Release 3.0.0: A2A 1.0 agent cards, UCP 2026-08-25 profiles, MPP payment offers

[vvillait88]

Summary

Mirrors node-commerce 3.0.0 (agentscore/node-commerce#141). Requested by Varun after a report that our A2A cards were out of date; a sweep of every hand-written format found two more.

• A2A agent card. The card declared protocol 1.0 but carried the 0.3 shape. to_dict() now emits A2A 1.0 (specification/a2a.proto at v1.0.1): the required supportedInterfaces[] (url, protocolBinding, protocolVersion), the extended-card flag in capabilities.extendedAgentCard, and securityRequirements in place of security on the card and on skills. build_a2a_agent_card keeps url, preferred_transport, additional_interfaces and security as inputs. The UCP extension URI moves to 2026-08-25.
• UCP profile. UCP 2026-08-25 removed signing_keys and made keys (a JWK Set) the one canonical field. The profile publishes keys at version 2026-08-25; build_ucp_profile(keys=...), with signing_keys still accepted. supported_versions is no longer published.
• MPP payment discovery. x-payment-info now also carries MPP's offers[] (integer amount in the rail's smallest unit, None when dynamic) beside the x402scan price and protocols. New offers_from.
• Dependency sweep, in the same release. Relocked (markupsafe 3.0.4, tzdata 2026.5) and the uv CLI workflow input moves to 0.12.23. The capped requirements (x402, pympp, redis, cdp-sdk, joserfc, httpx, stripe) all lock at PyPI latest, no prerelease is locked, and OSV over uv.lock (157 packages) is clean.
• A real guard. tests/test_a2a_canonical.py parses the built card as the official A2A AgentCard protobuf from a2a-sdk (added as a dev dependency only), which refuses any field the spec does not define, plus the negative case on a 0.3-shaped card.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

• Card JSON: url, preferredTransport, protocolVersion, additionalInterfaces, supportsAuthenticatedExtendedCard, security removed; supportedInterfaces, securityRequirements added.
• build_a2a_agent_card: state_transition_history and supports_authenticated_extended_card removed; extended_agent_card added. A2AAgentCardCapabilities follows the same rename.
• UCPProfile.signing_keys becomes keys; build_ucp_profile(keys=...), signing_keys still accepted.
• well_known_ucp_url on build_signed_ucp_response and the mount_ucp_routes_* methods becomes optional and is ignored.
• New exports: offers_from, to_security_requirements. Version 3.0.0.

Test plan

• Updated the A2A and UCP tests for the new shapes, including a test that none of the removed 0.3 fields appear.
• New: MPP offers per rail through x_payment_info_from_checkout, and the protobuf guard with its negative case.
• uv run ruff check ., uv run ruff format --check ., uv run ty check agentscore_commerce/, uv run vulture . --min-confidence 80 --exclude .venv, uv run pytest tests (1891 passed, coverage 95.41% against the 95% gate).

What this deliberately does not do: release the package or move core's store, which takes 3.0.0 separately.

Checklist

• Tests cover the new behavior, and the suite passes locally
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed
• No secrets, credentials, or personal data in the diff or the tests