contract-v2.0.0 (contract libraries)

What's Changed

• docs: fix stale tool counts and inaccurate references in root docs by @cesteral in #119
• fix: fail-fast when a tool's account-scoping param is ignored (P1) by @cesteral in #121
• docs: correct search-tool server list + document cross-server naming variants by @cesteral in #122
• docs(meta): fix misleading get_available_metrics level example by @cesteral in #123
• docs(meta,gads): honest client-side wording for get_pacing_status by @cesteral in #124
• docs: document gads_bulk_mutate in cross-server naming variants by @cesteral in #125
• feat(mcp): fail-fast create-payload validation on the execute path by @cesteral in #127
• fix(ttd,linkedin): drop required-but-unused params from two tools by @cesteral in #129
• feat(meta): paginate meta_search_targeting via the after cursor by @cesteral in #130
• refactor(pinterest,ttd,dbm): align tool file names with wire names by @cesteral in #126
• feat(mcp): paginate the account-listing tools (pinterest/snapchat/amazon-dsp) by @cesteral in #128
• refactor(sa360)!: rename sa360_search → sa360_gaql_search by @cesteral in #134
• fix(msads): register the env-gated conformance tools like every server by @cesteral in #135
• feat(mcp): add duplicate_entity to snapchat, ttd, msads, gads by @cesteral in #131
• feat(msads): honest search_targeting + add msads_get_targeting_options by @cesteral in #132
• feat(gads): add gads_upload_image (image asset upload) by @cesteral in #133
• fix: unbreak main — README tool counts + pinterest test import + msads flaky-timeout by @cesteral in #136
• test: raise timeout on remaining pagination-conformance cold-import cases by @cesteral in #138
• fix(write): validate update_entity payloads on the execute path (M3) by @cesteral in #139
• fix(audit): thread reason into effect summary / audit log on dv360+ttd writes (M1, M2) by @cesteral in #140
• fix(write): validate bulk-create payloads on the execute path (M4) by @cesteral in #141
• refactor(structural): align snapchat file name to wire name + hoist dbm tool name (M10, M11) by @cesteral in #142
• fix(dv360): schema-validate bulk-create dry-run + validate-entity advertiserId; document cm360 gaps (M5, M6, M7, M9) by @cesteral in #143
• fix(validate): thread tiktok advertiserId + ttd entityId into validation (M6) by @cesteral in #144
• fix(msads): decompress ZIP report bodies and strip quoted metadata rows by @cesteral in #147
• feat(gads): add gads_upload_video; document ttd/amazon-dsp upload gaps (#145) by @cesteral in #148
• feat(pacing): port get_pacing_status to the 9 remaining platforms (M12) by @cesteral in #150
• feat(ttd,amazon-dsp): add upload_video — close the remaining #145 gaps by @cesteral in #149
• fix(dv360): guard update dry-run for out-of-scope kinds; reject read-only types in create/update by @cesteral in #151
• fix(shared): close the auth/session/log findings from the shared-layer security review by @cesteral in #152
• shared: transport-factory auth integration tests + pin JWT verification to HS256 by @cesteral in #153
• harden(shared): constant-time fingerprint compare, tighter session-id validation, truncated fp logs by @cesteral in #154
• test(contract-hash): pin per-decision cross-repo definitionHash golden vectors by @cesteral in #155
• harden: external-write-rail safety — method-aware retry (C3), jti fail-closed posture (P3), DV360 dry-run fidelity (P4) by @cesteral in #156
• fix(contract-hash)!: SECURITY — canonicalization dropped own proto keys (definitionHash collision → attested bypass) by @cesteral in #157
• harden(contract-schema): enforce write-promise fields in the runtime annotation schema (C5) by @cesteral in #158
• harden(security): scope report-csv:// resource listing to the calling session by @cesteral in #159
• C2 (#742) S1 producer: advertise Cloud Run deployment identity on server-card by @cesteral in #160
• feat(linkedin): offset pagination for linkedin_search_targeting (#146) by @cesteral in #161
• docs(contract): document gads_gaql_search as the intended targeting-discovery path (#146) by @cesteral in #162
• docs: note remaining servers lacking a targeting-discovery tool (#146 follow-up to #162) by @cesteral in #163
• feat(targeting): canonical pagination for linkedin/snapchat get_targeting_options (#146) by @cesteral in #164
• fix(governance): harden decision-token verify (jti-store errors, mode conflicts, TTL/boundary) by @cesteral in #168
• Release guard: workspace contract-hash must match the published tarball (F7) by @cesteral in #169
• Governance hardening sweep — MCP auth, session capacity, destructive-write defaults by @cesteral in #170
• Release the contract-library fixes: bump to 2.0.0, and make the parity guard able to see them by @cesteral in #172
• fix(ci): stop style-gating generated code, which turned main red by @cesteral in #173
• Two recurrence guards for the contract libraries: version-bump at PR time, schema parity at release by @cesteral in #174
• feat(governance): wire the distributed jti store, and check the posture at boot (#166, #167) by @cesteral in #178
• fix(dv360): make schema codegen reproducible, and actually run it (#175) by @cesteral in #176
• feat(release): give the contract libraries their own release lane (#165, #171) by @cesteral in #177
• docs(runbook): dev fleet LB recovery, and what is NOT broken about it by @cesteral in #179
• fix(release): stop the contracts-only lane demanding a tool it never uses by @cesteral in #180

Full Changelog: v1.9.0...contract-v2.0.0