Skip to content

fix(protocol): adopt the signed AdCP 3.2.3 security bundle #1429

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bokelley merged 3 commits into from
Oct 8, 2026
Merged

fix(protocol): adopt the signed AdCP 3.2.3 security bundle #1429

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
34419e0
fix(release): verify audited stable 3.2 maintenance bundles
bokelley Oct 6, 2026
07e9d02
fix(protocol): adopt the signed AdCP 3.2.3 security bundle
bokelley Oct 7, 2026
fc2b4f0
test(protocol): resolve the current signed reporting corpus
bokelley Oct 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
7 changes: 4 additions & 3 deletions MANIFEST.in
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,11 +4,11 @@ include LICENSE
include MIGRATION*.md
recursive-include src/adcp py.typed
recursive-include src/adcp/reporting/materializer/assets *.json
recursive-include src/adcp/_compliance/3.2.1 *.json *.jsonl *.yaml *.md
recursive-include src/adcp/_compliance/3.2.3 *.json *.jsonl *.yaml *.md
# Bundled AdCP JSON schemas. ``scripts/bundle_schemas.py`` mirrors
# ``schemas/cache/`` into ``src/adcp/_schemas/`` before ``python -m
# build`` so the validator ships with the wheel. Keep distributions on
# supported released lines: 3.0, 3.1 and 3.2 (AdCP 3.2.1).
# supported released lines: 3.0, 3.1 and 3.2 (AdCP 3.2.3).
recursive-include src/adcp/_schemas/3.0 *.json
recursive-include src/adcp/_schemas/3.1 *.json
recursive-include src/adcp/_schemas/3.2 *.json
Expand All @@ -19,6 +19,7 @@ prune src/adcp/_schemas/3.2.0-rc.6
prune src/adcp/_schemas/3.2.0-rc.7
prune src/adcp/_compliance/3.2.0-rc.6
prune src/adcp/_compliance/3.2.0-rc.7
prune src/adcp/_compliance/3.2.1
prune src/adcp/_schemas/3.1.0-*
# A clean VCS source tree has no ignored ``src/adcp/_schemas`` directory.
# Keep the tracked inputs needed by the build_py hook in source distributions
Expand All @@ -32,4 +33,4 @@ prune schemas/cache/3.2.0-rc.3
prune schemas/cache/3.2.0-rc.6
prune schemas/cache/3.2.0-rc.7
prune schemas/releases
include schemas/releases/3.2.1.json
include schemas/releases/3.2.3.json
8 changes: 4 additions & 4 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -333,9 +333,9 @@ async with ADCPMultiAgentClient(

## AdCP version support

SDK 8 is built against **AdCP 3.2.1**, the AdCP 3.2 general-availability
release, and makes canonical creatives the primary Python contract. It
negotiates AdCP 3.0, 3.1, and 3.2. On the wire, 3.2 is `"3.2"`, because
SDK 8 is built against **AdCP 3.2.3**, the maintenance release including
the A2A request-signing security errata. Canonical creatives remain the
primary Python contract. It negotiates AdCP 3.0, 3.1, and 3.2. On the wire, 3.2 is `"3.2"`, because
`adcp_version` carries release precision only. AdCP 3.2.0 was withdrawn and
is not a supported target. The SDK package version and protocol version are
intentionally independent:
Expand All @@ -344,7 +344,7 @@ intentionally independent:
import adcp

adcp.get_adcp_sdk_version() # SDK package version, e.g. "8.0.0"
adcp.get_adcp_spec_version() # AdCP spec this build targets, e.g. "3.2.1"
adcp.get_adcp_spec_version() # AdCP spec this build targets, e.g. "3.2.3"
```

The SDK also accepts and advertises `"3.2-rc.7"` as an explicit compatibility
Expand Down
8 changes: 4 additions & 4 deletions pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -215,10 +215,10 @@ adcp = [
"_schemas/3.1/**/*.json",
"_schemas/3.2/**/*.json",
# Exact signed compliance inputs plus their immutable release provenance.
"_compliance/3.2.1/**/*.json",
"_compliance/3.2.1/**/*.jsonl",
"_compliance/3.2.1/**/*.yaml",
"_compliance/3.2.1/**/*.md",
"_compliance/3.2.3/**/*.json",
"_compliance/3.2.3/**/*.jsonl",
"_compliance/3.2.3/**/*.yaml",
"_compliance/3.2.3/**/*.md",
# Vendored canonical-formats reference fixtures (14 v2 products +
# 50-entry v1 catalog) so :mod:`adcp.canonical_formats.fixtures`
# can serve them to adopter test suites without forcing each
Expand Down
48 changes: 24 additions & 24 deletions schemas/cache/3.2/a2ui/si-catalog.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@
"description": "Text display component",
"properties": {
"text": {
"$ref": "https://adcontextprotocol.org/schemas/3.2.1/a2ui/bound-value.json",
"$ref": "https://adcontextprotocol.org/schemas/3.2.3/a2ui/bound-value.json",
"description": "Text content to display"
},
"variant": {
Expand All @@ -31,7 +31,7 @@
"description": "Interactive button component",
"properties": {
"label": {
"$ref": "https://adcontextprotocol.org/schemas/3.2.1/a2ui/bound-value.json",
"$ref": "https://adcontextprotocol.org/schemas/3.2.3/a2ui/bound-value.json",
"description": "Button label text"
},
"action": {
Expand All @@ -46,7 +46,7 @@
"type": "object",
"description": "Context data to include with action",
"additionalProperties": {
"$ref": "https://adcontextprotocol.org/schemas/3.2.1/a2ui/bound-value.json"
"$ref": "https://adcontextprotocol.org/schemas/3.2.3/a2ui/bound-value.json"
}
}
},
Expand All @@ -64,7 +64,7 @@
"default": "primary"
},
"disabled": {
"$ref": "https://adcontextprotocol.org/schemas/3.2.1/a2ui/bound-value.json"
"$ref": "https://adcontextprotocol.org/schemas/3.2.3/a2ui/bound-value.json"
}
},
"required": [
Expand All @@ -77,11 +77,11 @@
"description": "Hyperlink component",
"properties": {
"label": {
"$ref": "https://adcontextprotocol.org/schemas/3.2.1/a2ui/bound-value.json",
"$ref": "https://adcontextprotocol.org/schemas/3.2.3/a2ui/bound-value.json",
"description": "Link text"
},
"url": {
"$ref": "https://adcontextprotocol.org/schemas/3.2.1/a2ui/bound-value.json",
"$ref": "https://adcontextprotocol.org/schemas/3.2.3/a2ui/bound-value.json",
"description": "URL to navigate to"
},
"external": {
Expand All @@ -100,11 +100,11 @@
"description": "Image display component",
"properties": {
"src": {
"$ref": "https://adcontextprotocol.org/schemas/3.2.1/a2ui/bound-value.json",
"$ref": "https://adcontextprotocol.org/schemas/3.2.3/a2ui/bound-value.json",
"description": "Image source URL"
},
"alt": {
"$ref": "https://adcontextprotocol.org/schemas/3.2.1/a2ui/bound-value.json",
"$ref": "https://adcontextprotocol.org/schemas/3.2.3/a2ui/bound-value.json",
"description": "Alt text for accessibility"
},
"width": {
Expand All @@ -126,19 +126,19 @@
"description": "Card container for grouped content",
"properties": {
"title": {
"$ref": "https://adcontextprotocol.org/schemas/3.2.1/a2ui/bound-value.json",
"$ref": "https://adcontextprotocol.org/schemas/3.2.3/a2ui/bound-value.json",
"description": "Card title"
},
"subtitle": {
"$ref": "https://adcontextprotocol.org/schemas/3.2.1/a2ui/bound-value.json",
"$ref": "https://adcontextprotocol.org/schemas/3.2.3/a2ui/bound-value.json",
"description": "Card subtitle"
},
"image": {
"$ref": "https://adcontextprotocol.org/schemas/3.2.1/a2ui/bound-value.json",
"$ref": "https://adcontextprotocol.org/schemas/3.2.3/a2ui/bound-value.json",
"description": "Card image URL"
},
"badge": {
"$ref": "https://adcontextprotocol.org/schemas/3.2.1/a2ui/bound-value.json",
"$ref": "https://adcontextprotocol.org/schemas/3.2.3/a2ui/bound-value.json",
"description": "Badge text (e.g., 'New', 'Sale')"
},
"action": {
Expand All @@ -151,7 +151,7 @@
"context": {
"type": "object",
"additionalProperties": {
"$ref": "https://adcontextprotocol.org/schemas/3.2.1/a2ui/bound-value.json"
"$ref": "https://adcontextprotocol.org/schemas/3.2.3/a2ui/bound-value.json"
}
}
},
Expand All @@ -176,27 +176,27 @@
"description": "Product display card (SI-specific)",
"properties": {
"title": {
"$ref": "https://adcontextprotocol.org/schemas/3.2.1/a2ui/bound-value.json",
"$ref": "https://adcontextprotocol.org/schemas/3.2.3/a2ui/bound-value.json",
"description": "Product name"
},
"price": {
"$ref": "https://adcontextprotocol.org/schemas/3.2.1/a2ui/bound-value.json",
"$ref": "https://adcontextprotocol.org/schemas/3.2.3/a2ui/bound-value.json",
"description": "Price display string"
},
"image": {
"$ref": "https://adcontextprotocol.org/schemas/3.2.1/a2ui/bound-value.json",
"$ref": "https://adcontextprotocol.org/schemas/3.2.3/a2ui/bound-value.json",
"description": "Product image URL"
},
"description": {
"$ref": "https://adcontextprotocol.org/schemas/3.2.1/a2ui/bound-value.json",
"$ref": "https://adcontextprotocol.org/schemas/3.2.3/a2ui/bound-value.json",
"description": "Product description"
},
"badge": {
"$ref": "https://adcontextprotocol.org/schemas/3.2.1/a2ui/bound-value.json",
"$ref": "https://adcontextprotocol.org/schemas/3.2.3/a2ui/bound-value.json",
"description": "Badge text (e.g., 'Best Seller')"
},
"ctaLabel": {
"$ref": "https://adcontextprotocol.org/schemas/3.2.1/a2ui/bound-value.json",
"$ref": "https://adcontextprotocol.org/schemas/3.2.3/a2ui/bound-value.json",
"description": "CTA button label"
},
"action": {
Expand All @@ -208,7 +208,7 @@
"context": {
"type": "object",
"additionalProperties": {
"$ref": "https://adcontextprotocol.org/schemas/3.2.1/a2ui/bound-value.json"
"$ref": "https://adcontextprotocol.org/schemas/3.2.3/a2ui/bound-value.json"
}
}
},
Expand All @@ -227,7 +227,7 @@
"description": "Data-bound list component",
"properties": {
"items": {
"$ref": "https://adcontextprotocol.org/schemas/3.2.1/a2ui/bound-value.json",
"$ref": "https://adcontextprotocol.org/schemas/3.2.3/a2ui/bound-value.json",
"description": "Path to array in data model"
},
"template": {
Expand All @@ -244,7 +244,7 @@
]
},
"emptyMessage": {
"$ref": "https://adcontextprotocol.org/schemas/3.2.1/a2ui/bound-value.json",
"$ref": "https://adcontextprotocol.org/schemas/3.2.3/a2ui/bound-value.json",
"description": "Message to show when list is empty"
},
"layout": {
Expand Down Expand Up @@ -348,11 +348,11 @@
"description": "Integration type"
},
"label": {
"$ref": "https://adcontextprotocol.org/schemas/3.2.1/a2ui/bound-value.json",
"$ref": "https://adcontextprotocol.org/schemas/3.2.3/a2ui/bound-value.json",
"description": "Button label"
},
"url": {
"$ref": "https://adcontextprotocol.org/schemas/3.2.1/a2ui/bound-value.json",
"$ref": "https://adcontextprotocol.org/schemas/3.2.3/a2ui/bound-value.json",
"description": "Integration endpoint URL"
},
"highlighted": {
Expand Down
2 changes: 1 addition & 1 deletion schemas/cache/3.2/a2ui/surface.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@
"type": "array",
"description": "Flat list of components (adjacency list structure)",
"items": {
"$ref": "https://adcontextprotocol.org/schemas/3.2.1/a2ui/component.json"
"$ref": "https://adcontextprotocol.org/schemas/3.2.3/a2ui/component.json"
}
},
"rootId": {
Expand Down
10 changes: 5 additions & 5 deletions schemas/cache/3.2/account/get-account-financials-request.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,23 +6,23 @@
"type": "object",
"allOf": [
{
"$ref": "https://adcontextprotocol.org/schemas/3.2.1/core/version-envelope.json"
"$ref": "https://adcontextprotocol.org/schemas/3.2.3/core/version-envelope.json"
}
],
"properties": {
"account": {
"$ref": "https://adcontextprotocol.org/schemas/3.2.1/core/account-ref.json",
"$ref": "https://adcontextprotocol.org/schemas/3.2.3/core/account-ref.json",
"description": "Account to query financials for. Must be an operator-billed account."
},
"period": {
"$ref": "https://adcontextprotocol.org/schemas/3.2.1/core/date-range.json",
"$ref": "https://adcontextprotocol.org/schemas/3.2.3/core/date-range.json",
"description": "Date range for the spend summary. Defaults to the current billing cycle if omitted."
},
"context": {
"$ref": "https://adcontextprotocol.org/schemas/3.2.1/core/context.json"
"$ref": "https://adcontextprotocol.org/schemas/3.2.3/core/context.json"
},
"ext": {
"$ref": "https://adcontextprotocol.org/schemas/3.2.1/core/ext.json"
"$ref": "https://adcontextprotocol.org/schemas/3.2.3/core/ext.json"
}
},
"required": [
Expand Down
22 changes: 11 additions & 11 deletions schemas/cache/3.2/account/get-account-financials-response.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,10 +5,10 @@
"type": "object",
"allOf": [
{
"$ref": "https://adcontextprotocol.org/schemas/3.2.1/core/version-envelope.json"
"$ref": "https://adcontextprotocol.org/schemas/3.2.3/core/version-envelope.json"
},
{
"$ref": "https://adcontextprotocol.org/schemas/3.2.1/core/protocol-envelope.json"
"$ref": "https://adcontextprotocol.org/schemas/3.2.3/core/protocol-envelope.json"
}
],
"oneOf": [
Expand All @@ -18,7 +18,7 @@
"type": "object",
"properties": {
"account": {
"$ref": "https://adcontextprotocol.org/schemas/3.2.1/core/account-ref.json",
"$ref": "https://adcontextprotocol.org/schemas/3.2.3/core/account-ref.json",
"description": "Account reference, echoed from the request"
},
"currency": {
Expand All @@ -27,7 +27,7 @@
"description": "ISO 4217 currency code for all monetary amounts in this response"
},
"period": {
"$ref": "https://adcontextprotocol.org/schemas/3.2.1/core/date-range.json",
"$ref": "https://adcontextprotocol.org/schemas/3.2.3/core/date-range.json",
"description": "The actual period covered by spend data. May differ from the requested period if the seller adjusts to billing cycle boundaries."
},
"timezone": {
Expand Down Expand Up @@ -122,7 +122,7 @@
"description": "Overall payment status. current: all obligations met. past_due: one or more invoices overdue. suspended: account suspended due to payment issues."
},
"payment_terms": {
"$ref": "https://adcontextprotocol.org/schemas/3.2.1/enums/payment-terms.json",
"$ref": "https://adcontextprotocol.org/schemas/3.2.3/enums/payment-terms.json",
"description": "Payment terms in effect for this account"
},
"invoices": {
Expand All @@ -136,7 +136,7 @@
"description": "Seller-assigned invoice identifier"
},
"period": {
"$ref": "https://adcontextprotocol.org/schemas/3.2.1/core/date-range.json",
"$ref": "https://adcontextprotocol.org/schemas/3.2.3/core/date-range.json",
"description": "Billing period covered by this invoice"
},
"amount": {
Expand Down Expand Up @@ -174,10 +174,10 @@
}
},
"context": {
"$ref": "https://adcontextprotocol.org/schemas/3.2.1/core/context.json"
"$ref": "https://adcontextprotocol.org/schemas/3.2.3/core/context.json"
},
"ext": {
"$ref": "https://adcontextprotocol.org/schemas/3.2.1/core/ext.json"
"$ref": "https://adcontextprotocol.org/schemas/3.2.3/core/ext.json"
}
},
"required": [
Expand All @@ -202,15 +202,15 @@
"type": "array",
"description": "Operation-level errors",
"items": {
"$ref": "https://adcontextprotocol.org/schemas/3.2.1/core/error.json"
"$ref": "https://adcontextprotocol.org/schemas/3.2.3/core/error.json"
},
"minItems": 1
},
"context": {
"$ref": "https://adcontextprotocol.org/schemas/3.2.1/core/context.json"
"$ref": "https://adcontextprotocol.org/schemas/3.2.3/core/context.json"
},
"ext": {
"$ref": "https://adcontextprotocol.org/schemas/3.2.1/core/ext.json"
"$ref": "https://adcontextprotocol.org/schemas/3.2.3/core/ext.json"
}
},
"required": [
Expand Down
6 changes: 3 additions & 3 deletions schemas/cache/3.2/account/list-account-changes-request.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@
"maximum": 99
},
"account": {
"$ref": "https://adcontextprotocol.org/schemas/3.2.1/core/account-ref.json",
"$ref": "https://adcontextprotocol.org/schemas/3.2.3/core/account-ref.json",
"description": "Account whose change feed to read. The resolved account and returned cursor are bound to the authenticated principal."
},
"cursor": {
Expand Down Expand Up @@ -58,10 +58,10 @@
"description": "Maximum changes to return. Sellers still scan through nonmatching records and advance the returned cursor."
},
"context": {
"$ref": "https://adcontextprotocol.org/schemas/3.2.1/core/context.json"
"$ref": "https://adcontextprotocol.org/schemas/3.2.3/core/context.json"
},
"ext": {
"$ref": "https://adcontextprotocol.org/schemas/3.2.1/core/ext.json"
"$ref": "https://adcontextprotocol.org/schemas/3.2.3/core/ext.json"
}
},
"required": [
Expand Down
Loading
Loading