feat(creative): define delivery and macro resolution contracts by bokelley · Pull Request #6767 · adcontextprotocol/adcp

bokelley · 2026-08-22T08:31:28Z

Summary

add first-class inline, URL, and atomic internal-redirect display tag assets (spec(creative): model inline display tags and paired internal redirects #6761)
add late-bound creative delivery variants with deterministic selection and structured rejections (RFC: preserve one-of creative delivery variants for late seller binding #6762)
require exact VAST asset versions and resolve them against product and seller acceptance sets (spec(creative): reconcile VAST version requirements and compatibility resolution #6763)
define exact decimal file-size units, VAST MediaFile MIME/container/codec/dimension/bitrate/byte requirements, and seller completeness assertions
add occurrence-level macro declarations, dialect identity, translation/value-resolution ownership, exact encoding, capabilities, results, and compatibility vectors (RFC: declare macro dialect, substitution owner, and encoding for creative tags #6764)

Relationship to #6207

This PR deliberately defines the macro-processing primitive without claiming that a product accepts or fires buyer-supplied trackers.

The contracts here answer questions about an individual macro occurrence:

what token and semantic it represents, under which registry namespace and immutable revision
whether the operation is translation, value resolution, or byte-preserving handoff
which actor performs that operation
where the occurrence appears and which value context and encoding depth apply
whether seller-wide and selected-product capabilities close the full processing chain

#6207 is the separate product-level measurement promise. It should answer:

which buyer-supplied tracker asset types are accepted, persisted/rendered, and actually fired
whether tracker firing is client-side, server-side, or mixed where that distinction is material
which macro-processing commitments apply to each honored tracker type
who mints IMPRESSION_ID and whether it is exposed as a delivery/log join key
what accepted, rejected, honored, fired, and substituted evidence is returned to the buyer

The intended integration is for #6207 to reuse the exact macro-resolution-capability tuple and path-addressable macro-resolution-result introduced here, rather than defining a second macro dialect/ownership/encoding model. In particular, its proposed substituted_macros_in_trackers field should either carry or reference those exact capabilities; a universal-macro name alone cannot express vendor/IAB identity, resolver ownership, context, translation, or encoding depth.

The inference rules should remain asymmetric:

macro compatibility does not prove that a tracker will be honored or fired
honored_tracker_assets does not prove that every embedded macro can be processed
omitted RFC: Measurement capability declaration (tracking_capabilities, attribution methodologies, TMP exposure data) #6207 capability remains undeclared, never unsupported
explicit empty support remains distinct from omission

That lets #6764 land as the shared processing vocabulary in 3.2 while #6207, currently targeted to 3.3, can add product discovery, tracker execution, measurement joins, and behavioral evidence without reopening macro semantics.

Related: #6207

Protocol details

treats omitted technical constraints as either explicitly unconstrained or undeclared through technical_requirements_complete; implementations must never silently infer them
evaluates each VAST MediaFile rendition atomically against MIME type, container, codec, dimensions, bitrate, and exact-byte limits
uses governed dialect families (adcp, iab_vast, iab_daast, vendor, unknown) plus qualified namespaces/revisions instead of a closed vendor-name enum
preserves unknown and undeclared legacy token bytes without guessing semantics
separates universal-to-native translation from value resolution and requires downstream capability closure
restricts IAB VAST/DAAST value resolution to the functional request executor
retains format.supported_macros as the legacy validation vocabulary while defining precedence for declared macros and build_creative.macro_values
validates macro-bearing HTTP URLs without weakening authority or percent-escape validation

Expert review

Reviewed iteratively by ad-tech protocol, protocol/schema, and existing-macro-contract specialists. All three final reviews reported no remaining merge blockers.

Verification

npm run build:schemas
node tests/schema-validation.test.cjs (34/34; 851 schemas)
npm run test:schemas
npm run build:compliance -- --check
node --test tests/creative-delivery-contracts.test.cjs tests/universal-macro-translation-vectors.test.cjs (10/10)
node scripts/check-changeset-protocol-scope.cjs origin/main
npx --yes @changesets/cli@^3.0.0 status --since=origin/main
npm run typecheck
git diff --check

The local pre-commit unit gate passed 1,046/1,046 tests. Its repository-wide server-unit phase reached the 600-second local timeout without reporting an assertion failure; CI remains authoritative for that suite. The pre-push compliance matrix passed its signals set, then a sales runner stalled with no CPU or assertion output and was left to CI.

Closes #6761
Closes #6762
Closes #6763
Closes #6764

aao-secretariat

Ladon verdict: Escalate to human review

Escalate — gated paths require human/CODEOWNERS review, and a breaking-class wire change is present.

Why escalate

gated_paths: true (many files under static/schemas/source/**) AND review_decision: REVIEW_REQUIRED (not APPROVED). Per decision-table row 2, this is a hard approval gate that only a real human/CODEOWNERS approval can satisfy.
Independent of the path gate, the repo's constitution treats Breaking-class protocol changes as never auto-approvable. The reviewer flagged that macro-bearing-url.json narrows every existing url asset field to absolute HTTP(S) — a tightening of a published wire shape that can break existing conformant payloads. Ratification is a human act; escalate unless review_decision is APPROVED.

Medium findings (non-blocking, for human reviewers)

static/schemas/source/core/macro-bearing-url.json:16 — narrows all existing url asset fields to absolute HTTP(S) (potential breaking wire-shape tightening).
docs/creative/delivery-variants.mdx:1 — feature's primary doc missing from docs.json navigation.

No critical/high findings were raised, so this is not request-changes. But the deterministic gated-paths gate is unsatisfied and a breaking-class change warrants explicit human sign-off. Once a CODEOWNER approves (review_decision: APPROVED), the gate lifts and a re-run can fall through to the normal table.

Medium findings

static/schemas/source/core/macro-bearing-url.json:16 — macro-bearing-url.json narrows all existing url asset fields to absolute HTTP(S)
docs/creative/delivery-variants.mdx:1 — delivery-variants.mdx missing from docs.json navigation

Why human review

Gated paths: PR modifies files under static/schemas/source/** (e.g. macro-bearing-url.json, error.json, asset schemas) and review_decision is REVIEW_REQUIRED, not APPROVED — human/CODEOWNERS approval required.
Breaking-class protocol change: macro-bearing-url.json narrows all existing url asset fields to absolute HTTP(S), tightening a published wire shape; per the constitution, breaking-class changes require human ratification and are never auto-approved unless review_decision is APPROVED.
This PR touches a path under a hard, non-overridable approval gate (static/schemas/source/core/assets/asset-union.json (modified) matches static/schemas/source/**; static/schemas/source/core/assets/daast-asset.json (modified) matches static/schemas/source/**; static/schemas/source/core/assets/daast-tracker-asset.json (modified) matches static/schemas/source/**; static/schemas/source/core/assets/display-tag-asset.json (added) matches static/schemas/source/**; static/schemas/source/core/assets/html-asset.json (modified) matches static/schemas/source/**; static/schemas/source/core/assets/javascript-asset.json (modified) matches static/schemas/source/**; static/schemas/source/core/assets/pixel-tracker-asset.json (modified) matches static/schemas/source/**; static/schemas/source/core/assets/url-asset.json (modified) matches static/schemas/source/**; static/schemas/source/core/assets/vast-asset.json (modified) matches static/schemas/source/**; static/schemas/source/core/assets/vast-tracker-asset.json (modified) matches static/schemas/source/**; static/schemas/source/core/creative-asset.json (modified) matches static/schemas/source/**; static/schemas/source/core/creative-delivery-variant.json (added) matches static/schemas/source/**; static/schemas/source/core/creative-manifest.json (modified) matches static/schemas/source/**; static/schemas/source/core/creative-source.json (added) matches static/schemas/source/**; static/schemas/source/core/delivery-variant-rejection.json (added) matches static/schemas/source/**; static/schemas/source/core/delivery-variant-selection.json (added) matches static/schemas/source/**; static/schemas/source/core/error.json (modified) matches static/schemas/source/**; static/schemas/source/cor

…(truncated)…

aao-secretariat

Ladon verdict: Escalate to human review

Escalate — gated-path approval required plus breaking-class protocol change.

This PR modifies the protocol source of truth under static/schemas/source/** (40+ files, both added and modified), which places it under a hard, deterministic approval gate. gated_paths: true and review_decision is not APPROVED (unknown/none) — per decision-table row 2 the outcome MUST be escalate until a human/CODEOWNERS approval is recorded.

Independently, the constitution's Breaking-class hard gate applies: macro-bearing-url.json narrows all existing url asset fields to absolute HTTP(S), tightening a published wire shape. Breaking-class changes are never auto-approved; ratification is a human act and requires review_decision: APPROVED.

The current reviewer pass found no new blocking or Medium findings — the delta is a single normative reframing in canonical-formats.mdx:137 (fail-closed, internally coherent). Prior medium findings (macro-bearing-url narrowing; delivery-variants.mdx nav gap) sit in files out of scope for this delta. Net: the diff is clean, but the gate is not satisfied.

Escalation reasons

Gated paths: PR modifies static/schemas/source/** (e.g. macro-bearing-url.json, error.json, asset schemas) and review_decision is not APPROVED — human/CODEOWNERS approval required.
Breaking-class protocol change: macro-bearing-url.json narrows existing url asset fields to absolute HTTP(S), tightening a published wire shape — requires human ratification per the constitution.

Why human review

Gated paths: PR modifies files under static/schemas/source/** (macro-bearing-url.json, error.json, asset schemas, and 40+ others) and review_decision is not APPROVED — human/CODEOWNERS approval required before merge.
Breaking-class protocol change: macro-bearing-url.json narrows all existing url asset fields to absolute HTTP(S), tightening a published wire shape; per the constitution breaking-class changes are never auto-approved and require human ratification unless review_decision is APPROVED.
This PR touches a path under a hard, non-overridable approval gate (static/schemas/source/core/assets/asset-union.json (modified) matches static/schemas/source/**; static/schemas/source/core/assets/daast-asset.json (modified) matches static/schemas/source/**; static/schemas/source/core/assets/daast-tracker-asset.json (modified) matches static/schemas/source/**; static/schemas/source/core/assets/display-tag-asset.json (added) matches static/schemas/source/**; static/schemas/source/core/assets/html-asset.json (modified) matches static/schemas/source/**; static/schemas/source/core/assets/javascript-asset.json (modified) matches static/schemas/source/**; static/schemas/source/core/assets/pixel-tracker-asset.json (modified) matches static/schemas/source/**; static/schemas/source/core/assets/url-asset.json (modified) matches static/schemas/source/**; static/schemas/source/core/assets/vast-asset.json (modified) matches static/schemas/source/**; static/schemas/source/core/assets/vast-tracker-asset.json (modified) matches static/schemas/source/**; static/schemas/source/core/creative-asset.json (modified) matches static/schemas/source/**; static/schemas/source/core/creative-delivery-variant.json (added) matches static/schemas/source/**; static/schemas/source/core/creative-manifest.json (modified) matches static/schemas/source/**; static/schemas/source/core/creative-source.json (added) matches static/schemas/source/**; static/schemas/source/core/delivery-variant-rejection.json (added) matches static/schemas/source/**; static/schemas/source/core/delivery-variant-selection.json (added) matches static/schemas/source/**; static/schemas/source/core/error.json (modified) matches static/schemas/source/**; static/schemas/source/core/macro-bearing-url.json (added) matches static/schemas/source/**; static/schemas/so

…(truncated)…

aao-secretariat

Ladon verdict: Escalate to human review

Escalate — gated-path approval gate unsatisfied.

This PR modifies 40+ files under static/schemas/source/**, which is under a hard, deterministic approval gate (gated_paths: true), and review_decision is REVIEW_REQUIRED, not APPROVED. Per decision-table row 2, the outcome must be escalate until a human/CODEOWNERS approval is recorded.

The reviewer found no critical/high/medium code-correctness issues in the delta: error.details refactored into three named error-detail schemas selected by error code with the base kept as an additionalProperties:true extension point (wire shape unchanged), the uri-template backward-compat branch restored on macro-bearing-url.json, VAST_VERSION_MISMATCH SHOULD→MUST tightened coherently across error-code.json/compliance-error-codes.mdx/video.mdx, tests and model-context budget updated. All $refs resolve, no oneOf discriminator regression, additionalProperties defaults preserved (DR-0009). A changeset is present (.changeset/creative-delivery-contracts.md).

The prior escalation reason concerning macro-bearing-url.json narrowing url fields appears addressed (backward-compat branch restored, wire shape unchanged). However, the gated-path gate independently requires human review, and this touches protocol source of truth including a SHOULD→MUST normative tightening (breaking-class posture). Human/CODEOWNERS review required before merge.

Escalation reasons

Gated paths: PR modifies files under static/schemas/source/** (asset-union.json, error-code.json, macro-* schemas, and 40+ others) and review_decision is REVIEW_REQUIRED, not APPROVED. Human/CODEOWNERS approval required.
Normative tightening (VAST_VERSION_MISMATCH SHOULD→MUST) on published protocol surface — breaking-class changes are never auto-approved without human ratification.

Why human review

Gated paths: PR modifies files under static/schemas/source/** (asset-union.json, error-code.json, macro-* schemas, and 40+ others) and review_decision is REVIEW_REQUIRED, not APPROVED — human/CODEOWNERS approval required before merge.
Normative tightening of VAST_VERSION_MISMATCH from SHOULD to MUST on the published protocol surface is a breaking-class change; per the constitution, breaking-class changes are never auto-approved and require human ratification unless review_decision is APPROVED.
This PR touches a path under a hard, non-overridable approval gate (static/schemas/source/core/assets/asset-union.json (modified) matches static/schemas/source/**; static/schemas/source/core/assets/daast-asset.json (modified) matches static/schemas/source/**; static/schemas/source/core/assets/daast-tracker-asset.json (modified) matches static/schemas/source/**; static/schemas/source/core/assets/display-tag-asset.json (added) matches static/schemas/source/**; static/schemas/source/core/assets/html-asset.json (modified) matches static/schemas/source/**; static/schemas/source/core/assets/javascript-asset.json (modified) matches static/schemas/source/**; static/schemas/source/core/assets/pixel-tracker-asset.json (modified) matches static/schemas/source/**; static/schemas/source/core/assets/url-asset.json (modified) matches static/schemas/source/**; static/schemas/source/core/assets/vast-asset.json (modified) matches static/schemas/source/**; static/schemas/source/core/assets/vast-tracker-asset.json (modified) matches static/schemas/source/**; static/schemas/source/core/creative-asset.json (modified) matches static/schemas/source/**; static/schemas/source/core/creative-delivery-variant.json (added) matches static/schemas/source/**; static/schemas/source/core/creative-manifest.json (modified) matches static/schemas/source/**; static/schemas/source/core/creative-source.json (added) matches static/schemas/source/**; static/schemas/source/core/delivery-variant-rejection.json (added) matches static/schemas/source/**; static/schemas/source/core/

…(truncated)…

aao-secretariat

Ladon verdict: Request changes

Request changes — 1 blocking finding.

Blocking findings

static/schemas/source/core/vast-media-file-requirements.json:79 — New published schema ships additionalProperties: false, contradicting DR-0009's default and every sibling requirement schema. This is a spec-drift / governance-precedent violation on the published protocol surface (static/schemas/source/**), classified high by the reviewer.

Row 1 of the decision table fires: a high finding is present, so the outcome is request-changes regardless of the gated-paths/high-risk state. Fix the schema to omit or set additionalProperties: true per DR-0009 before merge.

Note: this PR also touches gated paths (static/schemas/source/**) with review_decision: REVIEW_REQUIRED, so even once the high finding is resolved, human/CODEOWNERS approval will be required before this can proceed (the prior escalate). The reviewer credits the delta since the prior run for correct minor changeset scope, schema↔docs coherence, and no dist/** or oneOf regressions.

Blocking findings

static/schemas/source/core/vast-media-file-requirements.json:79 — New published schema closes additionalProperties, contradicting DR-0009

aao-secretariat

Ladon verdict: Escalate to human review

Escalate — gated paths touched without approving review.

This delta pass has no blocking or medium findings: the prior high finding (vast-media-file-requirements.json:79 closing additionalProperties, contradicting DR-0009) is resolved. The schema now flips additionalProperties back to true, restoring the DR-0009 default of extension-carrying published schemas, and a regression test in creative-delivery-contracts.test.cjs asserts a vendor_extension key still validates. Both delta files are clean; nothing new was flagged.

However, this PR modifies numerous files under static/schemas/source/**, which are under a hard, deterministic approval gate (gated_paths: true). review_decision is CHANGES_REQUESTED, not APPROVED, so the gate is not satisfied (decision-table row 2). In addition, this is a large protocol-surface change (new schemas, enums, error codes, error-details) that classifies as Normative/Breaking-class protocol work — ratification is a human act per the constitution's hard gate. Human/CODEOWNERS review is required before this can merge.

Escalation reasons below list the gated files requiring human review.

Why human review

Gated paths under static/schemas/source/** are modified/added but review_decision is CHANGES_REQUESTED, not APPROVED — a human/CODEOWNERS approval is required to satisfy the hard schema-source approval gate.
Protocol-surface change (new schemas, enums, error codes, error-details, canonical formats) constitutes normative/breaking-class spec work whose ratification is a human act per the constitution — cannot auto-merge without an approving human review.
This PR touches a path under a hard, non-overridable approval gate (static/schemas/source/core/assets/asset-union.json (modified) matches static/schemas/source/**; static/schemas/source/core/assets/daast-asset.json (modified) matches static/schemas/source/**; static/schemas/source/core/assets/daast-tracker-asset.json (modified) matches static/schemas/source/**; static/schemas/source/core/assets/display-tag-asset.json (added) matches static/schemas/source/**; static/schemas/source/core/assets/html-asset.json (modified) matches static/schemas/source/**; static/schemas/source/core/assets/javascript-asset.json (modified) matches static/schemas/source/**; static/schemas/source/core/assets/pixel-tracker-asset.json (modified) matches static/schemas/source/**; static/schemas/source/core/assets/url-asset.json (modified) matches static/schemas/source/**; static/schemas/source/core/assets/vast-asset.json (modified) matches static/schemas/source/**; static/schemas/source/core/assets/vast-tracker-asset.json (modified) matches static/schemas/source/**; static/schemas/source/core/canonical-format-option.json (modified) matches static/schemas/source/**; static/schemas/source/core/creative-asset.json (modified) matches static/schemas/source/**; static/schemas/source/core/creative-delivery-variant.json (added) matches static/schemas/source/**; static/schemas/source/core/creative-manifest.json (modified) matches static/schemas/source/**; static/schemas/source/core/creative-source.json (added) matches static/schemas/source/**; static/schemas/source/core/delivery-variant-rejection.json (added) matches static/schemas/source/**; static/schemas/source/core/delivery-variant-selection.json (added) matches static/schemas/source/**; static/schemas/source/core/macro-bearing-url.json (added) matches static/schemas/source/**; static/schemas/source/core/macro-declaration.json (added) matches static/schemas/source/**; static/schemas/source/core/macro-encoding.json (added) matches static/schemas/source/**; static/schemas/source/core/macro-resolution-capability.json (added) matches static/schemas/source/**; static/schemas/source/core/macro-resolution-result.json (added) matches static/schemas/source/**; static/schemas/source/core/macro-translation

…(truncated)…

bokelley · 2026-08-22T10:43:32Z

Addressed the remaining DR-0009 must-fix in 7adff6f: the nested VAST MediaFile requirements object is extension-carrying (additionalProperties: true) and has regression coverage. The thread is resolved and all 50 checks are green, including current /sales storyboards. Ready for re-review.

…y-rules # Conflicts: # package.json

bokelley · 2026-08-22T15:18:18Z

All review findings are addressed in 1613da7, including the VAST technical acceptance follow-up (exact byte units, MediaFile delivery/MIME/container/codec/dimensions/bitrate/maximum bytes, explicit omission semantics, and completeness guarantees). The branch now includes origin/main.

Validation completed locally: all 856 schemas, 9 focused creative-delivery contracts, 6,390 server tests, typecheck, current 3.2 storyboard matrix, released 3.0 compatibility matrix, docs navigation, compliance generation, and diff checks. Three independent protocol/code reviewers report no remaining blocker/high findings, and all GitHub review threads are resolved. Requesting the required human schema-source approval while fresh CI runs.

aao-secretariat

Ladon verdict: Escalate to human review

Escalate — hard schema-source approval gate unsatisfied.

This PR modifies/adds numerous files under static/schemas/source/**, which are under a hard, non-overridable approval gate (gated_paths: true). The current GitHub review decision is CHANGES_REQUESTED, not APPROVED, so decision-table row 2 fires: the gate is not satisfied and the outcome must be escalate.

Additionally, this is a protocol-surface change (new schemas, enums, error codes, error-details, canonical formats, VAST MediaFile delivery methods, new capabilities). Per the constitution's hard gate, normative/breaking-class spec work requires human ratification and cannot auto-merge without an approving human review.

Reviewer findings: No blocking or Medium findings. Schema↔docs coherence, changeset scope/type (three minor changesets covering the wire surface), oneOf disjointness, and the normative async-identity/convergence contract are all sound. The clean diff does not lift the gate — only a recorded human/CODEOWNERS APPROVED review does.

Escalation reasons:

Gated paths under static/schemas/source/** are modified/added while review_decision is CHANGES_REQUESTED — human/CODEOWNERS approval required.
Protocol-surface/normative spec change requiring human ratification per the constitution's breaking-class hard gate.

Prior decision was also escalate for the same gate reasons; this remains sticky solely due to the unsatisfied hard gate, not new findings.

Why human review

Gated paths under static/schemas/source/** are modified/added but review_decision is CHANGES_REQUESTED, not APPROVED — a human/CODEOWNERS approval is required to satisfy the hard schema-source approval gate.
Protocol-surface change (new schemas, enums, error codes, error-details, canonical formats) is normative/breaking-class spec work whose ratification is a human act per the constitution — cannot auto-merge without an approving human review.
This PR touches a path under a hard, non-overridable approval gate (static/schemas/source/core/assets/asset-union.json (modified) matches static/schemas/source/**; static/schemas/source/core/assets/daast-asset.json (modified) matches static/schemas/source/**; static/schemas/source/core/assets/daast-tracker-asset.json (modified) matches static/schemas/source/**; static/schemas/source/core/assets/display-tag-asset.json (added) matches static/schemas/source/**; static/schemas/source/core/assets/html-asset.json (modified) matches static/schemas/source/**; static/schemas/source/core/assets/javascript-asset.json (modified) matches static/schemas/source/**; static/schemas/source/core/assets/pixel-tracker-asset.json (modified) matches static/schemas/source/**; static/schemas/source/core/assets/url-asset.json (modified) matches static/schemas/source/**; static/schemas/source/core/assets/vast-asset.json (modified) matches static/schemas/source/**; static/schemas/source/core/assets/vast-tracker-asset.json (modified) matches static/schemas/source/**; static/schemas/source/core/canonical-format-option.json (modified) matches static/schemas/source/**; static/schemas/source/core/creative-asset.json (modified) matches static/schemas/source/**; static/schemas/source/core/creative-delivery-variant.json (added) matches static/schemas/source/**; static/schemas/source/core/creative-manifest.json (modified) matches static/schemas/source/**; static/schemas/source/core/creative-source.json (added) matches static/schemas/source/**; static/schemas/source/core/delivery-variant-rejection.json (added) matches static/schemas/source/**; static/schemas/source/core/delivery-variant-selection.json (added) matches static/schemas/source/**; static/schemas/source/core/macro-bearing-url.json (added) matches static/schemas/source/**; static/schemas/source/core/macro-declaration.json (added) matches static/schemas/source/**; static/schemas/source/core/

…(truncated)…

aao-secretariat

Ladon verdict: Escalate to human review

Escalate — hard schema-source approval gate not satisfied, plus breaking-class protocol surface change requiring human ratification.

This PR touches many files under static/schemas/source/**, which are under a hard, non-overridable approval gate (gated_paths: true). The current review_decision is CHANGES_REQUESTED, not APPROVED, so the gate is not satisfied (decision table row 2).

The reviewer surfaced no critical/high/medium findings this run — the delta since the prior pass (vast-version-mismatch.json oneOf→anyOf on provably-disjoint arms; a compliance fixture adding vast_version: "4.0") is clean. But a clean diff does not lift the gate: it lifts only when a human/CODEOWNERS approval is recorded. This is a normative/breaking-class protocol surface change (new core schemas, enums, error codes, error-details, canonical formats) whose ratification is a human act per the constitution's "Breaking-class changes are never auto-approved" rule.

No blocking code findings; the block is the unsatisfied approval gate. A human/CODEOWNERS approval on the PR will clear this.

Escalation reasons:

Gated paths under static/schemas/source/** modified/added but review_decision is CHANGES_REQUESTED, not APPROVED — human/CODEOWNERS approval required.
Breaking-class / normative protocol-surface change (new schemas, enums, error codes, error-details, canonical formats) — ratification is a human act; never auto-approved.