chore: forward-merge 3.1.14 into main - #6585
Conversation
) * docs(request-signing): drop stale conformance vector counts The Testing section said the spec ships 39 test vectors (12 positive + 27 negative). The set is 40 — 12 positive + 28 negative — since vector 028-unsigned-protocol-method-required was added in 3.1.0. Refer to the positive/ and negative/ directories instead of stating counts, matching universal/signed-requests.yaml, whose pass_criteria deliberately grades "all vectors in positive/ ... and all vectors in negative/" rather than a total, and so cannot drift as vectors are added. Refs #6071 * fix(compliance): drop stale vector count from signed-requests-runner header The header said the storyboard grades a verifier against 28 conformance vectors. The set is 40 - 12 positive + 28 negative. 28 is the size of negative/ alone, so the count omitted the positive set entirely. It was never accurate: at 3.0.x the set was 39 (12 + 27), matching neither the total nor the negative count. Vector 028-unsigned-protocol-method-required landed in 3.1.0, which is what made 28 coincide with len(negative/). Refer to the positive/ and negative/ directories instead of a count, matching universal/signed-requests.yaml, whose pass_criteria grades "all vectors in positive/ ... and all vectors in negative/" and therefore cannot drift. Refs #6071 * chore: add changeset for request-signing vector count fixes --------- Co-authored-by: Constantine Mirin <konstantin.mirin@gmail.com> Co-authored-by: Constantine.mirin <konstantin.mirin@postindustria.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
![aao-secretariat[bot]](https://avatars.githubusercontent.com/u/221690821?s=60&v=4){kind=small}
There was a problem hiding this comment.
Ladon verdict: Request changes
Request changes — 1 blocking finding.
This is a forward-merge of the released 3.1.14 artifacts into main: 1,052 new append-only files under dist/{schemas,compliance,protocol}/3.1.14/*. Append-only immutability holds (no existing semver artifact modified or deleted), and there are no source-schema, changeset, or server changes — the enum fix already landed on main in base commit 2c1d02d. The high_risk flag is driven entirely by (added) files under dist/**, which is normal release-artifact scaffolding and not escalation-worthy on its own.
However, two regressions hide in the three modified metadata files, neither disclosed in the PR's resolution audit:
Blocking (high):
- dist/schemas/index.json:564 — The forward-merge flips
deprecatedtrue→false for 2.5.0–2.5.3 in the live discovery document, silently un-deprecating four released versions that adopters resolve against. This is a real regression in the mutable live discovery doc (not the immutable per-version artifacts), reproducible on a load-bearing path. Restore the deprecated:true state for the 2.5.x line.
Medium (non-blocking, noted):
- CHANGELOG.md:3 — The merge resolution clobbered main's Unreleased experimental-surface notice. Restore it.
Decision table: row 1 fires (a high finding is present) → request-changes. Please fix the index.json deprecation regression and restore the CHANGELOG notice, then re-request review.
Blocking findings
- dist/schemas/index.json:564 — Forward-merge un-deprecates 2.5.0–2.5.3 (deprecated true→false) in the live discovery document; restore deprecated:true for the 2.5.x line
Medium findings
- CHANGELOG.md:3 — Forward-merge deletes main's Unreleased experimental-surface notice
|
|
||
| - Cross-role governance enforcement: the experimental `governance.campaign` surface will add typed `target_agent`, task-scoped `adcp.governance_enforcement`, critical task/payload/commitment JWS bindings, intent-only conditions negotiation, and governance-authoritative settlement. The implementation may merge during 3.2 development; the beta-to-GA period provides the experimental-surface notice window. See the 3.2 release notes and migration guide. | ||
|
|
||
| ## 3.1.14 |
There was a problem hiding this comment.
Medium: This resolution overwrites main's ## Unreleased experimental-surface notices section rather than inserting ## 3.1.14 above ## 3.1.13. The 3.2 cross-role governance-enforcement notice that was on base (CHANGELOG.md:3-5) is dropped from main. A forward-merge should preserve the Unreleased notices section and add the 3.1.14 entry beneath it. The resolution audit lists what it preserved (package/changeset metadata, schema index metadata) but not this section — looks overlooked. The notice points to "the 3.2 release notes and migration guide," so the canonical record survives elsewhere, but the notice-window marker on main is lost.
There was a problem hiding this comment.
Ladon verdict: Approve
Approve — subsequent review; prior blocking findings resolved.
This is a follow-up pass to a prior request-changes. The delta since that pass touches only CHANGELOG.md and dist/schemas/index.json, and it clears both prior findings:
- Prior [high]
dist/schemas/index.json:564(forward-merge un-deprecated 2.5.0–2.5.3): resolved — the delta re-deprecates 2.5.0–2.5.3 (deprecated:true) and restores the absolute$id, both matching main's base. - Prior [medium]
CHANGELOG.md:3(forward-merge deleted main's Unreleased notice): resolved — main's## Unreleased experimental-surface noticessection is re-added verbatim above the new## 3.1.14entry.
Current run surfaces no findings.
Decision-table walk:
- Row 1 (critical/high): no findings — not triggered.
- Row 2 (gated_paths + not APPROVED):
gated_paths: false— not triggered. (Note:review_decisionis CHANGES_REQUESTED, but row 2 only fires when gated_paths is true, and it is not.) - Row 3 (high_risk + deleted): all high-risk
dist/**reasons are(added)except two(modified)— no deletions — not triggered. - Row 4 (medium + data-loss/schema/infra): no findings — not triggered.
- Row 5 (high_risk + modified + medium finding): the two
(modified)entries exist, but there are no medium findings — not triggered. - Row 6 (sticky escalate): prior decision was
request-changes, notescalate— not applicable. - Row 7 (no-auto-approve team): no team match — not triggered.
- Row 8 (≥3 medium): zero medium findings — not triggered.
- Row 9: approve.
The bulk of the diff is newly-added immutable release artifacts under dist/compliance/3.1.14/, dist/schemas/3.1.14/, and dist/protocol/3.1.14.* — new semver artifacts, which is normal release scaffolding, not a mutation of an existing released artifact. The only modifications are to the mutable dist/schemas/index.json and dist/schemas/latest.json discovery docs, and the reviewer confirmed those now match main's base for the previously-flagged fields. Net improvement over the prior pass with no remaining actionable findings.
There was a problem hiding this comment.
Ladon verdict: Approve
Approve — forward-merge of the 3.1.14 stable release artifacts into main.
What I checked:
- Immutability (critical gate): 1,053 added files all live under NEW
3.1.14semver paths (dist/compliance/3.1.14/**,dist/schemas/3.1.14/**,dist/protocol/3.1.14.*). No file inside a pre-existing semver artifact is modified or deleted. The reviewer confirms all 12 deletions are confined to mutable discovery/changelog surfaces (CHANGELOG.md,dist/schemas/index.json,dist/schemas/latest.json) — the only mutabledist/*outputs. Append-only release-record semantics hold. - Discovery-pointer consistency:
dist/schemas/index.jsonandlatest.json(bothmodified, both mutable) updated coherently to point at the new version. - High-risk flag: true, but every
high_risk_reasonsentry is(added)scaffolding of a new versioned artifact, plus two(modified)mutable pointer files. Per the flag-reading rules, new files matching high-risk globs are normal release work and not escalation-worthy on the flag alone; the two modified files carry no medium-or-higher finding.
Decision-table walk:
- Row 1 (critical/high): no such findings.
- Row 2 (gated_paths + not APPROVED):
gated_pathsis false — does not fire. - Row 3 (deleted high-risk): no
(deleted)entries in high_risk_reasons. - Row 4 (medium + data-loss/schema/infra): the single medium (CHANGELOG resolution dropped main's 'Unreleased experimental-surface notices' section) is a changelog-content/merge-resolution issue, not a schema/data-loss/infra category finding — does not fire.
- Row 5 (high_risk modified + medium): the CHANGELOG.md finding is not on a file listed in high_risk_reasons (only index.json/latest.json are the modified high-risk entries) — does not fire.
- Row 6: no prior decision.
- Row 7: no no-auto-approve team match.
- Row 8: only ONE medium finding — does not fire.
- Row 9: approve.
Medium finding (non-blocking):
- CHANGELOG.md:7 — merge resolution dropped main's 'Unreleased experimental-surface notices' section. Worth a human eyeball on the next changelog edit, but it is a single medium on a mutable file and does not block per the decision rules.
Medium findings
- CHANGELOG.md:7 — CHANGELOG resolution drops main's 'Unreleased experimental-surface notices' section
1 participant
Forward-merges the completed 3.1.14 release into main after the automatic workflow correctly failed loud on three substantive conflicts.
Resolution audit:
The resulting diff against main contains only the 3.1.14 immutable artifacts plus their changelog and dist discovery metadata.