Take pympp 0.10.0, fix an unusable Stripe SPT example, release 2.5.17 (#106)

## Summary

Three things, all evidence-driven rather than precautionary.

**pympp 0.9.1 to 0.10.0**, inside the declared `>=0.6,<1` range. The
initial instinct was to pin under it, since pympp sits on the MPP settle
path and 0.10.0 rewrites the Tempo intent validators from calldata
length checks to real ABI decoding. What settled it against pinning:

- The executable pympp surface in this package is exactly two imports,
`Receipt` and `Credential`. Both resolve on 0.10.0.
- The full suite passes identically on 0.9.1 and 0.10.0, same 1841
tests, same 95.36% coverage.
- On the Tempo side, `client.py`, `account.py` and `__init__.py` are
**byte-identical** between the two releases, so no signing or
domain-separation behavior moved. This is not the mppx-0.8.0 class of
change that binds agent, verifier and merchants together.

**A Stripe SPT example that could never have worked.** The `mppx_stripe`
module docstring told merchants to write `from mpp.server import Mppx`
and `Mppx.create(methods=[...])`. `Mppx` has never existed in any pympp
release (checked 0.9.1 and 0.10.0 sources directly), and `Mpp.create`
takes a single `method` rather than a list, so a merchant copying the
example hit `ImportError` on the first line and then an API shape that
does not exist. Corrected against the installed package and pympp's own
README, with the docstring's imports executed to prove they resolve. The
working code in `mppx_server.py` was always correct; only the example
was wrong.

**agentscore-py 2.6.3**, published minutes before this branch was
finalized.

## Type of change

- [x] Bug fix (no breaking change)
- [ ] New feature (no breaking change)
- [ ] Breaking change (existing callers must update)
- [ ] Docs, tests, or internal maintenance only

## Public API

None changed. No exported symbol, submodule, or wire shape moved.

The observable changes for a merchant are the `agentscore-py` floor and
the version bump. The docstring correction changes documentation only,
but it is worth calling out for anyone who copied the old example: `from
mpp.server import Mppx` becomes `from mpp.server import Mpp`, and
`Mpp.create` takes `method=` (singular) rather than `methods=[...]`, so
a merchant accepting Stripe SPT alongside another rail builds one `Mpp`
per method. That was already true of the shipped behavior; the docs just
described something else.

## Test plan

- `uv sync --all-extras --all-groups --upgrade`, then the full gate set:
- `uv run ruff check .` all checks passed
- `uv run ruff format --check .` 215 files already formatted
- `uv run ty check agentscore_commerce/` all checks passed
- `uv run pytest tests/`: 1841 passed, 4 skipped, 95.36% coverage (gate
is 95%)
- osv-scanner v2.4.0 over `uv.lock`: no issues found

Baseline captured on 0.9.1 before the bump, so the "identical" claim is
a comparison rather than an assertion. The docstring fix was verified by
parsing the docstring out of the module and executing its import lines
against the installed package, not by reading it.

`uv.lock` was re-locked after the version bump, because it embeds the
project's own version and a bare `pyproject.toml` bump leaves the two
files disagreeing with nothing to catch it.

## Checklist

- [x] Tests cover the new behavior, and the suite passes locally
- [x] Lint, format, and type checks pass
- [x] Docs and README examples updated if the public surface changed
- [x] No secrets, credentials, or personal data in the diff or the tests

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: vvillait88

agentscore_commerce/stripe_multichain/mppx_stripe.py

@@ -1,21 +1,24 @@
 """Stripe SPT method wrapper for ``pympp`` server merchants.
 
 Wraps the ``mpp.methods.stripe.charge(...)`` boilerplate so vendors only declare config,
-not method instantiation. Returns the value vendors pass into ``Mppx.create(methods=[...])``.
+not method instantiation. Returns the value vendors pass into ``Mpp.create(method=...)``.
+
+``Mpp.create`` takes ONE method per server, so a merchant accepting Stripe SPT alongside
+another rail builds a separate ``Mpp`` per method rather than passing a list. This mirrors
+what ``create_mppx_server`` does.
 
 Example::
 
-    from mpp.server import Mppx
-    from mpp.methods.tempo import charge as tempo_charge
+    from mpp.server import Mpp
     from agentscore_commerce.stripe_multichain import create_mppx_stripe
 
     stripe_method = await create_mppx_stripe(
         profile_id=os.environ["STRIPE_PROFILE_ID"],
         secret_key=os.environ["STRIPE_SECRET_KEY"],
     )
 
-    mpp = Mppx.create(
-        methods=[tempo_charge(currency=USDC_TEMPO, recipient=...), stripe_method],
+    stripe_server = Mpp.create(
+        method=stripe_method,
         secret_key=os.environ["MPP_SECRET_KEY"],
     )
 
@@ -36,7 +39,7 @@ async def create_mppx_stripe(
     secret_key: str,
     payment_method_types: list[str] | None = None,
 ) -> Any:
-    """Build the Stripe SPT method instance for ``Mppx.create(methods=[...])``.
+    """Build the Stripe SPT method instance for ``Mpp.create(method=...)``.
 
     Args:
         profile_id: Stripe profile_id / network_id advertised in your ``stripe/charge``

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "agentscore-commerce"
-version = "2.5.16"
+version = "2.5.17"
 description = "Agentic commerce SDK for Python: identity middleware (FastAPI, Flask, Django, AIOHTTP, Sanic, ASGI) + payment helpers + 402 builders + discovery + Stripe multichain. The full merchant-side toolkit for AgentScore-powered agentic commerce."
 readme = "README.md"
 license = "MIT"