Take pympp 0.10.0, fix an unusable Stripe SPT example, release 2.5.17

[vvillait88]

Summary

Three things, all evidence-driven rather than precautionary.

pympp 0.9.1 to 0.10.0, inside the declared >=0.6,<1 range. The initial instinct was to pin under it, since pympp sits on the MPP settle path and 0.10.0 rewrites the Tempo intent validators from calldata length checks to real ABI decoding. What settled it against pinning:

• The executable pympp surface in this package is exactly two imports, Receipt and Credential. Both resolve on 0.10.0.
• The full suite passes identically on 0.9.1 and 0.10.0, same 1841 tests, same 95.36% coverage.
• On the Tempo side, client.py, account.py and __init__.py are byte-identical between the two releases, so no signing or domain-separation behavior moved. This is not the mppx-0.8.0 class of change that binds agent, verifier and merchants together.

A Stripe SPT example that could never have worked. The mppx_stripe module docstring told merchants to write from mpp.server import Mppx and Mppx.create(methods=[...]). Mppx has never existed in any pympp release (checked 0.9.1 and 0.10.0 sources directly), and Mpp.create takes a single method rather than a list, so a merchant copying the example hit ImportError on the first line and then an API shape that does not exist. Corrected against the installed package and pympp's own README, with the docstring's imports executed to prove they resolve. The working code in mppx_server.py was always correct; only the example was wrong.

agentscore-py 2.6.3, published minutes before this branch was finalized.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

None changed. No exported symbol, submodule, or wire shape moved.

The observable changes for a merchant are the agentscore-py floor and the version bump. The docstring correction changes documentation only, but it is worth calling out for anyone who copied the old example: from mpp.server import Mppx becomes from mpp.server import Mpp, and Mpp.create takes method= (singular) rather than methods=[...], so a merchant accepting Stripe SPT alongside another rail builds one Mpp per method. That was already true of the shipped behavior; the docs just described something else.

Test plan

• uv sync --all-extras --all-groups --upgrade, then the full gate set:
• uv run ruff check . all checks passed
• uv run ruff format --check . 215 files already formatted
• uv run ty check agentscore_commerce/ all checks passed
• uv run pytest tests/: 1841 passed, 4 skipped, 95.36% coverage (gate is 95%)
• osv-scanner v2.4.0 over uv.lock: no issues found

Baseline captured on 0.9.1 before the bump, so the "identical" claim is a comparison rather than an assertion. The docstring fix was verified by parsing the docstring out of the module and executing its import lines against the installed package, not by reading it.

uv.lock was re-locked after the version bump, because it embeds the project's own version and a bare pyproject.toml bump leaves the two files disagreeing with nothing to catch it.

Checklist

• Tests cover the new behavior, and the suite passes locally
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed
• No secrets, credentials, or personal data in the diff or the tests