[bokelley]

Adopts the signed AdCP 3.3.0-beta.5 bundle on the SDK 10 / next line, following #1851. The 3.3 GA criterion "both SDKs support the latest 3.3 beta" resets with each beta. adcp 10.0.0b12 pins 3.3.0-beta.4.

Pin

• schemas/releases/3.3.0-beta.5.json records:
  • Source commit 5ae065826eae, taken from the Fulcio certificate. The v3.3.0-beta.5 tag (e096e60c) is its "Version Packages" child, the same layout as beta.4.
  • Bundle sha256 6c716e67b127…, 27,965,617 bytes, plus the .sig, .crt and .sha256 sidecars.
• cosign verify-blob against the exact release.yml@refs/heads/main identity prints Verified OK.
• make regenerate-schemas took the audited-pin path: checksum and signing identity verified, no fallback.
• src/adcp/ADCP_VERSION is 3.3.0-beta.5.
• The wheel ships the beta.5 schema cache and _compliance tree. MANIFEST.in and pyproject.toml prune beta.4 from distributions, and the beta.4 trees stay in the repo as history.

What beta.5 changes, and what the SDK does

Spec change	SDK
Experimental match keys (adcp#8375, feature media_buy.match_keys): core/match-key.json, enums/match-key-use.json, media_buy.supported_match_keys, Product.identity.match_keys, TMP provider-registration match_keys	Generated: adcp.types.domains.core.match_key.MatchKey, adcp.types.domains.enums.MatchKeyUse, ProductIdentity.match_keys, MediaBuy.supported_match_keys, TmpProviderRegistration*.match_keys. The prose rules (compatibility, persistent_identifier, vendor) aren't enforced by the SDK.
sales-fixed-rate promoted from preview to stable (DR-0028)	No change. The SDK already lists it with the other sales-* specialisms.
PSL prose (DR-0037, adcp#8409): verifiers use a bundled list, and AdCP names no reference snapshot	No code change. The SDK already vendors its list (adcp.signing.PSL_SNAPSHOT). The trust.json grantee description is regenerated, and the docs that waited on #8409 now cite DR-0037.
Compliance fixtures (deterministic_testing account scoping, legacy creative test-kit catalog)	The packaged _compliance/3.3.0-beta.5 files are byte-identical to beta.4's. Only bundle-manifest.json (4712 files) and provenance.json (1770 schemas) change.
Reporting subscriptions: no change	No change (see below).

Generated deltas are in SCHEMA_DELTAS.md. Nothing renumbers. Two name changes:

• adcp.types._generated.MatchKey now binds core.match_key instead of core.signal_definition, by the consolidator's stem-match rule. _generated is internal and no SDK module imports MatchKey from it. The public API snapshot records the repoint. The signals MatchKey is unchanged under adcp.types.domains.signals.
• The bundled capabilities module's TMP Surface enum is now PropertyType. Bundled modules aren't re-exported.

Generator fix

fix_trusted_match_runtime_validators (scripts/post_generate_fixes.py) put arm 1's validators immediately before class TmpProviderRegistration2. Beta.5 generates arm 2's MatchKey3 between the two arms, so the https-endpoint and identity-match checks ended up on MatchKey3. That model then fails to build (PydanticUserError). On the first regen, mypy and 30 tests caught it: test_trusted_match_validation, test_wire_round_trip collection, test_freezegun_models, and a reporting HTTP test that builds every model. The fixer now anchors arm 1's validators on the end of arm 1's own body, as it already did for arm 2. test_each_provider_registration_arm_carries_its_own_validators pins this.

Follow-up, not in this PR: the TMP match_keys item is allOf the core match key, plus uses: const identity_match and "no property_types". The generated subclass makes uses optional and leaves the const and the not required unenforced. That is looser than the schema but never refuses a valid registration.

Breaking

• The SDK speaks 3.3-beta.5 and no longer accepts a 3.3-beta.4 pin. get_supported_adcp_versions() returns 3.0, 3.1, 3.2, 3.3-beta.5, 3.2-rc.7.
• An adcp_version of 3.3-beta.4 or 3.3.0-beta.4 raises ConfigurationError.
• A peer that advertises only 3.3-beta.4 for the 3.3 line negotiates down to 3.2.
• There is no beta.4 alias. Betas aren't guaranteed additive over each other, and beta.6 withdraws fields under adcp#8501.

This is recorded in MIGRATION_v9_to_v10.md (wire-pin row, plus a new beta.5 row) and in docs/adcp-3.3-sdk-inventory.md section 15.

Reporting vectors and storage contract

• The six vendored files in tests/fixtures/reporting_subscriptions/spec/ are byte-identical to the beta.5 bundle's compliance/test-vectors/reporting-subscriptions/. They are not re-vendored, and SPEC_COMMIT stays 8ee1bfa2.
• All 138 coverage vectors, the 8 offering checks and the 3 differential regressions pass, with the wire objects now validated against the beta.5 schemas.
• The upstream reference model (scripts/reference/reporting-coverage/) is identical at both commits. feat(reporting): adopt AdCP 3.3.0-beta.4 coverage, grant and controller rules and the signed bundle #1851 expected beta.5 to fix the missing timezone-cutover stub. It didn't, and docs/reporting-subscriptions-coverage.md now says so. Both SDKs still follow the cutover text.
• Storage contract unchanged. REPORTING_STORAGE_CONTRACT == adcp_reporting_storage.contract.STORAGE_CONTRACT == 2. Nothing under src/adcp/reporting/ or packages/ changes.

Other updates

• The current-pin references move from beta.4 to beta.5. Comments that say a rule arrived "in 3.3.0-beta.4" are left alone.
• The adoption test is renamed to tests/test_adcp_3_3_0_beta_5_adoption.py, with the beta.5 identity values: source commit, bundle sha, manifest and provenance counts.

Verification

Local, on 61b377d9e (Python 3.13):

• make validate-generated and make test-generation: pass (127 codegen tests).
• make lint and make typecheck-all (mypy on 1706 files, the adopter mypy-strict and pyright fixtures, the type-ignore contract): pass.
• pytest tests/ -n 24: 21,833 passed, 2,944 skipped, 1 xfailed, 0 failed.
• Reporting: 138 spec vectors, 8 offering checks and 3 differential regressions pass. The vendored files match their pinned SHA-256s, and the wire objects validate against 3.3.0-beta.5.
• scripts/sync_schemas.py --require-signed-release re-run after the regen: the cache, compliance and vectors come out byte-identical.
• get_supported_adcp_versions() returns ('3.0', '3.1', '3.2', '3.3-beta.5', '3.2-rc.7').

Pre-commit black and bandit were skipped for this commit. Black's only edits would have reformatted existing code in scripts/post_generate_fixes.py and src/adcp/accounts.py, which was already unformatted on next. Bandit's only findings are pre-existing ones in accounts.py and testing/reporting.py, where this PR changes just a comment and a string. CI runs neither.

BREAKING CHANGE: the SDK no longer advertises or accepts AdCP 3.3-beta.4. get_supported_adcp_versions is 3.0, 3.1, 3.2, 3.3-beta.5 and 3.2-rc.7; an adcp_version pin of 3.3-beta.4 or 3.3.0-beta.4 raises ConfigurationError, and a peer that advertises only 3.3-beta.4 for the 3.3 line negotiates down to 3.2. Re-pin to 3.3-beta.5 or omit the pin.

🤖 Generated with Claude Code

[aao-secretariat]

Ladon verdict: Approve

Approve — clean beta.4→beta.5 schema adoption with no blocking findings.

Checked against the decision table top-down:

• Rows 1 (critical/high) and 4/8 (medium): no findings of any severity reported.
• Row 2 (gated paths): gated_paths: false — does not apply.
• Row 3/5 (high-risk deleted/modified): high_risk is true, but every one of the ~1700+ matches is (added) — new schema cache files. New files matching schemas/** are normal scaffolding/adoption work and are not escalation-worthy on the flag alone; no (deleted) or (modified) entries present.
• Row 6 (sticky escalate): no prior decision.
• Row 7 (no-auto-approve team): no team match.
• Falls through to row 9 → approve.

Reviewer verification notes: the single hand-written logic change (scripts/post_generate_fixes.py:4530-4538, anchoring arm 1's TMP provider-registration validators on its own body) is correct and pinned by test_each_provider_registration_arm_carries_its_own_validators. Semver signal is present and correct (feat(protocol)! + BREAKING CHANGE footer + migration notes). MANIFEST/pyproject prune beta.4 and ship beta.5. Forward-compat stays additive (extra='allow', no removed arms). The version-conversion sweep covers the beta.5→3.2/3.1/3.0 pathway, satisfying the DR-0032/DR-0033 pathway-back requirement. No forward-compat union, import-layering, generated-code, or credential-handling violations.