feat(reporting): add managed reporting status schemas

[bokelley]

Summary

• add experimental get_reporting_status summary, period-ledger, and exact-revision views
• add idempotent sync_reporting_receipts with durable accepted/rejected evidence
• model obligations, canonical revisions, materializations, immutable resources, verification, schedules, and consumer receipts
• support file transfer, dataset sharing, and warehouse delivery through atomic vendor-neutral offerings
• publish a protocol-owned, byte-exact reconciliation scenario index for cross-SDK conformance
• make required canonicalization vectors machine-identifiable and non-trivial
• enforce integer/decimal control values and SHA-256/SHA-512 lengths in generated schemas

Reconciliation conformance

The fixture pins exact manifest, row, schema, report-definition, canonicalization, and receipt bytes. Its nine executable scenarios cover success, missing objects, physical checksum mismatch, row-count mismatch, control-total mismatch, canonical digest mismatch, transient pre-commit reads, rejected receipts, and uncertain-write checkpoint recovery. Each scenario pins the mutation, read trace/count, error code/classification, and receipt outcome.

The fixture records an immutable fixture-bearing protocol revision and enforces LF checkout for byte stability. Protocol CI validates every declared size, SHA-256, SHA-512, schema instance, canonical byte sequence, manifest-last invariant, and receipt acknowledgement.

Validation

• three expert reviews: protocol, implementation/security, and test architecture — no remaining blockers
• npm run test:schemas: 34 schema checks, 209 Node tests, 10 premium-display tests, and 6 geo tests pass
• reporting fixture/status suites: 26/26 pass; related reporting/MCP suites: 54/54 pass
• generated TypeScript Zod and Python Pydantic probes accept valid contracts and reject all required malformed control/checksum cases
• compliance/schema builds, oneOf audit, conformance-doc freshness, test registration, and diff checks pass

This implements the protocol prerequisite for #6911 and addresses the protocol-side work in #6993, #6994, and #6995. Cross-SDK closure remains gated on the TypeScript and Python SDK PRs consuming this pinned fixture revision in their own CI.

[aao-secretariat]

Ladon verdict: Escalate to human review

Escalate — gated schema paths require human/CODEOWNERS approval.

This PR touches static/schemas/source/** (both modified and newly added files), which is under a hard, deterministic approval gate (gated_paths: true). The current review_decision is REVIEW_REQUIRED, not APPROVED, so decision-table row 2 fires: the gate is not satisfied and the outcome cannot be approve.

No blocking (critical/high) or medium findings were surfaced by the reviewer. The change is an additive experimental managed-reporting delivery surface (#6911): new get_reporting_status task, reporting-delivery-* core schemas, two additive enum values, a capability block, and an mcp-schema-projection cleanup. It carries a correct minor changeset, leaves dist/** untouched, ships a 409-line contract test plus docs, and all four new oneOf sites are const-discriminated and disjoint with schema↔docs coherence intact. This looks clean on the merits — but ratification of protocol wire-shape changes is a human act, and the gated paths require an explicit CODEOWNERS/human approval before merge.

Escalation reasons

• Modifies/adds files under static/schemas/source/** (e.g. core/account.json, protocol/get-adcp-capabilities-response.json, plus new reporting-* schemas) — protocol source of truth under a hard approval gate. review_decision is REVIEW_REQUIRED; human/CODEOWNERS review is required to satisfy the gate.

Why human review

• Touches gated paths under static/schemas/source/** (protocol wire-shape source of truth) while review_decision is REVIEW_REQUIRED, not APPROVED — human/CODEOWNERS approval required before merge.
• This PR touches a path under a hard, non-overridable approval gate (static/schemas/source/account/sync-accounts-request.json (modified) matches static/schemas/source/**; static/schemas/source/account/sync-accounts-response.json (modified) matches static/schemas/source/**; static/schemas/source/core/account.json (modified) matches static/schemas/source/**; static/schemas/source/core/notification-config.json (modified) matches static/schemas/source/**; static/schemas/source/core/reporting-dataset-share-destination.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-capabilities.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-config-state.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-config.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-method.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-ready-webhook.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-materialization.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-obligation.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-resource.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-revision.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-schedule.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-status-issue.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-verification.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-write-destination.json (added) matches static/schemas/source/**; static/schemas/source/core/x-entity-types.json (modified) matches static/schemas/source/**; static/schemas/source/enums/notification-type.json (modified) matches static/schemas/source/**; static/schemas/source/enums/reporting-finality.json (added) matches static/schemas/source/**; static/schemas/source/enums/reporting-health.json (added) matches static/schemas/source/**; static/schemas/sour

…(truncated)…

[aao-secretariat]

Ladon verdict: Escalate to human review

Escalate — gated schema-source paths require human/CODEOWNERS approval.

This PR modifies and adds files under static/schemas/source/**, which are under a hard, non-overridable approval gate (gated_paths: true). The current GitHub review_decision is REVIEW_REQUIRED, not APPROVED, so decision-table row 2 fires: Ladon cannot auto-approve until a human/CODEOWNERS approval is recorded, regardless of how clean the diff is.

The reviewer found no blocking issues. Schema↔docs coherence holds, the changeset is a correct minor (additive experimental surface, no shipped enum removed), the response oneOf is disjoint and discriminated, and the contract test confirms the Unavailable lookup branch behavior. Only one non-blocking low observation exists:

• docs/media-buy/task-reference/get_reporting_status.mdx:34 — schema links switched to /schemas/latest/ vs the /schemas/v3/ convention.

This is a clean iteration on the prior escalate (which also had no actionable findings), but the gated-paths condition persists because approval has not yet been recorded. Once review_decision becomes APPROVED, this PR would fall through to approve.

Gated files needing human/CODEOWNERS review: the modified/added schema sources under static/schemas/source/** (account, core reporting-delivery-, enums, media-buy get-reporting-status-, protocol get-adcp-capabilities-response).

Why human review

• Touches gated paths under static/schemas/source/** (protocol wire-shape source of truth) while review_decision is REVIEW_REQUIRED, not APPROVED — human/CODEOWNERS approval required before merge.
• Hard approval gate (gated_paths: true) is unsatisfied: modified/added schema-source files under static/schemas/source/** cannot auto-approve until a real GitHub/CODEOWNERS APPROVED review is recorded.
• This PR touches a path under a hard, non-overridable approval gate (static/schemas/source/account/sync-accounts-request.json (modified) matches static/schemas/source/**; static/schemas/source/account/sync-accounts-response.json (modified) matches static/schemas/source/**; static/schemas/source/core/account.json (modified) matches static/schemas/source/**; static/schemas/source/core/notification-config.json (modified) matches static/schemas/source/**; static/schemas/source/core/reporting-dataset-share-destination.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-capabilities.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-config-state.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-config.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-method.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-offering.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-ready-webhook.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-materialization.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-obligation.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-resource.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-revision.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-schedule.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-status-issue.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-verification.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-write-destination.json (added) matches static/schemas/source/**; static/schemas/source/core/x-entity-types.json (modified) matches static/schemas/source/**; static/schemas/source/enums/notific

…(truncated)…

[aao-secretariat]

Ladon verdict: Escalate to human review

Escalate — hard approval gate on gated schema-source paths is unsatisfied.

This PR touches protocol wire-shape source of truth under static/schemas/source/** (both modified files like core/account.json, enums/task-type.json, protocol/get-adcp-capabilities-response.json, and many added reporting-* schemas). gated_paths: true and review_decision: REVIEW_REQUIRED (not APPROVED), so decision-table row 2 fires: outcome MUST be escalate, not approve.

The reviewer's subsequent delta pass found no Critical/High/Medium findings — changeset scope (minor, additive experimental surface) is correct, schema↔docs coherence verified, all new oneOfs discriminated by const, released artifacts untouched, idempotency coverage added for sync_reporting_receipts, and cross-reference integrity intact. The diff is mechanically clean. But a clean diff does not lift a hard, non-overridable path gate: only a real GitHub/CODEOWNERS APPROVED review does. Prior decision was also escalate for the same gate reason.

Escalation reasons

• PR modifies/adds files under the hard-gated path static/schemas/source/** (protocol wire-shape source of truth) while review_decision is REVIEW_REQUIRED, not APPROVED. Human/CODEOWNERS approval is required before this can merge.

Once a human/CODEOWNERS APPROVED review is recorded, this PR — with no blocking or medium findings — falls through to a normal approve.

Why human review

• Hard approval gate unsatisfied: PR touches gated paths under static/schemas/source/** (protocol wire-shape source of truth) while review_decision is REVIEW_REQUIRED, not APPROVED. Human/CODEOWNERS approval required before merge (decision-table row 2).
• This PR touches a path under a hard, non-overridable approval gate (static/schemas/source/account/sync-accounts-request.json (modified) matches static/schemas/source/**; static/schemas/source/account/sync-accounts-response.json (modified) matches static/schemas/source/**; static/schemas/source/core/account.json (modified) matches static/schemas/source/**; static/schemas/source/core/notification-config.json (modified) matches static/schemas/source/**; static/schemas/source/core/reporting-canonical-content-digest.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-control-total.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-dataset-share-destination.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-capabilities.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-config-state.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-config.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-method.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-offering.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-ready-webhook.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-file-compression.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-file-entry.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-file-manifest.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-materialization.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-obligation.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-receipt.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-reconciliation-mode.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-resource.json (added) matches static/schemas/source/**; static/schemas/source/core/

…(truncated)…

[aao-secretariat]

Medium: This request does not compose version-envelope, and additionalProperties: false (L31) hard-rejects any unknown key. Every other top-level media-buy request (21/21, including its own sibling get-reporting-status-request) does allOf /schemas/core/version-envelope.json, and this delta just gave the paired sync-reporting-receipts-response both envelopes. Net effect: a buyer that pins adcp_version (the negotiation field the envelope description says lives on "every AdCP request and response schema") on sync_reporting_receipts gets a validation failure, while the same field works on get_reporting_status and every sibling. The MUST NOT assert a buyer or governance principal constraint is about identity, not version negotiation — it doesn't explain the omission. Add the version-envelope $ref for parity.

[bokelley]

Fixed in 3a58137: the request now composes version-envelope, explicitly admits both version fields under its closed object shape, and the contract test exercises them.

[aao-secretariat]

Ladon verdict: Escalate to human review

Escalate — hard approval gate on gated paths is unsatisfied.

This PR touches static/schemas/source/** (protocol wire-shape source of truth) — a hard, non-overridable approval gate (gated_paths: true) — while review_decision is REVIEW_REQUIRED, not APPROVED. Per decision-table row 2, the outcome must be escalate until a human/CODEOWNERS approval is recorded.

The reviewer delta since the prior run is a clean pass with no critical/high/medium findings: doc cross-links added, sync_reporting_receipts registered in the media-buy MCP role profile and mutating-tools set, an x-tool-summary added, and sync-reporting-receipts-response.json aligned to the standard version/protocol envelope + status:"completed" convention (the additionalProperties false→true flip is required for the allOf envelope refs to validate, consistent with DR-0009). Schema↔docs coherent.

No blocking findings exist, so this is not request-changes — but the gate cannot lift without a real approval.

Escalation reasons

• Gated paths under static/schemas/source/** (protocol source of truth) modified/added with review_decision: REVIEW_REQUIRED, not APPROVED. Human/CODEOWNERS approval required before merge (decision-table row 2).

Why human review

• Hard approval gate unsatisfied: PR modifies/adds files under static/schemas/source/** (protocol wire-shape source of truth) while review_decision is REVIEW_REQUIRED, not APPROVED. Human/CODEOWNERS approval required before merge (decision-table row 2).
• Gated files include static/schemas/source/media-buy/sync-reporting-receipts-response.json, static/schemas/source/protocol/get-adcp-capabilities-response.json, static/schemas/source/enums/task-type.json, and the new reporting-* core/enums schemas.
• This PR touches a path under a hard, non-overridable approval gate (static/schemas/source/account/sync-accounts-request.json (modified) matches static/schemas/source/**; static/schemas/source/account/sync-accounts-response.json (modified) matches static/schemas/source/**; static/schemas/source/core/account.json (modified) matches static/schemas/source/**; static/schemas/source/core/notification-config.json (modified) matches static/schemas/source/**; static/schemas/source/core/reporting-canonical-content-digest.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-control-total.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-dataset-share-destination.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-capabilities.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-config-state.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-config.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-method.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-offering.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-ready-webhook.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-file-compression.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-file-entry.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-file-manifest.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-materialization.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-obligation.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-receipt.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-reconciliation-mode.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-resource.json

…(truncated)…

[aao-secretariat]

Ladon verdict: Escalate to human review

Escalate — hard approval gate unsatisfied on gated schema paths.

This PR touches protocol wire-shape source of truth under static/schemas/source/**, which is under a hard, non-overridable approval gate (gated_paths: true). The current GitHub review decision is REVIEW_REQUIRED, not APPROVED, so decision-table row 2 fires: Ladon cannot auto-approve until a human/CODEOWNERS approval is recorded, regardless of how clean the diff is.

Escalation reasons

• Gated paths: PR modifies/adds numerous files under static/schemas/source/** (e.g. static/schemas/source/core/account.json, the new reporting-* schemas, sync-accounts-request/response.json, get-reporting-status-*.json, sync-reporting-receipts-*.json) while review_decision is REVIEW_REQUIRED. Human/CODEOWNERS approval required before merge.

Medium finding (non-blocking, for reviewer awareness)

• static/schemas/source/media-buy/sync-reporting-receipts-request.json — left behind on the envelope convention: omits version-envelope and keeps additionalProperties: false, hard-rejecting the adcp_version negotiation field that all 21 sibling requests and its own enveloped response accept. Worth fixing for wire-shape consistency.

Note: this is a subsequent pass. The prior run was escalate for the same gated-paths gate; that gate remains unsatisfied, so the escalation stands. A human/CODEOWNERS approval lifts the gate and lets the PR fall through to the normal table.

Why human review

• Hard approval gate unsatisfied: PR touches gated paths under static/schemas/source/** (protocol wire-shape source of truth) while review_decision is REVIEW_REQUIRED, not APPROVED. Human/CODEOWNERS approval required before merge (decision-table row 2).
• Modifies/adds many files under static/schemas/source/** including core account/notification/reporting schemas, new reporting-* schemas, and media-buy request/response schemas.
• This PR touches a path under a hard, non-overridable approval gate (static/schemas/source/account/sync-accounts-request.json (modified) matches static/schemas/source/**; static/schemas/source/account/sync-accounts-response.json (modified) matches static/schemas/source/**; static/schemas/source/core/account.json (modified) matches static/schemas/source/**; static/schemas/source/core/notification-config.json (modified) matches static/schemas/source/**; static/schemas/source/core/reporting-canonical-content-digest.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-control-total.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-dataset-share-destination.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-capabilities.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-config-state.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-config.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-method.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-offering.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-ready-webhook.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-file-compression.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-file-entry.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-file-manifest.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-materialization.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-obligation.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-receipt.json (added) matches static/schemas/source/**;

…(truncated)…

[aao-secretariat]

Ladon verdict: Escalate to human review

Escalate — hard approval gate on gated paths unsatisfied.

This PR modifies/adds many files under static/schemas/source/** (the protocol wire-shape source of truth), which is under a hard, non-overridable approval gate. gated_paths is true and review_decision is not APPROVED (unknown/none) — decision-table row 2 forces escalation until a human/CODEOWNERS approval is recorded, regardless of how clean the diff is.

The reviewer reported a clean pass with no Critical/High/Medium findings. Delta since the prior escalate run is three files: reporting-resource.json merges duplicate top-level allOf keys (correctness fix restoring the manifest if/then conditional), a regression test exercising the manifest-required branch, and sync-reporting-receipts-response.json adds status const completed coherent with the protocol envelope and get_reporting_status response. This is additive experimental surface on a minor changeset.

Escalation reasons

• Gated paths under static/schemas/source/** touched (core account/notification/reporting schemas, new reporting-* schemas, media-buy request/response schemas, get_adcp_capabilities response) while review_decision is not APPROVED. Human/CODEOWNERS approval required before merge.

Once a real GitHub/CODEOWNERS approval is recorded, this clean diff can fall through to approval on a subsequent run.

Why human review

• Hard approval gate unsatisfied: PR touches gated paths under static/schemas/source/** (protocol wire-shape source of truth) while review_decision is not APPROVED. Human/CODEOWNERS approval required before merge (decision-table row 2).
• This PR touches a path under a hard, non-overridable approval gate (static/schemas/source/account/sync-accounts-request.json (modified) matches static/schemas/source/**; static/schemas/source/account/sync-accounts-response.json (modified) matches static/schemas/source/**; static/schemas/source/core/account.json (modified) matches static/schemas/source/**; static/schemas/source/core/notification-config.json (modified) matches static/schemas/source/**; static/schemas/source/core/reporting-canonical-content-digest.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-control-total.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-dataset-share-destination.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-capabilities.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-config-state.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-config.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-method.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-offering.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-ready-webhook.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-file-compression.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-file-entry.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-file-manifest.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-materialization.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-obligation.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-receipt.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-reconciliation-mode.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-resource.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-revision.json (added) mat

…(truncated)…

[bokelley]

Implemented the first reconciliation prototypes against this branch in both SDKs:

• TypeScript: feat(reporting): add reliable ledger reconciliation adcp-client#2726
• Python: feat(reporting): prototype reliable ledger reconciliation adcp-client-python#1095

Both are draft PRs until this protocol work is released, but they now exercise the same end-to-end contract: stable-snapshot pagination, independent expected-period enumeration, immutable-ID deduplication, revision/finality selection, materialization verification, receipt submission with retry, receipt readback, retention checks, and durable checkpoints.

The prototypes found and fixed one important ambiguity: (delivery config, period) is not a sufficient obligation identity. If several campaigns share a feed and period, one campaign's publication could otherwise satisfy another campaign's expected result. The SDKs now match the complete coordinates—configuration generation, report definition, feed purpose, reporting profile, exact applicable media-buy set, and period—and reject a revision whose campaign scope differs from its obligation.

The resulting agreement boundary is now concrete:

1. The seller's obligation ledger says what should have existed, including zero-row periods.
2. An immutable revision plus verified materialization says exactly what the seller published.
3. The consumer independently observes row count, control totals, and the negotiated evidence profile.
4. sync_reporting_receipts records accepted or rejected agreement for that authenticated consumer.
5. Receipt readback proves the seller durably recorded that consumer's result.

For billing, canonical digest equality makes the agreement about the exact logical rows, not merely matching aggregate totals. Buyer and governance consumers run the same algorithm and submit separate receipts, so neither one's acceptance stands in for the other.

Focused local validation is green: 9 reconciliation scenarios in each SDK, including missing-first-obligation, same-period/different-campaign isolation, revision/obligation campaign mismatch, incomplete history, fan-out deduplication, false native evidence, rejected consumer evidence, receipt retry, and receipt readback.

[aao-secretariat]

Ladon cannot review this PR until merge conflicts are resolved.

[sarah-hord-db]

Reviewing from the Databricks side, since Delta Sharing is one of the delivery targets here.

The core model holds up well. Keeping revision identity independent of destination is what lets a single revision land in Delta Sharing, a warehouse, and a bucket without the counts drifting, and the two Delta Sharing gotchas are both accounted for: the recipient-visibility lag via a representative-consumer readiness check, and the minimum reader version that Deletion Vectors require (DBR 14.1+, or delta-sharing-spark 3.1+ for open clients) via reader_compatibility. That matches the current behavior.

One resolved-state ergonomics point for buyer-owned destinations. The setup handshake itself is well modeled: setup.action covers activate_recipient and grant_access with a setup URL, reporting-dataset-share-destination.json carries the recipient identity (including an open-sharing recipient email), and credentials are deliberately kept out. The gap I'd flag is that for a buyer-owned destination, resolved state signals grant_access but doesn't echo the structured producer_identity the offering defines as the grant target, so a programmatic buyer has to cross-reference the offering to complete the grant. Echoing that identity into the setup payload would make automated setup self-contained. Minor, and fine to defer.

One question on incremental reads: revisions and restatements imply buyers re-reading updated tables. Is the contract full-snapshot per revision, or can a buyer read incrementally? Incremental reads need the table shared WITH HISTORY and CDF enabled, which the provider configures and which is on by default only for recent Databricks-to-Databricks shares, so an open-client buyer can't assume it. If incremental is in scope, the offering probably needs to signal history/CDF availability.

Two smaller schema notes while I'm here:

• coverage_complete: false looks only half-enforced on the periods view. The top-level rule ties incomplete coverage to health: action_required and a required issues[]. That works for summary, where health is required, but periods neither requires nor forbids top-level health, so that half of the rule is vacuous there. Either require health on periods too, or scope the rule to summary.
• provider is required for every offering method via {"if": {"required": ["pattern"]}, "then": {"required": ["provider"]}}. Since pattern is always required, an S3 or GCS file_transfer offering has to name a provider.domain. If that's intended, provider may as well move into required; if not, the if/then needs a real discriminator.

[bokelley]

The SDK implementation exercise produced a concrete release-engineering follow-up: #6984.

The important result is that protocol schema PRs need a deterministic pre-release bundle artifact and an automated compatibility matrix against both SDK generators before merge. During this RFC, manual schema overlays made both dependent SDK branches easy to stale as required fields changed. Generated artifacts should record the exact protocol commit and bundle digest they consumed.

SDK-specific findings are tracked in:

• Python: [codegen] Make regeneration atomic and make --help/check read-only adcp-client-python#1099, fix: Parse WorkOS error responses as JSON in API key creation #1100, feat: Add HTTP save endpoints for brands and properties #1101, fix: Parse WorkOS error responses in API key proxy #1102, fix: Prevent Addie from hallucinating names and bulk-inviting members #1103
• TypeScript: [reporting] Provide built-in manifest and resource inspection adcp-client#2744

None changes the reporting wire model by itself. They separate release safety and SDK “just works” work from this RFC's protocol review.

[bokelley]

Seller-side implementation evidence is now available in scope3data/embedded-sales-agent#456. The vertical slice uses the generated Python SDK contracts end to end: durable caller/account ledger, manifest-last delivery, destination-independent revision fan-out, rejected receipts, stable snapshot pagination, exact media-buy/package coverage, and a superseding billing restatement that invalidates the old accepted receipt until the consumer verifies the new revision.

[aao-secretariat]

Ladon verdict: Escalate to human review

Escalate — hard approval gate on protocol source-of-truth is unsatisfied.

This PR touches 44 files under static/schemas/source/** (the AdCP wire-shape source of truth), so gated_paths is true. The current review_decision is unknown/none — NOT APPROVED. Per decision-table row 2, this is a hard, non-overridable gate: Ladon cannot auto-approve until a human/CODEOWNERS approval is recorded, regardless of how clean the diff is.

The reviewer's pass is clean: this is a purely additive, all-experimental managed-reporting-status protocol addition carrying a correct minor changeset, no dist immutability violation (beta.9 artifacts appear only via rebase, untouched), every new oneOf is const-discriminated, schema↔docs coherence holds, and two new test suites pin the reconciliation/status contracts. No critical/high/medium findings. That clean bill of health is exactly why this is escalate rather than request-changes — there is nothing to fix, but a human/CODEOWNERS approval is required by the gate before merge.

Escalation reasons

• Hard approval gate unsatisfied: PR modifies/adds 44 files under static/schemas/source/** (protocol wire-shape source of truth) while review_decision is not APPROVED. Human/CODEOWNERS approval required before merge (row 2).

This carries forward the prior escalate decision; the underlying gate condition is unchanged and remains unsatisfied.

Why human review

• Hard approval gate unsatisfied: PR modifies/adds files under static/schemas/source/** (protocol wire-shape source of truth) while review_decision is not APPROVED. Human/CODEOWNERS approval required before merge (decision-table row 2).
• This PR touches a path under a hard, non-overridable approval gate (static/schemas/source/account/sync-accounts-request.json (modified) matches static/schemas/source/**; static/schemas/source/account/sync-accounts-response.json (modified) matches static/schemas/source/**; static/schemas/source/core/account.json (modified) matches static/schemas/source/**; static/schemas/source/core/notification-config.json (modified) matches static/schemas/source/**; static/schemas/source/core/reporting-canonical-content-digest.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-canonicalization-contract.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-capabilities.json (modified) matches static/schemas/source/**; static/schemas/source/core/reporting-control-total.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-coverage.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-dataset-share-destination.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-capabilities.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-config-state.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-config.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-method.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-offering.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-ready-webhook.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-file-compression.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-file-entry.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-file-manifest.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-materialization.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-obligation.json (added) matches static/schemas/source/**; stati

…(truncated)…

[aao-secretariat]

Ladon verdict: Escalate to human review

Escalate — hard approval gate on protocol schema source is unsatisfied.

This PR adds/modifies numerous files under static/schemas/source/** (the protocol wire-shape source of truth) — introducing the experimental managed-reporting reconciliation schemas plus edits to account, notification-config, capabilities, and enum sources. That path is under a deterministic, non-overridable approval gate (gated_paths: true), and the current review_decision is not APPROVED (unknown/none). Per decision-table row 2, this cannot be auto-approved until a human/CODEOWNERS approval is recorded.

The reviewer's substantive pass is clean: the delta is a mechanical refactor (inline enum/string constraints hoisted into named definitions and replaced with local/cross-document $refs) that preserves every constraint set exactly — no wire-shape, enum-value, or required[] change, no schema↔docs drift, and oneOf discriminators untouched. No critical/high/medium findings. A changeset (.changeset/add-managed-reporting-status.md) is present. This matches the prior run, which was also clean and escalated solely on the same gate.

Escalation reason: PR modifies/adds files under static/schemas/source/** while review_decision ≠ APPROVED. Human/CODEOWNERS review required before merge. The gate lifts automatically once an approval is recorded; no code changes needed to satisfy it.

Why human review

• Hard approval gate unsatisfied: PR adds/modifies files under static/schemas/source/** (protocol wire-shape source of truth) while review_decision is not APPROVED (currently unknown/none). Human/CODEOWNERS approval required before merge (decision-table row 2). Files include static/schemas/source/account/sync-accounts-request.json, static/schemas/source/core/account.json, static/schemas/source/core/reporting-.json (many added), static/schemas/source/enums/.json, and static/schemas/source/protocol/get-adcp-capabilities-response.json.
• This PR touches a path under a hard, non-overridable approval gate (static/schemas/source/account/sync-accounts-request.json (modified) matches static/schemas/source/**; static/schemas/source/account/sync-accounts-response.json (modified) matches static/schemas/source/**; static/schemas/source/core/account.json (modified) matches static/schemas/source/**; static/schemas/source/core/notification-config.json (modified) matches static/schemas/source/**; static/schemas/source/core/reporting-canonical-content-digest.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-canonicalization-contract.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-capabilities.json (modified) matches static/schemas/source/**; static/schemas/source/core/reporting-control-total.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-coverage.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-dataset-share-destination.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-capabilities.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-config-state.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-config.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-method.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-offering.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-ready-webhook.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-file-compression.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-file-entry.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-file-manifest

…(truncated)…

[aao-secretariat]

Ladon verdict: Escalate to human review

Escalate — hard approval gate unsatisfied (gated paths).

This PR modifies/adds files under static/schemas/source/**, which is under a hard, non-overridable approval gate (gated_paths: true). The current review_decision is unknown/none — not APPROVED. Per decision-table row 2, the outcome MUST be escalate until a human/CODEOWNERS approval is recorded, regardless of how clean the diff is.

The reviewer reported a clean pass: no Critical/High/Medium findings. The schema changes are additive x-adcp-model-context-inline annotations only — no field/enum/required/type changes, no schema↔docs drift, no oneOf regression, no immutable-artifact edits. There is a changeset present (.changeset/add-managed-reporting-status.md). This is a net-clean iteration on the prior escalate.

Escalation reasons

• Hard approval gate unsatisfied: PR touches protocol wire-shape source of truth under static/schemas/source/** (e.g. static/schemas/source/account/sync-accounts-request.json, static/schemas/source/core/reporting-*.json (many added), static/schemas/source/enums/*.json, static/schemas/source/protocol/get-adcp-capabilities-response.json) while review_decision is not APPROVED. Human/CODEOWNERS approval required before merge (row 2).

No blocking findings exist; the escalation is purely due to the deterministic gated-paths gate. The gate lifts automatically once a real GitHub/CODEOWNERS approval is recorded.

Why human review

• Hard approval gate unsatisfied (decision-table row 2): PR adds/modifies files under static/schemas/source/** (protocol wire-shape source of truth) while review_decision is not APPROVED (currently unknown/none). Human/CODEOWNERS approval required before merge. Files include static/schemas/source/account/sync-accounts-request.json, static/schemas/source/core/account.json, static/schemas/source/core/reporting-.json (many added), static/schemas/source/enums/.json, and static/schemas/source/protocol/get-adcp-capabilities-response.json.
• This PR touches a path under a hard, non-overridable approval gate (static/schemas/source/account/sync-accounts-request.json (modified) matches static/schemas/source/**; static/schemas/source/account/sync-accounts-response.json (modified) matches static/schemas/source/**; static/schemas/source/core/account.json (modified) matches static/schemas/source/**; static/schemas/source/core/notification-config.json (modified) matches static/schemas/source/**; static/schemas/source/core/reporting-canonical-content-digest.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-canonicalization-contract.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-capabilities.json (modified) matches static/schemas/source/**; static/schemas/source/core/reporting-control-total.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-coverage.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-dataset-share-destination.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-capabilities.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-config-state.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-config.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-method.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-offering.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-delivery-ready-webhook.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-file-compression.json (added) matches static/schemas/source/**; static/schemas/source/core/reporting-file-entry.json (added) matches static/schemas/source/**; s

…(truncated)…

[bokelley]

Merge-ordering precondition with #6966. A red-team pass on the agent-configuration PR found the two branches currently match vocabulary by hand, not by reference:

• feat(protocol): add agent configuration sync #6966 ships /schemas/core/reporting-verification-profile-set.json (inline native_commit / manifest_checksums / canonical_digest enum); this PR carries its own reporting-verification-profile.json with the same values — two sources of truth for the enum the billing contract hangs on.
• The provider-domain shapes differ: feat(protocol): add agent configuration sync #6966's delivery-provider.json requires a dotted domain, while this branch's inline provider objects accept single-label domains feat(protocol): add agent configuration sync #6966 rejects.
• This branch re-declares pattern / access_mode / provider coordinates inline rather than $ref-ing feat(protocol): add agent configuration sync #6966's destination fragments.

Proposal: whichever PR merges second consumes the first's $refs (single profile enum, single provider object, shared destination-coordinate fragments) before merge, so the vocabularies can't drift once both are released. #6966 also now advertises per-pattern reporting_destination_offerings and a suspension_interval_seconds kill-switch bound in capabilities — worth cross-checking against this PR's per-feed delivery capabilities so the two layers stay coherent.

🤖 Generated with Claude Code

[bokelley]

The vocabulary-drift concern is accurate — both branches define overlapping types hand-matched rather than by reference, creating a real divergence risk on the billing-contract enum and destination shapes.

Recommended merge order: #6966 first, #6953 second.

#6966's own PR body states it is "intentionally separate from #6953; reporting delivery consumes the seller-issued destination_ref only after a separate account/feed configuration authorizes disclosure." The dependency arrow already runs #6966 → #6953; merge order should match.

What #6953 needs before merge (assuming #6966 lands first):

1. Verification-profile enum — replace the inline native_commit / manifest_checksums / canonical_digest enum in reporting-verification-profile.json with a $ref to feat(protocol): add agent configuration sync #6966's /schemas/core/reporting-verification-profile-set.json. Any future enum addition then touches one file.
2. Provider-domain constraint — align inline provider objects to require dotted domains, matching feat(protocol): add agent configuration sync #6966's delivery-provider.json. Single-label domains should be rejected at both layers or neither.
3. Destination-coordinate fragments — replace inline pattern / access_mode / provider coordinates with $refs to feat(protocol): add agent configuration sync #6966's destination fragments.
4. reporting_destination_offerings vs per-feed delivery capabilities — feat(protocol): add agent configuration sync #6966's per-pattern offerings and this PR's per-feed delivery capabilities likely represent the same concept at different granularity. Verify a feed's capabilities are a subset of the pattern's offerings (or document the layer distinction explicitly).
5. suspension_interval_seconds — confirm whether this PR's delivery scheduling layer should honor or propagate this kill-switch, or whether it's purely a configuration-sync concern invisible to reporting.

Both PRs are currently blocked on merge conflicts, so the ordering decision isn't urgent. But the $ref consolidation should land in #6953's merge commit — once both land independently on main, the drift becomes live vocabulary.

---

Generated by Claude Code