[bokelley]

Summary

Sales agents syncing shared publisher manifests need consistent publisher attribution and a way to reject unverified inventory claims. Add properties_for_publisher_domain, an optional publisher_domain gate for bare-entry permissive resolution, and async verify_cross_domain_properties with injectable discovery.

Verification requires strict authorization for the claimed inventory, honors revocations and publisher delegation, and independently checks unrelated domains. A verified publisher anchor covers its own subdomains. Domain identity supports IDNA, wildcard inventory and subdomain identifiers; www. aliases stay within a registrable domain to avoid granting authority over public or private suffixes. Existing resolution behavior is preserved when the new options are omitted.

Update public exports, the API snapshot, adopter documentation and strict typing examples. Regression coverage includes fresh interpreter imports, forged claims, shared manager manifests, revocation refresh, malformed domains, publisher subdomains and suffix boundaries.

Closes #1697.

Validation

• Targeted adagents, public API and import-layering tests.
• Full SDK and storage mypy checks; strict adopter typing fixtures.
• Pyright adopter fixtures, Ruff, Black and whitespace checks.

Expert review

Independent authorization-security and SDK/API reviews identified import, domain identity and trust-boundary issues; those were fixed with regression tests before publication.

---

Open workspace in Conductor

[aao-secretariat]

Ladon verdict: Approve

Approve — additive, backward-compatible feature with correct semver signal.

This PR adds two new public helpers (properties_for_publisher_domain, verify_cross_domain_properties) and an optional publisher_domain kwarg on resolve_properties_for_agent. The new exports are reflected in the public API snapshot and AGENTS.md handler table, and the optional kwarg preserves the existing signature — semver is correct (feat, no break).

Largest-file coverage was done on src/adcp/adagents.py (~230 net lines). The trust-boundary logic is fail-closed and well-tested: the verify loop's for/else requires every external domain to vouch (adagents.py:534-577), remote candidates are re-attributed with include_unattributed=False, revocations are canonicalized before comparison, the www-alias never broadens to a public/private suffix, and fetch uses the 10s default timeout with per-domain caching and bounded sequential I/O.

Checked against decision rules:

• No critical/high findings (row 1 n/a).
• gated_paths is false (row 2 n/a).
• high_risk is true but the only reason is src/adcp/init.py (modified), and there are no medium-or-higher findings on it — presumed safe; no (deleted) reason (rows 3-5 n/a).
• No prior decision (row 6 n/a).
• No no-auto-approve team match (row 7 n/a).
• Zero medium findings (row 8 n/a).

Falls through to row 9 → approve. review_decision is REVIEW_REQUIRED, but gated_paths is false and no team gate applies, so that does not block auto-approval.

[aao-secretariat]

Ladon verdict: Approve

Approve.

Delta since the prior approve (head ce501a9) is a single documentation/logging change: the bare pass in the except AdagentsValidationError arm of properties_for_publisher_domain (adagents.py:348-350) is replaced with an explanatory comment plus logger.debug (logger defined at adagents.py:41). Behavior is unchanged — the trailing continue at L351 already excludes an invalid explicit publisher_domain claim without identifier fallback; the comment just documents that.

Checked: no public-API shape changes (no removed/renamed exports, no required→optional flips, no enum removals), so no semver signal is triggered despite src/adcp/__init__.py being modified. No hand-edits to generated code, no import-layering violations, no credentials in ctx_metadata, no disabled CI gates. The high-risk flag is on src/adcp/__init__.py (modified) only — presumed safe since the reviewer surfaced no medium-or-higher concerns there.

Decision-table walk: no critical/high/medium findings (row 1, 4, 5, 8 don't fire); gated_paths is false (row 2 n/a); no deletions in high-risk reasons (row 3 n/a); prior decision was approve, not escalate (row 6 n/a); no no-auto-approve team match (row 7 n/a). Falls through to row 9 → approve. Note: high_risk true with a (modified) entry does NOT escalate absent a medium finding, and REVIEW_REQUIRED only gates when gated_paths is true (it is not).