feat: implement durable legacy purchase continuation coordinator for AdCP 3.2

[bokelley]

Context

Protocol follow-up to adcp#6716 and adcp#6733.

AdCP 3.2 splits legacy compound media-buy operations across compact lifecycle tasks. The protocol now defines the compatibility coordinator input and the exact failure/atomicity contract, including products-only brief continuation and legacy inline-creative behavior.

Scope

Implement the Go SDK-local coordinator API: an idiomatic equivalent of ContinueLegacyPurchase(CompatibilityPurchaseCoordinatorInput).

• Consume the exact signed 3.2.0-beta.4 schema artifact once published.
• Provide a durable, pluggable continuation store.
• Bind continuations to principal, account, source protocol version, expiry, the full request payload, selected products/packages, and any listed-purchase context.
• Enforce atomic single-use claim, deterministic replay, fail-closed crash reconciliation, and the protocol's exact loss/error reporting.
• Support the products-only brief path and the reverse compact-seller → legacy-buyer facade where this SDK exposes server-side adapters.
• Keep operational controls distinct from commercial-term proposal successors.
• Run the shared products-only-brief-compatibility vectors from the beta.4 protocol bundle.

Acceptance criteria

• Coordinator API and durable-store interface are public and documented.
• Concurrent claims cannot purchase twice.
• Retry after success returns the deterministic prior result.
• Ambiguous/crashed claims fail closed and expose recovery guidance.
• Principal/account/version/expiry/payload mismatches are rejected.
• Shared beta.4 compatibility vectors pass.
• Migration guidance explains what remains application-owned.

Blocked until adcp#6733 merges and the signed 3.2.0-beta.4 artifact is available.

[bokelley]

Triage

Classification: Feature request (new coordinator API surface)
Bucket(s): cross-repo (adcp#6733 / AdCP 3.2 spec), sdk, tmpclient
Status: deferred — blocked on adcontextprotocol/adcp#6733 (protocol spec PR) and the signed 3.2.0-beta.4 schema artifact

Blocked-on: adcontextprotocol/adcp#6733 — resurfaces on merge

What the experts said:

• security-reviewer: durable purchase-state store widens the TEE pinhole (full payload/products/principal data written to external storage), single-use claim needs an atomic claim+void FSM that is structurally different from the existing PutIfAbsent replay pattern, compact-seller→legacy-buyer facade is a confused-deputy risk without explicit principal forwarding — human security design review required before implementation starts, even once the upstream block clears
• ad-tech-protocol-expert: compact lifecycle task split is a coherent evolution from the current single-step create_media_buy model; however, the atomicity contract for a multi-task purchase flow that can partially succeed is the load-bearing spec gap — it must be fully defined in adcp#6733 before any Go SDK implementation can be correct; the structural question of whether CompatibilityPurchaseCoordinatorInput is a new top-level tool registration or an augmented input to an existing one must be explicitly resolved in the spec PR
• code-reviewer: pluggable durable-store interface mirrors the existing idempotency.Backend pattern and is sound Go design, but CompatibilityPurchaseCoordinatorInput must be generated from the signed beta.4 JSON schema (not hand-written), and the three-state FSM requirement (pending/committed/failed) for atomic single-use claim is semantically distinct from PutIfAbsent replay — conflating them would be a correctness footgun

My take: This is a well-scoped protocol implementation task but cannot move forward until adcp#6733 merges and the signed 3.2.0-beta.4 schema artifact is published. Once unblocked, the security surface (TEE pinhole expansion via external durable store, atomic claim design, confused-deputy risk in the compact-seller→legacy-buyer facade) warrants a human security design review at the start of implementation before any code is written.

Note: cross-repo and tmpclient scope labels are not present in this repo's label set and could not be applied — bucket noted here instead.

---

Triaged by Claude Code. Session: https://claude.ai/code/

---

Generated by Claude Code

[bokelley]

Queue update: the upstream protocol blocker is cleared and PR #483 implements the in-memory coordinator core, but it is held on a principal-binding review finding. #466 remains open intentionally because #483 does not deliver the persistent backend or reverse compatibility facade; those remain tracked in #482.