v2.0.0

2.0.0 (2026-07-01)

⚠ BREAKING CHANGES

• idempotency: CreateMediaBuyRequest.idempotency_key is now REQUIRED, inheriting the adcp library field (str, MinLen 16, MaxLen 255, pattern limited to [A-Za-z0-9_.:-]) -- the create-side optional override is deleted and its schema-inheritance allowlist entry removed. A missing key rejects as VALIDATION_ERROR at the schema boundary (the storyboard missing_key step); the MCP/A2A wrappers omit the kwarg when absent so the wire message is the spec's "Field required", not a None type error. update_media_buy and sync_* keys stay optional -- a deliberate create-first rollout, since the update BDD contract still encodes optional keys.

Features

• add CPA and time-based pricing model support (AdCP 3.1) (#1473) (970c0e1)
• bdd: render UC-011/019/026 feature files to AdCP 3.1 (merge mode) (4e9c183)
• behavioral test foundation for safe refactoring — BDD harness, 10 use cases, 4-transport coverage (#1335) (61f6ad9)
• ci: parallel BDD CI shards with merged coverage (stacked on PR3) (#1379) (19d3efd)
• idempotency: success-cache replay (PR 1 after error-emission) (#1312) (b94ab97)
• implement by_device_type breakdown and truncation flags (#1376) (#1475) (ab6840c)
• match list_creative_formats format_ids on (agent_url, id) federation pair (#1411) (#1479) (c1802c3)
• migrate to adcp 3.12.0 (rc.3 spec alignment) (#1217) (0cf4de7)
• round-trip property_list and add collection_list on media-buy (#1275) (#1276) (cfb7597)
• upgrade adcp SDK 3.12→4.3 and import protocol metadata (#1266) (5011855)

Bug Fixes

• add explicit strict=False to pairwise zip() in uc002 (B905) (f89201c)
• agent-db: resolve PROJECT_DIR to the worktree root, not the skill dir (#1443) (ad33521)
• apply selection_type inference to inventory profile publisher_properties (#1174) (a50ff50)
• bdd: add brand+op+sandbox account-resolution boundary branch (67681ed)
• bdd: add natural_key_sandbox account-resolution Given branch (26540ea)
• bdd: add reach_unit Given parser to stop status-column overflow (9249071)
• bdd: parse space-separated status_filter so v3.1 values reach _impl (0a9612c)
• bdd: resolve 'media_buy_ids provided' boundary to an IDs request (ed9633f)
• bdd: revert too-broad request_params parser; xfail pending_* status filters (2073994)
• bust browser cache on favicon re-upload (#1255) (a50e9b9), closes #1254
• ci: #1233 prep — D9/D11 docs, remove requires_server tests, scorecard harden-runner (#1478) (fa1b4da)
• ci: bump authlib 1.6.11 -> 1.7.2 for PYSEC-2026-188 (7399a77)
• ci: bump uv 0.11.6 -> 0.11.15 for GHSA-4gg8-gxpx-9rph (#1375) (e4e8b4d)
• ci: cache creative agent build with buildx GHA cache (#1189) (#1437) (c1f0ab1)
• ci: format compile_bdd.py and bump aiohttp 3.13.5 -> 3.14.0 (081d3e4)
• ci: operational helper layering and guard completeness (PR 3-3 of #1234) (#1424) (fa4221b)
• ci: pass GITHUB_TOKEN to pinact to avoid anonymous rate limit (#1344) (5ec6b16)
• ci: tighten check_no_skip_tests and hook-count guard (Pattern 4, #1234) (#1460) (7ecb77b)
• correct GAM service account authorization instructions (#1218) (c2ce35e)
• deps: bump aiohttp + authlib for CVE-2026-34993 / PYSEC-2026-188 (#1385) (a54b906)
• deps: bump mako, python-multipart, urllib3 for security audit (#1298) (a8e6bad)
• docker: patch base-image and supercronic CVEs blocking the release Trivy gate (#1510) (6bd96b1)
• error-handling cleanup — data loss bugs, silent catches, structural guard (#1078) (#1212) (e5886aa)
• forward typed account in get_media_buy_delivery A2A skill (#1438) (2a1f557)
• GAM test-connection must not report success with no accessible network (#1219) (6bf9d6a)
• gh-#1264 memory-leak follow-ups and test-suite integrity (#1334) (b47f1b0)
• implement empty BDD Given step bodies (#1181) (#1185) (d0b472c)
• lazy-loading inventory tree to prevent OOM on large GAM networks (#1176) (5c0e2c0)
• link ObjectWorkflowMapping on auto-approve path before push notification (#1378) (#1461) (cced480)
• mcp: accept creative format relationship filters (#1331) (d8ff48d)
• memory: leak triage #3 + #5 + #6 + sibling reapers (4 fixes) (#1264) (b57e27d)
• move app venv to /opt/venv to stop stale compose overlays (#1310) (#1488) (6cd14e6)
• normalize domains in property filtering to handle www/m subdomains (#1207) (76701c1)
• push held-back creatives to GAM after creative approval (#1038) (#1337) (04c3af5)
• remove invoice_recipient from UpdateMediaBuyRequest (717f5a7)
• replace broken adcontextprotocol.org auth setup guide link (#1252) (#1253) (beeff5c)
• restore AdCPValidationError import lost in merge auto-resolution (af39e87)
• schema: align GetProductsRequest push notification config (#1393) (7cb7e00)
• serialize push_notification_config with mode='json' at MCP/A2A transport boundaries (#1464) (31dd6b4), closes #1377
• strengthen 131 weak BDD Then step assertions with production-value checks (78be790)
• test-harness: implement MediaBuyCreateEnv's missing setup helpers (#1382) (ac1e97a)
• test: read step files as UTF-8 in bdd-no-direct-call-impl guard (#1431) (246d85c)
• tests: remove stale strict xfails on get-products schema drift (#1336) (8aebd75)
• use shared _get_error_message() instead of str(error).lower() in uc004 (wdge) (1629369)
• wrap account dict in AccountReference and normalise list-form assignments in sync_creatives (#1251) (14dbefd)

Code Refactoring

• add _require/_require_error helpers + guard ctx['error'] subscripts in BDD Then steps (qlsx-a) (bbbcda5)
• consolidate account reference coercion (#1439) (aa02c54)
• extract _assert_exponential_backoff helper in uc004_delivery (vpgh) (d2f1474)
• extract _assert_format_check_outcome helper in uc006_sync_creatives (ftmy) (c5ef5c1)
• extract _get_assignment_from_db helper in uc006_sync_creatives (spug) (9c2fc60)
• extract shared helpers in property discovery service (#1206) (426fd97)
• move billing policy and approval mode to tenant configuration (#1184) (#1186) (5ef141a)
• move then_webhook_notification to uc002 domain step file (aya0) (c7a1527)
• relocate pre-commit hooks to appropriate layers (PR 4 of #1234) (#1390) (afbe8e8)
• replace 6 SUSPECT auth_setup_mode tests with endpoint-level coverage (c05aa70)
• replace SUSPECT auth_setup_mode tests with endpoint-level coverage (f4aa3ad)
• test: adopt iter_call_expressions in architecture guards (Pattern 1b, #1234) (#1457) (25472b7)

Documentation

• adcp: correct AdCP spec version citations to introduction tags (#1356) (84db058)
• add 2.0.0 release notes and establish docs/releases convention (#1444) (4039fdc)
• document Code Quality path scope mirroring CodeQL (#1422) (#1491) (260e8d6)