[bokelley]

Stacked on #1787 (storage side); base will be retargeted to next once #1787 merges. The diff against next is the top commit only.

Why

adcp 10.0.0b4 + adcp-reporting-storage 0.2.0b0 installs cleanly and fails every reporting turn with UndefinedColumn, logged only as Reliable Reporting worker component configuration failed (#1763, item 3(b)).

What

• adcp.reporting.ledger.storage_contract.REPORTING_STORAGE_CONTRACT = 2 names the ledger layout this adcp reads (the _record_rows column lists). Contract history is in the module docstring (1 = SDK 9 and 10.0.0b0–b3; 2 = 10.0.0b4+).

• Startup check in ReliableReportingService._initialize() (before any schema work, for both store= and storage= wiring) and in adcp.storage.postgres_storage() at construction. A store declares its contract with a storage_contract attribute (storage 0.2.0b1+); a store from adcp_reporting_storage without one is classified as contract 1 (0.1.0b4 / 0.2.0b0); in-memory and adopter stores are not subject to the check.

• A mismatch raises ReliableReportingConfigurationError(code="REPORTING_SCHEMA_BEHIND") (correctable, config_field="adcp-reporting-storage"):

  adcp 10.0.0b6 reads the reporting ledger with storage contract 2, but the installed adcp-reporting-storage 0.2.0b0 implements contract 1; the pair would fail every reporting turn. Install adcp-reporting-storage>=0.2.0b1 (storage contract 2), then run "python -m adcp migrate" or start the service, whose create_schema() upgrades the ledger in place.

  The existing cross-SDK code is reused deliberately: the seller configuration vocabulary is pinned to error-codes.json, and "the storage schema is behind this SDK" is exactly the condition.

• Fingerprint pin: tests/test_reporting_storage_contract.py hashes the shared column lists and pins the hash to the contract number, so a future _record_rows change without a contract bump (and the matching storage DDL/migration) fails the build.

• Docs: MIGRATION_v9_to_v10.md, docs/reliable-reporting-service.md, docs/reporting-subscriptions-errors.md, docs/reporting-subscriptions-seller.md.

Tests

Classification (declared / older / newer / undeclared storage release / custom store), refusal messages, service startup refusing before create_schema() is touched, postgres_storage refusing at construction, and the real PgReportingLedgerStore agreeing with adcp. PG migration and core-recovery conformance tests pass locally with the workspace pair.

🤖 Generated with Claude Code

[aao-secretariat]

Ladon verdict: Approve

Approve.

Adds a storage-contract version handshake between adcp and adcp-reporting-storage (#1763). The reviewer surfaced no medium-or-higher findings.

What was checked:

• Fail-closed require_storage_contract runs at ReliableReportingService._initialize (service.py:213) before any create_schema/check_schema and at postgres_storage() construction (storage/init.py:231); both pass the ledger store, consistent with service.store → storage.ledger (service.py:549).
• Six shared column lists in _record_rows exist and parse correctly for the fingerprint; _STATUS_COLUMNS covered via _STATUS_COLUMNS_BARE.
• REPORTING_SCHEMA_BEHIND is a pre-existing valid seller-config code with correctable recovery, reused deliberately.
• Provenance classification correct by construction; check is local-only (importlib.metadata, no I/O, no timeout needed) and fails once at startup.
• Tests cover classification, both refusal directions, startup-before-schema, construction-time refusal, and real-storage agreement.
• Additive public surface under a fix: commit — no semver break.

Decision table: no critical/high/medium findings; gated_paths false; high_risk false; no author team gate; no prior decision. Falls through to row 9 → approve.

[aao-secretariat]

Ladon verdict: Approve

Approve — clean pass, no blocking or medium findings.

This is an additive commit introducing adcp.reporting.ledger.storage_contract (REPORTING_STORAGE_CONTRACT=2) plus startup/construction consistency checks in ReliableReportingService._initialize and postgres_storage. Verified:

• Both sites check the ledger store consistently (service.py:549 sets self.store = storage.ledger).
• The check fails closed before any schema work.
• REPORTING_SCHEMA_BEHIND is a valid correctable code.
• Classification by declaration-then-provenance matches the stated contract history.
• The fingerprint hashes six column lists that all exist in _record_rows.
• The fix() prefix is appropriate for a purely additive guard.

No public-API surface removal/rename, no discriminated-union or forward-compat change, no generated-code hand-edits, no CI-gate disabling, no credential-in-ctx_metadata concerns. high_risk is false; gated_paths is false and review_decision is APPROVED. No no-auto-approve team match. Prior decision was also approve with no findings; current run adds nothing actionable. Falls through to row 9.