feat(protocol): draft account change feed

[bokelley]

Summary

• define source-neutral authoritative reads: seller UI, seller systems, connected platforms, and AdCP writes converge on the same current-state surfaces
• add the draft list_account_changes durable account feed, account.change_recorded wake-up, capability declaration, cursor-expiry recovery, privacy boundary, and 90-day retention floor
• add a shared-account learning lab, capability-gated compliance scenario, and training-agent reference implementation

RFC/epic: #6810

Why a new feed

webhook_activity[] is delivery-attempt diagnostics, task history covers AdCP operations, and snapshots only answer current state. None can durably enumerate changes made while the buyer is idle. The feed is ordered metadata plus a safe repair-read hint; authoritative reads remain current truth.

Scope boundary

The completeness claim covers committed material changes to account-scoped control-plane fields recoverable through an advertised authoritative read. It excludes raw audience members/events, per-impression delivery accumulation, naturally moving forecasts, validation failures, dry runs, exact idempotency replays, and webhook delivery attempts.

Reviewer focus

This draft is ready for protocol review. The highest-value questions are:

1. Is the completeness boundary correct: every material mutation to a field on
   an advertised authoritative read, but not high-volume data-plane events?
2. Is one generic list_account_changes feed preferable to per-resource feeds
   or notification-only convergence?
3. Should every committed record fan out one logical
   account.change_recorded notification to every active subscriber, including
   changes initiated synchronously through AdCP?
4. Are a 90-day minimum retention window and explicit CURSOR_EXPIRED
   rebootstrap sufficient?
5. Does the source-neutral coverage matrix set the right bar before a seller
   may advertise each resource family?
6. Is this foundational enough for 3.2, or should the durable feed move to 3.3
   while 3.2 ships only source-neutral snapshots and invalidations?

The storage responsibilities split at the protocol boundary. The seller runtime
owns durable ordered records, the 90-day retention guarantee, authorization-
scoped cursors, and atomic seller-state/change commits. Buyer applications own
their local projection and last acknowledged cursor; SDK follow-up
adcontextprotocol/adcp-client#2669 covers typed drain, registration, parsing,
rebootstrap, and checkpoint helpers. An SDK storage adapter can make either
side easier to implement, but cannot turn process-local reference state into a
seller durability guarantee.

Draft / merge gates

Remaining before merge:

• RFC RFC: complete account change visibility across seller-managed state #6810 completes the minimum seven-day review and is accepted
• generated SDKs include the new closed account.change_recorded notification value; the currently installed SDK rejects registration before regeneration
• end-to-end notification transport checks validate retry/re-emission identity once the generated SDK can execute the new notification contract

Completed in 8a0f887 / ed2c09d:

• the production training deployment now hard-disables both the change-feed capability and list_account_changes tool while its store is process-local; local/test/compliance use remains available, and SDK server: durable account change feed store adcp-client#2681 tracks the durable server-SDK store needed before production can advertise the 90-day guarantee
• a real /sales/mcp integration probe now validates CURSOR_EXPIRED as a canonical payload error, acquires a fresh latest checkpoint, rebuilds the authoritative creative snapshot, and resumes draining from the replacement cursor

The training seller now advertises only creative coverage. Its shared-account fixture proves that a creative added through a connected platform while the buyer is idle appears both in list_account_changes and the authoritative list_creatives read. Account, media-buy, money, and reporting coverage remain explicitly unadvertised until their mutation paths and snapshots meet the same bar.

Within creative coverage, the reference implementation now exercises
connected-platform create and status modification, direct sync_creatives,
inline media-buy create/update, purge, shared-account readback, no-op replay
suppression, cross-account isolation, and subscriber fanout. The learning lab
uses both external creation and external modification so this is visibly a
shared account, not a buyer-exclusive sandbox.

Security decisions

• cursors are opaque and bound to principal, authorization-scope epoch, internal seller account scope, and normalized filters
• principal/account/filter mismatch is rejected; visibility changes expire the cursor and force snapshot rebootstrap
• equal buyer-visible account IDs do not grant shared access; the training implementation uses an internal seller scope for history and fanout
• repair.task is a closed allowlist of reads and is only a hint; buyers construct and validate requests locally and never dispatch feed-provided arguments
• subscriber authorization must be rechecked at fire time and removed immediately when account access is revoked
• records and webhooks omit credentials, raw payloads, and unbounded before/after state

Review changes after 716c5d8

• flattened the emitted MCP request root and moved cursor/start exclusion to
  runtime, with a regression assertion for Anthropic-compatible tool catalogs
• defined one record per independently repairable identity plus optional
  batch_id grouping
• made connected-source current mechanically testable with
  stale_after_seconds
• added authorization-scope epochs and mandatory cursor/filter mismatch
  rejection, including a compliance probe
• scoped external atomicity to seller ingestion and bounded pass-through lag
• added list_products and get_signals to the repair allowlist
• reconciled the generic 3.2 account invalidation with the resource-scoped 4.0
  notification language

Validation

• npm run test:schemas
• npm run typecheck
• npm run test:docs-nav
• npm run test:tenant-routing
• npm run test:sdk-runner-capability-gates
• npm run test:error-code-drift
• npx vitest run --config server/vitest.config.ts server/tests/unit/account-change-feed.test.ts
• npx vitest run --config server/vitest.config.ts server/tests/unit/training-agent.test.ts
• npm run test:oneof-discriminators
• npm run test:error-codes
• git diff --check

[aao-secretariat]

Ladon verdict: Escalate to human review

Escalate — gated schema paths require human/CODEOWNERS approval.

This PR modifies files under static/schemas/source/**, which are under a hard, path-based approval gate (gated_paths: true). The required review status is not APPROVED (unknown/none), so decision-table row 2 fires: the gate is not satisfied and the outcome must be escalate.

The reviewer surfaced no Critical/High/Medium findings — this is a clean additive 3.2 draft (new list_account_changes task, account.change_recorded notification, CURSOR_EXPIRED code, change_feed capability). Schema↔docs coherence, changeset scope/type (correctly additive/Normative), oneOf disjointness, and released-artifact immutability were all verified. Absent the gate, this would approve.

Human/CODEOWNERS review is required on the gated schema-source files before merge.

Escalation reasons:

• Gated paths touched without an APPROVED review: static/schemas/source/account/list-account-changes-request.json, list-account-changes-response.json, core/account-change-recorded-webhook.json, core/account-change.json, core/account.json, core/notification-config.json, enums/error-code.json, enums/notification-type.json, index.json, protocol/get-adcp-capabilities-response.json — CODEOWNERS/human approval required.

Why human review

• Gated schema-source files changed (static/schemas/source/**) but review_decision is not APPROVED — human/CODEOWNERS approval required (decision rule row 2).
• Affected gated files include list-account-changes-request/response.json, account-change*.json, account.json, notification-config.json, error-code.json, notification-type.json, index.json, and get-adcp-capabilities-response.json.
• This PR touches a path under a hard, non-overridable approval gate (static/schemas/source/account/list-account-changes-request.json (added) matches static/schemas/source/**; static/schemas/source/account/list-account-changes-response.json (added) matches static/schemas/source/**; static/schemas/source/core/account-change-recorded-webhook.json (added) matches static/schemas/source/**; static/schemas/source/core/account-change.json (added) matches static/schemas/source/**; static/schemas/source/core/account.json (modified) matches static/schemas/source/**; static/schemas/source/core/notification-config.json (modified) matches static/schemas/source/**; static/schemas/source/enums/error-code.json (modified) matches static/schemas/source/**; static/schemas/source/enums/notification-type.json (modified) matches static/schemas/source/**; static/schemas/source/index.json (modified) matches static/schemas/source/**; static/schemas/source/protocol/get-adcp-capabilities-response.json (modified) matches static/schemas/source/**) and the current GitHub review decision is 'unknown', not APPROVED. This is a hard gate enforced in code — Ladon cannot auto-approve until a human/CODEOWNERS approval is recorded, regardless of how clean the diff is.

[bokelley]

SDK adopter follow-up filed: adcontextprotocol/adcp-client#2669. It covers generated types/enums, a typed listAccountChanges() client surface, normalized capability discovery, notification registration and parsing, structured CURSOR_EXPIRED, and flattening the emitted MCP input schema for Anthropic-compatible clients. Durable seller retention and application projection persistence remain runtime responsibilities.

[lukasz-pubx]

Review at 716c5d8 (schemas, spec doc, task doc, enums, capability block, compliance scenario; baseline claims cite the repo tree at the merge-base — the live docs page for media-buy/specification currently lags main).

Overall: strong draft — the tree delivers what the RFC promises, and it's wired unusually completely. The notification enum's own meta-rule (anchor + notification_id semantics + repair key in the enumDescription) is followed to the letter, CURSOR_EXPIRED lands with recovery text and a drift-disposition entry, and the divergence from house pagination (cursor always returned, even on empty pages) is declared rather than smuggled. Three design choices deserve explicit support: the starting_position: "latest" bootstrap-race closure (this is the correct fix for a gap that changed-since filters can't close — speaking as the buyer intermediary that was contemplating exactly such a filter on the forum), the repair-hint-never-dispatched rule, and refusing to weaken snapshot completeness into a complete: true self-assertion.

Four findings:

1. blocker — the coverage matrix promises wholesale change records the schema cannot express

specs/account-change-feed.md coverage matrix: "Wholesale products and signals | list_products / get_signals | Existing versioned feeds stay authoritative. Account changes record control or bulk revisions rather than duplicating every feed entity body." But core/account-change.json makes repair required with a closed repair.task enum of eight reads that excludes list_products and get_signals. A seller advertising product coverage that records a bulk pricing revision per the matrix cannot produce a valid record: it either drops the record (violating the invariant for an advertised type) or mislabels the repair read. Any of these resolves it: (a) add both tasks to the repair.task enum; (b) amend the matrix to state wholesale control changes are not recorded here because wholesale_feed.bulk_change + the versioned feeds already cover them, and exclude those resource types from advertisable coverage; (c) make repair conditional for feed-authoritative families with a stated default. Schema and matrix just need to agree before ratification.

2. warning — cursor/filter mismatch has no defined disposition, and the silent branch loses data permanently

The cursor is "bound to the normalized filter" (request schema; task doc), but nothing defines what a seller MUST do when a cursor arrives with different filters than it was minted under. Two conformant implementations diverge: one rejects with VALIDATION_ERROR; another honors the embedded position and applies the new filters — silently skipping every record of a newly-added resource type older than the checkpoint. On a surface whose reason to exist is completeness, the silent branch is a permanent, undetectable gap. Ask: define MUST-reject with a named code, state it in both the schema description and the task doc, and add a compliance probe for the rejection (the same probe list should cover a cursor presented by a different principal).

3. warning — the commit-boundary invariant is unimplementable for non-mediated changes as literally written

Invariant item 2: "append one immutable account change record in the same commit boundary." For a seller whose authoritative reads pass through to the underlying ad server, a seller-UI or connected-platform change is visible on get_media_buys the moment it lands upstream — before the seller's poller observes it. There is no commit boundary joining read-visibility and record-append for that architecture; read literally, every pass-through implementation is non-conformant even when its feed is correct. The PR's own surfaces already acknowledge ingestion lag (has_more "caught up to the seller's ingestion boundary", source_coverage.observed_through, recorded_at "committed or durably observed") — the invariant hasn't caught up with them. Ask: scope item 2 to the seller's ingestion/projection commit for observed (non-mediated) changes and state that authoritative reads MAY lead the feed within declared source freshness — or, if atomic read/feed coupling is truly intended, say that advertised coverage requires projection-backed reads and accept that this excludes pass-through architectures.

4. warning — the ratified "durable seller-initiated subscription is 4.0 work" statements survive untouched and now mislead

Three normative sentences this PR doesn't modify: docs/media-buy/specification.mdx ("A durable resource-scoped status webhook is reserved for the 4.0 notification model"; "buyers that need immediate push delivery should negotiate an implementation extension until the 4.0 resource-scoped notification contract lands") and docs/media-buy/task-reference/control_media_buy.mdx ("…remains 4.0 work"). This PR ships a durable, account-anchored, seller-initiated change surface in 3.2 whose coverage matrix explicitly includes media buys. The defensible distinction — account-anchored invalidation metadata is not a resource-scoped status webhook — doesn't save the middle sentence: once a seller advertises account.change_feed with media_buy coverage, "negotiate an implementation extension" is wrong advice, and the stalest copy is the one implementers will cite back. Ask: cross-reference all three sites, or state in the spec doc why they deliberately stand unchanged.

Notes

• The compliance scenario probes webhook fanout and the drain flow but not CURSOR_EXPIRED recovery — the PR's own merge gates already commit to this; the finding-2 mismatch probe would fit the same batch.
• starting_position defaulting to earliest means a parameterless first call drains up to 90 days of history. Defensible (completeness-first), but worth one sentence confirming it's intentional, since the documented bootstrap workflow leads with latest.
• On the reviewer-focus questions: Q2 — one generic feed is right; it matches the registry change-feed precedent and avoids the per-resource enum growth the RFC itself argues against. Q4 — 90 days + explicit CURSOR_EXPIRED is sufficient given the no-silent-restart rule, which is the part that matters. Q6 — from the demand side: ship in 3.2 even with creative-only coverage; the bootstrap-race closure and origin attribution have buyer value from day one, and the capability gate means nobody pays for coverage that isn't ready.

[bokelley]

Review round addressed in 8dad354. Thanks for the precise findings.

• Added list_products and get_signals to the closed repair-task allowlist so the wholesale coverage matrix is expressible.
• Defined principal/account/filter cursor mismatch as mandatory INVALID_REQUEST at cursor, prohibited silent reuse, and added a compliance probe.
• Scoped atomicity for external changes to seller ingestion/projection; pass-through reads may lead only within declared source freshness.
• Reconciled both media-buy 4.0 statements with the generic account-anchored 3.2 invalidation.
• Confirmed earliest as the intentional completeness-first default.

The follow-up also defines per-repairable-identity invalidation plus optional batch_id, authorization-scope epochs, mechanically testable stale_after_seconds coverage, and a combinator-free emitted MCP input schema regression test. RFC #6810 and the PR body now carry the same refinements.

The seller remains responsible for durable feed records and retention. Buyer SDK/application work owns typed draining, local projection/checkpoint persistence, and rebootstrap helpers; that adopter work is tracked in adcontextprotocol/adcp-client#2669.

CURSOR_EXPIRED transport recovery and durable reference deployment storage remain explicit pre-merge gates rather than being implied complete by this review round.

[aao-secretariat]

Ladon cannot review this PR until merge conflicts are resolved.

[bokelley]

Main is merged at fd1634b97b; the PR is conflict-free again and the full CI matrix is running.

The SDK ownership split is now tracked explicitly:

• adcp-client#2669: generated contract, buyer drain/checkpoint helpers, notification parsing, and rebootstrap support.
• adcp-client#2681: seller-side durable AccountChangeStore primitive, retention/cursor semantics, concurrency, and transaction/outbox integration.

The second item may be implemented in the server SDK, but the seller deployment still owns the configured durable backend and the advertised 90-day guarantee. The current process-local training store remains an explicit no-merge condition unless production advertisement is disabled.

Post-merge local validation is green: focused feed tests (13/13), typecheck, schema audit, oneOf audit, docs navigation, compliance build/check, and git diff --check. No review threads are unresolved.

[aao-secretariat]

Ladon verdict: Escalate to human review

Escalate — gated schema-source files require human/CODEOWNERS approval.

This PR modifies static/schemas/source/** (a hard, deterministic approval gate) while review_decision is REVIEW_REQUIRED, not APPROVED. Per decision rule row 2, the outcome must be escalate until a human/CODEOWNERS approval is recorded.

The reviewer found no blocking or medium findings in the PR's own new work — the account change feed additions (list-account-changes-request/response.json, account-change.json, account.json, notification-config.json, error-code.json, notification-type.json, get-adcp-capabilities-response.json) are clean, additive, and schema↔docs coherent, with a correct minor changeset for an additive Normative task. The escalation is driven solely by the unsatisfied path gate, not by code defects.

Escalation reasons

• Gated schema-source files under static/schemas/source/** changed but review_decision is REVIEW_REQUIRED, not APPROVED — human/CODEOWNERS approval required (rule row 2).
• Affected gated files: list-account-changes-request.json, list-account-changes-response.json, account-change-recorded-webhook.json, account-change.json, account.json, notification-config.json, error-code.json, notification-type.json, index.json, get-adcp-capabilities-response.json.

This is a continuation of the prior escalate — the gate remains unsatisfied.

Why human review

• Gated schema-source files under static/schemas/source/** changed but review_decision is REVIEW_REQUIRED, not APPROVED — human/CODEOWNERS approval required (decision rule row 2).
• Affected gated files: list-account-changes-request.json, list-account-changes-response.json, account-change-recorded-webhook.json, account-change.json, account.json, notification-config.json, error-code.json, notification-type.json, index.json, get-adcp-capabilities-response.json.
• This PR touches a path under a hard, non-overridable approval gate (static/schemas/source/account/list-account-changes-request.json (added) matches static/schemas/source/**; static/schemas/source/account/list-account-changes-response.json (added) matches static/schemas/source/**; static/schemas/source/core/account-change-recorded-webhook.json (added) matches static/schemas/source/**; static/schemas/source/core/account-change.json (added) matches static/schemas/source/**; static/schemas/source/core/account.json (modified) matches static/schemas/source/**; static/schemas/source/core/notification-config.json (modified) matches static/schemas/source/**; static/schemas/source/enums/error-code.json (modified) matches static/schemas/source/**; static/schemas/source/enums/notification-type.json (modified) matches static/schemas/source/**; static/schemas/source/index.json (modified) matches static/schemas/source/**; static/schemas/source/protocol/get-adcp-capabilities-response.json (modified) matches static/schemas/source/**) and the current GitHub review decision is 'REVIEW_REQUIRED', not APPROVED. This is a hard gate enforced in code — Ladon cannot auto-approve until a human/CODEOWNERS approval is recorded, regardless of how clean the diff is.

[bokelley]

@lukasz-pubx requesting your Working Group approval on this 3.2 account change-feed proposal.

Your four protocol findings are addressed in 8dad354e2e, the branch is current with main, all review threads are resolved, and Ladon's fresh pass found no additional code or schema defects. Please review the final completeness boundary, generic feed/notification contract, 90-day cursor semantics, and the decision to include this in 3.2.

This is an approval request for the protocol direction and wire contract. The PR still records separate pre-merge implementation gates for durable production seller storage, generated SDK support, transport conformance, and the RFC review window.

[lukasz-pubx]

Re-reviewed at fd1634b (fixes in 8dad354e2e). All four findings from my review are verifiably resolved:

1. list_products and get_signals are in the repair.task allowlist — the wholesale coverage matrix is now expressible.
2. Cursor mismatch is mandatory INVALID_REQUEST at field cursor in the schema, task doc, and spec, with the compliance probe asserting the rejection. The authorization-scope epoch addition (scope change → CURSOR_EXPIRED → rebootstrap) goes beyond my ask and is the right answer to access revocation mid-stream.
3. Atomicity is scoped to the seller's ingestion/projection commit for observed changes, with pass-through reads allowed to lead within declared source freshness — implementable for both architectures.
4. Both media-buy statements and control_media_buy now cross-reference the 3.2 account-anchored invalidation while keeping the resource-status webhook distinction for 4.0. Exactly the reconciliation needed.

I also reviewed the same-round additions: the conditional requirement making last_successful_sync_at + stale_after_seconds mandatory when a connected source self-classifies current closes the freshness self-assertion loophole, and batch_id is cleanly non-ordering/non-identity. No new findings.

Approve on the wire contract and implementation review, with the two pre-merge gates you're already holding (e2e CURSOR_EXPIRED transport recovery, durable reference-deployment storage) remaining as stated.

The RFC-level Working Group decision I'll record on #6810 after today's WG meeting.

[bokelley]

Thanks, @lukasz-pubx. The two implementation gates from your re-review are now closed at head d9c39efdcf:\n\n- CURSOR_EXPIRED recovery now has a real /sales/mcp transport test: canonical payload error → fresh latest checkpoint → authoritative list_creatives snapshot → resumed drain. The handler suite separately covers authorization-scope epoch rotation.\n- The hosted production training seller now hard-disables both the change-feed capability and list_account_changes while its store is process-local. Local/test/compliance retain the reference implementation; adcp-client#2681 remains the durable server-SDK/store follow-up required before any production deployment can advertise the 90-day guarantee.\n\nThe branch is current with main. Typecheck, the focused feed suites (16/16), and the controller suite (80/80) are green; CI is rerunning after the controller scenario-inventory assertion was updated for the new expiry scenario. I have left the RFC decision and generated-SDK notification transport work explicitly open; I am not treating this as the RFC-level WG decision you said you would record on #6810.

[aao-secretariat]

Ladon verdict: Escalate to human review

Escalate — gated schema-source files changed and review is not yet APPROVED.

This PR modifies/adds multiple files under static/schemas/source/**, which is a hard, non-overridable approval gate (gated_paths: true). The current GitHub review_decision is REVIEW_REQUIRED, not APPROVED, so decision rule row 2 applies: the gate cannot be lifted until a human/CODEOWNERS approval is recorded, regardless of how clean the diff is.

Blocking findings: none. The reviewer surfaced no critical/high/medium findings. The account-change-feed cursor-expiry recovery and production advertisement gate are coherent across schema, implementation, compliance, spec, docs, and tests; the largest deltas are merged-from-main features. No spec/docs drift, no immutability violation, no undiscriminated oneOf, changeset present.

Escalation reasons:

• Gated files under static/schemas/source/** changed but review_decision is REVIEW_REQUIRED, not APPROVED — human/CODEOWNERS approval required (row 2).
• Affected gated files: list-account-changes-request.json, list-account-changes-response.json, comply-test-controller-request.json, account-change-recorded-webhook.json, account-change.json, account.json, notification-config.json, error-code.json, notification-type.json, index.json, get-adcp-capabilities-response.json.

This sustains the prior escalate outcome; the underlying gate remains unsatisfied. Once a human/CODEOWNERS approval flips review_decision to APPROVED, this clean diff can fall through to approval.

Why human review

• Gated schema-source files under static/schemas/source/** changed but review_decision is REVIEW_REQUIRED, not APPROVED — human/CODEOWNERS approval required (decision rule row 2).
• Affected gated files: list-account-changes-request.json, list-account-changes-response.json, comply-test-controller-request.json, account-change-recorded-webhook.json, account-change.json, account.json, notification-config.json, error-code.json, notification-type.json, index.json, get-adcp-capabilities-response.json.
• This PR touches a path under a hard, non-overridable approval gate (static/schemas/source/account/list-account-changes-request.json (added) matches static/schemas/source/**; static/schemas/source/account/list-account-changes-response.json (added) matches static/schemas/source/**; static/schemas/source/compliance/comply-test-controller-request.json (modified) matches static/schemas/source/**; static/schemas/source/core/account-change-recorded-webhook.json (added) matches static/schemas/source/**; static/schemas/source/core/account-change.json (added) matches static/schemas/source/**; static/schemas/source/core/account.json (modified) matches static/schemas/source/**; static/schemas/source/core/notification-config.json (modified) matches static/schemas/source/**; static/schemas/source/enums/error-code.json (modified) matches static/schemas/source/**; static/schemas/source/enums/notification-type.json (modified) matches static/schemas/source/**; static/schemas/source/index.json (modified) matches static/schemas/source/**; static/schemas/source/protocol/get-adcp-capabilities-response.json (modified) matches static/schemas/source/**) and the current GitHub review decision is 'REVIEW_REQUIRED', not APPROVED. This is a hard gate enforced in code — Ladon cannot auto-approve until a human/CODEOWNERS approval is recorded, regardless of how clean the diff is.

[aao-secretariat]

Ladon verdict: Escalate to human review

Escalate — gated schema-source files changed without an APPROVED review decision.

This PR modifies/adds files under static/schemas/source/**, which sit behind a hard, non-overridable approval gate (gated_paths: true). The current review_decision is REVIEW_REQUIRED, not APPROVED, so decision-table row 2 fires and the outcome must be escalate regardless of how clean the diff is.

The reviewer found no Critical/High/Medium findings — the account-change-feed epoch re-keying (accountScopeId → (principal, accountScopeId)), the authorizationEpoch → visibilityEpoch rename, and the supportsAccountChangeFeed version gating are well-tested, fail-closed, and schema↔docs coherent. This is a clean, well-executed change. The only blocker is the mechanical approval gate: a human/CODEOWNERS approval must be recorded before this can merge.

Escalation reasons

• Gated schema-source files under static/schemas/source/** changed but review_decision is REVIEW_REQUIRED, not APPROVED — human/CODEOWNERS approval required (decision rule row 2).
• Affected gated files: list-account-changes-request.json, list-account-changes-response.json, comply-test-controller-request.json, account-change-recorded-webhook.json, account-change.json, account.json, notification-config.json, error-code.json, notification-type.json, index.json, get-adcp-capabilities-response.json.

Why human review

• Gated schema-source files under static/schemas/source/** changed but review_decision is REVIEW_REQUIRED, not APPROVED — human/CODEOWNERS approval required (decision rule row 2).
• Affected gated files: list-account-changes-request.json, list-account-changes-response.json, comply-test-controller-request.json, account-change-recorded-webhook.json, account-change.json, account.json, notification-config.json, error-code.json, notification-type.json, index.json, get-adcp-capabilities-response.json.
• This PR touches a path under a hard, non-overridable approval gate (static/schemas/source/account/list-account-changes-request.json (added) matches static/schemas/source/**; static/schemas/source/account/list-account-changes-response.json (added) matches static/schemas/source/**; static/schemas/source/compliance/comply-test-controller-request.json (modified) matches static/schemas/source/**; static/schemas/source/core/account-change-recorded-webhook.json (added) matches static/schemas/source/**; static/schemas/source/core/account-change.json (added) matches static/schemas/source/**; static/schemas/source/core/account.json (modified) matches static/schemas/source/**; static/schemas/source/core/notification-config.json (modified) matches static/schemas/source/**; static/schemas/source/enums/error-code.json (modified) matches static/schemas/source/**; static/schemas/source/enums/notification-type.json (modified) matches static/schemas/source/**; static/schemas/source/index.json (modified) matches static/schemas/source/**; static/schemas/source/protocol/get-adcp-capabilities-response.json (modified) matches static/schemas/source/**) and the current GitHub review decision is 'REVIEW_REQUIRED', not APPROVED. This is a hard gate enforced in code — Ladon cannot auto-approve until a human/CODEOWNERS approval is recorded, regardless of how clean the diff is.

[aao-secretariat]

Ladon verdict: Escalate to human review

Escalate — gated schema-source files require human/CODEOWNERS approval.

This PR touches multiple files under static/schemas/source/**, which is a hard, non-overridable approval gate (gated_paths: true). The current review_decision is unknown/none — not APPROVED — so decision rule row 2 forces escalation regardless of how clean the diff is.

Escalation reasons

• Gated schema-source files changed but review_decision is not APPROVED. Human/CODEOWNERS approval is required before merge.
• Affected gated files: list-account-changes-request.json, list-account-changes-response.json, comply-test-controller-request.json, account-change-recorded-webhook.json, account-change.json, account.json, notification-config.json, error-code.json, notification-type.json, index.json, get-adcp-capabilities-response.json.

On the delta: The only code change since the prior review renames handleVerifyGovernanceToken → handleInspectGovernanceTokenFixture (definition + sole call site, no behavior change) to clarify it's a sandbox teaching fixture, not an auth check. Reviewer reports a clean pass with no critical/high/medium findings.

This is a net-clean iteration, but the schema-source approval gate stands until a human approval is recorded. No blocking findings exist; escalation is purely the gated-paths requirement.

Why human review

• Gated schema-source files under static/schemas/source/** changed but review_decision is not APPROVED — human/CODEOWNERS approval required (decision rule row 2).
• Affected gated files: list-account-changes-request.json, list-account-changes-response.json, comply-test-controller-request.json, account-change-recorded-webhook.json, account-change.json, account.json, notification-config.json, error-code.json, notification-type.json, index.json, get-adcp-capabilities-response.json.
• This PR touches a path under a hard, non-overridable approval gate (static/schemas/source/account/list-account-changes-request.json (added) matches static/schemas/source/**; static/schemas/source/account/list-account-changes-response.json (added) matches static/schemas/source/**; static/schemas/source/compliance/comply-test-controller-request.json (modified) matches static/schemas/source/**; static/schemas/source/core/account-change-recorded-webhook.json (added) matches static/schemas/source/**; static/schemas/source/core/account-change.json (added) matches static/schemas/source/**; static/schemas/source/core/account.json (modified) matches static/schemas/source/**; static/schemas/source/core/notification-config.json (modified) matches static/schemas/source/**; static/schemas/source/enums/error-code.json (modified) matches static/schemas/source/**; static/schemas/source/enums/notification-type.json (modified) matches static/schemas/source/**; static/schemas/source/index.json (modified) matches static/schemas/source/**; static/schemas/source/protocol/get-adcp-capabilities-response.json (modified) matches static/schemas/source/**) and the current GitHub review decision is 'unknown', not APPROVED. This is a hard gate enforced in code — Ladon cannot auto-approve until a human/CODEOWNERS approval is recorded, regardless of how clean the diff is.

[aao-secretariat]

Ladon verdict: Escalate to human review

Escalate — gated schema-source paths require human/CODEOWNERS approval.

This PR modifies and adds files under static/schemas/source/**, which is a hard, deterministic approval gate (gated_paths: true). The current review_decision is unknown/none — not APPROVED — so decision rule row 2 forces escalation regardless of how clean the diff is. Ladon cannot auto-approve gated schema-source changes until a human/CODEOWNERS approval is recorded.

The delta since the prior review is a single cosmetic rename in server/src/training-agent/comply-test-controller.ts (verifyGovernanceToken → alias inspectGovernanceTokenForTraining, import at L54 and call at L1497 both rewritten, no missed call site, no behavior change). The reviewer surfaced no critical/high/medium findings.

This is additionally a new protocol surface (account change feed) touching the published wire shape under static/schemas/source/** — schema additions and enum changes are protocol changes whose ratification is a human act. Prior decision was also escalate for the same gate; the gate remains unsatisfied.

Escalation reasons

• Gated files under static/schemas/source/** changed but review_decision is not APPROVED — human/CODEOWNERS approval required (rule row 2).
• Affected gated files: list-account-changes-request.json, list-account-changes-response.json, comply-test-controller-request.json, account-change-recorded-webhook.json, account-change.json, account.json, notification-config.json, error-code.json, notification-type.json, index.json, get-adcp-capabilities-response.json.

Why human review

• Gated schema-source files under static/schemas/source/** changed but review_decision is not APPROVED — human/CODEOWNERS approval required (decision rule row 2).
• Affected gated files: list-account-changes-request.json, list-account-changes-response.json, comply-test-controller-request.json, account-change-recorded-webhook.json, account-change.json, account.json, notification-config.json, error-code.json, notification-type.json, index.json, get-adcp-capabilities-response.json.
• New account-change-feed protocol surface adds fields/enums to the published wire shape under static/schemas/source/** — protocol ratification is a human act; escalate unless review_decision is APPROVED.
• This PR touches a path under a hard, non-overridable approval gate (static/schemas/source/account/list-account-changes-request.json (added) matches static/schemas/source/**; static/schemas/source/account/list-account-changes-response.json (added) matches static/schemas/source/**; static/schemas/source/compliance/comply-test-controller-request.json (modified) matches static/schemas/source/**; static/schemas/source/core/account-change-recorded-webhook.json (added) matches static/schemas/source/**; static/schemas/source/core/account-change.json (added) matches static/schemas/source/**; static/schemas/source/core/account.json (modified) matches static/schemas/source/**; static/schemas/source/core/notification-config.json (modified) matches static/schemas/source/**; static/schemas/source/enums/error-code.json (modified) matches static/schemas/source/**; static/schemas/source/enums/notification-type.json (modified) matches static/schemas/source/**; static/schemas/source/index.json (modified) matches static/schemas/source/**; static/schemas/source/protocol/get-adcp-capabilities-response.json (modified) matches static/schemas/source/**) and the current GitHub review decision is 'unknown', not APPROVED. This is a hard gate enforced in code — Ladon cannot auto-approve until a human/CODEOWNERS approval is recorded, regardless of how clean the diff is.

[aao-secretariat]

Ladon verdict: Escalate to human review

Escalate — gated schema-source files require human/CODEOWNERS approval.

Gate: This PR touches files under the hard, non-overridable approval gate static/schemas/source/** and review_decision is REVIEW_REQUIRED (not APPROVED). Decision rule row 2 forces escalation.

Gated files: list-account-changes-request.json, list-account-changes-response.json, comply-test-controller-request.json, account-change-recorded-webhook.json, account-change.json, account.json, notification-config.json, error-code.json, notification-type.json, index.json, get-adcp-capabilities-response.json.

This PR introduces a new account-change-feed protocol surface (new fields, enums, error codes, and wire shapes). Ratification of new published protocol surface is a human act and cannot be auto-approved until a CODEOWNERS/human approval is recorded.

Prior decision was escalate. The current run surfaces one fresh Medium finding (broadened seeded fallback widens cross-session creative reads for account-less, ID-filtered requests in task-handlers.ts), so the escalation continues to be backed by fresh evidence in addition to the still-unsatisfied gate.

Medium findings

• server/src/training-agent/task-handlers.ts:13837 — Broadened seeded fallback widens cross-session creative reads for account-less requests

Human reviewers should confirm the wire-shape/protocol additions and evaluate the cross-session read scope of the seeded fallback change before merge.

Medium findings

• server/src/training-agent/task-handlers.ts:13837 — Broadened seeded fallback widens cross-session creative reads for account-less requests

Why human review

• Gated schema-source files under static/schemas/source/** changed but review_decision is REVIEW_REQUIRED, not APPROVED — human/CODEOWNERS approval required (decision rule row 2).
• Affected gated files: list-account-changes-request.json, list-account-changes-response.json, comply-test-controller-request.json, account-change-recorded-webhook.json, account-change.json, account.json, notification-config.json, error-code.json, notification-type.json, index.json, get-adcp-capabilities-response.json.
• New account-change-feed protocol surface adds fields/enums/error-codes to the published wire shape under static/schemas/source/** — protocol ratification is a human act; escalate unless review_decision is APPROVED.
• Prior decision was escalate and a fresh Medium finding (cross-session creative read widening in task-handlers.ts:13837) persists — sticky escalation backed by current evidence (row 6).
• This PR touches a path under a hard, non-overridable approval gate (static/schemas/source/account/list-account-changes-request.json (added) matches static/schemas/source/**; static/schemas/source/account/list-account-changes-response.json (added) matches static/schemas/source/**; static/schemas/source/compliance/comply-test-controller-request.json (modified) matches static/schemas/source/**; static/schemas/source/core/account-change-recorded-webhook.json (added) matches static/schemas/source/**; static/schemas/source/core/account-change.json (added) matches static/schemas/source/**; static/schemas/source/core/account.json (modified) matches static/schemas/source/**; static/schemas/source/core/notification-config.json (modified) matches static/schemas/source/**; static/schemas/source/enums/error-code.json (modified) matches static/schemas/source/**; static/schemas/source/enums/notification-type.json (modified) matches static/schemas/source/**; static/schemas/source/index.json (modified) matches static/schemas/source/**; static/schemas/source/protocol/get-adcp-capabilities-response.json (modified) matches static/schemas/source/**) and the current GitHub review decision is 'REVIEW_REQUIRED', not APPROVED. This is a hard gate enforced in code — Ladon cannot auto-approve until a human/CODEOWNERS approval i

…(truncated)…

[aao-secretariat]

Ladon verdict: Escalate to human review

Escalate — gated schema-source files changed and no APPROVED review recorded; protocol wire surface added.

Gated paths gate (decision rule row 2): This PR modifies/adds files under static/schemas/source/** (a hard, deterministic approval gate) and review_decision is not APPROVED (unknown/none). Ladon cannot auto-approve until a human/CODEOWNERS approval is recorded, regardless of how clean the diff is.

Affected gated files: list-account-changes-request.json, list-account-changes-response.json, comply-test-controller-request.json, account-change-recorded-webhook.json, account-change.json, account.json, notification-config.json, error-code.json, notification-type.json, index.json, get-adcp-capabilities-response.json.

New protocol surface: The account-change-feed feature adds new schemas, enum values (notification-type, error-code) and webhook shapes to the published wire surface. Protocol ratification of new fields/enums/error-codes is a human act — escalate unless review_decision is APPROVED.

Medium findings (non-blocking):

• server/src/training-agent/task-handlers.ts:13838 — frozenOpaqueFixtureBridge gates on account_id but ignores its value, widening cross-session controller-fixture reads. Isolation for real (non-controller-seeded) libraries remains intact. This is a fresh finding on the delta since the prior pass, sustaining the sticky escalation (row 6) alongside the gated-paths gate.

The prior escalation stands: the gated-paths gate is unsatisfied and a current medium finding persists. A human/CODEOWNERS approval is required before this can proceed.

Medium findings

• server/src/training-agent/task-handlers.ts:13838 — frozenOpaqueFixtureBridge gates on account_id but ignores its value, widening cross-session controller-fixture reads

Why human review

• Gated schema-source files under static/schemas/source/** changed but review_decision is not APPROVED (unknown/none) — human/CODEOWNERS approval required (decision rule row 2). Affected: list-account-changes-request.json, list-account-changes-response.json, comply-test-controller-request.json, account-change-recorded-webhook.json, account-change.json, account.json, notification-config.json, error-code.json, notification-type.json, index.json, get-adcp-capabilities-response.json.
• New account-change-feed protocol surface adds fields/enums/error-codes to the published wire shape under static/schemas/source/** — protocol ratification is a human act; escalate unless review_decision is APPROVED.
• Prior decision was escalate and a fresh medium finding persists (task-handlers.ts:13838 — frozenOpaqueFixtureBridge widens cross-session controller-fixture reads) — sticky escalation backed by current evidence (row 6).
• This PR touches a path under a hard, non-overridable approval gate (static/schemas/source/account/list-account-changes-request.json (added) matches static/schemas/source/**; static/schemas/source/account/list-account-changes-response.json (added) matches static/schemas/source/**; static/schemas/source/compliance/comply-test-controller-request.json (modified) matches static/schemas/source/**; static/schemas/source/core/account-change-recorded-webhook.json (added) matches static/schemas/source/**; static/schemas/source/core/account-change.json (added) matches static/schemas/source/**; static/schemas/source/core/account.json (modified) matches static/schemas/source/**; static/schemas/source/core/notification-config.json (modified) matches static/schemas/source/**; static/schemas/source/enums/error-code.json (modified) matches static/schemas/source/**; static/schemas/source/enums/notification-type.json (modified) matches static/schemas/source/**; static/schemas/source/index.json (modified) matches static/schemas/source/**; static/schemas/source/protocol/get-adcp-capabilities-response.json (modified) matches static/schemas/source/**) and the current GitHub rev

…(truncated)…

[aao-secretariat]

Ladon verdict: Escalate to human review

Escalate — gated schema-source paths require human/CODEOWNERS approval, and this PR introduces a new breaking-class protocol surface.

This PR adds the account-change-feed protocol surface: new schemas (list-account-changes-request.json, list-account-changes-response.json, account-change.json, account-change-recorded-webhook.json), new enum values (notification-type.json, error-code.json), and modifications to published wire shapes (account.json, notification-config.json, get-adcp-capabilities-response.json, index.json). All of these live under static/schemas/source/**, which is under a hard, deterministic approval gate.

Decision rule row 2 fires: gated_paths is true AND review_decision is REVIEW_REQUIRED (not APPROVED). Ladon cannot auto-approve gated schema-source changes until a human/CODEOWNERS approval is recorded, regardless of how clean the diff is.

Additionally, adding new fields, new enum values, and new error codes to the published wire shape is a protocol-surface expansion — ratification of new protocol surface is a human act per the constitution's breaking/normative decision classes. Escalate unless review_decision is APPROVED.

Reviewer delta assessment (positive): the prior medium finding (task-handlers.ts:13838 — frozenOpaqueFixtureBridge widening cross-session controller-fixture reads) has been RESOLVED. The read path now gates on an exact FROZEN_PAGINATION_ACCOUNT_ID plus three named fixture IDs, and needsSeededFallback requires req.account before borrowing. New tests confirm acct_runner_generated cannot read the pagination fixture and an account-less non-empty session returns []. No new findings surfaced in this run. The escalation is driven entirely by the gated-path / breaking-class governance gates, not by any outstanding code defect.

Escalation reasons

• Gated schema-source files under static/schemas/source/** changed but review_decision is REVIEW_REQUIRED, not APPROVED — human/CODEOWNERS approval required (row 2). Affected: list-account-changes-request.json, list-account-changes-response.json, comply-test-controller-request.json, account-change-recorded-webhook.json, account-change.json, account.json, notification-config.json, error-code.json, notification-type.json, index.json, get-adcp-capabilities-response.json.
• New account-change-feed protocol surface adds fields, enum values, and error codes to the published wire shape — protocol ratification is a human act; escalate unless review_decision is APPROVED.

Why human review

• Gated schema-source files under static/schemas/source/** changed but review_decision is REVIEW_REQUIRED, not APPROVED — human/CODEOWNERS approval required (decision rule row 2). Affected: list-account-changes-request.json, list-account-changes-response.json, comply-test-controller-request.json, account-change-recorded-webhook.json, account-change.json, account.json, notification-config.json, error-code.json, notification-type.json, index.json, get-adcp-capabilities-response.json.
• New account-change-feed protocol surface adds fields, enum values, and error codes to the published wire shape under static/schemas/source/** — protocol ratification is a human act; escalate unless review_decision is APPROVED.
• This PR touches a path under a hard, non-overridable approval gate (static/schemas/source/account/list-account-changes-request.json (added) matches static/schemas/source/**; static/schemas/source/account/list-account-changes-response.json (added) matches static/schemas/source/**; static/schemas/source/compliance/comply-test-controller-request.json (modified) matches static/schemas/source/**; static/schemas/source/core/account-change-recorded-webhook.json (added) matches static/schemas/source/**; static/schemas/source/core/account-change.json (added) matches static/schemas/source/**; static/schemas/source/co

…(truncated)…

[bokelley]

Final reviewer checkpoint at 69a91dd128:

• all review threads are resolved; Ladon confirms the prior fixture-fallback finding is fixed and reports no new findings
• CodeQL and Semgrep are green, with zero open code-scanning alerts
• 52 GitHub checks pass; GitGuardian is neutral
• frozen 3.0 /sales is restored to 40/40 clean storyboards and the 224-step floor
• focused feed/controller/transport suites pass (97/97), both new isolation regressions pass, typecheck is green, and the branch is clean/current with main

The only two red checks are exact default-branch baseline defects, reproduced on main run 32842430342:

• current /creative: the same two SDK Maximum call stack size exceeded failures, 48/50 and 200 steps
• current /creative-builder: the same three isolated SDK stack failures, 48/51 and 172 steps

No floor was weakened and no baseline failure was waived in code.

Remaining merge gates are governance/external: human CODEOWNERS approval for the gated schema surface, the RFC-level WG decision on #6810, and the generated-SDK notification/transport follow-up already listed in the PR body. Lukasz has approved the wire contract and implementation review; his RFC-level WG decision is still intentionally tracked on #6810.

[aao-secretariat]

Ladon verdict: Escalate to human review

Escalate — gated schema-source files changed without an APPROVED review.

This PR adds a new account-change-feed protocol surface: new fields, enum values (notification-type, error-code), and new schema files under static/schemas/source/**. Eleven gated files match the hard, non-overridable approval gate (static/schemas/source/**), and the current review_decision is REVIEW_REQUIRED, not APPROVED (decision rule row 2). Ladon cannot auto-approve until a human/CODEOWNERS approval is recorded, regardless of how clean the diff is.

The reviewer surfaced no Critical/High/Medium findings — wire schemas are internally consistent, the tracker-execution-selector oneOf is discriminated on asset_type, VAST/DAAST version matrices match IAB history, schema↔docs coherence holds, and the changeset is minor/additive with no removed identifiers or optional→required flips. That clean bill of health is credited, but it does not lift the gate.

Additionally, this is a new protocol surface adding fields/enums/error codes to the published wire shape — protocol ratification is a human act. The prior decision was also escalate; the current run continues to touch the gated surface with the gate unsatisfied, so the escalation stands.

Escalation reasons

• Gated files under static/schemas/source/** changed but review_decision is REVIEW_REQUIRED, not APPROVED — human/CODEOWNERS approval required (row 2).
• New account-change-feed protocol surface (new fields, enum values, error codes) on the published wire shape — ratification is a human act.

No blocking code-level findings; the gate is the sole reason for escalation. Once a human/CODEOWNERS approval is recorded, a subsequent run can fall through to approve on this clean diff.

Why human review

• Gated schema-source files under static/schemas/source/** changed (list-account-changes-request.json, list-account-changes-response.json, comply-test-controller-request.json, account-change-recorded-webhook.json, account-change.json, account.json, notification-config.json, error-code.json, notification-type.json, index.json, get-adcp-capabilities-response.json) but review_decision is REVIEW_REQUIRED, not APPROVED — human/CODEOWNERS approval required (decision rule row 2).
• New account-change-feed protocol surface adds fields, enum values, and error codes to the published wire shape under static/schemas/source/** — protocol ratification is a human act; escalate unless review_decision is APPROVED.
• This PR touches a path under a hard, non-overridable approval gate (static/schemas/source/account/list-account-changes-request.json (added) matches static/schemas/source/**; static/schemas/source/account/list-account-changes-response.json (added) matches static/schemas/source/**; static/schemas/source/compliance/comply-test-controller-request.json (modified) matches static/schemas/source/**; static/schemas/source/core/account-change-recorded-webhook.json (added) matches static/schemas/source/**; static/schemas/source/core/account-change.json (added) matches static/schemas/source/**; static/schemas/source/core/account.json (modified) matches static/schemas/source/**; static/schemas/source/core/notification-config.json (modified) matches static/schemas/source/**; static/schemas/source/enums/error-code.json (modified) matches static/schemas/source/**; static/schemas/source/enums/notification-type.json (modified) matches static/schemas/source/**; static/schemas/source/index.json (modified) matches static/schemas/source/**; static/schemas/source/protocol/get-adcp-capabilities-response.json (modified) matches static/schemas/source/**) and the current GitHub review decision is 'REVIEW_REQUIRED', not APPROVED. This is a hard gate enforced in code — Ladon cannot auto-approve until a human/CODEOWNERS approval is recorded, regardless of how clean the diff is.

[bokelley]

Post-main reviewer checkpoint at e4a4b1efbf:

• merged current origin/main cleanly, including the overlapping tracker-contract schema registry/capability changes
• all 56 GitHub checks pass; GitGuardian is neutral
• current /creative and /creative-builder are both green, so the prior default-branch stack-overflow caveat is no longer applicable
• all eight sales storyboard shards, current and frozen 3.0 tenant matrices, canonical/schema suites, build/typecheck, docs, CodeQL, Semgrep, and Ladon are green
• zero open code-scanning alerts; Ladon's head review reports no Critical/High/Medium findings
• worktree is clean and the PR is mergeable

The remaining gates are intentionally human/external: RFC acceptance after its review window and the Working Group decision on #6810, an APPROVED human/CODEOWNERS review for the gated schema surface, and the generated-SDK notification/transport work already tracked in the PR body and adcp-client#2669.