feat(accounts)!: enforce change feed changed_paths and per-reader idempotency_key (#1647)

MIGRATION_v9_to_v10.md

@@ -48,3 +48,4 @@ the SDK-relevant inventory is [docs/adcp-3.3-sdk-inventory.md](docs/adcp-3.3-sdk
 | Unknown keys on open objects are kept and written back | `AdCPBaseModel` defaults to `extra='allow'`: a property the pinned model does not declare (a field a newer spec added, a sibling arm's property the schema admits) survives `model_validate` → `model_dump` in `model_extra`, including a `null` value. Generated classes whose schema object is closed (`additionalProperties: false`) keep `extra='forbid'`. SDK 9 dropped unknown keys (`extra='ignore'`). If your code passed stray keyword arguments and relied on them being dropped, remove them; `ADCP_STRICT_VALIDATION=1` turns the default into `forbid` so tests find them. |
 | Permissive adagents.json resolution requires the fetched domain | `resolve_properties_for_agent(doc, agent_url, mode="permissive")` raises `ValueError` without `publisher_domain=`. Pass the domain the document was fetched for: a bare entry's top-level properties are then kept only when every identifier is a `type: "domain"` under that domain, so a file on another host can no longer claim a publisher's site, app bundle or DOOH venue through a bare entry. Properties identified by bundle, store or venue IDs, and properties whose `publisher_domain` names another domain, are dropped from the bare fallback. `allow_any_domain=True` restores the SDK 9 result. Typed selectors and strict mode are unchanged. See [docs/adagents-discovery.md](docs/adagents-discovery.md) for `properties_for_publisher_domain` and `verify_cross_domain_properties`. |
 | Generated enums name each value once | The `_1` alias members codegen emitted when an `anyOf` arm repeated an enum value (`System.zip_1`, `Field17.ad_request_url_1`, 19 enums on 10.0.0b4) are gone; each value has one member, the first-declared one. Code that referenced an alias name (`System.zip_1`) must use the real member (`System.zip`); `System("zip")` and `member.value` are unchanged. |
+| `list_account_changes` pages are checked and projected per caller | AdCP 3.3 requires non-empty `changed_paths` on every `adcp` / `seller_operator` change record (`[""]` for a whole-resource create, delete or purge) and lets the originating request's `idempotency_key` reach only the principal that sent it. A handler on 3.3 or later that returns such a record without `changed_paths` now fails the call with `VALIDATION_ERROR` (`field` `/changes/N/changed_paths`), whatever the validation mode; and every record loses `idempotency_key` unless it is an `adcp` record built with `adcp.account_change_feed.attribute_account_change(record, originator)` whose originator is the caller (`ToolContext.tenant_id` + `caller_identity`). Persist the originator when the mutation commits and attribute records when serving the page. `WebhookSender.prepare_account_change_recorded` / `send_account_change_recorded` also accept the change record itself (with `subscriber_id=`), refuse one without `changed_paths`, and never carry its `idempotency_key`. |

docs/adcp-3.3-sdk-inventory.md

@@ -63,7 +63,7 @@ it adopted the bundle, and what is left to the codegen/wire-fidelity (2) and
 | `creative_assignments_as_of`, `approval_status_as_of` | `get_media_buys` `Package`, `CreativeApproval`; `list_creatives` `AssignedPackage` | Timestamps. | generated |
 | `landing_page_url`, `trackers` on assignments | `core/creative-assignment.json`, `core/assignment-tracker.json`; `sync_creatives` `Assignment` / `AssignmentOperations1`; `list_creatives` `AssignedPackage`; `get_media_buys` `CreativeApproval`; capabilities `creative.supports_assignment_landing_page`, `creative.supports_assignment_trackers` | Per-assignment overrides. | generated |
 | `sync_creatives` `merges[]`, `AssignmentOperations4` | `sync_creatives` response `Merge`; error `CREATIVE_MERGE_REJECTED` with `error-details/creative-merge-rejected.json`; enum `creative-merge-rejection-reason`; capability `creative.supports_assignment_merge` | Creative merge. | generated; `CreativeMergeRejectedError` mints schema-valid details (field defaults to the first rejected `assignment_operations` entry) and `creative_merge_rejected_details` narrows them: done (3), #1668 |
-| `list_creatives` `platform_id`, `provenance`, `seller_revision`, `status_as_of`; request filter `provenance` | `creative/list-creatives-response.json`; `x-entity-types` `creative_seller_revision`; capability `creative.stable_creative_ids` | `platform_id` is native in 3.3 (adcp#8175). There was no forward-compat patch for it in this SDK; nothing to retire. | generated; `stable_creative_ids` seller support and `delete_missing` exclusion: (3), #1638 |
+| `list_creatives` `platform_id`, `provenance`, `seller_revision`, `status_as_of`; request filter `provenance` | `creative/list-creatives-response.json`; `x-entity-types` `creative_seller_revision`; capability `creative.stable_creative_ids` | `platform_id` is native in 3.3 (adcp#8175). There was no forward-compat patch for it in this SDK; nothing to retire. | generated; `seller_revision` passes through `list_creatives` unharmed and is dropped (loss recorded) when served to a buyer below 3.3; `adcp.account_change_feed.mirror_creative_revision` copies it into a creative change record's `resource_revision` in the same JSON type: done (3), #1647; `stable_creative_ids` seller support and `delete_missing` exclusion: (3), #1638 |
 | `validate_input` `Warning.field` | `creative/validate-input-result.json` | `field` is now declared as a string (#8212). | generated |
 | `build_creative` `errors` | `BuildCreativeResponse1/3` | Errors array on build responses. | generated |
 | `pixel_tracker` events | enum `pixel-tracking-event`: `start`, `first_quartile`, `midpoint`, `third_quartile`, `complete` | Send only to 3.3 peers. Interim form for 3.2 peers: `event: "custom"` with `custom_event_name`; the 3.3 → 3.2 downgrade may rewrite to that form. Downgrade to 3.0 `tracker_pixel` drops them with `PIXEL_TRACKER_LOSSY_DOWNGRADE`, never as `impression_tracker`. | generated; 3.0 downgrade drop (including the `custom` interim form): done (3), #1655; 3.3 → 3.2 rewrite to `custom` in `convert_payload`, buyer requests and seller responses (loss `playback_event_as_custom`): done (3), #1643 |
@@ -109,7 +109,7 @@ it adopted the bundle, and what is left to the codegen/wire-fidelity (2) and
 | --- | --- | --- | --- |
 | `account.stable_account_id`, `account_id` from `sync_accounts` | capabilities `Account.stable_account_id` | Natural-key references after provisioning are deprecated. | seller `NaturalKeyAccounts(loader_by_id=...)`: done (3), #1653; capability declaration and buyer `AccountRegistry.prepare`: (3), #1478 |
 | Discovery never provisions | `get_products`, `list_products`, `get_signals`, `request_proposals`, `refine_proposals`, `decline_proposals` MUST NOT create or activate an account; unresolved `account` → `ACCOUNT_NOT_FOUND`; `list_accounts` treats `account` as a filter | Storyboard `media_buy_seller/unprovisioned_account_reference` (advisory until runner 14.1.0). | done: discovery tasks never provision (`ResolveContext.is_provisioning`, #1288) and a supplied unresolved reference is `ACCOUNT_NOT_FOUND`; confirm with the storyboard: (3) |
-| `account-change.json` `idempotency_key`; `changed_paths` required for `adcp` / `seller_operator` origins | `AccountChange.idempotency_key` | Echoed to the sending principal only. | generated; account change feed: (3), #1647 |
+| `account-change.json` `idempotency_key`; `changed_paths` required for `adcp` / `seller_operator` origins | `AccountChange.idempotency_key` | Echoed to the sending principal only. | generated; `list_account_changes` dispatch refuses a page with an `adcp` / `seller_operator` record lacking non-empty `changed_paths` (`VALIDATION_ERROR` at `/changes/N/changed_paths`, any validation mode, handlers on 3.3 or later) and strips `idempotency_key` from every record except an `adcp` record attributed (`attribute_account_change`, off the wire) to the calling principal; `WebhookSender.prepare_account_change_recorded` accepts the record, checks it, and never carries its key; helpers in `adcp.account_change_feed`: done (3), #1647 |
 | `account.agent_onboarding`, `get_principal` `relationship`, `identity.trust_json`, `identity-relying-party` | `core/agent-onboarding.json`, `-tier.json`, `-requirement.json`, `core/buyer-onboarding-posture.json`, `core/principal-relationship.json`, `trust/v1/trust.json`, `trust/v1/trust-acknowledgements.json`; enums `agent-onboarding-mode`, `agent-onboarding-requirement-kind` (x-extensible), `principal-relationship-status`; `PrincipalChangedWebhook.Reason` `relationship_changed`, `relationship_expiring`; `get_principal` `Result.errors` | Experimental. The identity preview (`_identity_preview.py`, vendored `_identity_schemas/`, `generate_identity_preview.py`) is retired: `adcp.types.experimental_identity` binds the generated 3.3 types, `AgentOnboardingRequirement.kind` stays open (`enum | str`), and `adcp.signing.trust` validates against the bundle through `get_named_validator`. | done (1) |
 | `adcp.implementation.sdks[]` | capabilities `Adcp.implementation` (`Implementation`, `Sdk`, `Component`) | Vendors move data out of `ext.adcp`. | generated; advertise this SDK: (3), #1646 |
 | `security_profiles` | `GetAdcpCapabilitiesResponse.security_profiles` (`adcp-prod-security-3.3`, experimental) | | generated |