Clean room and log-level delivery for reporting (3.1)

[bokelley]

Problem

AdCP reporting today supports three delivery methods:

• Polling — buyer calls get_media_buy_delivery on their schedule
• Webhook push — seller POSTs aggregated metrics to buyer endpoint
• Offline file delivery — seller pushes batch files (JSONL/CSV/Parquet) to cloud storage buckets

All three deliver aggregated metrics (impressions, spend, clicks, etc. rolled up by package, geo, device, etc.).

Large buyer-seller relationships — especially in CTV, retail media, and cross-platform measurement — need log-level data shared into clean rooms for:

• Cross-publisher frequency management and deduplication
• Attribution modeling across walled gardens
• Audience overlap analysis without exposing PII
• Custom measurement and incrementality studies
• Retailer closed-loop reporting (matching ad exposure to purchase data)

This is a fundamentally different data shape and trust model from aggregated reporting.

Scope

Log-Level Delivery (LLD)

• Define what "log-level" means in AdCP context (impression logs, not user-level PII)
• Schema for log-level records (timestamp, impression_id, package_id, creative_id, geo, device, hashed identifiers)
• Privacy controls: which fields are included, minimum aggregation thresholds, differential privacy options
• Delivery configuration surface on create_media_buy (parallel to reporting_webhook and offline_delivery_config)
• Product-level capability declaration (supports_log_level_delivery)

Clean Room Integration

• Configuration for supported clean room providers (Snowflake Clean Rooms, Habu, InfoSum, AWS Clean Rooms, LiveRamp Data Collaboration)
• Clean room destination config on create_media_buy — where to send data and under what terms
• Data collaboration agreements: what queries are permitted, what outputs are allowed
• Integration with existing measurement_terms for who pays for clean room costs

Capability Declaration

• Product-level: supports_log_level_delivery, supported_clean_rooms, lld_available_fields
• Capabilities-level: whether to add clean room support as a media_buy feature flag

Non-Goals (for now)

• Real-time bidstream data sharing (that's TMP territory)
• Building a clean room — we're defining the configuration protocol, not the infrastructure
• Replacing aggregated reporting — LLD is additive, not a replacement

Dependencies

• Offline file delivery formalization (done — supports_offline_delivery + offline_delivery_config added in current PR)
• Privacy/consent framework alignment (existing PII scrubbing rules extend here)

Open Questions

• Should clean room config live at the media buy level or the account level? (Account level makes more sense for ongoing relationships)
• How do we handle clean room costs in measurement_terms? Fixed fee? Per-query? Per-record?
• Do we need a standard field schema for LLD records, or is this inherently publisher-specific?
• How does this interact with data-protection-roles (controller/processor) from TMP?