feat(server): Account v3 wire fields + AccountStore.upsert/list/syncGovernance receive ResolveContext

[bokelley]

Parent: #452

Two paired changes that together unlock principal-keyed account governance.

(a) Account v3 wire fields

Extend the SDK's Account shape to carry:

• setup (pending_approval lifecycle): {url?, message, expires_at?}
• governance_agents
• account_scope: operator | brand | operator_brand | agent
• payment_terms
• credit_limit
• rate_card

to_wire_account() projection strips billing_entity.bank (write-only on emit).

Already partially present; finish.

(b) AccountStore.upsert(ctx) / list(ctx) / sync_governance(ctx)

Pass ResolveContext (auth_info, tool_name, agent) to upsert and list per JS account-store-upsert-list-ctx.md.

Promote sync_governance to typed AccountStore.sync_governance(entries, ctx) with framework-side credential write-only-strip on emit (per JS account-store-sync-governance.md). Specifically: governance_agents[i].authentication.credentials is stripped on the way out.

Why this matters

Security-relevant: enables principal-keyed gates for BILLING_NOT_PERMITTED_FOR_AGENT per #449's spec. Pre-this, no way to scope accounts.list per-principal — implementations either over-disclose or reject.

It's also the dependency #5 (create_tenant_store) needs to bake a per-entry tenant gate into the framework.

JS source

.changeset/account-store-upsert-list-ctx.md and .changeset/account-store-sync-governance.md (6.7).

Acceptance criteria

• Account shape extensions with Pydantic models for setup, governance_agents, account_scope, payment_terms, credit_limit, rate_card.
• to_wire_account() strips billing_entity.bank.
• AccountStore.upsert, AccountStore.list, AccountStore.sync_governance all receive ResolveContext as a typed parameter.
• Credential-strip on sync_governance emit covered by tests.
• Tests for each new wire field round-tripping through validation.

[bokelley]

Fold candidate from #463: While triaging #463 (credential-leak guidance + write-only strip on every echo path), I noted that #463 extends what #456 already specifies: your acceptance criteria cover governance_agents[i].authentication.credentials on sync_governance emit, but #463 asks for the same strip on the remaining echo paths — resolve, list, and upsert echo — plus a ctx_metadata credential-leak guidance note in CLAUDE.md.

Since both issues are same-author, touch the same file scope, and #456 is still in-flight, consider pulling the broader credential sweep and the documentation deliverable into this PR before merge. Doing so closes #463's scope in one shot and removes a Batch 3 sequencing round-trip.

Source: #463 (deferred, resurfaces on merge of this issue).

---

Generated by Claude Code

[bokelley]

Triage

Classification: Feature request
Bucket(s): handlers, signing (no matching labels found — gap noted in run summary)
Status: ready-for-human

What the experts said:

• code-reviewer: Six blockers. In-place Protocol extension breaks all existing AccountStore impls — requires a new MutableAccountStore subprotocol. sync_governance handler shim is entirely absent from handler.py, leaving no attachment point for the credential strip. ResolveContext must be defined (or mapped to existing RequestContext) before new method signatures can be typed correctly.
• security-reviewer: CRITICAL — governance_agents[i].authentication.credentials strip gap exists today, independently of this PR (projections.py:19 explicitly defers it with "track separately"). Bearer tokens are readable via get_media_buys, create_media_buy, and sync_creatives by any authenticated buyer. Strip must be framework-enforced at serialization time, not adopter-callable. validate_billing_for_agent is a dead export with no call site in handler.py.
• ad-tech-protocol-expert: Spec-aligned — sync_governance is a first-class wire method; its response schema uses additionalProperties: false and structurally omits authentication. ResolveContext is a JS 6.7 SDK convention, not a spec shape; Python's RequestContext already carries auth_info, tool_name, and agent.

My take: The goals are spec-correct and the security win is real, but three design decisions need @bokelley before executing: (1) MutableAccountStore subprotocol vs. in-place extension, (2) RequestContext reuse vs. new ResolveContext, (3) framework-enforced vs. adopter-callable credential strip on all account emit paths.

---

Triaged by Claude Code. Session: https://claude.ai/code/${CLAUDE_CODE_REMOTE_SESSION_ID}

---

Generated by Claude Code