fix(webhooks): disable synchronous completion emission by default

[bokelley]

Summary

auto_emit_completion_webhooks defaults to True, but AdCP specifies that a synchronously completed request does not emit a completion webhook. The buyer already receives the terminal result inline, and sync completions have no registry task_id.

Required change

• Change the default of auto_emit_completion_webhooks to False.
• Keep an explicit non-default compatibility opt-in if needed for existing adopters, clearly documented as non-conformant extension behavior.
• Add a regression test proving a synchronous terminal response does not emit a webhook by default.
• Document the behavior change and migration path.

The protocol-side negative conformance scenario is tracked from adcontextprotocol/adcp#5389.

[bokelley]

Triage

Classification: Bug (protocol-conformance)
Bucket(s): middleware, cross-repo (neither label exists in this repo — flagging gap)
Status: ready-for-human
Milestone: (omitted — no version target named)

What the experts said:

• ad-tech-protocol-expert: The strongest conformance argument is the synthesized task_id: "sync-{uuid4()}" — a buyer calling tasks/get on it gets 404, making the webhook envelope malformed by construction; the PR must quote the normative clause from adcp#5389 (MUST NOT vs. absence of MUST) before the conformance claim is airtight.
• code-reviewer: Realistic adopter impact is near-zero — every example already passes False, testing helpers default False, and the boot-gate blocks silent adoption of True without a wired sender — but this is a minor-version bump (wire-behavior change), not a patch.

My take: Both experts agree the direction is correct and the True default is operationally untenable. Two open questions must be resolved before merge: (1) whether adcp#5389 contains a normative MUST NOT (or merely lacks a MUST), and (2) whether the JS SDK also plans to flip (cross-SDK asymmetry risk). This is flagged for human review because changing a default value is breaking by SDK semver definition.

Implementation scope:

• Three signature changes: serve.py:89, serve.py:463, handler.py:1292 (bool = True → bool = False)
• Update docstrings: serve.py:181, serve.py:508, and stale comment at testing/decisioning.py:189-190 ("production serve defaults to True")
• Invert existing test test_handler_default_is_enabled at tests/test_decisioning_webhook_emit.py:675 — it asserts the OLD behavior and will fail; rename to test_handler_default_is_disabled, flip assertion to assert_not_called(), add new test for explicit True opt-in
• Migration note and minor version bump required

/cc @bokelley

---

Triaged by Claude Code. Session: https://claude.ai/code/cse_01UjAywHuwKPmMznpgtBvyys

---

Generated by Claude Code