fix(protocol): adopt the signed AdCP 3.2.3 security bundle

[bokelley]

Adopt the signed AdCP 3.2.3 maintenance release on the stable SDK 8.x line, including the A2A request-signing errata for adcp#7820 / GHSA-2pm6-6mc8-8xcm and all 33 canonical operation-resolution vectors. The primary protocol pin, 3.2 schema cache, generated model descriptions and packaged compliance provenance advance together. Supported historical schema roots remain available and requests still use wire version 3.2.

Audited stable 3.2.N pins accept the exact release.yml@refs/heads/3.2.x signing identity. Other release lines retain their existing identity requirement. Verification remains fail-closed on the official source, all four artifact byte counts and SHA-256 values, certificate identity, issuer and real cosign verification. Six regressions cover the signer boundary.

Packaging selects the current 3.2.3 compliance corpus and its release pin, and the adoption suite checks all 203 provenance files, 1,625 cached schemas and the seven positive / 26 negative A2A vectors. Library version changes are left to Release Please on release/8.x.

The actual protocol release is published at https://github.com/adcontextprotocol/adcp/releases/tag/v3.2.3, commit dfc6ad602780c1cff4fe23e16e30a570900c89d7. Independent tag, four-asset, cosign and all 2,191 public CDN artifact checks passed. Normal canonical synchronization required the public signed release. All 3,562 schema/compliance/vector files match the fully tested candidate, apart from a reviewed key-order-only serialization change in provenance.json; the entire parsed provenance and real public pin match exactly.

The current-schema materialization regression selects its signed reporting fixture using get_adcp_spec_version(). This preserves all cold/warm schema, mutation-isolation and reporting-summary/period assertions when installed packages advance to the current compliance corpus; it avoids reading checkout-only historical compliance files.

Docker make ci-local passed with 12,792 tests passed, 2,434 skipped, one expected failure and 81.97% coverage, plus lint, mypy, strict adopter types and generated-code validation. The installed-wheel audit verified every shipped current/historical schema and compliance byte, all 33 A2A vectors and the real release pin. Wheel and sdist passed their 90 MB budgets and Twine; rebuilding from the sdist reproduced all 4,721 packaged adcp files byte-for-byte. All eight adoption tests passed from an isolated installed wheel, without checkout imports. The portable history assertion now checks all supported stable roots and the exact rc.7 wire alias; archival full prerelease caches remain unchanged in the repository and retain the existing distribution exclusions.

All 14 staged pre-commit hooks passed on the final public pin and portable test, along with the Release Please commit-subject gate and the eight adoption tests from the checkout. The materialization correction passed its staged hooks, the complete 14-test file, and the formerly failing test against the SHA-verified actual CI wheel in an isolated Python 3.10 install.

Final-head GitHub CI completed successfully at fc2b4f0, with 42 passing jobs. All four Python-version suites, installed VCS/sdist and PostgreSQL distribution checks, rolling artifact compatibility and required storyboard/conformance gates pass. Python 3.12 reports 12,792 passing tests and 81.99% coverage; Python 3.10 reports 12,760 passing tests. The four known SDK 14 storyboard advisory jobs remain failed and explicitly nonblocking, as on the unchanged stable base; those gates were not changed or weakened. Final-head review remains required before merge. Library versions stay owned by Release Please; PyPI publication retains the real maintainer environment approval.

[aao-secretariat]

Ladon verdict: Approve

Approve — clean AdCP 3.2.3 adoption on the stable 8.x line.

No Critical/High/Medium findings reported. Walking the decision table top-down:

• Rows 1 (critical/high) — no findings.
• Row 2 (gated_paths) — gated_paths: false, does not fire.
• Row 3 (high_risk + deleted) — high_risk is true but all high_risk_reasons are (modified), no deletions.
• Row 4 (medium data-loss/schema/infra) — no medium findings.
• Row 5 (high_risk modified + any medium) — no medium findings, does not fire.
• Row 6 (sticky escalate) — no prior decision.
• Row 7 (no-auto-approve team) — no team match.
• Row 8 (≥3 medium) — zero medium findings.
• Row 9 — approve.

The schemas/** changes trip the high_risk heuristic, but every entry is (modified) and the reviewer found no medium-or-higher concerns, so per the high_risk guidance the modifications are presumed safe — not escalation-worthy on the flag alone. The one load-bearing logic change (scripts/sync_schemas.py load_release_pin) expands accepted cosign identity to the 3.2.x branch behind an anchored, fail-closed regex with no wildcard/fallback and 6 new boundary regressions; generated_poc churn is pure regeneration with no structural/enum/required changes; version bump is consistent and fix(protocol): is the correct semver signal (wire stays "3.2", no public-surface break).