[bokelley]

Summary

Registers the published 3.1.33 compliance records on 3.2.x, following #8825, which did the same for 3.1.32.

@adcp/sdk 16.7.1 (latest / adcp-3.2) was published on 2026-11-12 at 18:07Z and ships the 3.1.33 compliance bundle. Since then, Build Check's "Check hosted compliance publication manifest" step has failed on every 3.2.x PR and push, including #8959 and the 3.2.11 Version Packages PR #8942 once it regenerates. main already registers 3.1.33 (#8852), so it doesn't need this.

What changes

These artifacts are taken unchanged from v3.1.33 with git checkout v3.1.33 -- …. Their tree and blob hashes are identical on the tag and on main:

Path	Hash (tag = main)
dist/compliance/3.1.33/	2d42dd58ad
dist/schemas/3.1.33/	68e9e4c9d0
dist/protocol/3.1.33.tgz	9f45146801
dist/protocol/3.1.33.tgz.sig	2bdba302ef
dist/protocol/3.1.33.tgz.sha256, .crt	from the tag

Registration and bookkeeping, matching #8825:

• static/compliance/published-versions.json: registers 3.1.33.
• dist/schemas/index.json: regenerated with buildRootSchemaDiscovery(). v3.1 and 3.1 now point to 3.1.33, and a 3.1.33 entry is added.
• server/tests/unit/storyboards.test.ts: the 3.1 hosted alias floor moves to 3.1.33, and 3.1.32 stays pinned as an explicit exact target, as chore(compliance): integrate published 3.1.32 records on 3.2.x #8825 did for 3.1.30.
• CHANGELOG.md: the ## 3.1.33 section, verbatim from v3.1.33.

This PR has no changeset: the forward-merge/ branch skips the changeset check, as on #8825, and it adds nothing to the 3.2.11 notes.

Verification (on 3.2.x a07826a449 + this commit)

• npm run check:published-compliance: "Published compliance manifest is current for npm tags: adcp-3.0, adcp-3.1, adcp-3.2, latest, rc."
• check-immutable-release-artifacts.cjs origin/3.2.x: passed.
• server/tests/unit/storyboards.test.ts: 69/69.
• npm run test:release-workflow: passes.
• npm run test:dist-schema-version-ids: passes.

Merge order (3.2.11)

1. fix(release): tolerate pulls API lag after the fence's acknowledged push (3.2.x backport of #8397) #8959 (fence backport) merges. Its Release run regenerates Version Packages #8942 with fix(compliance): 3.2.x backport - functional-dispatch signing key (#8889) and enforced_policies gate for policy_backed_rejections (#8850) #8938 + fix(schemas): open schemas that were closed by accident (3.2.x backport) #8864.
2. This PR merges, and Version Packages #8942 regenerates again. That's fine while it is Draft; this PR adds no changeset.
3. Brian approves Version Packages #8942 only once its Build Check is green on its exact head.

Brian merges. No auto-merge.

🤖 Generated with Claude Code

[aao-secretariat]

Ladon verdict: Approve

Approve — clean forward-merge of published 3.1.33 compliance/schema/protocol records onto 3.2.x (following #8825).

What I checked:

• The high_risk flag is driven entirely by dist/** matches, but every one of those entries is (added) — new append-only semver artifact paths (dist/compliance/3.1.33/**, dist/schemas/3.1.33/**, dist/protocol/3.1.33.*) copied verbatim from v3.1.33. No existing immutable released artifact is modified, so the immutability rule (critical on in-place edits) is not triggered. Added files matching high-risk globs are normal release scaffolding, not an escalation trigger.
• No (deleted) or (modified) high-risk entries — rows 3 and 5 do not fire.
• The only mutable dist edit is dist/schemas/index.json: 3.1 alias advance (3.1.32→3.1.33) plus a new 3.1.33 entry, coherent, with v3/v3.2 correctly unchanged.
• storyboards.test.ts moves the 3.1 floor to 3.1.33 and pins 3.1.32 as an explicit exact target (the #8825 pattern); copied 3.1.33 compliance and schema indexes both declare adcp_version 3.1.33, matching the test. published-versions.json registers 3.1.33.
• Absent changeset is intentional and precedent-backed for a forward-merge branch.

Gates: gated_paths: false; no no-auto-approve team match; no prior decision. No critical/high/medium findings.

Decision table: rows 1–8 do not fire (no findings, high-risk is additive-only), falls through to row 9 → approve.