feat(reporting): prototype reliable ledger reconciliation

SCHEMA_DELTAS.md

@@ -2,5 +2,5 @@
 
 ## Field changes
 
-- `core/reporting_webhook.py`
-  - `ReportingWebhook`: `+operation_id`
+- `core/reporting_receipt.py`
+  - `ReportingReceipt`: `+observed_native_version_ref`

schemas/cache/3.2.0-beta.6/account/sync-accounts-response.json

@@ -5,10 +5,10 @@
   "type": "object",
   "allOf": [
     {
-      "$ref": "https://adcontextprotocol.org/schemas/3.2.0-beta.6/core/version-envelope.json"
+      "$ref": "../core/version-envelope.json"
     },
     {
-      "$ref": "https://adcontextprotocol.org/schemas/3.2.0-beta.6/core/protocol-envelope.json"
+      "$ref": "../core/protocol-envelope.json"
     }
   ],
   "oneOf": [
@@ -33,15 +33,15 @@
                 "x-entity": "account"
               },
               "brand": {
-                "$ref": "https://adcontextprotocol.org/schemas/3.2.0-beta.6/core/brand-ref.json",
+                "$ref": "../core/brand-ref.json",
                 "description": "Current canonical brand reference for the account."
               },
               "operator": {
                 "type": "string",
                 "description": "Current canonical operator domain. When an identity change is pending or rejected, this remains the current value rather than echoing the requested value."
               },
               "operator_unit": {
-                "$ref": "https://adcontextprotocol.org/schemas/3.2.0-beta.6/core/operator-unit.json",
+                "$ref": "../core/operator-unit.json",
                 "description": "Current canonical operator-owned business unit, agency seat, or platform account. The stable id participates in the natural key; name is mutable display metadata. This is distinct from the seller/storefront account_id. When an identity change is pending or rejected, this remains the current value rather than echoing the requested value."
               },
               "revision": {
@@ -50,11 +50,11 @@
                 "description": "Current account revision after this operation. Incremented by each persisted settings change, identity-change request, or identity-change disposition; not incremented by dry runs, validation failures, or exact idempotency replays. Pass this value in the next settings-update entry to prevent lost updates."
               },
               "identity_change": {
-                "$ref": "https://adcontextprotocol.org/schemas/3.2.0-beta.6/core/account-identity-change.json",
+                "$ref": "../core/account-identity-change.json",
                 "description": "Pending or rejected desired operator identity. The top-level operator and operator_unit remain canonical until an approved change is applied."
               },
               "identity_change_preview": {
-                "$ref": "https://adcontextprotocol.org/schemas/3.2.0-beta.6/core/account-identity-change-preview.json",
+                "$ref": "../core/account-identity-change-preview.json",
                 "description": "Dry-run-only preview of whether the requested identity would apply, require approval, or be blocked, plus evaluated resource impacts. This value is not persisted; canonical fields and revision remain current."
               },
               "currency": {
@@ -94,19 +94,19 @@
                 "description": "Account status. active: ready for use. pending_approval: seller reviewing (credit, legal). rejected: seller declined the account request. payment_required: credit limit reached or funds depleted. suspended: was active, now paused. closed: was active, now terminated."
               },
               "billing": {
-                "$ref": "https://adcontextprotocol.org/schemas/3.2.0-beta.6/enums/billing-party.json",
+                "$ref": "../enums/billing-party.json",
                 "description": "Who is invoiced on this account. Matches the requested billing model."
               },
               "billing_entity": {
-                "$ref": "https://adcontextprotocol.org/schemas/3.2.0-beta.6/core/business-entity.json",
+                "$ref": "../core/business-entity.json",
                 "description": "Current canonical business entity for the party responsible for payment. Sellers MAY add verified fields, but MUST NOT return data from a different entity. During an operator-domain handoff this remains the current entity until approval applies atomically; destination_billing_entity is staged and write-only. Bank details are omitted (write-only)."
               },
               "destination_billing_entity": {
                 "description": "Request-only staging field. It MUST NOT appear in sync_accounts responses.",
                 "not": {}
               },
               "account_scope": {
-                "$ref": "https://adcontextprotocol.org/schemas/3.2.0-beta.6/enums/account-scope.json"
+                "$ref": "../enums/account-scope.json"
               },
               "setup": {
                 "type": "object",
@@ -137,7 +137,7 @@
                 "description": "Rate card applied to this account"
               },
               "payment_terms": {
-                "$ref": "https://adcontextprotocol.org/schemas/3.2.0-beta.6/enums/payment-terms.json",
+                "$ref": "../enums/payment-terms.json",
                 "description": "Payment terms agreed for this account. When the account is active, these are the binding terms for all invoices on this account."
               },
               "credit_limit": {
@@ -161,7 +161,7 @@
                 "type": "array",
                 "description": "Per-account errors (only present when action is 'failed')",
                 "items": {
-                  "$ref": "https://adcontextprotocol.org/schemas/3.2.0-beta.6/core/error.json"
+                  "$ref": "../core/error.json"
                 }
               },
               "warnings": {
@@ -179,12 +179,21 @@
                 "type": "array",
                 "description": "Applied notification subscribers for this account after declarative replacement and activation-proof checks. Present on `created`, `updated`, and `unchanged` results when the buyer included `notification_configs` in the request or any persisted entries exist on the account. Entries are keyed by account-scoped `subscriber_id`; re-sending an existing `subscriber_id` replaces that subscriber's config rather than creating a duplicate. Only configs that the seller has persisted are echoed. `authentication.credentials` is omitted on every entry (write-only).",
                 "items": {
-                  "$ref": "https://adcontextprotocol.org/schemas/3.2.0-beta.6/core/notification-config.json"
+                  "$ref": "../core/notification-config.json"
+                },
+                "maxItems": 16
+              },
+              "reporting_delivery_configs": {
+                "type": "array",
+                "x-status": "experimental",
+                "description": "Resolved caller-owned durable reporting delivery configurations after declarative replacement. Each item echoes desired state and reports validation/setup state plus the seller-issued destination_ref when resolved. A setup action may direct an authenticated user to complete a provider grant or Open Sharing activation, but MUST NOT carry credentials or a bearer URL.",
+                "items": {
+                  "$ref": "../core/reporting-delivery-config-state.json"
                 },
                 "maxItems": 16
               },
               "authorization": {
-                "$ref": "https://adcontextprotocol.org/schemas/3.2.0-beta.6/core/account-authorization.json",
+                "$ref": "../core/account-authorization.json",
                 "description": "Optional. The caller's scope grant against this account after the sync operation. Vendor agents of any type (media-buy, signals, governance, creative, brand) that support scope introspection SHOULD populate this so callers can preempt RBAC errors rather than discovering scope by trial and error. Media-buy sales agents claiming the `attestation_verifier` standard scope MUST populate it. Present on `created`, `updated`, and `unchanged` results; omitted on `failed` results (where the account did not reach a usable state). Absence means the vendor agent does not advertise introspectable scope \u2014 callers MUST NOT infer access from absence."
               }
             },
@@ -211,10 +220,10 @@
           }
         },
         "context": {
-          "$ref": "https://adcontextprotocol.org/schemas/3.2.0-beta.6/core/context.json"
+          "$ref": "../core/context.json"
         },
         "ext": {
-          "$ref": "https://adcontextprotocol.org/schemas/3.2.0-beta.6/core/ext.json"
+          "$ref": "../core/ext.json"
         }
       },
       "required": [
@@ -276,15 +285,15 @@
           "type": "array",
           "description": "Operation-level errors (e.g., authentication failure, service unavailable)",
           "items": {
-            "$ref": "https://adcontextprotocol.org/schemas/3.2.0-beta.6/core/error.json"
+            "$ref": "../core/error.json"
           },
           "minItems": 1
         },
         "context": {
-          "$ref": "https://adcontextprotocol.org/schemas/3.2.0-beta.6/core/context.json"
+          "$ref": "../core/context.json"
         },
         "ext": {
-          "$ref": "https://adcontextprotocol.org/schemas/3.2.0-beta.6/core/ext.json"
+          "$ref": "../core/ext.json"
         }
       },
       "required": [

schemas/cache/3.2.0-beta.6/core/account.json

@@ -22,11 +22,11 @@
       "description": "Optional intermediary who receives invoices on behalf of the advertiser (e.g., agency)"
     },
     "status": {
-      "$ref": "https://adcontextprotocol.org/schemas/3.2.0-beta.6/enums/account-status.json",
+      "$ref": "../enums/account-status.json",
       "description": "Account lifecycle status. See the Accounts Protocol overview for the operations matrix showing which tasks are permitted in each state."
     },
     "brand": {
-      "$ref": "https://adcontextprotocol.org/schemas/3.2.0-beta.6/core/brand-ref.json",
+      "$ref": "brand-ref.json",
       "description": "Brand reference identifying the advertiser"
     },
     "operator": {
@@ -36,7 +36,7 @@
       "x-entity": "operator"
     },
     "operator_unit": {
-      "$ref": "https://adcontextprotocol.org/schemas/3.2.0-beta.6/core/operator-unit.json",
+      "$ref": "operator-unit.json",
       "description": "Operator-owned business unit, agency seat, or platform account associated with this advertiser account. The id round-trips from the natural key; name is mutable display metadata. This is distinct from account_id, which belongs to the seller/storefront namespace."
     },
     "revision": {
@@ -45,7 +45,7 @@
       "description": "Monotonically increasing optimistic-concurrency token for this account. Incremented on every persisted settings change, identity-change request, and identity-change disposition; reads, dry runs, validation failures, and exact idempotency replays do not increment it. Pass the latest observed value in a sync_accounts settings-update entry to prevent lost updates."
     },
     "identity_change": {
-      "$ref": "https://adcontextprotocol.org/schemas/3.2.0-beta.6/core/account-identity-change.json",
+      "$ref": "account-identity-change.json",
       "description": "Pending or rejected operator-identity transition. While present, the top-level operator and operator_unit remain the current canonical identity. Re-read list_accounts until the request is applied (canonical fields change and this object disappears) or rejected."
     },
     "currency": {
@@ -59,11 +59,11 @@
       "description": "Immutable operational timezone for this account, expressed as UTC or an IANA timezone identifier. AdCP 3.2 sellers return it on every account. It is the default calendar-day boundary for account-scoped behavior unless a feature explicitly declares another timezone basis. For buyer-selected account_fixed provisioning it participates in the natural account key."
     },
     "billing": {
-      "$ref": "https://adcontextprotocol.org/schemas/3.2.0-beta.6/enums/billing-party.json",
+      "$ref": "../enums/billing-party.json",
       "description": "Who is invoiced on this account. See billing_entity for the invoiced party's business details."
     },
     "billing_entity": {
-      "$ref": "https://adcontextprotocol.org/schemas/3.2.0-beta.6/core/business-entity.json",
+      "$ref": "business-entity.json",
       "description": "Current canonical business entity for the party responsible for payment. Contains the legal name, tax IDs, and address needed for formal B2B invoicing. Corresponds to whoever billing points to (operator, agent, or advertiser). When this account appears in a response, bank details MUST be omitted and the request-only destination_billing_entity MUST NOT be exposed."
     },
     "destination_billing_entity": {
@@ -75,7 +75,7 @@
       "description": "Identifier for the rate card applied to this account"
     },
     "payment_terms": {
-      "$ref": "https://adcontextprotocol.org/schemas/3.2.0-beta.6/enums/payment-terms.json",
+      "$ref": "../enums/payment-terms.json",
       "description": "Payment terms agreed for this account. Binding for all invoices when the account is active."
     },
     "credit_limit": {
@@ -121,7 +121,7 @@
       "additionalProperties": true
     },
     "account_scope": {
-      "$ref": "https://adcontextprotocol.org/schemas/3.2.0-beta.6/enums/account-scope.json"
+      "$ref": "../enums/account-scope.json"
     },
     "governance_agents": {
       "type": "array",
@@ -149,7 +149,7 @@
       "description": "Cloud storage bucket where the seller delivers offline reporting files for this account. Seller provisions a dedicated bucket or a per-account prefix within a shared bucket, and grants the buyer read access out-of-band. Access MUST be scoped at the IAM layer so each account can only read its own prefix \u2014 bucket-wide grants are non-compliant even with per-account prefixes. Seller MUST revoke access when the account's status transitions to inactive, suspended, or closed. See security considerations for offline delivery in docs/media-buy/media-buys/optimization-reporting. Only present when the seller supports offline delivery (reporting_delivery_methods includes 'offline' in capabilities).",
       "properties": {
         "protocol": {
-          "$ref": "https://adcontextprotocol.org/schemas/3.2.0-beta.6/enums/cloud-storage-protocol.json",
+          "$ref": "../enums/cloud-storage-protocol.json",
           "description": "Cloud storage protocol"
         },
         "bucket": {
@@ -230,22 +230,31 @@
     },
     "notification_configs": {
       "type": "array",
-      "description": "Account-level webhook subscriptions for creative lifecycle/assignment changes, indicators.changed, account status, and wholesale feed changes. Buyers manage entries via sync_accounts and verify persisted state on list_accounts. Indicator and assignment payloads are invalidations repaired completely through get_media_buys; list_creatives may provide a bounded reverse projection. Distinct from per-resource push_notification_config. Entries are keyed by account-scoped subscriber_id; credentials are write-only.",
+      "description": "Account-level webhook subscriptions for creative lifecycle/assignment changes, indicators.changed, account status, wholesale feed changes, and reporting.delivery_ready. Buyers manage entries via sync_accounts and verify persisted state on list_accounts. reporting.delivery_ready is repaired through get_reporting_status; indicator and assignment payloads are repaired through get_media_buys. Entries are keyed by account-scoped subscriber_id; credentials are write-only.",
       "items": {
-        "$ref": "https://adcontextprotocol.org/schemas/3.2.0-beta.6/core/notification-config.json"
+        "$ref": "notification-config.json"
+      },
+      "maxItems": 16
+    },
+    "reporting_delivery_configs": {
+      "type": "array",
+      "x-status": "experimental",
+      "description": "Resolved durable reporting delivery configurations owned by the authenticated caller for this account. list_accounts MUST expose only the calling principal's set. State and seller-issued destination_ref are returned; credentials and bearer profiles MUST NOT appear. Any setup URL is a secret-free authenticated entry point, not a bearer credential.",
+      "items": {
+        "$ref": "reporting-delivery-config-state.json"
       },
       "maxItems": 16
     },
     "webhook_activity": {
       "type": "array",
       "description": "Recent webhook delivery attempts scoped to this account when the caller requested webhook activity on list_accounts and the seller surfaces the log. Includes account-anchored notifications such as account.status_changed and MAY include other account-level fires relevant to this account. Three-state presence follows the shared webhook_activity[] contract: omitted means unsupported or not requested, [] means supported but no retained fires, non-empty lists recent attempts most-recent-first.",
       "items": {
-        "$ref": "https://adcontextprotocol.org/schemas/3.2.0-beta.6/core/webhook-activity-record.json"
+        "$ref": "webhook-activity-record.json"
       },
       "maxItems": 200
     },
     "ext": {
-      "$ref": "https://adcontextprotocol.org/schemas/3.2.0-beta.6/core/ext.json"
+      "$ref": "ext.json"
     }
   },
   "required": [