[bokelley]

The CTV experience and premium display validation storyboards admitted controller-only agents through the OR semantics of required_tools. Both now require validate_input while retaining requires: [controller], fixture seeding, phases and validator checks.

Live local MCP discovery and adapter replay prove /brand and /governance do not implement validate_input. Reconstructing the old gates yields exactly 14 CTV and 18 premium-display passing product seed steps on each tenant; every validator step skips as missing_tool. The corrected gates produce 0P / 1S, so both synchronized ratchet sources adjust only current passing-step floors: brand 115→83, governance 160→128. All clean-storyboard floors, other tenants, 3.0 compatibility floors and required-exact checks stay unchanged.

Failure evidence is retained from the original head: brand: 83/115 and governance: 128/160. Those failed jobs were not retried. Fresh CI grades the corrected head.

Tests cover source and a freshly built publication-shaped bundle: controller-only exclusion, validator inclusion, fixture-unavailable remaining untested, and genuine validator failures remaining failures. A live-router regression proves the exact 32-step setup-only loss; synchronized ratchet tests pin every tenant's current and 3.0 floors. The other 61 mixed controller gates were inventoried and remain unchanged.

Related issue: #7404

This patch alone does not complete the tracking issue. Retain the landing/deployment order: #7506 human-land + web/worker deploy -> #7510 human-land/deploy -> this #7541 human-land/deploy so /compliance/latest contains the corrected 3.2 gates -> refresh/requalify #7507 -> #7507 human-land/deploy -> repeated public-card verification.

Scope: eight tracked files: two one-line YAML gate removals, original focused test and patch changeset, two synchronized ratchet sources, and two existing regression test files. No migration, dependency, release-version or immutable release artifact changes. Generation rebuilt only ignored dist/compliance/latest/ (485 files) and dist/schemas/latest/ (1,612 files); required documentation snippets regenerated identically. Tracked generated diff: zero.

Validation: both full exact local matrices met all tenant floors and required checks (current source and frozen 3.0.26). Brand: 56 clean/83 passing; governance: 57 clean/128 passing. Focused source/bundle, live-router, synchronized ratchet, SDK capability, build/artifact immutability, changeset, shell syntax, diff and type checks passed. Proportionate correction commit hooks passed, including 1,075 root tests and repository typechecks. Independent read-only semantic and metadata review found no code blockers.

Exact reviewed head: 82eb1f3c069a14f2b9b5213285b0503f7cc5a1bb; tree: e1fd475e5f867b234bfb668c64a30b26ed223ef7; sole parent: cdcc8f996e8acd2417d5f7a547711cd21929289b. The exact validated tree was squashed without changing files, and every PR-range commit message was checked for issue-closing syntax.

Preserved row failures: reporting_core (10P/1F/11S) and account_change_feed (3P/1F/13S) match the previous head’s CI. The local audience_buy_flow run additionally reports fetch failed (6P/1F/2S); old CI passed that row (9P/0S), so this remains an unexplained local transport failure. Relevant storyboards, training-agent runtime, runners and lockfile are identical across pinned main, the previous head and the corrected head. No retries or grading changes were used to hide these results; matrix-floor success does not mean every storyboard passed.

Fresh exact-head CI completed successfully: Training Agent Storyboards (attempt 1) and Build Check. Every reported PR check is now successful or intentionally skipped. Current brand passed 83/83 and governance 128/128; both corrected storyboard rows are 0P/1S on each tenant. This is a CI gate result, not approval to land or deploy.

Publication controls: Draft/open, auto-merge off, no requested reviewers, no closing issue references. The corrected branch is a single squashed commit on pinned main; the previous commit with unsafe issue-linking metadata is absent from the PR ancestry. No merge, deployment, release or issue closure is authorized.

[aao-secretariat]

Ladon verdict: Escalate to human review

Escalate — gated path requires human/CODEOWNERS review.

This PR modifies .github/workflows/training-agent-storyboards.yml, which matches the deterministic hard approval gate glob .github/workflows/** (gated_paths: true). The current review_decision is REVIEW_REQUIRED, not APPROVED, so per decision rule row 2 the gate is NOT satisfied and the outcome must be escalate.

Escalation reasons:

• .github/workflows/training-agent-storyboards.yml (modified) is under a hard approval gate (.github/workflows/**). review_decision is REVIEW_REQUIRED — a human/CODEOWNERS approval is required before this can merge.

No blocking code findings otherwise: the reviewer confirms a narrow, well-tested correction of the CTV and premium-display validate_input gates (removing comply_test_controller from required_tools to close the OR-gate, consistent ratchet floors across workflow/matrix.sh/sharding test, properly scoped errata-class changeset, no immutable-artifact edits). No Critical/High/Medium findings. Once a human approval lands, this would fall through to approve on the merits.

Why human review

• .github/workflows/training-agent-storyboards.yml (modified) matches gated path .github/workflows/** — hard approval gate; review_decision is REVIEW_REQUIRED, so human/CODEOWNERS approval is required before merge.
• This PR touches a path under a hard, non-overridable approval gate (.github/workflows/training-agent-storyboards.yml (modified) matches .github/workflows/**) and the current GitHub review decision is 'REVIEW_REQUIRED', not APPROVED. This is a hard gate enforced in code — Ladon cannot auto-approve until a human/CODEOWNERS approval is recorded, regardless of how clean the diff is.