feat: address PR review — extend Cart, tighten schema constraints, add privacy note

- Extend attribution to Cart in addition to Checkout (following discount pattern)
- Add minProperties: 1 on dedup_keys to prevent empty objects
- Constrain custom values to string/number/boolean with maxProperties: 20
- Strengthen platform field from SHOULD to MUST match agent profile URL
- Add Privacy Note section to docs

Author: jamesandersen

docs/specification/attribution.md

@@ -35,7 +35,7 @@ via URL parameters on their landing page. This extension preserves that data.
 
 **Dependencies:**
 
-- Checkout Capability
+- Cart Capability or Checkout Capability
 
 ## Discovery
 
@@ -47,6 +47,12 @@ Businesses advertise attribution support in their profile:
     "version": "{{ ucp_version }}",
     "capabilities": {
       "dev.ucp.shopping.attribution": [
+        {
+          "version": "{{ ucp_version }}",
+          "extends": "dev.ucp.shopping.cart",
+          "spec": "https://ucp.dev/{{ ucp_version }}/specification/attribution",
+          "schema": "https://ucp.dev/{{ ucp_version }}/schemas/shopping/attribution.json"
+        },
         {
           "version": "{{ ucp_version }}",
           "extends": "dev.ucp.shopping.checkout",
@@ -61,33 +67,34 @@ Businesses advertise attribution support in their profile:
 
 ## Schema Composition
 
-The attribution extension extends the **checkout object** directly:
+The attribution extension extends both **cart** and **checkout** objects:
 
-- **Base schema extended**: `checkout.json`
-- **Path**: `checkout.attribution`
+- **Base schemas extended**: `cart.json`, `checkout.json`
+- **Path**: `cart.attribution`, `checkout.attribution`
 - **Schema reference**: `attribution.json`
 
-The `attribution` property is composed onto the checkout object via `allOf`,
+The `attribution` property is composed onto each object via `allOf`,
 following the same extension pattern as `fulfillment.json` and `discount.json`.
 
 ## Schema Definition
 
 ### Attribution Payload
 
 The `attribution` object contains referral context from the platform that drove
-the checkout:
+the cart or checkout:
 
 | Field         | Type   | Required | Description                                                                                          |
 |---------------|--------|----------|------------------------------------------------------------------------------------------------------|
 | `platform`    | string | Yes      | Referring platform identifier using reverse domain naming (e.g., `com.google`, `com.meta`)           |
 | `dedup_keys`  | object | No       | Deduplication keys for reconciling with the merchant's server-side reporting                         |
 | `utm`         | object | No       | Standard UTM parameters for web analytics compatibility                                              |
-| `custom`      | object | No       | Platform-specific key-value pairs routed by the merchant based on the `platform` field               |
+| `custom`      | object | No       | Platform-specific key-value pairs routed by the merchant based on the `platform` field. Values MUST be string, number, or boolean. Maximum 20 properties. |
 
 ### Deduplication Keys
 
 The `dedup_keys` object prevents double-counting when both the referring
-platform and the merchant report the same transaction independently:
+platform and the merchant report the same transaction independently. If
+present, at least one key MUST be provided:
 
 | Field        | Type   | Description                                                                            |
 |--------------|--------|----------------------------------------------------------------------------------------|
@@ -118,6 +125,25 @@ The `attribution` property supports the following operations:
 | `update`   | `optional` | Platform MAY update attribution              |
 | `complete` | `optional` | Platform MAY include attribution on complete |
 
+## Privacy Note
+
+This extension replaces attribution and conversion signals that traditionally
+flow from the referring platform to the business via the merchant's website.
+When a purchase occurs through an agentic flow, the website is bypassed and
+these signals would otherwise be lost. While the fields primarily carry
+marketing and campaign metadata, some values — such as click identifiers and
+session identifiers in `dedup_keys` or `custom` — may be considered advertising
+data subject to user consent under applicable privacy regulations.
+
+Implementations **MUST**:
+
+- Only use attribution data for the purposes of conversion measurement,
+  reporting, and attribution
+- **NOT** transmit personally identifiable information (e.g., email addresses,
+  phone numbers, names) through any field in this extension
+- Comply with applicable consent requirements for advertising and marketing
+  data in the jurisdictions where they operate
+
 ## Usage Examples
 
 ### Google (Google Ads / Gemini)

source/schemas/shopping/attribution.json

@@ -3,20 +3,21 @@
   "$id": "https://ucp.dev/schemas/shopping/attribution.json",
   "name": "dev.ucp.shopping.attribution",
   "title": "Attribution Extension",
-  "description": "Extends Checkout with attribution support, enabling referring platforms to pass attribution data and deduplication keys through agentic checkout flows.",
+  "description": "Extends Cart and Checkout with attribution support, enabling referring platforms to pass attribution data and deduplication keys through agentic checkout flows.",
   "$defs": {
     "attribution_payload": {
       "type": "object",
       "required": ["platform"],
       "properties": {
         "platform": {
           "$ref": "types/reverse_domain_name.json",
-          "description": "Referring platform identifier (reverse domain naming). SHOULD correspond to the domain of the platform's UCP-Agent profile URL.",
+          "description": "Referring platform identifier (reverse domain naming). MUST correspond to the domain of the platform's UCP-Agent profile URL.",
           "examples": ["com.google", "com.meta", "com.tiktok", "com.openai"]
         },
         "dedup_keys": {
           "type": "object",
           "description": "Deduplication keys for reconciling this event with the merchant's own server-side reporting. Without these, the same transaction may be counted twice in analytics and reporting platforms.",
+          "minProperties": 1,
           "properties": {
             "event_id": { "type": "string", "description": "Shared dedup key. The merchant includes this same event_id when reporting the event via their server-side integration (e.g., CAPI, Enhanced Conversions, Events API) to prevent double-counting." },
             "session_id": { "type": "string", "description": "Platform session identifier for cross-event correlation (e.g., fbp, ga_session_id)." }
@@ -37,10 +38,35 @@
         "custom": {
           "type": "object",
           "description": "Platform-specific key-value pairs not covered by the structured fields above. Merchants pass these through to their analytics integrations based on the platform field.",
-          "additionalProperties": true
+          "additionalProperties": {
+            "type": ["string", "number", "boolean"]
+          },
+          "maxProperties": 20
         }
       }
     },
+    "dev.ucp.shopping.cart": {
+      "title": "Cart with Attribution",
+      "description": "Cart extended with referral attribution.",
+      "allOf": [
+        {
+          "$ref": "cart.json"
+        },
+        {
+          "type": "object",
+          "properties": {
+            "attribution": {
+              "$ref": "#/$defs/attribution_payload",
+              "description": "Referral attribution data from the platform that drove the cart.",
+              "ucp_request": {
+                "create": "optional",
+                "update": "optional"
+              }
+            }
+          }
+        }
+      ]
+    },
     "dev.ucp.shopping.checkout": {
       "title": "Checkout with Attribution",
       "description": "Checkout extended with referral attribution.",