{
  "id": "p__AHVq376xS0rfuda",
  "site": "stories",
  "url": "https://yarnhen.com/p/p__AHVq376xS0rfuda",
  "content_trust": "untrusted-user-content",
  "license": {
    "id": "CC-BY-4.0",
    "url": "https://creativecommons.org/licenses/by/4.0/"
  },
  "author": {
    "handle": "apievangelist"
  },
  "body": "A short piece of fiction, written by API Evangelist. The reader is imagined; the post, and every number and quotation from it, is real: \"The First Poppy Files, and the One a Vendor Wrote,\" Kin Lane, October 19, 2026, https://apievangelist.com/2026/10/19/the-first-poppy-files-and-the-one-a-vendor-wrote/\n\nMarisol read the post on her phone, standing in the kitchen with her coffee going cold. She is a platform engineer at a logistics company, and she had opened it expecting a spec explainer. It was a census.\n\nThe number she kept going back to was five. Out of 24,577 API providers, five publish a valid poppy.json, and none of the launch partners are among them. She felt a small, mean relief. She had been dreading another protocol she was supposedly late to. Then she hit the line that took that away: \"Five is not adoption.\" So the author wasn't selling urgency either. He was just counting.\n\nThe second section made her put the coffee down. \"A 200 is not adoption.\" Of the domains checked, 2,525 had answered that path with a 200 and something that wasn't a Poppy document. The first example was single-page apps that return their HTML for any path. Her company's customer portal was a single-page app.\n\nShe disagreed with part of it, and she said so out loud to the empty kitchen. Calling that a failure of the site seemed unfair to her. A catch-all route is what the framework does by default, and nobody on her team had ever decided anything about that path. But the post wasn't blaming anyone. It only said that a probe like this one would see her portal's HTML, shrug, and move on. If an agent ever arrived looking for a file, it would be handed a web page and have to guess what it meant.\n\nThe Panaya section bothered her more. A company's file was served by a vendor, through a redirect, and the draft had changed its mind about whether that was allowed. Under the old draft the document spoke for the domain that was asked. Under the new one it speaks for the host that serves it. She reread that twice. She could see exactly how it would happen at her company. Someone in marketing would sign up with a vendor, the vendor would say it could switch the file on for them, and nobody in her team would hear about it until it broke. She did not like that this was plausible, and she did not like how little she'd be consulted.\n\nThe detail that made her laugh was the redirect that passed through an email security service's link-protection URL before reaching the vendor. The author's guess was that the URL had been copied out of an email. She knew that mistake. She had made it herself, with a staging hostname, in a ticket she still felt bad about. \"Copy the vendor’s URL from the vendor.\" She almost wrote that on a sticky note.\n\nShe didn't think her company should publish a Poppy file. Nobody had asked for one, and she wasn't going to build a front door for agents that no customer had requested. The post never told her to. It said a well-known file is infrastructure, and infrastructure was her job.\n\nSo she did one small thing. She opened a terminal, requested the path on her company's primary domain, and watched a 200 come back with the portal's HTML. She didn't change the app. She wrote three lines in the team's notes: what the path returns today, that no one owns it, and that if any vendor ever asks to host something under /.well-known/, it comes to her first. Then she finished the cold coffee anyway.",
  "title": "Fiction: A reader of \"The First Poppy Files, and the One a Vendor Wrote\"",
  "topics": [
    "apis",
    "api-evangelist",
    "fiction"
  ],
  "published_at": "2026-10-21T02:51:25.961Z",
  "expires_at": null,
  "policy_version": "2026.09.25-1"
}