/.well-known/poppy.json over HTTPS, where {domain} is the Company's domain or a subdomain it controls.	CompanyService.discovery_document	test_company_end_to_end.py::test_a_user_and_a_company_from_question_to_confirmed_exchange	implemented
PAP-3-02	§3	MUST	personal-agent	Personal Agents MUST follow redirects, and every redirect MUST be to an HTTPS URL.	DiscoveryClient._get_json	test_fixtures.py::test_local_fixture_case protocol.organization-domain-after-redirect security.discovery-redirect-followed	implemented
PAP-3-03	§3	MUST	personal-agent	Personal Agents MUST follow redirects, and every redirect MUST be to an HTTPS URL.	DiscoveryClient._get_json PublicUrlSafetyPolicy.assert_safe	test_fixtures.py::test_local_fixture_case security.discovery-redirect-to-http security.discovery-redirect-followed	implemented
PAP-3-04	§3	SHOULD	personal-agent	Personal Agents SHOULD cache the document according to its HTTP caching headers.	DiscoveryClient._get_json MetadataCache cache_lifetime	test_guidance.py::test_discovery_and_oauth_metadata_are_cached_until_they_expire test_guidance.py::test_cache_lifetime_follows_cache_control_within_bounds	implemented
PAP-3.1-01	§3.1	MUST NOT	personal-agent	A Personal Agent MUST NOT use a document whose major version it doesn't support.	DiscoveryDocument.validate_protocol_version	test_fixtures.py::test_local_fixture_case protocol.major-version-unsupported protocol.minor-version-newer protocol.version-not-major-minor	implemented
PAP-3.1-02	§3.1	MUST	personal-agent	domain MUST match the host of the well-known URL the Personal Agent requested, ignoring a leading www..	DiscoveryClient.discover	test_fixtures.py::test_local_fixture_case protocol.organization-domain-www protocol.organization-domain-after-redirect	implemented
PAP-3.2-01	§3.2	MUST	company	The issuer MUST publish OAuth Authorization Server Metadata (RFC 8414), and poppy_domains in it MUST list every domain whose poppy.json names the issuer.	CompanyService.oauth_metadata	test_company_end_to_end.py::test_a_user_and_a_company_from_question_to_confirmed_exchange	implemented
PAP-3.2-02	§3.2	MUST	company	The issuer MUST publish OAuth Authorization Server Metadata (RFC 8414), and poppy_domains in it MUST list every domain whose poppy.json names the issuer.	CompanyService.oauth_metadata	test_company_end_to_end.py::test_a_user_and_a_company_from_question_to_confirmed_exchange	implemented
PAP-3.2-03	§3.2	MUST	personal-agent	Before using a Company's poppy.json, the Personal Agent fetches the metadata and MUST check that its issuer exactly matches auth.issuer and that poppy_domains includes organization.domain.	DiscoveryClient.discover	test_discovery.py::test_discovers_and_authenticates_company test_fixtures.py::test_local_fixture_case protocol.multi-domain-issuer protocol.issuer-mismatch	implemented
PAP-3.2-04	§3.2	MUST	personal-agent	Before using a Company's poppy.json, the Personal Agent fetches the metadata and MUST check that its issuer exactly matches auth.issuer and that poppy_domains includes organization.domain.	DiscoveryClient.discover	test_discovery.py::test_rejects_issuer_that_does_not_authorize_domain test_fixtures.py::test_local_fixture_case protocol.multi-domain-issuer protocol.issuer-not-claiming-domain	implemented
PAP-3.2-05	§3.2	SHOULD	personal-agent	Personal Agents SHOULD cache it according to its HTTP caching headers.	DiscoveryClient._get_json MetadataCache	test_guidance.py::test_discovery_and_oauth_metadata_are_cached_until_they_expire	implemented
PAP-3.3-01	§3.3	MUST	both	Anyone else MUST start an extension's name with a domain they control, such as example.com/gift-wrap.	extension_name_kind negotiate_extensions	test_fixtures.py::test_local_fixture_case protocol.third-party-extension-name	implemented
PAP-3.3-02	§3.3	MUST	personal-agent	Personal Agents and Companies MUST ignore extensions they don't support and fields they don't recognize, so either side can work with the other under this specification alone.	negotiate_extensions operations_endpoint	test_operations.py::test_operations_are_used_only_when_both_sides_list_version_1 test_fixtures.py::test_local_fixture_case protocol.unknown-extension-ignored protocol.extension-version-mismatch	implemented
PAP-3.3-03	§3.3	MUST	company	Personal Agents and Companies MUST ignore extensions they don't support and fields they don't recognize, so either side can work with the other under this specification alone.	CompanyService._client ClientMetadata	test_conformance.py::test_python_agent_python_company_over_tls test_company_refusals.py::test_an_agent_without_the_extension_gets_no_operations protocol.extension-required-company	implemented
PAP-3.3-04	§3.3	MUST	personal-agent	Personal Agents and Companies MUST ignore extensions they don't support and fields they don't recognize, so either side can work with the other under this specification alone.	ProtocolModel	test_models.py::test_discovery_fixture_round_trips_and_preserves_extensions test_fixtures.py::test_local_fixture_case protocol.minor-version-newer protocol.unknown-api-type protocol.unknown-conversation-protocol protocol.third-party-extension-name protocol.unknown-event-type protocol.unknown-operation-fields	implemented
PAP-3.3-05	§3.3	MUST	company	Personal Agents and Companies MUST ignore extensions they don't support and fields they don't recognize, so either side can work with the other under this specification alone.	ProtocolModel CompanyService._token	—	partial: The company parses requests with the same extra-tolerant models and ignores unknown form fields, but no test sends it unknown fields.

Conformance case IDs name protocol/fixtures/conformance cases; see the conformance report for their outcome in every language pairing.