[bokelley]

Summary

• restore the packaged Zod response validator when an active external protocol schema root has no schema for the task
• keep external JSON Schema verdicts authoritative whenever the external bundle does contain the task schema
• cover the comply_test_controller arm response regression and verify malformed controller payloads are still rejected

Fixes #2867

Verification

• env -u DATABASE_URL npm run ci:quick — passed
  • formatting, typecheck, and library build passed
  • fast suite: 13,290 passed, 0 failed, 7 skipped
  • slow test shard passed
  • ESLint plugin workspace: 30 passed, 0 failed
• focused storyboard-strict-validation regression: 28 passed, 0 failed
• changeset status: @adcp/sdk patch
• commitlint and PR-title checks passed

13.x maintenance ordering

This PR is based directly on origin/13.x at 6424498b and is intentionally independent of the open maintenance stack. It does not overlap the files changed by #2890–#2893 and does not modify package versions, release tags, or release automation.

Land #2891 → #2892 → #2893 first so 13.x PR checks are enabled, then refresh this branch and #2890 onto the updated 13.x tip. This PR and #2890 have no code-order dependency and may merge in either order after that refresh. Any stable 13.x publication should still honor the compliance-artifact ordering gate documented on #2890.

---

Open workspace in Conductor

[aao-secretariat]

Ladon verdict: Approve

Approve — clean, minimal regression fix.

This PR tightens the external-schema-authority branch in validateResponseSchema to externalSchemaIsAuthoritative && strict, so compliance-only harness tools (e.g. comply_test_controller) absent from external protocol bundles fall through to their packaged Zod projection instead of returning a spurious no_schema_registered failure. Fall-through correctness verified across all four branch states, no new null-deref surface, honest two-arm test coverage, and a correctly-scoped patch changeset (.changeset/quiet-runners-validate.md).

No blocking or Medium findings. No high-risk paths, no gated paths, no author-team gate.

Decision path: No critical/high findings (row 1 n/a); gated_paths false (row 2 n/a); high_risk false (rows 3/5 n/a); no medium findings (rows 4/6/8 n/a); no team gate (row 7 n/a) → row 9 approve.