[bokelley]

Refs #8501 (entries 11 and 12).

This merges only after the consent window closes on Fri 2026-11-13, before the 3.3 RC. static/schemas/source/** is Ladon-gated, so a human merges it.

Summary

3.3.0-beta.1 added clock and business_calendar_id to core/sla-window.json. 3.2 published that schema closed, and #8866 keeps it closed with the commercial terms until 4.0 (DR-0036), so a strict 3.2 validator rejects a 3.3 SLA. This PR puts sla-window back to its 3.2.8 shape and moves business time to the creative review SLA.

Rebased onto main after #8866. Per the #8501 re-triage, only entries 11 and 12 remain. The commit for entries 4 and 5 is dropped: #8866 opened core/media-buy-available-action.json and core/canonical-media-buy-action-fields.json, so review_sla on a buy action is an addition to an open schema and stays.

clock and business_calendar_id move to the creative review SLA

The signed terms reach sla-window through change_terms[].processing_sla, and 3.2.8 says sellers include weekends and non-working periods in the maximum.

• core/sla-window.json matches its 3.2.8 publication. Only $id differs.
• core/creative-review-sla.json no longer composes sla-window. It defines clock (default elapsed), business_calendar_id, response_max and completion_max itself. It keeps completion_max required, the business-clock if/then/else and the calendar and snapshot verifier constraints. It is open.
• core/escalation-sla.json loses clock. Its response_max gets a description, because the 3.2.8 sla-window text measures from buyer issuance, not seller receipt.
• media-buy/change-term.json: the processing_sla description is back to its 3.2.8 text.
• Description-only edits to x-entity-types, index.json and the get_adcp_capabilities business_calendars field.

Shared

• The two sla-window rows leave scripts/lint-additive-minor-baseline.json, which keeps 2 entries: metric_id (Minor releases sometimes break older buyers, and our versioning rules disagree about whether that's allowed #8501 entry 6) and evaluator (entry 26).
• Docs:
  • service commitments, proposal negotiation and product discovery;
  • one line each in the release notes and What's new in 3.3, describing the review-SLA feature;
  • one bullet in the 3.2 to 3.3 migration guide telling sellers built on beta.1 through beta.5 what to stop sending.
• One changeset, creative-review-business-clock.md (minor).

Wire effect.

• clock and business_calendar_id are accepted only on the creative review SLA: creative_policy.review_sla, and the review_sla on a creative action.
• An action's sla, a change term's processing_sla and the escalation SLA reject them, even clock: "elapsed", because 3.2.8 does.

For reviewers

• Release docs. docs(reference): bring the 3.3 release docs to 3.3.0-rc.0 #8883 owns the 3.3 release docs. This PR's lines in the release notes, What's new and the migration guide correct how the SLA feature is described, and they don't withdraw anything. Whichever of the two PRs lands second rebases onto the other.
• MCP parity bound. tests/mcp-schema-projection.test.cjs moves PARITY_COMPILE_LIMIT from 1,387,000 to 1,388,000 bytes. On main the comply-test-controller closure measures 1,386,397 bytes. This PR measures 1,387,457, because the review SLA now inlines its own durations and sla-window has its longer 3.2.8 descriptions back.

Testing

On the rebased tree (main 2dc672e316 + cb0ea9d135):

• npm run build:schemas: pass.
• npm run test:schemas: 1192/1192, plus premium-display 10/10 and geo-region 6/6. tests/service-commitments.test.cjs covers:
  • sla-window equals 3.2.8 apart from $id, and rejects clock and business_calendar_id;
  • creative-review-sla is open, clock defaults to elapsed, and business time works;
  • escalation rejects clock;
  • a change term with a business-clock or explicit-clock processing_sla is rejected;
  • a business-clock sla is rejected on all four action schemas.
• npm run test:mcp-schema-projection: 42/42.
• npm run test:examples: pass.
• npm run lint:additive-minor and npm run test:additive-minor: pass, 2 recorded, 0 new.
• Pre-push: changeset policy and docs validation (58/58 navigation tests) pass.

Local hook

The rebased commit was made with HUSKY=0, with the release coordinator's approval. The hook's server-unit stage (precommit:server-unit) hit its own 1500s timeout at load ~70, with no assertion failure, and was skipped for load. This PR touches no server file. CI is the gate.

I ran every other hook step by hand on the commit, and they pass: npm run test:unit, the dynamic-import, format-identity and callApi guards, npm run typecheck, and the image check.

🤖 Generated with Claude Code

[aao-secretariat]

Ladon verdict: Escalate to human review

Escalate — gated schema paths require human/CODEOWNERS approval.

The reviewer found a clean diff: the business clock fields (clock, business_calendar_id) are relocated off the now-closed core/sla-window.json onto core/creative-review-sla.json, restoring sla-window to its exact 3.2.8 byte-for-byte shape. creative-review-sla gets self-contained properties, kept-required completion_max, open additionalProperties (correct for a new 3.3 schema per DR-0009), and a correct if/then/else calendar constraint. Consumers are coherent, docs/migration/release-notes/lint-baseline are consistent, and the minor changeset is correct (additive vs stable 3.2.x). No Critical/High/Medium findings.

However, this PR modifies files under static/schemas/source/**, which are under a hard, deterministic approval gate (gated_paths: true), and review_decision is REVIEW_REQUIRED — not APPROVED. Per decision rule row 2, the gate is not satisfied and the outcome must be escalate. A clean diff does not lift this gate; only a real human/CODEOWNERS approval does.

Escalation reasons

• Modifies gated protocol-source schemas (static/schemas/source/core/creative-review-sla.json, core/escalation-sla.json, core/sla-window.json, core/x-entity-types.json, index.json, media-buy/change-term.json, protocol/get-adcp-capabilities-response.json) while review_decision is REVIEW_REQUIRED. Human/CODEOWNERS approval required before merge.

Why human review

• Modifies gated paths under static/schemas/source/** while review_decision is REVIEW_REQUIRED (not APPROVED) — human/CODEOWNERS approval required per hard approval gate.
• This PR touches a path under a hard, non-overridable approval gate (static/schemas/source/core/creative-review-sla.json (modified) matches static/schemas/source/**; static/schemas/source/core/escalation-sla.json (modified) matches static/schemas/source/**; static/schemas/source/core/sla-window.json (modified) matches static/schemas/source/**; static/schemas/source/core/x-entity-types.json (modified) matches static/schemas/source/**; static/schemas/source/index.json (modified) matches static/schemas/source/**; static/schemas/source/media-buy/change-term.json (modified) matches static/schemas/source/**; static/schemas/source/protocol/get-adcp-capabilities-response.json (modified) matches static/schemas/source/**) and the current GitHub review decision is 'REVIEW_REQUIRED', not APPROVED. This is a hard gate enforced in code — Ladon cannot auto-approve until a human/CODEOWNERS approval is recorded, regardless of how clean the diff is.