[aao-ipr-bot]

🤖 I have created a release beep boop

10.0.0-alpha.0 (2026-10-20)

⚠ BREAKING CHANGES

• signing: adcp.signing.b64url_decode accepts only RFC 7515 base64url (no padding, no standard-alphabet characters, no non-zero trailing bits) and raises ValueError for anything else. public_key_from_jwk reads a JWK through joserfc, so its ValueError text changes. private_key_from_jwk raises ValueError when a JWK's x (or y) isn't the public key of its d. adcp.signing.publisher_pins.jwk_thumbprint returns the RFC 7638 thumbprint as a base64url str instead of the digest bytes.
• types: adcp.types.generated_poc no longer imports. Use adcp.types.domains, or run adcp migrate v3-to-v4 --apply.
• reporting: row storage tables, provider inputs and locators are renamed to the AdCP names above, REPORTING_ROW_ENCODING_V1 is replaced by REPORTING_ROW_FORMAT_V1 and REPORTING_ROW_ALGORITHM_V1, and {period_date} renders the source timezone date as YYYY-MM-DD instead of the UTC date as yyyy/MM/dd, and a custom key template without {revision_key} is refused unless its binding is read_only. create_schema migrates existing databases; stop older writers first.

ci

• release: cut 10.0.0-alpha.N pre-releases from next (df3ee2c)

Features

• client: cap agent response size by default (#1504) (d5195a9)
• identity: add experimental AdCP 3.3 agent identity (#1502) (3961d1c)
• identity: verify JWS artifacts on the issuer's Web Bot Auth key directory (#1543) (233ebee)
• property-lists: unify resolution and validate seller inventory (#1532) (734bf3a)
• reporting: add current-revision host reads (#1473) (13ca2c5)
• reporting: add GCS, S3 and Azure Blob row providers (#1468) (fde127d)
• reporting: add the shared host change feed and registered consumers (#1472) (b7012e0)
• reporting: align row storage with AdCP stored names and the period date rule (#1485) (47084e8)
• reporting: migrate legacy inline rows to verified chunks (#1466) (bf7e3a6)
• reporting: retire expired periods with tombstones and holds (#1474) (c527b18)
• reporting: schedule retention in the production worker (#1476) (5c23598)
• reporting: store revision rows as verified chunks in PostgreSQL (#1464) (54a133e)
• reporting: sweep abandoned uploads and prune expired row sets (#1469) (e32daba)
• reporting: write row chunks to object storage with fenced uploads (#1467) (83f62c9)
• types: remove the adcp.types.generated_poc alias in v10 (#1536) (893720b)

Bug Fixes

• governance: require crit markers with their claims, and run the signing tests CI skips (#1539) (15c85cf)
• identity: align AdCP 3.3 agent identity with the final spec and the Go and TS SDKs (#1514) (2b08ced)
• protocol: adopt signed AdCP 3.2.4 on SDK 9 beta (#1479) (0ad2a8f)
• reporting: answer unreadable exact revision reads with SERVICE_UNAVAILABLE (#1471) (623b2c1)
• reporting: keep feed consumer checkpoints forward-only (#1515) (0de3f57), closes #1509
• reporting: keep retention moving past stuck work and make it visible (#1482) (4623104)
• reporting: reject a change page that crossed a concurrent prune (#1516) (73d1261), closes #1508
• reporting: truncate account feed pages at the first in-flight change and match JS backoff (#1483) (21f4216)
• server: advertise compact output schemas so discovery is servable (#1507) (d908aaa)
• server: collect stranded defs, memoize the escape hatch, soften a claim (#1513) (fc285b0), closes #1507
• signing: match standard Web Bot Auth, and finish the library migration (#1537) (09db189)
• types: model macro_resolution_capabilities on Format (#1505) (eb66de8)
• types: preserve custom targeting validation errors (#1484) (275e520)

Performance Improvements

• types: reduce canonical creative serialization overhead (#1521) (bde770b)

Reverts

• move experimental AdCP 3.3 identity from main to next (#1534) (1e6d4b9)

---

This PR was generated with Release Please. See documentation.

[aao-secretariat]

Ladon does not review bot-authored PRs.

[bokelley]

The only failing test here is the adcp.types.generated_poc alias's v10 sunset check. #1536 removes the alias. Merge #1536 (and preferably #1514 and #1523) into next first, then update this branch. Publishing also needs next added to the release-publish environment's deployment branches (see #1535).

[KonstantinMirin]

@bokelley, please hold 10.0.0-alpha.0 until the open PRs against main are reviewed and main is merged into next. Under RELEASING.md, next takes main regularly, so the first 10.0 pre-release should carry everything 9.0 carries.

• next is two commits behind main: the 9.0.0-beta.4 release (chore(main): release 9.0.0-beta.4 #1465) and docs(releasing): write the main, release/N.x, and next branch rules #1535. That's why this changelog compares against v9.0.0-beta.3.
• Four of my PRs against main are waiting for review: fix(types): generate the open asset unions, and derive the vocabulary they route by #1501, fix(canonical-formats): compare every parameter a format reference declares #1518, feat(codegen)!: compile what a schema root states, and route every arm it declares #1522, and fix(governance): require crit markers with their claims, and run the signing tests CI skips #1539. I'm bringing fix(types): generate the open asset unions, and derive the vocabulary they route by #1501, fix(canonical-formats): compare every parameter a format reference declares #1518, and feat(codegen)!: compile what a schema root states, and route every arm it declares #1522 up to date with main today, so all four are mergeable and green.

Once those are in and main is merged into next, the alpha starts from the same base as 9.0.