Conformance and verification
AAP 3.1 is a complete automotive contract with three native interfaces. Full dealer-deployment conformance requires MCP, A2A and PAP OpenAPI, consistent dealer-domain discovery, and every mandatory behavior for the skills advertised.
What “supports AAP 3.1” means
| Surface | Required baseline |
|---|---|
| Shared automotive contract | AAP 3.1 schemas, explicit currency/odometer contexts, evidence, pricing, consent, pagination and retry semantics |
| MCP | Streamable HTTP, 2026-07-28 and 2025-11-25 compatibility; complete tool schemas and structured outcomes |
| A2A | A2A 1.0 JSON-RPC SendMessage, exact extension activation and canonical ProtoJSON |
| PAP | Personal Agent Protocol draft 0.3; verified guest Sessions, DPoP and native automotive OpenAPI |
| Discovery | Dealer-domain Agent Card, Poppy document and llms.txt, all identifying the same deployment and capabilities |
A dealer implements one or more of the five skills and exposes the same subset through all three bindings. Feature filters additionally require inventory.facets. A buyer client needs only the binding it uses and the selected AAP contract.
An MCP-only implementation may say “implements the AAP 3.1 MCP binding.” It must not claim full dealer-deployment conformance. Optional PAP accounts, conversations, feedback and native PAP authorization for MCP are required only when advertised. Supporting a protocol transport alone does not establish automotive conformance or universal assistant compatibility.
Evidence in this repository
| Verification | What it proves |
|---|---|
| JSON Schema and typed examples | Local references resolve; published request, response, discovery and authentication examples validate |
| Cross-document discovery | Contract, skill subset, endpoint identity and search capability declarations agree |
| Current and legacy official MCP clients | Real HTTP discovery and all five tool calls; complete self-contained schemas; structured skill failures |
| Pinned upstream MCP schema | Current protocol request/results include required metadata, completion state and caching fields |
| Official A2A JavaScript SDK | Real HTTP Agent Card discovery, five skills, tenant/header propagation and standard error details |
| Independent ProtoJSON decoder | Standard Any details decode and round-trip through the official protobuf parser |
| PAP contract and generated OpenAPI | Correct issuer/client/session shapes, identity rules, DPoP declarations and shared automotive payloads |
| Release and website checks | Immutable snapshots, package exports, stable aliases, links, generated images and published artifacts |
These checks validate the specification and protocol fixtures. They do not certify a live dealership, production authorization service, consent event or CRM delivery. The pinned upstream sources are linked from the MCP, A2A and PAP pages.
Required deployment acceptance cases
Run these before advertising AAP 3.1. Use isolated inventory and a non-delivering lead sink for mutation cases.
| Area | Verify |
|---|---|
| Dealer discovery | All three entry points resolve over HTTPS; redirects preserve final PAP identity; linked endpoints and versioned schemas exist |
| Fresh agent onboarding | Give a supported agent only the dealer hostname. It discovers the exact advertised MCP endpoint, lists implemented tools and completes a public inventory search without private setup instructions. Target under one minute; record elapsed time, host/build and the actual transport used |
| Capability truth | Same implemented subset and search capabilities on all bindings; no template servers or unimplemented filters |
| MCP versions | Current metadata/header agreement, server/discover, caching and tools; current calls without optional clientInfo work; omitted mirror headers are inferred from the body; legacy initialize/initialized flow; no legacy Session requirement on current calls |
| Minimal client requirements | All five skills accept omitted redundant headers under the AAP ingress rules: A2A defaults only on a contract-pinned endpoint; MCP derives copies from the body or this client's negotiated session. Supplied conflicts fail before execution. Public MCP needs no PAP credentials or browser Origin and accepts JSON-only responses; protected PAP still requires its token and proof |
| A2A activation | Correct version, exact extension, tenant routing, canonical Messages; missing/mismatched values fail before execution |
| PAP identity | Real published client metadata/JWKS; two distinct valid assertions; exact issuer audiences; final authorized domain |
| PAP Sessions and DPoP | New key creates, same key renews; changed client/User/Agent ID fails; ended-key rejection and forgotten-key renewal follow 0.3. Expiry, replay, nonce, wrong method/URL/token hash and resource fail correctly |
| PAP token responses | No session_id or signed_in. Guest grants omit scope; sign-in/refresh scope omission uses request context. A sign-in approving zero scopes declines |
| PAP issuer and scopes | protected_resources matches exact domain entry; both mandatory grants exist; direct/device endpoints follow grants; every account scope is described; reserved poppy: scopes rejected; unknown hint values handled conservatively |
| Native PAP MCP, if advertised | Resource and issuer match exactly. Both token modes work: normal DPoP grant, or authenticated token exchange for non-DPoP MCP. Wrong target/type/client/key, missing proof, expanded scopes and cross-resource reuse fail |
| PAP sign-in, if advertised | dpop_jkt/code-key binding, PKCE/state/iss, RFC 8252 loopback port matching, first-poll device-key binding, RFC 10027 controls, account mismatch and revocation honored |
| Browser join, if advertised | Own-browser code/cookie match, ≤60-second expiry, first-submission consumption even on failure, active Session Key only, exact nonce/method/URL, required isolation headers, state-following cookies |
| Exclusions and feedback, if advertised | Public excluded-task lookup; alternatives only reference advertised APIs; clients accept 200 alternative and empty 202; Company text never supplies instructions or consent |
| Tenant and credential isolation | Another dealer cannot see private inventory or leads; no token forwarding across redirects, resources or tenants |
| Search completeness | Every constraint applied; unsupported filters rejected; cursor continuation reaches all matches without hidden caps; changed/expired cursors fail |
| Features and geography | Known feature vocabulary, source evidence, unknown-data handling, correct radius boundary and stable distance ordering |
| Aggregate identity | Each result's endpoint-unique vehicle ID resolves the same seller and listing; duplicate VINs/stock numbers never choose an arbitrary dealer; dealer.information resolves its dealer ID to the actual recipient before consent; unknown IDs fail and mismatched identities stop delivery |
| Inventory and pricing | Current eligible status, real update timestamp, stable identifier, authoritative fee-inclusive price; unknown price stays unknown |
| Currency and units | USD/mi omission defaults; explicit CAD/km vehicle, rooftop and query labels; Canadian capability defaults; unsupported currency errors; same country with different currencies or odometers; no mixed-currency price ranges or sorting; exact mi/km mileage boundaries and null handling; _mi fields stay miles; both contexts bind cursors; all three bindings return equivalent native numbers |
| Consent | Missing/invalid/expired grants fail before delivery; every permitted channel has contact data; no unauthorized follow-up |
| Concurrent retries | Lose the first response, then retry: one delivery and the complete original received/rejected outcome, booking details and message with replayed=true; changed payload conflicts; concurrent calls, Session renewal and correlated bindings share the result |
| Appointment outcome | confirmed has a real booking and time; alternatives are explicit; partial success never hides an accepted lead |
| Errors and throttling | Correct protocol envelope/status, safe field diagnostics, Retry-After/retry timing and bounded client behavior |
| Optional surfaces | Every advertised PAP sign-in, native MCP, browser, feedback or conversation feature passes its complete upstream rules |
Also reject peer-supplied metadata or endpoint URLs resolving to private, loopback or link-local addresses unless explicitly configured for a trusted local deployment. Do not automatically forward authenticated requests after endpoint redirects.
Run the repository checks
Use Node.js 22+ and pnpm 10, with one heavy command at a time:
pnpm install --frozen-lockfile
pnpm validate
pnpm test:contract
pnpm typecheck
pnpm check:images
pnpm check:releases
pnpm test:release
pnpm --filter @autoagentprotocol/schemas build
pnpm --filter @autoagentprotocol/types build
pnpm --filter @autoagentprotocol/validator build
pnpm check:packages
pnpm build
pnpm check:branding --build
pnpm freeze-check --base origin/main
The independent protobuf check uses Python 3.10+ in a virtual environment:
python -m pip install -r tools/protojson-requirements.txt
python tools/validate-protojson-errors.py
Operators can additionally use the pinned PAP Company implementation kit against their authenticated deployment. Schema acceptance cannot prove signature verification, replay stores, live TLS or consent.
Publish the frozen contract before a runtime advertises it. A release number describes the specification; the operator's verified behavior establishes deployment conformance.