Skip to content

fix(compliance): decouple fixture provenance version - #2962

Merged
bokelley merged 1 commit into
mainfrom
conductor/decouple-fixture-provenance
Sep 18, 2026
Merged

bokelley merged 1 commit into
mainfrom
conductor/decouple-fixture-provenance

Conversation

@bokelley

Copy link
Copy Markdown
Contributor

Unblocks the AdCP 3.2.0-rc.4 release candidate validation in adcontextprotocol/adcp#7508.

Canonical principal and reporting-core fixtures are independently immutable artifacts from AdCP 3.2.0-rc.3. Their own manifest already pins the exact source tag, commit, bundle digest, file SHA-256 values, Git blob IDs, paths, and byte sizes. Requiring that fixture source version to equal the SDK schema target creates a release deadlock: a candidate SDK build cannot validate rc.4 until an rc.4 fixture tag exists, but the protocol tag cannot land until that candidate build passes.

This removes only the equality check against ADCP_VERSION. Every provenance and byte-integrity check remains fail-closed.

Qualification on the exact published head:

  • regression harness with a deliberately different SDK target version
  • npm run check:canonical-storyboard-fixtures
  • npm run typecheck
  • native pre-push formatting/type/build gate

Includes a patch Changeset.

@bokelley
bokelley marked this pull request as ready for review September 18, 2026 11:04

@aao-secretariat aao-secretariat Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ladon verdict: Approve

Approve

Decouples immutable canonical storyboard fixtures from the moving ADCP_VERSION pin by removing the protocol_version === ADCP_VERSION guard in scripts/sync-canonical-storyboard-fixtures.ts, while preserving every integrity check (source_tag, source_commit, bundle/file hashes, byte-exact verification). Ships a correctly scoped patch changeset and a hermetic regression test.

Checked:

  • Changeset present and correctly scoped (patch) for the build-affecting scripts/** change — satisfies changeset-vs-wire-impact.
  • No witness-not-translator violations: no fabricated fields or re-shaping; integrity checks retained.
  • No transport-client concerns (no src/lib/protocols/ or src/lib/client/ changes).
  • New regression test covers the added behavior.

No blocking or Medium findings. high_risk false, gated_paths false, no no-auto-approve team match, no prior decision. Note: review_decision is REVIEW_REQUIRED, but that only forces escalation when gated_paths is true (row 2) — it is false here, so the PR falls through to row 9.

@bokelley
bokelley merged commit a1548f4 into main Sep 18, 2026
39 checks passed
@bokelley
bokelley deleted the conductor/decouple-fixture-provenance branch September 18, 2026 11:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant