v10.0.0-beta.0

10.0.0-beta.0 (2026-10-27)

⚠ BREAKING CHANGES

• protocol: the wire pin is AdCP 3.3.0-beta.0 (adcp_version "3.3-beta.0" by default; pin adcp_version="3.2" for a 3.2 contract). adcp.types.UniversalMacro is a RootModel union; the closed enum is UniversalMacro3. The identity preview modules are removed and adcp.types.experimental_identity binds the generated 3.3 types (RequestSigning.profiles is list[Profile], PrincipalChangedWebhook.reason is the generated enum). adcp.signing.identity_schema_bundle is removed. Legacy RFC 9421 SigningConfig / RequestSignatureVerification construction emits a DeprecationWarning. evaluator_id is gone from evaluator specs. See MIGRATION_v9_to_v10.md.
• a2a: With request signing configured, A2A requests that break the AdCP 3.3 operation-resolution hardening clauses (duplicate or case-variant keys, batches, malformed Parts, extra DataParts, mismatched task continuations) are refused with request_body_malformed or INVALID_REQUEST.
• webhooks: WebhookReceiver rejects bodies over 1 MiB (was 10 MiB) and JSON deeper than 64 or with more than 100,000 members with HTTP 413 before signature verification, and adds the rejection reasons body_too_complex, content_encoding_unsupported and body_framing_invalid. Client responses past the depth or member bounds raise ADCPResponseTooComplexError.
• signing: BrandJsonJwksResolver and the other brand.json fetchers raise ValueError for max_body_bytes above 2 MiB, the AdCP 3.3 cap verifiers must not read past.
• canonical-formats: PixelTrackerDowngrade.v1 is now V1UrlTracker or None. Check it before reading asset_id or url. See MIGRATION_v9_to_v10.md.
• reporting: the PostgreSQL reporting stores, the row storage providers, the change feed, the ownership-migration helpers and ReliableReportingService.postgres leave adcp; install adcp-reporting-storage[pg] (plus gcs/s3/azure) and import them from adcp_reporting_storage. The adcp[reporting-gcs], [reporting-s3] and [reporting-azure] extras are removed. See docs/reporting-storage-package-migration.md.
• codegen: a JSON document carrying null for an optional property whose schema does not admit null is now refused by model_validate_json and TypeAdapter.validate_json, and the published JSON Schema of such a property has no null arm. A Python None is still accepted. JSON produced with exclude_none=False must be read back in Python mode (model_validate(json.loads(...))).
• types: SyncCreativesRequest.creatives is now list[CreativeAsset] | None. Handlers must guard it before iteration or use request.creatives or [] for assignment-only requests.
• signing: adcp.signing.b64url_decode accepts only RFC 7515 base64url (no padding, no standard-alphabet characters, no non-zero trailing bits) and raises ValueError for anything else. public_key_from_jwk reads a JWK through joserfc, so its ValueError text changes. private_key_from_jwk raises ValueError when a JWK's x (or y) isn't the public key of its d. adcp.signing.publisher_pins.jwk_thumbprint returns the RFC 7638 thumbprint as a base64url str instead of the digest bytes.
• types: adcp.types.generated_poc no longer imports. Use adcp.types.domains, or run adcp migrate v3-to-v4 --apply.
• reporting: row storage tables, provider inputs and locators are renamed to the AdCP names above, REPORTING_ROW_ENCODING_V1 is replaced by REPORTING_ROW_FORMAT_V1 and REPORTING_ROW_ALGORITHM_V1, and {period_date} renders the source timezone date as YYYY-MM-DD instead of the UTC date as yyyy/MM/dd, and a custom key template without {revision_key} is refused unless its binding is read_only. create_schema migrates existing databases; stop older writers first.

ci

• release: cut 10.0.0-alpha.N pre-releases from next (df3ee2c)
• release: cut 10.0.0-beta.N pre-releases from next (#1672) (322e6f0)

chore

• release: leave the beta channel for SDK 9.0.0 GA (#1567) (4e9c123)

Features

• client: cap agent response size by default (#1504) (d5195a9)
• compat: negotiate and translate AdCP minor versions (#1559) (31d7217)
• decisioning: export media-buy terminal statuses and the observed transition graph (#1664) (4b1554e), closes #1604
• decisioning: resolve account_id references in NaturalKeyAccounts for AdCP 3.3 (#1653) (dca87b9), closes #1478
• identity: add experimental AdCP 3.3 agent identity (#1502) (3961d1c)
• identity: verify JWS artifacts on the issuer's Web Bot Auth key directory (#1543) (233ebee)
• media-buy: persist and echo create context on get_media_buys (#1600) (4083dc5), closes #1575
• property-lists: unify resolution and validate seller inventory (#1532) (734bf3a)
• protocol: adopt the signed AdCP 3.3.0-beta.0 bundle (#1662) (7472aae)
• reporting: add current-revision host reads (#1473) (13ca2c5)
• reporting: add GCS, S3 and Azure Blob row providers (#1468) (fde127d)
• reporting: add the shared host change feed and registered consumers (#1472) (b7012e0)
• reporting: align row storage with AdCP stored names and the period date rule (#1485) (47084e8)
• reporting: migrate legacy inline rows to verified chunks (#1466) (bf7e3a6)
• reporting: retire expired periods with tombstones and holds (#1474) (c527b18)
• reporting: schedule retention in the production worker (#1476) (5c23598)
• reporting: ship the Reliable Reporting storage as adcp-reporting-storage (#1557) (d59eee9)
• reporting: store revision rows as verified chunks in PostgreSQL (#1464) (54a133e)
• reporting: sweep abandoned uploads and prune expired row sets (#1469) (e32daba)
• reporting: sync empty-ledger replacement and owned-ledger rollback for 9.0 adopters (#1554) (38d046a)
• reporting: write row chunks to object storage with fenced uploads (#1467) (83f62c9)
• server: let PrincipalResolverError carry a stable error code (#1633) (cf96d57), closes #1623
• signing: accept brand.json up to 2 MiB for AdCP 3.3 (#1654) (ca8d422), closes #1635
• signing: pin the Public Suffix List snapshot used for eTLD+1 (#1652) (a6fd1fa), closes #1562
• types: keep wire bytes on parsed URLs, datetimes, UUIDs and emails so digests round-trip (#1617) (a7f5acd), closes #1610
• types: remove the adcp.types.generated_poc alias in v10 (#1536) (893720b)
• webhooks: add PgNotificationOutbox.enqueue_prepared_sync for synchronous business transactions (#1665) (e081fe4), closes #1607
• webhooks: bound inbound bodies before verification and response JSON shape for AdCP 3.3 (#1656) (283f877), closes #1636

Bug Fixes

• a2a: echo request context on unknown-skill and unexpected-error tasks (#1597) (7b44d8d), closes #1573
• a2a: enforce the AdCP 3.3 operation-resolution hardening clauses (#1659) (b3e34c2), closes #1637
• a2a: keep integers integral in echoed context across the protobuf Struct (#1594) (bf6d966), closes #1572
• adagents: strip surrounding whitespace in normalize_url (#1629) (4e2ae8f), closes #1624
• canonical-formats: compare every parameter a format reference declares (#1518) (d073712), closes #1517
• canonical-formats: drop playback trackers on the v1 downgrade instead of firing them as impressions (#1655) (2ffa538), closes #1643
• canonical-formats: read an omitted pixel_ratio as 1x on the supported side too (#1553) (b07adbc)
• codegen: refuse a JSON null on optional properties whose schema forbids one (#1555) (a40c2f0)
• compat: infer display_tag and every 3.2 asset type from the asset key (#1628) (88cf04a), closes #1624
• compat: log server-side conversion losses at DEBUG with one INFO summary (#1609) (f7e4f3a)
• compat: never downgrade into a payload the older schema refuses (#1630) (b5234e2)
• decisioning: project ADCPTaskError from platform methods to its own wire error (#1632) (7b95b26), closes #1622
• governance: require crit markers with their claims, and run the signing tests CI skips (#1539) (15c85cf)
• identity: a grantee that is not a registrable domain covers no claim (#1542) (6cb3c8a)
• identity: align AdCP 3.3 agent identity with the final spec and the Go and TS SDKs (#1514) (2b08ced)
• identity: implicit grant authority extends to the brand's house (#1565) (4b8b7e4)
• identity: never send a bound origin to the 3.2 profile, and treat a missing kid as invalid (#1549) (2db4741)
• protocol: adopt signed AdCP 3.2.4 on SDK 9 beta (#1479) (0ad2a8f)
• protocol: adopt signed AdCP 3.2.7 on SDK 9 (#1657) (95ed163)
• release: tighten V9 reporting and CI readiness checks (#1550) (41c2be7), closes #1383 #1493
• reporting: answer unreadable exact revision reads with SERVICE_UNAVAILABLE (#1471) (623b2c1)
• reporting: classify pending status and owed history as transient, unresolved references as REFERENCE_NOT_FOUND (#1631) (a2ec81c), closes #1618
• reporting: keep feed consumer checkpoints forward-only (#1515) (0de3f57), closes #1509
• reporting: keep retention moving past stuck work and make it visible (#1482) (4623104)
• reporting: name the cause of a reporting startup failure (a202a3c), closes #1561
• reporting: reject a change page that crossed a concurrent prune (#1516) (73d1261), closes #1508
• reporting: truncate account feed pages at the first in-flight change and match JS backoff (#1483) (21f4216)
• server: advertise compact output schemas so discovery is servable (#1507) (d908aaa)
• server: collect stranded defs, memoize the escape hatch, soften a claim (#1513) (fc285b0), closes #1507
• server: mirror a raised AdcpError into the payload errors array (#1592) (cd0319b), closes #1558
• signing: match standard Web Bot Auth, and finish the library migration (#1537) (09db189)
• signing: use only the directory keys with a valid signature (#1544) (56d5e73)
• signing: work with http-sf 1.5.0 and http-message-signatures 2.2.0 (#1568) (cf97bd2)
• sync: inherit generated fields on the identity facades and skip the retired generated_poc alias test (7d8b043)
• targeting: bridge package forecast request inputs (#1598) (7cd667f)
• tasks: echo the poll's own context on tasks/get (#1599) (f1f7593), closes #1574
• testing: stop build_all_models hanging after a generated_poc alias import (#1626) (6f61234), closes #1619
• types: allow assignment-only creative syncs (81c2a8b), closes #1545
• types: drop the empty-model arm codegen emits beside a constrained array (#1658) (adaf29b), closes #1616
• types: generate the open asset unions, and derive the vocabulary they route by (#1501) (30a72ee)
• types: inherit the generated constraints on the canonical creatives field (#1548) (69a0f6b)
• types: inherit the generated creatives ceiling on PackageRequest (#1579) (6f13ce0)
• types: inherit the generated field on every hand-written redeclaration (#1625) (6e0ed68)
• types: leave unset optional fields off the wire from any parent (#1591) (1086cd9), closes #1587
• types: model macro_resolution_capabilities on Format (#1505) (eb66de8)
• types: preserve custom targeting validation errors (#1484) (275e520)
• types: refuse a JSON null on reporting_webhook.operation_id too (#1570) (9e238f3)
• webhooks: echo reporting_webhook.operation_id on scheduled delivery reports (#1552) (0bac033), closes #1092
• webhooks: send PgWebhookDeliverySupervisor task webhooks and deliver the ones already stuck in the queue (#1651) (83a2fe3)

Performance Improvements

• types: reduce canonical creative serialization overhead (#1521) (bde770b)

Reverts

• move experimental AdCP 3.3 identity from main to next (#1534) (1e6d4b9)