[bokelley]

Buyer pre-acceptance verification must reject unsupported binding schema semantics even when the proposed and reviewed snapshots are identical. This completes Part B on top of #2757: verifyProposalCommercialTerms retains digest-first, exhaustive recursive comparison and now audits the complete selected schema graph before validation.

• Add the standalone, tree-shakeable Node ESM/CJS @adcp/sdk/negotiation/verification entry and its public types.
• Derive admitted fields from the runtime bundle; reject unknown fields, unsupported keywords/formats, changed or removed semantic contracts, cross-bundle references, and conflicting schema identities. Execute schema-declared targeting, locale, and timezone checks on the applicable branches.
• Cache immutable documents and support audits alongside isolated validators. Cover prices, currencies, flights, purchases, change rights, contract pointers, future fields, precise JSON Pointers, and version projection with portable fixtures. Preserve opaque 3.1 contract references; live action/term joining remains Part A.
• Document runtime bundle coupling, conservative enum membership, separate ESM/CJS loader state, and reviewed beta.8/rc.2/rc.3 semantics. Include a minor changeset and packed-artifact coverage.

Rebased onto #2910 (3a5edd3d). The only conflict was the package file-count budget: preserve its 6016 baseline plus this verifier's 13 artifacts, for 6029. A clean package run confirms exactly 6029 files (18.3 MiB packed, 100.8 MiB unpacked); byte budgets are unchanged. No index/docs conflicts or duplicate generated changes.

Post-rebase validation: npm run ci:quick passes end to end, including all 24 fast batches, slow tests, ESLint-plugin tests, and reference renderers. The command used env -u DATABASE_URL NODE_OPTIONS=--max-old-space-size=8192 TEST_CONCURRENCY=4 to avoid the workspace's stale database URL and the existing handler-flow suite's default-heap limit. All 87 focused verifier tests and ESM/CJS TypeScript consumer checks pass. npm run ci:schema-check passes with no generated drift. npm run check:package and clean-room npm run verify:package pass, including installed verifier exports in both module formats. Every GitHub check passes on 9b665ec5.

Review: Claude DX/protocol/code/security and npm run review:codex -- --all --base main reviews ran; actionable findings were resolved and the final Codex review found none. Executable checks ran separately from the supplied-source Codex review. Ladon reviewed and approved the rebased commit with no findings.

Coordination: RFC adcontextprotocol/adcp#6750 shipped through adcontextprotocol/adcp#6794. The upstream dist allowlist patch was already removed by adcontextprotocol/adcp#7018 when adopting SDK beta.16, so no companion removal PR is needed. After the SDK release containing this changeset publishes, upstream should update its SDK pin and lockfile together, then run npm run test:sdk-shims, npm run test:storyboards, and npm run test:storyboards:3.0-compat. No dist patch should be restored. #2907 is still open; this PR deliberately supports rc.3's revised snapshot annotation without duplicating its generated changes, and will rebase if it lands first. An isolated checkout of #2907 at dacd0c3e with Part B applied passes the build, all 87 verifier regressions, and package size check; its only integration conflict was the additive package file-count budget.

Refs #2664

[aao-secretariat]

Ladon verdict: Approve

Approve — clean review, no blocking findings.

Checked:

• Witness-not-translator preserved: the new proposal commercial-terms verifier returns upstream data unchanged (no projection/stripping/fabrication).
• Changeset present and correct: .changeset/proposal-verifier-schema-contracts.md is additive (minor) and matches the additive src/lib/negotiation/** changes.
• Packaging budgets (scripts/check-package-size.mjs, scripts/verify-package.mjs, package.json) updated consistently; no hand-edited version line.
• Fail-closed schema-support audit, isolated x-adcp-validation keyword validators, immutable memoized documents, and digest-first ordering all look sound.

No Critical/High/Medium findings. gated_paths is false and high_risk is false, so despite review_decision: REVIEW_REQUIRED no hard gate applies. Author is not on any no-auto-approve team. Falls through to row 9.

[aao-secretariat]

Ladon verdict: Approve

Approve — clean subsequent pass, no blocking findings.

This is a follow-up review (prior outcome: approve) on the standalone fail-closed proposal commercial-terms verifier: new @adcp/sdk/negotiation/verification entry plus commercial-terms-schema/keywords/semantics modules with generation-scoped caches. The reviewer examined the largest delta (commercial-terms-schema.ts) and verified digest-first rejection, exhaustive schema-admitted comparison, fail-closed handling of unknown keywords/dialects/cross-version refs, cache immutability, and changeset/manifest/doc consistency.

Findings: none (no critical/high/medium).

Gate checks:

• No no-auto-approve team match.
• gated_paths: false — row 2 does not apply (review_decision REVIEW_REQUIRED is irrelevant when no gated path is touched).
• high_risk: false — no deletion/modification escalation rows apply.
• Prior decision was approve, not escalate — row 6 does not apply.
• Zero medium findings — rows 4, 5, 8 do not apply.

No rows 1–8 fire; falls through to row 9 → approve. Changeset present (.changeset/proposal-verifier-schema-contracts.md) covering the src/lib/** changes.