feat: add affiliate attribution extension

[0xtotaylor]

Enhancement Proposal: Affiliate Attribution Extension

Status	Provisional
Author	@0xtotaylor
RFC	rfcs/affiliate-attribution.md

Summary

This proposal extends POST /checkout-sessions/{id}/complete to accept an optional affiliate_attribution object, enabling agents to transmit fraud-resistant attribution claims for crediting third-party publishers without relying on cookies, redirects, or client-side tracking.

Type of change

• Enhancement Proposal (new capability/extension per GOVERNANCE.md)

Proposal Contents

Per the Enhancement Proposal process, the RFC (rfcs/affiliate-attribution.md) includes:

• Summary
• Motivation
• Detailed Design
• Risks
• Test Plan
• Graduation Criteria

Implementation

This PR also includes a complete implementation ready to merge once the proposal reaches Implementable status:

• source/schemas/shopping/affiliate_attribution.json — Extension schema
• docs/specification/affiliate-attribution.md — Specification documentation
• mkdocs.yml — Navigation updates

Checklist

• RFC document follows Enhancement Proposal template
• Implementation aligns with RFC detailed design
• Documentation complete
• Schema validation passes
• mkdocs build --strict passes

Requested Action

Requesting TC review to advance from Provisional → Implementable.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[jingyli]

Thank you for your contribution to the Universal Commerce Protocol!

While we appreciate your enthusiasm for UCP, similarly to the response in #11 (comment), this doesn't align with our process for Enhancement proposals. We encourage you to explore either submitting a formal proposal for TC review or implementing this as a vendor specific extension and have it live & hosted on your own domain so they can be referenced in the profile as long as it follows UCP's governance model.