docs(governance): state DR-0036 as a decision; corrections live in the register by KonstantinMirin · Pull Request #8777 · adcontextprotocol/adcp

KonstantinMirin · 2026-11-06T18:16:11Z

DR-0036 had grown into a ledger. Besides the rule, it held a section and a per-location table for each correction, and it required every new correction to amend the record. The decision-record README asks for three short sections and says a record is amended only to fix errors or mark supersession. This PR rewrites DR-0036 to state the decision only. The register of corrections is scripts/lint-additive-minor-corrections.json, which already held every location.

The record is still proposed, so this is the text to ratify.

The decision

A closed schema stays closed for the whole major. No later minor or patch adds a property to it, even for peers that negotiated the newer minor, and even for an experimental property.
A minor changes a schema only by addition. It removes no property, requires no new name, and tightens no bound.
Corrections and named exceptions are the only departures. Each one is an entry in the register: the location, the change, the release, and the published text it rests on, quoted. The check accepts exactly those entries. A PR that adds one is reviewed against DR-0036.
There are two kinds of correction. Both make a schema match what the published text of the major already says:
1. Open a schema that the published text keeps open. DR-0019 keeps roots, capability blocks, and containers open, and calls a class B schema without an escape hatch a defect. From the release that opens it, it's an open schema.
2. Bound a concept the way the published text bounds it. A bound or required name that the text, a schema of the major, or a named standard (such as RFC 1035) sets for a concept holds wherever the concept appears.
A named exception lets a request schema that DR-0019 keeps closed accept a named property, when the name requires a capability the receiver declares and a sender MUST NOT send it otherwise.

The two kinds of correction cover what (a) to (d) recorded as separate cases. Category 2 states once the reasoning that (b), (c), and (d) each argued on its own.

Other changes

The lint check: it no longer parses correction tables out of the record. It still checks that the register names an existing record, that each source quote is in its file, the release of each entry, and that each change is applied exactly.
The register: a new $comment. The 71 reasons that began "Correction (a) of DR-0036:" now begin with the kind, such as "Opens a schema closed in 3.2 against DR-0019."
Tests: the four tests of the table cross-check are removed, and no test reads the record's prose. 89 tests.
Docs: the 3.2 to 3.3 and 3.1 to 3.2 migration guides, the versioning page, the 3.3 beta page, the release notes, and What's new describe corrections by kind instead of by letter. Five sentences that said "a minor release never changes a closed schema" now say "adds no property to a closed schema", which stays true with corrections.
DR-0019: its two notes on DR-0036 now match the new text.
Release notes for 3.3.0: two .changeset/pre/ entries cited correction letters that no longer exist, so they now say "a correction under DR-0036".
Changeset: patch. No schema changes.

After this lands

#8536 and #8772 each add a section and a table to DR-0036 today. They'll drop those edits and keep only their register entries.

Checks

node --test tests/lint-additive-minor.test.cjs: 89 of 89 pass.
ADCP_ADDITIVE_MINOR_BASELINE_REF=origin/main node scripts/lint-additive-minor.cjs: pass, 0 new findings.
npm run test:schemas, the docs navigation and link checks, and the changeset scope check pass.
The pre-commit hook passed in full.

…e register DR-0036 states the rule and its departures: a closed schema stays closed for the major, a minor changes a schema only by addition, and the only departures are corrections and named exceptions. A correction either opens a schema that the published text keeps open or applies a bound or required name that the published text already sets. The record no longer lists corrections location by location. scripts/lint-additive-minor-corrections.json is the register. The additive-minor check no longer parses correction tables from the decision record; it still requires the register to name an existing decision record, verifies each quoted source, and accepts exactly the listed changes. Each reason names its kind of correction in place of a correction letter. DR-0019's amendment note, the 3.3 release docs, the migration guides and the versioning page describe corrections by kind.

mintlify · 2026-11-06T18:16:16Z

Preview approval required

This pull request comes from a fork, so Mintlify won't build a preview until someone with write access approves commit b8dc28f.

Approve preview

aao-secretariat

Ladon verdict: Comment (human reviewer recommended)

Comment — governance/documentation refactor of DR-0036; one cross-cutting governance note for human eyes.

No blocking findings. The reviewer examined all 15 files and found no code-correctness issues. The lint change is clean (recordedCorrections/checkCorrectionsRecorded and coupling tests removed with no dangling references, replaced by checkCorrectionsDecision), no static/schemas/source/** touched, a patch changeset is present, and the baseline pointer resolves.

Why not approve: This PR decides a question of protocol governance convention rather than implementation — it intentionally removes the CI coupling that forced each JSON correction to also appear in DR-0036's tables, meaning a new correction no longer requires a governance-record edit. The reviewer flags this as deliberate but awaiting WG ratification. Governance-record changes that alter spec-correction policy are a human-ratification act, and review_decision is REVIEW_REQUIRED, not APPROVED. A human should confirm the WG has ratified loosening this coupling before merge.

High-risk flag: true only because docs/reference/** files were modified (not added/deleted). No medium-or-higher finding on those modified files, so the flag alone does not escalate.

A human reviewer should sign off on the governance-coupling change before this merges.

KonstantinMirin · 2026-11-07T16:27:13Z

Hi Brian, DR-0036 had turned into a ledger: every correction added a section and a table, and the record required that. The decision-records README asks for three short sections and says a record is amended only to fix errors or mark supersession, so I've rewritten it to state the decision only. Since it's still proposed, this would be the text to ratify. The corrections themselves now live only in scripts/lint-additive-minor-corrections.json, which already held every location, and the check reads them from there.

Two pieces of rule text are new compared to main, and I'd value your read on both:

Bounding a concept as the published text bounds it. One sentence now covers what (b), (c) and (d) each argued separately, and the bounds in schemas: give every repeated constraint one definition, and fail CI on any repeat (#8525) #8536.
Named exceptions, from the Minor releases sometimes break older buyers, and our versioning rules disagree about whether that's allowed #8501 discussion: a request schema that stays closed may accept a name that requires a capability the receiver declares.

#8536 and #8772 build on this and now add only register entries, so this one would go first. I'd love all three in 3.3. If you agree, could you add them to the milestone?

aao-secretariat

Ladon verdict: Approve

Approve — editorial/terminology normalization only.

Checked: Delta is 84 net lines across 3 effective files, all editorial. "oneOf arm" → "oneOf branch" terminology normalized across six descriptive reason strings in scripts/lint-additive-minor-corrections.json (descriptive text, not matcher-load-bearing), plus two docs prose clarifications ("answered in a shape its validator rejects" → "answered with a response its validator rejects"; "Planned shape" → "Planned schema"). No schema, wire-shape, or lint-logic changes; no changeset-scope concern; no oneOf discriminator regression; no released-artifact mutation.

Decision-table walk: No critical/high findings (row 1 n/a). gated_paths is false (row 2 n/a). high_risk is true but all high_risk_reasons are (modified) docs pages with no medium-or-worse finding on them — no (deleted) entries (rows 3, 5 n/a). No medium findings at all (rows 4, 8 n/a). Prior decision was comment, not escalate (row 6 n/a). No no-auto-approve team match (row 7 n/a). Falls through to row 9 → approve.

No breaking-class change present, so the breaking-change hard gate does not apply. The high_risk flag here is heuristic only (modified docs pages) and the reviewer found nothing actionable.

bokelley · 2026-11-09T16:51:55Z

@KonstantinMirin, the working-group session on Mon 2026-11-09 reversed DR-0036's direction, so this rewrite is superseded by #8858.

The decision

Schemas are open within a major.
A schema is closed only for a structural reason: oneOf disjointness, a closed key set or vocabulary, or a signed or binding payload.
3.x schemas closed without such a reason are opened as a correction, in 3.3 and in a 3.2.x patch.
Once opened, a schema takes additions in later minors.

What #8858 keeps from this PR

The record's shape. DR-0036 states the rule and leaves entries to scripts/lint-additive-minor-corrections.json.
Your definition of a correction that bounds a concept as the published text bounds it. It covers the existing required: status, task_id and message entries.

Where the rest goes. Your lint change, which stops cross-checking the register against tables in the record, and your "Applies the bound / required name the published text sets" wording for the register reasons are going into the schema-opening PR for #8501, since that PR owns the lint.

What #8858 drops

Named exceptions: request schemas are open now.
The "closed for the whole major" rule.

The PR credits you for the structure. I'm leaving this PR open for you to close.

🤖 Generated with Claude Code

…aw DR-0032 and DR-0033 The working-group session of 2026-11-09 reversed DR-0036's draft rule that a closed schema stays closed for the whole major. DR-0036 now records the decision: schemas are open within a major, and a schema is closed only for a structural reason (oneOf disjointness, a closed key set or vocabulary, or a signed or binding payload). Opening a 3.x schema closed without such a reason is a correction that 3.3 and a 3.2.x patch make. The record states the rule and leaves entries to the corrections register, following Konstantin Mirin's rewrite in #8777. - DR-0019 is superseded by DR-0036. - DR-0032 and DR-0033, proposed in #8519 and never ratified, are recorded as withdrawn in favor of the versioning rules of #8704, so their IDs stay reserved. - versioning.mdx drops "closed schemas stay closed until the next major" and describes opening as a correction, including in patches. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Brings the branch up to date with main at 867fdce (3.3.0-beta.5, match keys, the dependency bumps, and the compliance fixes since a00249e). Five files conflicted. Every other file merged cleanly. Resolution ledger Mechanical (resolved by measuring the merged tree, not by choosing a side): - tests/capabilities-structural-bounds.test.cjs and docs/building/by-layer/L1/security.mdx: the documented worst case is the figure scripts/capabilities-structural-bounds.cjs computes in 4.0 mode on the merged tree: 99,051,189 bytes (about 94 MiB), with 108 open positions. That is main's 99,100,981 plus this branch's -49,792, which adds up exactly. The block sizes and the open-position count in security.mdx keep main's text, which the merged measurement confirms (media_buy 34 MiB, creative 27 MiB, 108 open). - tests/mcp-schema-projection.test.cjs: PARITY_COMPILE_LIMIT is set from the merged measurement. The compliance test controller request measures 1,461,855 bytes with match keys on top of the named schemas, so the bound is 1,462,000. The comment keeps both histories: main's match-keys step and this branch's naming steps. The other bounds hold on the merged tree without a change: total projection 26,016,883 bytes under 25 MiB, media-buy model context 560,534 bytes under 549 KiB, creative 452,770 bytes under 443 KiB. Semantic (both sides kept): - package.json: main's version (3.3.0-beta.5), dependency bumps and test:auction-only-compliance list, and its new tests/match-keys entry in test:schemas. This branch's schemas:normalize, test:schema-named-constraints, test:schema-extraction, and its tests/named-schema-extraction entry in test:schemas. The merged test:schemas list is main's list plus that one file. package-lock.json is main's, unchanged; npm ci installs from it. - docs/reference/3-3-beta.mdx: the DR-0036 row takes this branch's wording of what a minor may change and its corrections list with adcontextprotocol#8536, and main's status (goes to ratification at the 2026-11-09 working-group session). Main's new DR-0037 row follows it. Merged without conflict, checked against the merged tree: - core/match-key.json, enums/match-key-use.json, the match_keys additions to core/product-identity.json, core/product.json, protocol/get-adcp-capabilities-response.json and trusted-match/provider-registration.json already reference named schemas (uid-type, brand-ref, reach-unit, property-type, ext). The named-constraints gate reports no inline copy and no repeated constraint on the merged tree, so no site needed a reference. - index.json takes both sides' registry entries. - The migration guide, release notes and What's new keep main's beta.4 and beta.5 sections and this branch's DR-0036 corrections text. Checks on the merged tree, against main and the pre-merge branch: build:schemas, typecheck, test:schemas (1,172 passed; main 1,168, the branch 1,165; 1 skipped, the on-demand extraction proof), test:additive-minor (0 new changes against 3.2.8; 89 passed, as on the branch, where adcontextprotocol#8777 replaced 4 tests that read correction tables from DR-0036 with 1), test:composed, test:json-schema, test:schema-named-constraints (35), test:mcp-schema-projection (42), the structural-bounds test (26), test:oneof-discriminators, test:platform-agnostic, test:unit (1,282 vitest tests), and tests/match-keys (7).

Under the WG decision of 2026-11-09 and the rewritten DR-0036, schemas are open by default and a schema stays closed only for a structural reason. The additive-minor lint now matches: - property-added-to-closed fires only where the schema is closed in both the base and the candidate. Opening a schema, and adding to one the candidate opens, passes. - The closed-anywhere-in-the-major rule goes: closedInEarlierReleases, the "(closed in X)" findings and the released exemption. - Corrections only tighten a bound or require a name the published text already set. The 24 whole-schema reopen entries go; an entry that lets in a property is an error. - Openings print one notice line with the count. - Removals, renames, retypes, enum removals, bound tightening, new required names and closing an open schema still fail. The baseline drops the 34 entries this resolves and keeps 4, each with its resolution: metric_id and the two sla-window fields sit on schemas that stay closed (signed commercial terms), and evaluator is restored. Also ports the DR-0036 cross-check removal from #8858 (from Konstantin Mirin's #8777): the corrections list names its decision record, which no longer lists entries. Co-authored-by: Konstantin Mirin <konstantin.mirin@gmail.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

KonstantinMirin · 2026-11-10T13:03:00Z

I'd recommend closing this as superseded by #8858 for the DR-0036 text and by #8866 for the lint change. One leftover from the old rule is in two docs pages that neither PR touches, and I've noted it in my review on #8866.

…aw DR-0032 and DR-0033 The working-group session of 2026-11-09 reversed DR-0036's draft rule that a closed schema stays closed for the whole major. DR-0036 now records the decision: schemas are open within a major, and a schema is closed only for a structural reason (oneOf disjointness, a closed key set or vocabulary, or a signed or binding payload). Opening a 3.x schema closed without such a reason is a correction that 3.3 and a 3.2.x patch make. The record states the rule and leaves entries to the corrections register, following Konstantin Mirin's rewrite in #8777. - DR-0019 is superseded by DR-0036. - DR-0032 and DR-0033, proposed in #8519 and never ratified, are recorded as withdrawn in favor of the versioning rules of #8704, so their IDs stay reserved. - versioning.mdx drops "closed schemas stay closed until the next major" and describes opening as a correction, including in patches. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Under the WG decision of 2026-11-09 and the rewritten DR-0036, schemas are open by default and a schema stays closed only for a structural reason. The additive-minor lint now matches: - property-added-to-closed fires only where the schema is closed in both the base and the candidate. Opening a schema, and adding to one the candidate opens, passes. - The closed-anywhere-in-the-major rule goes: closedInEarlierReleases, the "(closed in X)" findings and the released exemption. - Corrections only tighten a bound or require a name the published text already set. The 24 whole-schema reopen entries go; an entry that lets in a property is an error. - Openings print one notice line with the count. - Removals, renames, retypes, enum removals, bound tightening, new required names and closing an open schema still fail. The baseline drops the 34 entries this resolves and keeps 4, each with its resolution: metric_id and the two sla-window fields sit on schemas that stay closed (signed commercial terms), and evaluator is restored. Also ports the DR-0036 cross-check removal from #8858 (from Konstantin Mirin's #8777): the corrections list names its decision record, which no longer lists entries. Co-authored-by: Konstantin Mirin <konstantin.mirin@gmail.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(schemas): fold in #8772's capability-block and container openings Brings over the schema, test and doc changes of #8772 by Konstantin Mirin: the daypart window, the overlay requirement and support containers, spot reporting and canonical reporting capabilities open; boolean demographics becomes the deprecated 3.2 shorthand for { age: true }, so only gender support satisfies a gender requirement. The DR-0036 register entries and the named exception from #8772 are left out: the next commits open these schemas under the WG decision of 2026-11-09, which needs neither. Co-authored-by: Konstantin Mirin <konstantin.mirin@gmail.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(schemas): open the 3.3 schemas that were meant to be open The WG decided on 2026-11-09 that 3.x opens the schemas that were meant to be open: closing a schema only breaks hard-coded validators, so opening one is not a protocol break. additionalProperties goes from false to true at 784 of the 859 closed locations in the source tree. Nothing else in those schemas changes. 75 locations stay closed for a structural reason: oneOf branches told apart only by key presence (a2ui bound-value, brand.json), the signed commercial terms that terms_digest binds, metric qualifiers and forecast dimensions (join keys), the canonical installment identity, the JWS response envelope, the TMP match requests and the not-found error (privacy boundaries), the reporting-destination setup action, and patternProperties maps keyed by IDs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(schemas): keep the privacy clamps closed; drop closure claims from opened schemas The per-agent PERMISSION_DENIED details and the failed and unconfigured get_principal results stay closed: their descriptions make the closed shape the clamp against an existence or commercial-state oracle. Descriptions of schemas that are now open no longer say they are closed or reject unknown members. The metric qualifiers stay closed, so their descriptions now say new keys ship in a major release, not in a minor. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(lint): flag additions only to schemas that stay closed Under the WG decision of 2026-11-09 and the rewritten DR-0036, schemas are open by default and a schema stays closed only for a structural reason. The additive-minor lint now matches: - property-added-to-closed fires only where the schema is closed in both the base and the candidate. Opening a schema, and adding to one the candidate opens, passes. - The closed-anywhere-in-the-major rule goes: closedInEarlierReleases, the "(closed in X)" findings and the released exemption. - Corrections only tighten a bound or require a name the published text already set. The 24 whole-schema reopen entries go; an entry that lets in a property is an error. - Openings print one notice line with the count. - Removals, renames, retypes, enum removals, bound tightening, new required names and closing an open schema still fail. The baseline drops the 34 entries this resolves and keeps 4, each with its resolution: metric_id and the two sla-window fields sit on schemas that stay closed (signed commercial terms), and evaluator is restored. Also ports the DR-0036 cross-check removal from #8858 (from Konstantin Mirin's #8777): the corrections list names its decision record, which no longer lists entries. Co-authored-by: Konstantin Mirin <konstantin.mirin@gmail.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(lint): cover the open-by-default additive-minor rule Drops the tests of the earlier-release closure, the released exemption and the reopen and property corrections, moves the correction checks onto bound fixtures, and adds cases for additions to schemas closed on both sides, opened, or open, for closing an open schema, and for a correction that lets in a property. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(schemas): keep the reporting-status and billing-permission clamps closed The 3.2.10 backport found two more privacy clamps: - get_reporting_status's Unavailable lookup failure is closed in every 3.2 release; #8547 opened it during the 3.3 betas. Its caller isolation text requires unknown and unauthorized identifiers to use one identical lookup_unavailable shape, so it closes again with the envelope fields redeclared as 3.2.8 does. The Operational failure branch stays open; its failure_kind const keeps the two apart. - BILLING_NOT_PERMITTED_FOR_AGENT details stay closed, as PERMISSION_DENIED's per-agent details do: their description calls extra keys commercial-state oracles. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: say schemas are open by default; restate the closed ones' reasons The 3.2 to 3.3 migration guide's "Closed schemas stay closed within a major" section becomes "Schemas are open by default": what opened, the structural reasons the rest stay closed, and what it means for validators, generated types and 3.2 peers. The 3.3 beta page, What's new, the release notes and the 4.0 compatibility guide follow. Pending changesets that cited "a minor never changes a closed schema" or a lettered DR-0036 correction now cite the structural reason (commercial_terms is signed) or DR-0024. Adds the changeset for the opening. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(schemas): keep trust.json and placement-presentation closed Both are security-sensitive documents whose closure keeps out an open-ended class of content that no list of names could cover: - trust.json sits on the signature-verification fetch path, and signing keys are published only in the key directory, so its records, agents, grants and acknowledgements carry no key material (jwks_uri, key pins, signing profiles) and no undeclared authority. - placement-presentation is a declarative, non-executable frame that consumers render, so it carries no markup or script. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: count the 100 locations that stay closed Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(schemas): keep principal results, reporting destinations and hard budget bounds closed - get_principal and sync_principal results keep their closed branches: no branch may become an oracle for another principal's existence or state, and a dry run issues no durable identifier. - Reporting destinations are credential-free by contract, and closure rejects credentials under any name. - proposal-budget-constraint is the strict peer of budget-range: a seller that ignored an unknown member of a hard constraint would violate a constraint it never read. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: count the 116 locations that stay closed Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(schemas): keep the reporting-status lookup_unavailable branch open Every response root and status branch accepts every envelope field (#8547), so the Unavailable lookup branch can't close without redeclaring the envelope, which the composition rule forbids. main's shape already carries the caller-isolation clamp: the error objects stay closed, the message is a const, and the ledger and account fields are rejected by name. The branch goes back to that shape; only its nested error objects stay closed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(security): count the capability blocks 3.3 opens as open positions The worst-case capabilities document is unchanged at 99,100,981 bytes; its open positions go from 108 to 190. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(schemas): name the fields closure used to reject in opened schemas Where a closed schema also rejected a specific field the protocol defines elsewhere, or one its text forbids there, the opened schema now rejects it by name in a not/anyOf/required clause, as #8531 did for canonical-product. Examples: trackers, landing_page_url and weight stay off unassign, replace and merge; hold entries carry no expires_at; a reporting revision carries no destination_ref; delivery-ready webhooks carry no access_token; SDK metadata carries no self-asserted approval; an attestation presentation carries no evaluator decision; requirement branches reject seller maxima. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: expect opened schemas to accept unknown keys Tests that asserted generic closure (an undeclared key is rejected, or additionalProperties is false) now assert the opened behaviour. Tests that reject a named field are unchanged and pass through the schema's named rejection. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(schemas): keep key-presence anyOf unions apart by name Opening the branches of an anyOf that was told apart only by which keys are present lets one payload carry both forms. Each branch now rejects the other's keys by name: - canonical-account-ref: the account_id form rejects brand and operator, and the natural-key form rejects account_id; - geo-region requirement and support: all_values and values exclude each other per country; - the deprecated fused-system postal area rejects country; - a sync_reporting_receipts result carries a receipt or an adjustment receipt, not both. Also names step on frequency-cap impression constraints and mode on list application receipts, matching the 3.2.10 backport. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: finish the open-schema test fallout - mcp-schema-projection: PARITY_COMPILE_LIMIT 1,384,000 -> 1,385,000, measured (the named rejections add 395 bytes to the comply-test-controller closure); the list_products legacy-graph check strips the new format_ids and v1_format_ref prohibitions as it strips canonical-product's. - Unknown-key cases that are now accepted: entries_total on list receipts, an unknown geo_countries support key, response_due_at and completion_due_at on issue receipts, the bucket_completness typo, and an unexpected publisher targeting key-value config key. - New canonical-account-ref test: account_id and the natural key exclude each other, and an unknown key is accepted. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(training-agent): keep tools/list within budget and ignore unknown declarations - tools/list discovery schemas omit `additionalProperties: true` inside bundled definitions. It is JSON Schema's default and carries no information, and dropping it keeps the four-tool surface under its 162 KiB budget once the named rejections land. The root keeps the keyword, which the parity test compares with the source. - The parity test compares openness instead of the literal keyword. - sync_principal keeps only the declaration axes the seller reads, so an unknown declarations member is ignored rather than stored and read back. An unknown section is still refused (UNSUPPORTED_FEATURE). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(schemas): address review on named rejections and key-presence guards From Konstantin Mirin's review of #8866: - Key-presence guards on two more unions: account-ref's account_id and natural-key forms exclude each other (as canonical-account-ref does), and image bleed's uniform and per-side forms exclude each other. canonical-account-ref's account_id form also rejects operator_unit, currency, timezone and sandbox, and a failed receipt result carries no receipt. A rescan of every oneOf and anyOf finds no other key-presence union. - Named rejections now cover only names the protocol defines elsewhere or forbids there. Dropped: step, covered (two nodes), gpc_honored, political, threshold_rate, per_ad_spend, verified (two nodes) and mode on list receipts. access_token on the delivery-ready webhook stays as a credential clamp. - Every node or union with a named rejection says in its description what it rejects and why, since generated types can't express not. - The get_principal current branch and the sync_principal applied and validated branches open: they return the caller's own configuration and are dispatched by kind. The validated branch rejects destination_ref and configuration_version, because a dry run issues no durable identifier. recognized, unconfigured and failed stay closed. - The reporting-status lookup_unavailable branch states its clamp. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: call the commercial terms a hold until 4.0; carry #8772's doc hunks From Konstantin Mirin's review of #8866: - The commercial terms and proposal-budget-constraint are held closed until 4.0, not closed for a structural reason. terms_digest covers every member at every depth, open ones included, so the docs no longer claim that closure stops a 3.2 buyer accepting a term it ignored. - The boolean demographics deprecation reaches the 3.2 to 3.3 summary and Deprecations list, and the 4.0 guide's removal count and seller-emitted list, as #8772 had them. - target_audiences sits beside audience_evidence_requirements because one names which audience and the other the evidence quality, not because the requirements object was closed. - 3.2.10 opens all but one of 3.2's locations: it keeps the lookup_unavailable branch closed. The get_principal current and sync_principal applied and validated results open, so 747 locations open and 112 stay closed. - The lint hint points to the corrections register again and says a correction sets a bound or a required name. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: flip probes for dropped rejections; add account-ref and bleed guards From Konstantin Mirin's review of #8866: - Probes for names the protocol never defines (step, mode on receipts, covered, gpc_honored, political, threshold_rate, per_ad_spend, verified) now expect the opened schema to accept them. - New tests: account-ref and image bleed key-presence guards, and the extended canonical-account-ref guard. - The list_products legacy-graph check skips not subtrees and descriptions structurally, instead of matching serialized strings. - The model-context projection omits named rejections beside declared properties, as it omits bounds: they are validation, and the descriptions carry them. A bare not branch of a union stays. The media-buy budget is unchanged; PARITY_COMPILE_LIMIT is 1,386,000, measured. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore(lint): prune the additive-minor baseline to base 3.2.9 The 3.2.9 forward-merge makes 3.2.9 the default base. The 4 recorded entries are unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: point the backport to the next 3.2.x patch; drop stale closure claims 3.2.10 shipped without the open-schemas backport, so the changeset and the migration guide now say the next 3.2.x patch (#8864) opens 3.2's locations, all but one. Docs that still called opened objects closed now match the schemas: the refine scope branches (a stray id fails on the missing product_id), policy entries, sync_plans plan items, and the account-ref variants. Where the reason was the commercial terms, the docs say they are held closed until 4.0. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: regenerate compliance symbol links on get_products Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: describe the account-ref guard errors, not additionalProperties Merged variants now fail on the named rejection (not) or a missing required name, and a budget object fails on type. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(schemas): reserve the plan_hash bookkeeping names on sync_plans plans The opened sync_plans plan item accepted the governance agent's bookkeeping names: version, status, syncedAt, revisionHistory, committedBudget and committedByType. The plan_hash profile strips exactly those names from its preimage, so a buyer value under one of them would sit outside the hash and could collide with state the agent manages. The plan item now rejects them by name, and its description says they are reserved and a buyer MUST NOT send them. The list matches the profile's closed "Excluded fields" list. No storyboard, fixture or request example sends them. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(3.3): say the commercial terms are held closed until 4.0 whats-new and the release notes no longer give the signed commercial_terms as the example of a structural reason: the rest stay closed where closure enforces something, and commercial_terms is held closed until 4.0. experimental-status no longer calls the buy_products purchase input and the list_products offer_filters closed; both are open in 3.3 and gain target_audiences in 4.0, with the accepted product-purchase snapshot. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore(lint): describe the commercial terms as held closed until 4.0 The withdrawn-to-4-0 test comment, the additive-minor baseline $comment and the lint header drop the structural-reason framing for the commercial terms. All four baseline entries sit in commercial-terms schemas. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(refinement): match the troubleshooting heading to the error it shows The heading quoted "must NOT have additional properties" while the body shows the missing product_id error. The body no longer says every scope branch requires its own identifier: the request scope requires ask. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Konstantin Mirin <konstantin.mirin@gmail.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

…aw DR-0032 and DR-0033 The working-group session of 2026-11-09 reversed DR-0036's draft rule that a closed schema stays closed for the whole major. DR-0036 now records the decision: schemas are open within a major, and a schema is closed only for a structural reason (oneOf disjointness, a closed key set or vocabulary, or a signed or binding payload). Opening a 3.x schema closed without such a reason is a correction that 3.3 and a 3.2.x patch make. The record states the rule and leaves entries to the corrections register, following Konstantin Mirin's rewrite in #8777. - DR-0019 is superseded by DR-0036. - DR-0032 and DR-0033, proposed in #8519 and never ratified, are recorded as withdrawn in favor of the versioning rules of #8704, so their IDs stay reserved. - versioning.mdx drops "closed schemas stay closed until the next major" and describes opening as a correction, including in patches. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

bokelley · 2026-11-12T15:11:39Z

Closing as superseded by #8858, per the comment above: the working-group decision of 2026-11-09 reverses this rewrite's direction. #8858 keeps this PR's record structure and its definition of a correction that bounds a concept. #8866 took its lint change and register wording. Thanks @KonstantinMirin.

…aw DR-0032 and DR-0033 (#8858) * docs(governance): DR-0036 records open schemas within a major; withdraw DR-0032 and DR-0033 The working-group session of 2026-11-09 reversed DR-0036's draft rule that a closed schema stays closed for the whole major. DR-0036 now records the decision: schemas are open within a major, and a schema is closed only for a structural reason (oneOf disjointness, a closed key set or vocabulary, or a signed or binding payload). Opening a 3.x schema closed without such a reason is a correction that 3.3 and a 3.2.x patch make. The record states the rule and leaves entries to the corrections register, following Konstantin Mirin's rewrite in #8777. - DR-0019 is superseded by DR-0036. - DR-0032 and DR-0033, proposed in #8519 and never ratified, are recorded as withdrawn in favor of the versioning rules of #8704, so their IDs stay reserved. - versioning.mdx drops "closed schemas stay closed until the next major" and describes opening as a correction, including in patches. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(versioning): a deprecation needs no minimum notice before a major removes it Brian O'Kelley ruled on 2026-11-10 that a deprecation needs no minimum notice period before its removal in the next major. A deprecated feature is never removed within the major that deprecated it. The next major may remove it with no minimum notice, because removals are what a major is for. The previous major's support window of at least 12 months after the successor's GA protects implementers. Experimental surfaces keep their 6-week notice within a major. The ruling is open for working-group comment on RFC #8756 until 2026-12-04. The versioning page's deprecation policy, the cadence table, the specification lifecycle (text and diagram), and the pages that cited the 6-month notice now say so. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(schemas): the seller_id alias descriptions cite the deprecation policy without a notice period The deprecated `seller_id` alias on `sync_event_sources` and `sync_audiences` results said its removal was "subject to the deprecation policy's six-month notice window". Under the 2026-11-10 ruling the policy sets no minimum notice before a major removes a deprecated field, so the descriptions now say "subject to the deprecation policy". Description-only; no validation change. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

This was referenced Nov 6, 2026

fix(schemas): open the capability blocks and containers 3.3 extends, against DR-0019 (#8501) #8772

Open

schemas: give every repeated constraint one definition, and fail CI on any repeat (#8525) #8536

Open

KonstantinMirin marked this pull request as ready for review November 7, 2026 16:21

aao-secretariat Bot reviewed Nov 7, 2026

View reviewed changes

KonstantinMirin mentioned this pull request Nov 7, 2026

Minor releases sometimes break older buyers, and our versioning rules disagree about whether that's allowed #8501

Open

docs: say branch, schema and response, not arm and shape

b8dc28f

aao-secretariat Bot approved these changes Nov 7, 2026

View reviewed changes

KonstantinMirin added a commit to KonstantinMirin/adcp that referenced this pull request Nov 7, 2026

Merge the DR-0036 wording fix (adcontextprotocol#8777)

b114f6d

KonstantinMirin mentioned this pull request Nov 8, 2026

refactor(schemas): response schemas declare bodies only; generated status unions (discussion) #8565

Draft

bokelley mentioned this pull request Nov 9, 2026

docs(governance): DR-0036 records open schemas within a major; withdraw DR-0032 and DR-0033 #8858

Merged

This was referenced Nov 9, 2026

fix(schemas): open the 3.3 schemas that were meant to be open #8866

Merged

chore(release): derive the RC promotion line from package.json #8865

Merged

bokelley closed this Nov 12, 2026

Navigation Menu

Repository navigation

docs(governance): state DR-0036 as a decision; corrections live in the register - #8777

docs(governance): state DR-0036 as a decision; corrections live in the register#8777
KonstantinMirin wants to merge 2 commits into
adcontextprotocol:mainfrom
KonstantinMirin:governance/dr-0036-decision-only

KonstantinMirin commented Nov 6, 2026

Uh oh!

mintlify Bot commented Nov 6, 2026 •

edited

Loading

Uh oh!

aao-secretariat Bot left a comment

Uh oh!

KonstantinMirin commented Nov 7, 2026

Uh oh!

aao-secretariat Bot left a comment

Uh oh!

bokelley commented Nov 9, 2026 •

edited

Loading

Uh oh!

KonstantinMirin commented Nov 10, 2026

Uh oh!

bokelley commented Nov 12, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

KonstantinMirin commented Nov 6, 2026

The decision

Other changes

After this lands

Checks

Uh oh!

mintlify Bot commented Nov 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Preview approval required

Uh oh!

aao-secretariat Bot left a comment

Choose a reason for hiding this comment

Ladon verdict: Comment (human reviewer recommended)

Uh oh!

KonstantinMirin commented Nov 7, 2026

Uh oh!

aao-secretariat Bot left a comment

Choose a reason for hiding this comment

Ladon verdict: Approve

Uh oh!

bokelley commented Nov 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

KonstantinMirin commented Nov 10, 2026

Uh oh!

bokelley commented Nov 12, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

mintlify Bot commented Nov 6, 2026 •

edited

Loading

bokelley commented Nov 9, 2026 •

edited

Loading